Deductive Verification Of Hybrid Systems Lectures on Formal Methods - PowerPoint PPT Presentation

Deductive Verification Of Hybrid Systems Lectures on Formal Methods for Cyber-Physical Systems SOKENDAI, 07/29/19 Jérémy Dubut National Institute of Informatics Japanese-French Laboratory of Informatics

Objectives of this lecture • Deductive system to prove invariants of hybrid systems • Representability of HS (hybrid programs) • Platzer’s Di ff erential Dynamic Logic • Sequent calculus for this logic

References • T. A. Henzinger, The Theory of Hybrid Automata, Verification of 
 Digital and Hybrid Systems, volume 170 of the NATO ASI Series , 
 pp 265-292. Springer, 2000. • A. Platzer’s group. http://symbolaris.com • A. Platzer, Logical Foundations of Cyber-Physical Systems. 
 Springer, 2018. • J. Kol č ák, I. Hasuo, J. Dubut, S. Katsumata, D. Sprunger, 
 A. Yamada, Relational Di ff erential Dynamic Logic. Preprint 
 arXiv:1903.00153.

Recap’ on hybrid automata A hybrid automaton is: o ff · x ≥ T x = − 0.1 x T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} x > T + 1 turn x < T − 1 turn on o ff c ∈ {1,2,3} T ∈ [15,30] on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} M = {on, off} x > T + 1 turn x < T − 1 turn on o ff c ∈ {1,2,3} T ∈ [15,30] on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} V = {x, c, T} x > T + 1 turn x < T − 1 turn on o ff c ∈ {1,2,3} T ∈ [15,30] on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} x > T + 1 turn x < T − 1 turn E = {turn on, turn off} on o ff c ∈ {1,2,3} T ∈ [15,30] on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M x > T + 1 turn x < T − 1 turn on o ff c ∈ {1,2,3} s(turn off) = on T ∈ [15,30] s(turn on) = off t(turn off) = off on t(turn on) = on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff c ∈ {1,2,3} T ∈ [15,30] F off ( x , c , T , t ) = ( − 0.1 x ,0,0) on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} F on ( x , c , T , t ) = (4 c − 0.1 x ,0,0) Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff c ∈ {1,2,3} T ∈ [15,30] F off ( x , c , T , t ) = ( − 0.1 x ,0,0) on · x ≤ T x = 4 c − 0.1 x x ( t ) = cst exp( − 0.1 t ) c = cst , T = cst T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} F on ( x , c , T , t ) = (4 c − 0.1 x ,0,0) Thermostat system x ( t ) = 40 c + cst exp( − 0.1 t ) c = cst , T = cst

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff • for every mode m, an invariant predicate c ∈ {1,2,3} I m ⊆ ℝ V T ∈ [15,30] on · I off = {( x , c , T ) ∣ x ≥ T − 2} x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} I on = {( x , c , T ) ∣ x ≤ T + 2} Thermostat system

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff • for every mode m, an invariant predicate c ∈ {1,2,3} I m ⊆ ℝ V T ∈ [15,30] • for every event e, a guard predicate G e ⊆ ℝ V on · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 G turn off = {( x , c , T ) ∣ x > T + 1} c ∈ {1,2,3} Thermostat system G turn on = {( x , c , T ) ∣ x < T − 1}

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff • for every mode m, an invariant predicate c ∈ {1,2,3} I m ⊆ ℝ V T ∈ [15,30] • for every event e, a guard predicate G e ⊆ ℝ V on • for every event e, a jump relation · J e ⊆ ℝ V × ℝ V x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} J turn off = {( x , c , T , x ′ � , c ′ � , T ′ � ) ∣ x = x ′ � ∧ c = c ′ � ∧ T = T ′ � } Thermostat system J turn on = {( x , c , T , x ′ � , c ′ � , T ′ � ) ∣ x = x ′ � ∧ c ′ � ∈ {1,2,3} ∧ T ′ � ∈ [15,30]}

Recap’ on hybrid automata A hybrid automaton is: o ff • a set M of modes · x ≥ T x = − 0.1 x • a set V of variables • a set E of events T ∈ [15,30] • source and target functions x ≥ T − 2 c ∈ {1,2,3} s , t : E ⟶ M • for every mode m, a flow function x > T + 1 turn x < T − 1 turn F m : ℝ V × ℝ ⟶ ℝ V on o ff • for every mode m, an invariant predicate c ∈ {1,2,3} I m ⊆ ℝ V T ∈ [15,30] • for every event e, a guard predicate G e ⊆ ℝ V on • for every event e, a jump relation · J e ⊆ ℝ V × ℝ V x ≤ T x = 4 c − 0.1 x • for every mode m, an initial predicate T ∈ [15,30] I 0, m ⊆ ℝ V x ≤ T + 2 c ∈ {1,2,3} I 0, off = {( x , c , T ) ∣ x ≥ T ∧ c ∈ {1,2,3} ∧ T ∈ [15,30]} Thermostat system I 0, on = {( x , c , T ) ∣ x ≤ T ∧ c ∈ {1,2,3} ∧ T ∈ [15,30]}

Verification of hybrid systems Goal: prove that the system is not going wrong This means proving some properties on the set of 
 reachable configurations

Configurations of a hybrid automaton A hybrid automaton is: • a set M of modes • a set V of variables • a set E of events A configuration is an element of the form • source and target functions ( m , ω ) ∈ M × ℝ V s , t : E ⟶ M • for every mode m, a flow function F m : ℝ V × ℝ ⟶ ℝ V An initial configuration is a configuration • for every mode m, an invariant predicate such that . ( m , ω ) ω ∈ I 0, m I m ⊆ ℝ V • for every event e, a guard predicate G e ⊆ ℝ V A valid configuration is a configuration • for every event e, a jump relation such that . ( m , ω ) ω ∈ I m J e ⊆ ℝ V × ℝ V • for every mode m, an initial predicate I 0, m ⊆ ℝ V

Example o ff · x ≥ T x = − 0.1 x T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} configuration initial valid ( m , x , c , T ) x > T + 1 turn x < T − 1 turn ( o ff ,18,1,20) on o ff c ∈ {1,2,3} ( o ff ,17,2,20) T ∈ [15,30] ( on ,17,2,20) on ( on ,21,1,20) · x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Example o ff · x ≥ T x = − 0.1 x T ∈ [15,30] x ≥ T − 2 c ∈ {1,2,3} configuration initial valid ( m , x , c , T ) x > T + 1 turn x < T − 1 turn ( o ff ,18,1,20) No Yes on o ff c ∈ {1,2,3} ( o ff ,17,2,20) No No T ∈ [15,30] ( on ,17,2,20) Yes Yes on ( on ,21,1,20) · No Yes x ≤ T x = 4 c − 0.1 x T ∈ [15,30] x ≤ T + 2 c ∈ {1,2,3} Thermostat system

Discrete transitions of HA A hybrid automaton is: • a set M of modes • a set V of variables • a set E of events • source and target functions Given two valid configurations and s , t : E ⟶ M ( m 1 , ω 1 ) ( m 2 , ω 2 ) • for every mode m, a flow function we have a discrete transition F m : ℝ V × ℝ ⟶ ℝ V ( m 1 , ω 1 ) ⟶ d ( m 2 , ω 2 ) • for every mode m, an invariant predicate if there is an event such that: e ∈ E • and I m ⊆ ℝ V s ( e ) = m 1 t ( e ) = m 2 • • for every event e, a guard predicate ω 1 ∈ G e • G e ⊆ ℝ V ( ω 1 , ω 2 ) ∈ J e • for every event e, a jump relation J e ⊆ ℝ V × ℝ V • for every mode m, an initial predicate I 0, m ⊆ ℝ V