differential algebraic dynamic logic for keymaera x
play

Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix - PowerPoint PPT Presentation

Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix Benjamin Lim Yao Chong Lim School of Computer Science, Carnegie Mellon University December 11, 2018 Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 1 /


  1. Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix Benjamin Lim Yao Chong Lim School of Computer Science, Carnegie Mellon University December 11, 2018 Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 1 / 19

  2. Motivation Imprecision is everywhere in actual Cyber-Physical systems... Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 2 / 19

  3. Motivation Imprecision is everywhere in actual Cyber-Physical systems... but how do we precisely model its semantics and prove guarantees? Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 2 / 19

  4. Differential-Algebraic Dynamic Logic (dA L ) { x ′ = v , v ′ = a & v ≥ 0 } � � x ≤ m → x ≤ m Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 3 / 19

  5. Differential-Algebraic Dynamic Logic (dA L ) { x ′ = v , v ′ = a & v ≥ 0 } � � x ≤ m → x ≤ m Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 3 / 19

  6. Differential-Algebraic Dynamic Logic (dA L ) � {∃ δ. ( x ′ = v , v ′ = a + δ & v ≥ 0 ∧ δ 2 ≤ | v | � x ≤ m → 100) } x ≤ m Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 3 / 19

  7. Differential-Algebraic Dynamic Logic (dA L ) dA L = d L + existentially quantified ODEs y . ( x ′ 1 = θ 1 , x ′ 2 = θ 2 , · · · , x ′ {∃ ¯ n = θ n & Q ) } Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 3 / 19

  8. dA L Example (Perturbed Circular Motion) x 2 + y 2 = 1 → { x ′ = − y , y ′ = x } x 2 + y 2 ≤ 1 � � Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 4 / 19

  9. dA L Example (Perturbed Circular Motion) x 2 + y 2 = 1 → {∃ e . ( x ′ = − y + e , y ′ = x & x · e ≤ 0) } x 2 + y 2 ≤ 1 � � Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 4 / 19

  10. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  11. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  12. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  13. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  14. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Invalid instance! Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  15. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Invalid instance! Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  16. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Invalid instance! Side conditions necessary... Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  17. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Invalid instance! Side conditions necessary...but which ones? Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  18. Uniform Substitution (Abridged) [ x := e ] P ( x ) → P ( e ) Axiom Schema [ x := x + x ][ y := 3] x > 0 → [ y := 3] x + x > 0 Valid instance! [ x := x + y ][ y := 3] x > 0 → [ y := 3] x + y > 0 Invalid instance! Side conditions necessary...but which ones? Key observation: Never bind a free variable that was free! Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 5 / 19

  19. Uniform Substitution (Abridged) Instead of schema each with their own unique side conditions... [ x := e ] P ( x ) → P ( e ) (+some set of side conditions) Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 6 / 19

  20. Uniform Substitution (Abridged) Instead of schema each with their own unique side conditions... [ x := e ] P ( x ) → P ( e ) (+some set of side conditions) You have substitution axioms (without side conditions)... [ x := c ()] p ( x ) → p ( c ()) Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 6 / 19

  21. Uniform Substitution (Abridged) Instead of schema each with their own unique side conditions... [ x := e ] P ( x ) → P ( e ) (+some set of side conditions) You have substitution axioms (without side conditions)... [ x := c ()] p ( x ) → p ( c ()) and generic admissibility rules for each logical construct (checked recursively) preventing capture of free variables. Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 6 / 19

  22. Uniform Substitution (Abridged) Upshot: A significantly reduced soundness-critical core that is easier to maintain and understand Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 7 / 19

  23. Plan of Attack Modernize dA L , providing a uniform substitution calculus for it similar to that for d L . Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 8 / 19

  24. Plan of Attack Modernize dA L , providing a uniform substitution calculus for it similar to that for d L . Implement uniform substitution axioms into KeYmaeraX. Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 8 / 19

  25. Plan of Attack Modernize dA L , providing a uniform substitution calculus for it similar to that for d L . Implement uniform substitution axioms into KeYmaeraX. Implement derived axioms and tactics into KeYmaeraX. Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 8 / 19

  26. Plan of Attack Modernize dA L , providing a uniform substitution calculus for it similar to that for d L . Implement uniform substitution axioms into KeYmaeraX. Implement derived axioms and tactics into KeYmaeraX. Prove stuff! Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 8 / 19

  27. d L Recap DW [ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x )]( q (¯ x ) → p (¯ x )) DC ([ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x ) ∧ r (¯ x )] p (¯ x )) ← [ c & q (¯ x )] r (¯ x ) [ x ′ = f (¯ x ) ↔ [ x ′ = f (¯ x )][ x ′ := f (¯ DE x ) , c & q (¯ x )] p (¯ x ) , c & q (¯ x )] p (¯ x ) x )) ′ DI ([ c & q (¯ x )] p (¯ x ) ↔ [? q (¯ x )] p (¯ x )) ← [ c & q (¯ x )]( p (¯ Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 9 / 19

  28. d L Recap DW [ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x )]( q (¯ x ) → p (¯ x )) DC ([ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x ) ∧ r (¯ x )] p (¯ x )) ← [ c & q (¯ x )] r (¯ x ) [ x ′ = f (¯ x ) ↔ [ x ′ = f (¯ x )][ x ′ := f (¯ DE x ) , c & q (¯ x )] p (¯ x ) , c & q (¯ x )] p (¯ x ) x )) ′ DI ([ c & q (¯ x )] p (¯ x ) ↔ [? q (¯ x )] p (¯ x )) ← [ c & q (¯ x )]( p (¯ Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 9 / 19

  29. d L Recap DW [ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x )]( q (¯ x ) → p (¯ x )) DC ([ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x ) ∧ r (¯ x )] p (¯ x )) ← [ c & q (¯ x )] r (¯ x ) [ x ′ = f (¯ x ) ↔ [ x ′ = f (¯ x )][ x ′ := f (¯ DE x ) , c & q (¯ x )] p (¯ x ) , c & q (¯ x )] p (¯ x ) x )) ′ DI ([ c & q (¯ x )] p (¯ x ) ↔ [? q (¯ x )] p (¯ x )) ← [ c & q (¯ x )]( p (¯ Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 9 / 19

  30. d L Recap DW [ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x )]( q (¯ x ) → p (¯ x )) DC ([ c & q (¯ x )] p (¯ x ) ↔ [ c & q (¯ x ) ∧ r (¯ x )] p (¯ x )) ← [ c & q (¯ x )] r (¯ x ) [ x ′ = f (¯ x ) ↔ [ x ′ = f (¯ x )][ x ′ := f (¯ DE x ) , c & q (¯ x )] p (¯ x ) , c & q (¯ x )] p (¯ x ) DI ([ c & q (¯ x )] p (¯ x ) ↔ [? q (¯ x )] p (¯ x )) ← [ c & q (¯ x )]( p (¯ x )) ′ Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 9 / 19

Recommend


More recommend