Differential Dynamic Logic and Differential Invariants for Hybrid - PowerPoint PPT Presentation

Air Traffic Control Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control Verification? looks correct Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control Verification? looks correct NO! Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control ς y 2 ̺ ω e x 2 d x 1 y 1   x ′ 1 = − v 1 + v 2 cos ϑ + ω x 2  x ′  2 = v 2 sin ϑ − ω x 1   ϑ ′ = ̟ − ω Verification? looks correct NO! Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control ς y 2 ̺ ω e x 2 d x 1 y 1   x ′ 1 = − v 1 + v 2 cos ϑ + ω x 2  x ′  2 = v 2 sin ϑ − ω x 1   ϑ ′ = ̟ − ω Example (“Solving” differential equations) 1 � x 1 ( t ) = x 1 ω̟ cos t ω − v 2 ω cos t ω sin ϑ + v 2 ω cos t ω cos t ̟ sin ϑ − v 1 ̟ sin t ω ω̟ � 1 − sin ϑ 2 sin t ω + x 2 ω̟ sin t ω − v 2 ω cos ϑ cos t ̟ sin t ω − v 2 ω � + v 2 ω cos ϑ cos t ω sin t ̟ + v 2 ω sin ϑ sin t ω sin t ̟ . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

Air Traffic Control ς y 2 ̺ ω e x 2 d x 1 y 1   x ′ 1 = − v 1 + v 2 cos ϑ + ω x 2  x ′  2 = v 2 sin ϑ − ω x 1   ϑ ′ = ̟ − ω Example (“Solving” differential equations) 1 � ∀ t ≥ 0 x 1 ω̟ cos t ω − v 2 ω cos t ω sin ϑ + v 2 ω cos t ω cos t ̟ sin ϑ − v 1 ̟ sin t ω ω̟ � 1 − sin ϑ 2 sin t ω + x 2 ω̟ sin t ω − v 2 ω cos ϑ cos t ̟ sin t ω − v 2 ω � + v 2 ω cos ϑ cos t ω sin t ̟ + v 2 ω sin ϑ sin t ω sin t ̟ . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

\forall R ts2. ( 0 <= ts2 & ts2 <= t2_0 -> ( (om_1)^-1 * (omb_1)^-1 * ( om_1 * omb_1 * x1 * Cos(om_1 * ts2) + om_1 * v2 * Cos(om_1 * ts2) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * ts2) + om_1 * omb_1 * x2 * Sin(om_1 * ts2) + om_1 * v2 * Cos(u) * Sin(om_1 * ts2) + -1 * om_1 * v2 * Cos(omb_1 * ts2) * Cos(u) * Sin(om_1 * ts2) + om_1 * v2 * Cos(om_1 * ts2) * Cos(u) * Sin(omb_1 * ts2) + om_1 * v2 * Cos(om_1 * ts2) * Cos(omb_1 * ts2) * Sin(u) + om_1 * v2 * Sin(om_1 * ts2) * Sin(omb_1 * ts2) * Sin(u))) ^2 + ( (om_1)^-1 * (omb_1)^-1 * ( -1 * omb_1 * v1 * Cos(om_1 * ts2) + om_1 * omb_1 * x2 * Cos(om_1 * ts2) + omb_1 * v1 * (Cos(om_1 * ts2))^2 + om_1 * v2 * Cos(om_1 * ts2) * Cos(u) + -1 * om_1 * v2 * Cos(om_1 * ts2) * Cos(omb_1 * ts2) * Cos(u) + -1 * om_1 * omb_1 * x1 * Sin(om_1 * ts2) + -1 * om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * ts2) + omb_1 * v1 * (Sin(om_1 * ts2))^2 + -1 * om_1 * v2 * Cos(u) * Sin(om_1 * ts2) * Sin(omb_1 * ts2) + -1 * om_1 * v2 * Cos(omb_1 * ts2) * Sin(om_1 * ts2) * Sin(u) + om_1 * v2 * Cos(om_1 * ts2) * Sin(omb_1 * ts2) * Sin(u))) ^2 >= (p)^2), t2_0 >= 0, x1^2 + x2^2 >= (p)^2 ==> Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

\forall R t7. ( t7 >= 0 -> ( (om_3)^-1 * ( om_3 * ( (om_1)^-1 * (omb_1)^-1 * ( om_1 * omb_1 * x1 * Cos(om_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * t2_0) + om_1 * omb_1 * x2 * Sin(om_1 * t2_0) + om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) + -1 * om_1 * v2 * Cos(omb_1 * t2_0) * Cos(u) * Sin(om_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) * Sin(omb_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Sin(u) + om_1 * v2 * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

* Cos(om_3 * t5) + v2 * Cos(om_3 * t5) * ( 1 + -1 * (Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))^2) ^(1 / 2) + -1 * v1 * Sin(om_3 * t5) + om_3 * ( (om_1)^-1 * (omb_1)^-1 * ( -1 * omb_1 * v1 * Cos(om_1 * t2_0) + om_1 * omb_1 * x2 * Cos(om_1 * t2_0) + omb_1 * v1 * (Cos(om_1 * t2_0))^2 + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) + -1 * om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Cos(u) + -1 * om_1 * omb_1 * x1 * Sin(om_1 * t2_0) + -1 * om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * t2_0) + omb_1 * v1 * (Sin(om_1 * t2_0))^2 + -1 * om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

+ -1 * om_1 * v2 * Cos(omb_1 * t2_0) * Sin(om_1 * t2_0) * Sin(u) + om_1 * v2 * Cos(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Sin(om_3 * t5) + v2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) * Sin(om_3 * t5) + v2 * (Cos(om_3 * t5))^2 * Sin(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) + v2 * (Sin(om_3 * t5))^2 * Sin(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))) ^2 + ( (om_3)^-1 * ( -1 * v1 * Cos(om_3 * t5) + om_3 * ( (om_1)^-1 * (omb_1)^-1 * ( -1 * omb_1 * v1 * Cos(om_1 * t2_0) + om_1 * omb_1 * x2 * Cos(om_1 * t2_0) + omb_1 * v1 * (Cos(om_1 * t2_0))^2 + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) + -1 * om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42 * Cos(u)

+ -1 * om_1 * omb_1 * x1 * Sin(om_1 * t2_0) + -1 * om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * t2_0) + omb_1 * v1 * (Sin(om_1 * t2_0))^2 + -1 * om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) + -1 * om_1 * v2 * Cos(omb_1 * t2_0) * Sin(om_1 * t2_0) * Sin(u) + om_1 * v2 * Cos(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Cos(om_3 * t5) + v1 * (Cos(om_3 * t5))^2 + v2 * Cos(om_3 * t5) * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) + -1 * v2 * (Cos(om_3 * t5))^2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

+ -1 * om_3 * ( (om_1)^-1 * (omb_1)^-1 * ( om_1 * omb_1 * x1 * Cos(om_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * t2_0) + om_1 * omb_1 * x2 * Sin(om_1 * t2_0) + om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) + -1 * om_1 * v2 * Cos(omb_1 * t2_0) * Cos(u) * Sin(om_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) * Sin(omb_1 * t2_0) + om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Sin(u) + om_1 * v2 * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Sin(om_3 * t5) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

+ -1 * v2 * ( 1 + -1 * (Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))^2) ^(1 / 2) * Sin(om_3 * t5) + v1 * (Sin(om_3 * t5))^2 + -1 * v2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) * (Sin(om_3 * t5))^2)) ^2 >= (p)^2) This is just one branch to prove Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

Differential Invariants for Differential Equations “Definition” (Differential Invariant) “Formula that remains true in the direction of the dynamics” Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

Differential Invariants for Differential Equations “Definition” (Differential Invariant) “Formula that remains true in the direction of the dynamics” Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

Differential Invariants for Differential Equations “Definition” (Differential Invariant) “Formula that remains true in the direction of the dynamics” Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

Differential Induction: Local Dynamics w/o Solutions Definition (Differential Invariant) (J.Log.Comput. 2010) F closed under total differentiation with respect to differential constraints Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

Differential Induction: Local Dynamics w/o Solutions Definition (Differential Invariant) (J.Log.Comput. 2010) F closed under total differentiation with respect to differential constraints F ¬ F ¬ F ( χ → F ′ ) χ → F → [ x ′ = θ & χ ] F F → [ α ] F F → [ α ∗ ] F Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

Differential Induction: Local Dynamics w/o Solutions Definition (Differential Invariant) (J.Log.Comput. 2010) F closed under total differentiation with respect to differential constraints F ¬ χ F ¬ F F ( χ → F ′ ) χ → F → [ x ′ = θ & χ ] F Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

Differential Induction: Local Dynamics w/o Solutions Definition (Differential Invariant) (J.Log.Comput. 2010) F closed under total differentiation with respect to differential constraints F ¬ χ F ¬ F F ( χ → F ′ ) ( ¬ F ∧ χ → F ′ ≫ ) χ → F → [ x ′ = θ & χ ] F [ x ′ = θ & ¬ F ] χ →� x ′ = θ & χ � F Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

Differential Induction: Local Dynamics w/o Solutions Definition (Differential Invariant) (J.Log.Comput. 2010) F closed under total differentiation with respect to differential constraints F ¬ χ F ¬ F F ( χ → F ′ ) ( ¬ F ∧ χ → F ′ ≫ ) χ → F → [ x ′ = θ & χ ] F [ x ′ = θ & ¬ F ] χ →� x ′ = θ & χ � F Total differential F ′ of formulas ? Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

Equational Differential Invariants Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F ( H → p = 0) → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F H → p ′ = 0 ( H → p = 0) → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F 0 1 2 3 H → p ′ = 0 ( H → p = 0) → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F 0 1 2 3 H → p ′ = 0 p = c → [ x ′ = f ( x ) & H ] p = c ( H → p = 0) → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F 0 1 2 3 H → p ′ = 0 H → p ′ = 0 p = c → [ x ′ = f ( x ) & H ] p = c ( H → p = 0) → [ x ′ = θ & H ] p = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants ¬ F F 0 1 2 3 H → p ′ = 0 H → p ′ = 0 � � p = c → [ x ′ = f ( x ) & H ] p = c ( H → p = 0) → [ x ′ = θ & H ] p = 0 ∀ c Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants Theorem (Lie) H → p ′ = 0 equivalence if H open � � p = c → [ x ′ = f ( x ) & H ] p = c ∀ c ¬ F F 0 1 2 3 H → p ′ = 0 H → p ′ = 0 � � p = c → [ x ′ = f ( x ) & H ] p = c ( H → p = 0) → [ x ′ = θ & H ] p = 0 ∀ c Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Equational Differential Invariants Theorem (Lie) H → p ′ = 0 equivalence if H open � � p = c → [ x ′ = f ( x ) & H ] p = c ∀ c ¬ F F 0 1 2 3 H → p ′ = 0 H → p ′ = 0 � � p = c → [ x ′ = f ( x ) & H ] p = c ( H → p = 0) → [ x ′ = θ & H ] p = 0 ∀ c Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = 4 , a 1 = − 1 , a 0 = 5 3 prove ∀ x ( H → p ′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = 4 , a 1 = − 1 , a 0 = 6 3 prove ∀ x ( H → p ′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = 4 , a 1 = − 1 , a 0 = 7 3 prove ∀ x ( H → p ′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = 4 , a 1 = − 2 , a 0 = 5 3 prove ∀ x ( H → p ′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = − 4 , a 1 = 2 , a 0 = 8 3 prove ∀ x ( H → p ′ = 0) 3 Problem: enumerating all polynomials takes a while . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = − 4 , a 1 = 2 , a 0 = 8 3 prove ∀ x ( H → p ′ = 0) 3 Instead: ∃ a ∀ x ( H → p ′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Lie Generates Invariants Corollary (Decidable invariant polynomials) Decidable whether polynomial p invariant function of x ′ = f ( x ) on open H Corollary (Invariant polynomials with R ∩ Q coefficients r.e.) Invariant polynomial function p ∈ ( R ∩ Q )[ x ] of x ′ = f ( x ) on open H r.e. Proof (Direct Method). p def = a 2 x 2 + a 1 x + a 0 1 for 2 with a 2 = − 4 , a 1 = 2 , a 0 = 8 3 prove ∀ x ( H → p ′ = 0) 3 Instead: ∃ a ∀ x ( H → p ′ = 0) 4 Still enumerate polynomial degrees . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

Ex: Deconstructed Aircraft (I) Directly x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly ( − y )2 x + e 2 y = 0 ∧ − y = − y − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly − 2 xy + 2 ey = 0 ( − y )2 x + e 2 y = 0 ∧ − y = − y − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly not valid − 2 xy + 2 ey = 0 ( − y )2 x + e 2 y = 0 ∧ − y = − y − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly not valid − 2 xy + 2 ey = 0 ( − y )2 x + e 2 y = 0 ∧ − y = − y − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Not Provable? Wait! It’s true. Why not proved? y e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

Ex: Deconstructed Aircraft (I) Directly not valid − 2 xy + 2 ey = 0 ( − y )2 x + e 2 y = 0 ∧ − y = − y − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ x ∂ y ∂ x x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Not Provable? Wait! It’s true. Why not proved? y not single equation e y − c x e x d − e d Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

The Structure of Differential Invariants Theorem (Closure properties of differential invariants) (LMCS 2012) Closed under conjunction, differentiation, and propositional equivalences. Theorem (Differential Invariance Chart) (LMCS 2012) DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ DI = , ∧ , ∨ DI = DI DI >, ∧ , ∨ DI >, = , ∧ , ∨ DI > Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 18 / 42

Ex: Deconstructed Aircraft (II) Atomic . . . → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 − 1) 2 + ( e − x ) 2 = 0 Reduce to single equation, try again Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

Ex: Deconstructed Aircraft (II) Atomic not valid 2( x 2 + y 2 − 1)( − 2 yx + 2 ey ) = 0 2( x 2 + y 2 − 1)( − y 2 x + e 2 y ) + 2( e − x )( − y − ( − y )) = 0 � ( x 2 + y 2 − 1) 2 + ( e − x ) 2 � ( − y ∂ ∂ x + e ∂ ∂ y − y ∂ ∂ e ) = 0 . . . → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 − 1) 2 + ( e − x ) 2 = 0 Reduce to single equation, try again Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

Ex: Deconstructed Aircraft (II) Atomic not valid 2( x 2 + y 2 − 1)( − 2 yx + 2 ey ) = 0 2( x 2 + y 2 − 1)( − y 2 x + e 2 y ) + 2( e − x )( − y − ( − y )) = 0 � ( x 2 + y 2 − 1) 2 + ( e − x ) 2 � ( − y ∂ ∂ x + e ∂ ∂ y − y ∂ ∂ e ) = 0 . . . → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 − 1) 2 + ( e − x ) 2 = 0 Not Provable? Reduce to single equation, try again Wait! It’s true. Why not proved? Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

Ex: Deconstructed Aircraft (II) Atomic not valid 2( x 2 + y 2 − 1)( − 2 yx + 2 ey ) = 0 2( x 2 + y 2 − 1)( − y 2 x + e 2 y ) + 2( e − x )( − y − ( − y )) = 0 � ( x 2 + y 2 − 1) 2 + ( e − x ) 2 � ( − y ∂ ∂ x + e ∂ ∂ y − y ∂ ∂ e ) = 0 . . . → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 − 1) 2 + ( e − x ) 2 = 0 Reduce to single equation, try again Could Prove? If only we could assume invariant F during its proof . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions) x 2 − 6 x + 9 = 0 → [ x ′ = y , y ′ = − x ] x 2 − 6 x + 9 = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions) x 2 − 6 x + 9 = 0 → y ∂ ( x 2 − 6 x +9) − x ∂ ( x 2 − 6 x +9) = 0 ∂ x ∂ y x 2 − 6 x + 9 = 0 → [ x ′ = y , y ′ = − x ] x 2 − 6 x + 9 = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions) x x 2 − 6 x + 9 = 0 → y 2 x − 6 y = 0 x 2 − 6 x + 9 = 0 → y ∂ ( x 2 − 6 x +9) − x ∂ ( x 2 − 6 x +9) = 0 y 0 ∂ x ∂ y x 2 − 6 x + 9 = 0 → [ x ′ = y , y ′ = − x ] x 2 − 6 x + 9 = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions are unsound!) x x 2 − 6 x + 9 = 0 → y 2 x − 6 y = 0 x 2 − 6 x + 9 = 0 → y ∂ ( x 2 − 6 x +9) − x ∂ ( x 2 − 6 x +9) = 0 y 0 ∂ x ∂ y x 2 − 6 x + 9 = 0 → [ x ′ = y , y ′ = − x ] x 2 − 6 x + 9 = 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions) ( x 2 ≤ 0 → 2 x · 1 ≤ 0) x 2 ≤ 0 → [ x ′ = 1] x 2 ≤ 0 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Assuming Differential Invariance F F ¬ ¬ F F ¬ F ¬ F ( H → F ′ ) ( F ∧ H → F ′ ) ( H → F ) → [ x ′ = θ & H ] F ( H → F ) → [ x ′ = θ & H ] F Example (Restrictions are unsound!) x 0 + t x ( x 2 ≤ 0 → 2 x · 1 ≤ 0) x ′ = 1 x 2 ≤ 0 → [ x ′ = 1] x 2 ≤ 0 0 t Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

Ex: Deconstructed Aircraft (III) Differential Cut x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut e = x → − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∂ x ∂ y . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut e = x → ( − y )2 x + e 2 y = 0 e = x → − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∂ x ∂ y . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut e = x → − 2 yx + 2 xy = 0 e = x → ( − y )2 x + e 2 y = 0 e = x → − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∂ x ∂ y . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut ∗ e = x → − 2 yx + 2 xy = 0 e = x → ( − y )2 x + e 2 y = 0 e = x → − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∂ x ∂ y . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (III) Differential Cut ∗ e = x → − 2 yx + 2 xy = 0 e = x → ( − y )2 x + e 2 y = 0 e = x → − y ∂ ( x 2 + y 2 ) + e ∂ ( x 2 + y 2 ) = 0 ∂ x ∂ y . . . → [ x ′ = − y , y ′ = e , e ′ = − y & e = x ]( x 2 + y 2 = 1 ∧ e = x ) Successful Proof Lie & differential cuts separate aircraft ∗ − y = − y − y ∂ e ∂ e = − y ∂ x ∂ x e = x → [ x ′ = − y , y ′ = e , e ′ = − y ] e = x ⊲ x 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( x 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

Ex: Deconstructed Aircraft (IV) Smart e 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( e 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

Ex: Deconstructed Aircraft (IV) Smart − y ∂ ( e 2 + y 2 ) + e ∂ ( e 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ e ∂ y ∂ x e 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( e 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

Ex: Deconstructed Aircraft (IV) Smart − y 2 e + e 2 y = 0 ∧ − y = − y − y ∂ ( e 2 + y 2 ) + e ∂ ( e 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ e ∂ y ∂ x e 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( e 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

Ex: Deconstructed Aircraft (IV) Smart ∗ − y 2 e + e 2 y = 0 ∧ − y = − y − y ∂ ( e 2 + y 2 ) + e ∂ ( e 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ e ∂ y ∂ x e 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( e 2 + y 2 = 1 ∧ e = x ) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

Ex: Deconstructed Aircraft (IV) Smart ∗ − y 2 e + e 2 y = 0 ∧ − y = − y − y ∂ ( e 2 + y 2 ) + e ∂ ( e 2 + y 2 ) = 0 ∧ − y ∂ e ∂ e = − y ∂ x ∂ e ∂ y ∂ x e 2 + y 2 = 1 ∧ e = x → [ x ′ = − y , y ′ = e , e ′ = − y ]( e 2 + y 2 = 1 ∧ e = x ) Direct Proof Smart invariant also separates aircraft?! Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

Differential Cuts φ → [ x ′ = θ & H ] C φ → [ x ′ = θ & ( H ∧ C )] φ φ → [ x ′ = θ & H ] φ Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 23 / 42

Ex: Differential Cuts x 3 ≥ − 1 ∧ y 5 ≥ 0 → [ x ′ = ( x − 3) 4 + y 5 , y ′ = y 2 ] x 3 ≥ − 1 Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42