Foundations of Cyber-Physical Systems Andr e Platzer - PowerPoint PPT Presentation

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α x � = m x ′ = v , v ′ = a a := − b assign ODE 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α x � = m x ′ = v , v ′ = a ( if (SB( x , m )) a := − b ) test assign ODE 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) [ α ] φ φ α seq. compose ( if (SB( x , m )) a := − b ) ; x ′ = v , v ′ = a test assign ODE 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) [ α ] φ φ α seq. nondet. compose repeat � ( if (SB( x , m )) a := − b ) ; x ′ = v , v ′ = a � ∗ test assign ODE 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α x � = m �� ( if (SB( x , m )) a := − b ) ; x ′ = v , v ′ = a � ∗ � x � = m � �� � post 0.5 a 6 v x all runs 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α x � = m �� ( if (SB( x , m )) a := − b ) ; x ′ = v , v ′ = a � ∗ � x � = m ∧ b > 0 → x � = m � �� � � �� � post init 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α nondet. x � = m choice �� (? ¬ SB( x , m ) ∪ a := − b ) ; x ′ = v , v ′ = a � ∗ � x � = m ∧ b > 0 → x � = m � �� � � �� � post init 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

CPS Analysis Concept (Differential Dynamic Logic) (JAR’08,LICS’12) x � = m x � = m [ α ] φ φ [ ] x � = m α nondet. x � = m test choice �� (? ¬ SB( x , m ) ∪ a := − b ) ; x ′ = v , v ′ = a � ∗ � x � = m ∧ b > 0 → x � = m � �� � � �� � post init 0.5 a 6 v x 10 m 7 t 0.0 1 2 3 4 5 6 8 4 � 0.5 6 � 1.0 2 4 � 1.5 2 7 t 0 � 2.0 1 2 3 4 5 6 7 t 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 10 / 40

Hybrid Programs vs. Hybrid Automata Want: Compositional verification far cls x � = m brk fsa far ≡ x ′ = v , v ′ = A & ¬ SB( x , m ) brk ≡ x ′ = v , v ′ = − b & SB( x , m ) ∨ true cls ≡ x ′ = v , v ′ = . . . & . . . fsa ≡ x ′ = 0 , v ′ = 0 & v = 0 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 11 / 40

Hybrid Programs vs. Hybrid Automata Want: Compositional verification far x � = m cls cls brk fsa far ≡ x ′ = v , v ′ = A & ¬ SB( x , m ) brk ≡ x ′ = v , v ′ = − b & SB( x , m ) ∨ true cls ≡ x ′ = v , v ′ = . . . & . . . fsa ≡ x ′ = 0 , v ′ = 0 & v = 0 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 11 / 40

Hybrid Programs vs. Hybrid Automata Want: Compositional verification far x � = m cls cls brk fsa far ≡ x ′ = v , v ′ = A & ¬ SB( x , m ) brk ≡ x ′ = v , v ′ = − b & SB( x , m ) ∨ true cls ≡ x ′ = v , v ′ = . . . & . . . fsa ≡ x ′ = 0 , v ′ = 0 & v = 0 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 11 / 40

Hybrid Programs vs. Hybrid Automata Want: Compositional verification far x � = m cls cls brk Not fsa Compositional far ≡ x ′ = v , v ′ = A & ¬ SB( x , m ) brk ≡ x ′ = v , v ′ = − b & SB( x , m ) ∨ true cls ≡ x ′ = v , v ′ = . . . & . . . fsa ≡ x ′ = 0 , v ′ = 0 & v = 0 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 11 / 40

Differential Dynamic Logic d L : Syntax Definition (Hybrid program a ) x := f ( x ) | ? Q | x ′ = f ( x ) & Q | a ∪ b | a ; b | a ∗ Definition (d L Formula P ) e 1 ≥ e 2 | ¬ P | P ∧ Q | ∀ x P | ∃ x P | [ a ] P | � a � P Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 12 / 40

Differential Dynamic Logic d L : Syntax Discrete Differential Seq. Nondet. Test Nondet. Assign Equation Compose Repeat Condition Choice Definition (Hybrid program a ) x := f ( x ) | ? Q | x ′ = f ( x ) & Q | a ∪ b | a ; b | a ∗ Definition (d L Formula P ) e 1 ≥ e 2 | ¬ P | P ∧ Q | ∀ x P | ∃ x P | [ a ] P | � a � P All Some All Some Reals Reals Runs Runs Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 12 / 40

Differential Dynamic Logic d L : Semantics Definition (Hybrid program semantics) ([ [ · ] ] : HP → ℘ ( S × S )) [ [ x := f ( x )] ] = { ( v , w ) : w = v except [ [ x ] ] w = [ [ f ( x )] ] v } [ [? Q ] ] = { ( v , v ) : v ∈ [ [ Q ] ] } [ x ′ = f ( x )] = x ′ = f ( x ) for some duration r } [ ] = { ( ϕ (0) , ϕ ( r )) : ϕ | [ [ a ∪ b ] ] = [ [ a ] ] ∪ [ [ b ] ] [ [ a ; b ] ] = [ [ a ] ] ◦ [ [ b ] ] � [ a n ] [ a ∗ ] [ ] = [ ] n ∈ N Definition (d L semantics) ([ [ · ] ] : Fml → ℘ ( S )) [ [ e 1 ≥ e 2 ] ] = { v : [ [ e 1 ] ] v ≥ [ [ e 2 ] ] v } ]) ∁ [ [ ¬ P ] ] = ([ [ P ] [ [ P ∧ Q ] ] = [ [ P ] ] ∩ [ [ Q ] ] [ [ � a � P ] ] = [ [ a ] ] ◦ [ [ P ] ] = { v : w ∈ [ [ P ] ] for some w ( v , w ) ∈ [ [ a ] ] } [ [[ a ] P ] ] = [ [ ¬� a �¬ P ] ] = { v : w ∈ [ [ P ] ] for all w ( v , w ) ∈ [ [ a ] ] } ] = { v : v r [ [ ∃ x P ] x ∈ [ [ P ] ] for some r ∈ R } Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 13 / 40

Differential Dynamic Logic d L : Transition Semantics x w if w ( x ) = [ [ f ( x )] ] v x := f ( x ) and w ( z ) = v ( z ) for z � = x v w v t 0 x ϕ ( t ) x ′ = f ( x ) & Q w v w Q v t r 0 x ′ = f ( x ) & Q x ? Q v no change if v ∈ [ [ Q ] ] if v ∈ [ [ Q ] ] otherwise no transition v t 0 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 14 / 40

Differential Dynamic Logic d L : Transition Semantics w 1 x v a w 1 v a ∪ b w 2 b t w 2 x a ; b s v s w w v a t b a ∗ x w v v v 1 v 2 w a a a t Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 14 / 40

Differential Dynamic Logic d L : Transition Semantics w 1 x v a w 1 v a ∪ b w 2 b t w 2 x a ; b s v s w v w a t b a ∗ x w v v v 1 v 2 w a a a t Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 14 / 40

Differential Dynamic Logic d L : Transition Semantics w 1 x v a w 1 v a ∪ b w 2 b t w 2 x a ; b s v s w v w a t b ( a ; b ) ∗ x w v v v 1 v 2 w t a b a b a b Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 14 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) P v P [ a ] P P Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) v P � a � P Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) [ a ] P a -span v Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) [ a ] P a -span v � b � P b -span Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) [ a ] P � b � [ a ]-span a -span v � b � P b -span Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Differential Dynamic Logic d L : Semantics Definition (d L Formulas) [ a ] P � b � [ a ]-span a -span v � b � P b -span compositional semantics ⇒ compositional proofs! Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 15 / 40

Ex: Car Control Accelerate condition ? H Example ( Single car car s ) � ((? H ; a := A ) ∪ a := − b ); x ′ = v , v ′ = a & v ≥ 0 � ∗ 6 v x 0.5 a 10 m 7 t 0.0 8 1 2 3 4 5 6 4 � 0.5 6 2 � 1.0 4 � 1.5 2 7 t 0 1 2 3 4 5 6 7 t � 2.0 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 16 / 40

Ex: Car Control Properties time-triggered H ≡ 2 b ( m − x ) ≥ v 2 + � �� A ε 2 + 2 ε v � A + b Example (Single car car ε time-triggered) � ((? H ; a := A ) ∪ a := − b ); t := 0; x ′ = v , v ′ = a , t ′ = 1 & v ≥ 0 ∧ t ≤ ε � ∗ Example ( Safely stays before traffic light m ) v 2 ≤ 2 b ( m − x ) ∧ A ≥ 0 ∧ b > 0 → [ car ε ] x ≤ m 6 v x 0.5 a 10 m 7 t 0.0 8 1 2 3 4 5 6 4 � 0.5 6 2 � 1.0 4 � 1.5 2 7 t 0 1 2 3 4 5 6 7 t � 2.0 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 17 / 40

Ex: Car Control Properties time-triggered H ≡ 2 b ( m − x ) ≥ v 2 + � �� A ε 2 + 2 ε v � A + b Example (Single car car ε time-triggered) � ((? H ; a := A ) ∪ a := − b ); t := 0; x ′ = v , v ′ = a , t ′ = 1 & v ≥ 0 ∧ t ≤ ε � ∗ Example ( Live, can move everywhere) ε > 0 ∧ A > 0 ∧ b > 0 → ∀ p ∃ m � car ε � x ≥ p 6 v x 0.5 a 10 m 7 t 0.0 8 1 2 3 4 5 6 4 � 0.5 6 2 � 1.0 4 � 1.5 2 7 t 0 1 2 3 4 5 6 7 t � 2.0 0 1 2 3 4 5 6 � 2.5 � 2 � 2 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 17 / 40

Outline CPS are Multi-Dynamical Systems 1 Hybrid Systems Hybrid Games Dynamic Logic of Dynamical Systems 2 Syntax Semantics Example: Car Control Design Proofs for CPS 3 Compositional Proof Calculus Example: Safe Car Control Theory of CPS 4 Soundness and Completeness Differential Invariants Example: Elementary Differential Invariants Differential Axioms Applications 5 Summary 6 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 17 / 40

Differential Dynamic Logic: Axioms [:=] [ x := f ] p ( x ) ↔ p ( f ) [?] [? q ] p ↔ ( q → p ) [ ∪ ] [ a ∪ b ] p ( x ) ↔ [ a ] p ( x ) ∧ [ b ] p ( x ) [;] [ a ; b ] p ( x ) ↔ [ a ][ b ] p ( x ) [ ∗ ] [ a ∗ ] p ( x ) ↔ p ( x ) ∧ [ a ][ a ∗ ] p ( x ) K [ a ]( p ( x ) → q ( x )) → ([ a ] p ( x ) → [ a ] q ( x )) I [ a ∗ ]( p ( x ) → [ a ] p ( x )) → ( p ( x ) → [ a ∗ ] p ( x )) V p → [ a ] p [ x ′ = f ] p ( x ) ↔ ∀ t ≥ 0 [ x := x + ft ] p ( x ) DS LICS’12,CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 18 / 40

Proofs for Hybrid Systems compositional semantics ⇒ compositional rules! Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 19 / 40

Proofs for Hybrid Systems w 1 p ( x ) a [ a ] p ( x ) ∧ [ b ] p ( x ) v a ∪ b [ a ∪ b ] p ( x ) b w 2 p ( x ) Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 19 / 40

Proofs for Hybrid Systems w 1 p ( x ) a [ a ] p ( x ) ∧ [ b ] p ( x ) v a ∪ b [ a ∪ b ] p ( x ) b w 2 p ( x ) a ; b [ a ][ b ] p ( x ) v s w [ a ; b ] p ( x ) a b [ a ][ b ] p ( x ) [ b ] p ( x ) p ( x ) Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 19 / 40

Proofs for Hybrid Systems w 1 p ( x ) a [ a ] p ( x ) ∧ [ b ] p ( x ) v a ∪ b [ a ∪ b ] p ( x ) b w 2 p ( x ) a ; b [ a ][ b ] p ( x ) v s w [ a ; b ] p ( x ) a b [ a ][ b ] p ( x ) [ b ] p ( x ) p ( x ) a ∗ p ( x ) p ( x ) → [ a ] p ( x ) p ( x ) p ( x ) p ( x ) → [ a ] p ( x ) [ a ∗ ] p ( x ) v w a a a Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 19 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m [ ′ ] J ( x , v ) → [ x ′ = v , v ′ = − b ] J ( x , v ) [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m 2 t 2 + vt + x ] J ( x , v ) [:=] J ( x , v ) →∀ t ≥ 0 [ x := − b [ ′ ] J ( x , v ) → [ x ′ = v , v ′ = − b ] J ( x , v ) [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m 2 t 2 + vt + x ≤ m ) QE J ( x , v ) →∀ t ≥ 0 ( − b 2 t 2 + vt + x ] J ( x , v ) [:=] J ( x , v ) →∀ t ≥ 0 [ x := − b [ ′ ] J ( x , v ) → [ x ′ = v , v ′ = − b ] J ( x , v ) [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ x ≤ m J ( x , v ) → v 2 ≤ 2 b ( m − x ) 2 t 2 + vt + x ≤ m ) QE J ( x , v ) →∀ t ≥ 0 ( − b 2 t 2 + vt + x ] J ( x , v ) [:=] J ( x , v ) →∀ t ≥ 0 [ x := − b [ ′ ] J ( x , v ) → [ x ′ = v , v ′ = − b ] J ( x , v ) [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m J ( x , v ) → v 2 ≤ 2 b ( m − x ) 2 t 2 + vt + x ≤ m ) QE J ( x , v ) →∀ t ≥ 0 ( − b 2 t 2 + vt + x ] J ( x , v ) [:=] J ( x , v ) →∀ t ≥ 0 [ x := − b [ ′ ] J ( x , v ) → [ x ′ = v , v ′ = − b ] J ( x , v ) [:=] J ( x , v ) → [ a := − b ][ x ′ = v , v ′ = a ] J ( x , v ) [;] J ( x , v ) → [ a := − b ; ( x ′ = v , v ′ = a )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m 2 t 2 + vt + x ] J ( x , v )) [:=] J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → [ x := A [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m 2 t 2 + vt + x , At + v )) J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → J ( A 2 t 2 + vt + x ] J ( x , v )) [:=] J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → [ x := A [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m QE J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → ( At + v ) 2 ≤ 2 b ( m − A 2 t 2 − vt − x )) 2 t 2 + vt + x , At + v )) J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → J ( A 2 t 2 + vt + x ] J ( x , v )) [:=] J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → [ x := A [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v x m J ( x , v ) →¬ SB → ( A ε + v ) 2 ≤ 2 b ( m − A 2 ε 2 − v ε − x ) QE J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → ( At + v ) 2 ≤ 2 b ( m − A 2 t 2 − vt − x )) 2 t 2 + vt + x , At + v )) J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → J ( A 2 t 2 + vt + x ] J ( x , v )) [:=] J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → [ x := A [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m J ( x , v ) →¬ SB → ( A ε + v ) 2 ≤ 2 b ( m − A 2 ε 2 − v ε − x ) QE J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → ( At + v ) 2 ≤ 2 b ( m − A 2 t 2 − vt − x )) 2 t 2 + vt + x , At + v )) J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → J ( A 2 t 2 + vt + x ] J ( x , v )) [:=] J ( x , v ) →¬ SB → ∀ t ≥ 0 ( t ≤ ε → [ x := A [ ′ ] J ( x , v ) →¬ SB → [ x ′ = v , v ′ = A , t ′ = 1 & t ≤ ε ] J ( x , v ) [:=] J ( x , v ) →¬ SB → [ a := A ][ x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) →¬ SB → [ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [?] J ( x , v ) → [? ¬ SB][ a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) [;] J ( x , v ) → [? ¬ SB; a := A ; ( x ′ = v , v ′ = a , t ′ = 1 & t ≤ ε )] J ( x , v ) CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m [;] J ( x , v ) → [( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m [ ∪ ] J ( x , v ) → [ a := − b ∪ ? ¬ SB; a := A ][ x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) → [( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m J ( x , v ) → [ a := − b ][ x ′′ = a . . ] J ( x , v ) ∧ [? ¬ SB; a := A ][ x ′′ = a . . ] J ( x , v ) [ ∪ ] J ( x , v ) → [ a := − b ∪ ? ¬ SB; a := A ][ x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) → [( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m previous proofs for braking and acceleration J ( x , v ) → [ a := − b ][ x ′′ = a . . ] J ( x , v ) ∧ [? ¬ SB; a := A ][ x ′′ = a . . ] J ( x , v ) [ ∪ ] J ( x , v ) → [ a := − b ∪ ? ¬ SB; a := A ][ x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) → [( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Example Proof: Safe Driving J ( x , v ) ≡ v 2 ≤ 2 b ( m − x ) v SB ≡ 2 b ( m − x ) < v 2 +( A + b )( A ε 2 +2 ε v ) x m previous proofs for braking and acceleration J ( x , v ) → [ a := − b ][ x ′′ = a . . ] J ( x , v ) ∧ [? ¬ SB; a := A ][ x ′′ = a . . ] J ( x , v ) [ ∪ ] J ( x , v ) → [ a := − b ∪ ? ¬ SB; a := A ][ x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) [;] J ( x , v ) → [( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε ] J ( x , v ) � ( a := − b ∪ ? ¬ SB; a := A ); x ′′ = a , t ′ = 1 & t ≤ ε � ∗ ] J ( x , v ) ind J ( x , v ) → [ 1 Proof is essentially deterministic “follow your nose” 2 Synthesize invariant J ( , ) and parameter constraint SB 3 J ( x , v ) is a predicate symbol to prove only once and instantiate later CADE’15 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Outline CPS are Multi-Dynamical Systems 1 Hybrid Systems Hybrid Games Dynamic Logic of Dynamical Systems 2 Syntax Semantics Example: Car Control Design Proofs for CPS 3 Compositional Proof Calculus Example: Safe Car Control Theory of CPS 4 Soundness and Completeness Differential Invariants Example: Elementary Differential Invariants Differential Axioms Applications 5 Summary 6 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 20 / 40

Complete Proof Theory of Hybrid Systems Theorem (Sound & Complete) (J.Autom.Reas. 2008, LICS’12) d L calculus is a sound & complete axiomatization of hybrid systems relative to either differential equations or discrete dynamics. Proof 25pp Corollary (Complete Proof-theoretical Alignment & Bridging) proving continuous = proving hybrid = proving discrete JAutomReas’08,LICS’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 21 / 40

Complete Proof Theory of Hybrid Systems Theorem (Sound & Complete) (J.Autom.Reas. 2008, LICS’12) d L calculus is a sound & complete axiomatization of hybrid systems relative to either differential equations or discrete dynamics. Proof 25pp Corollary (Complete Proof-theoretical Alignment & Bridging) proving continuous = proving hybrid = proving discrete Hybrid Continuous Discrete System JAutomReas’08,LICS’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 21 / 40

Complete Proof Theory of Hybrid Systems Theorem (Sound & Complete) (J.Autom.Reas. 2008, LICS’12) d L calculus is a sound & complete axiomatization of hybrid systems relative to either differential equations or discrete dynamics. Proof 25pp Corollary (Complete Proof-theoretical Alignment & Bridging) proving continuous = proving hybrid = proving discrete Discrete Contin. Hybrid Theory Theory Theory Hybrid Continuous Discrete System JAutomReas’08,LICS’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 21 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost y ′ = g ( x , y ) x x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant Differential Cut Differential Ghost y ′ = g ( x , y ) x inv x ′ = f ( x ) 0 t DI ≥ DI ≥ , ∧ , ∨ DI ≥ , = , ∧ , ∨ Logic Math Character- DI = , ∧ , ∨ Provability DI = DI theory istic PDE DI > DI >, ∧ , ∨ DI >, = , ∧ , ∨ JLogComput’10,CAV’08,FMSD’09,LMCS’12,ITP’12 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 22 / 40

Differential Invariants for Differential Equations Differential Invariant H → [ x ′ := f ( x )] F ′ F → [ x ′ = f ( x ) & H ] F Differential Cut F → [ x ′ = f ( x )] C F → [ x ′ = f ( x ) & C ] F F → [ x ′ = f ( x )] F y ′ = g ( x, y ) Differential Ghost G → [ x ′ = f ( x ) , y ′ = g ( x , y ) & H ] G F ↔ ∃ y G x inv F → [ x ′ = f ( x ) & H ] F x ′ = f ( x ) 0 t if new y ′ = g ( x , y ) has a global solution Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 23 / 40

Differential Invariants for Differential Equations Differential Invariant H → [ x ′ := f ( x )] F ′ F → [ x ′ = f ( x ) & H ] F Differential Cut F → [ x ′ = f ( x ) & H ] C F → [ x ′ = f ( x ) & H ∧ C ] F F → [ x ′ = f ( x ) & H ] F y ′ = g ( x, y ) Differential Ghost G → [ x ′ = f ( x ) , y ′ = g ( x , y ) & H ] G F ↔ ∃ y G x inv F → [ x ′ = f ( x ) & H ] F x ′ = f ( x ) 0 t if new y ′ = g ( x , y ) has a global solution Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 23 / 40

Differential Invariants for Differential Equations ω 2 x 2 + y 2 ≤ c 2 → [ x ′ = y , y ′ = − ω 2 x − 2 d ω y & ( ω ≥ 0 ∧ d ≥ 0)] ω 2 x 2 + y 2 ≤ c 2 1.0 x 0.5 1 2 3 4 5 6 y � 0.5 � 1.0 � 1.5 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 24 / 40

Differential Invariants for Differential Equations ω ≥ 0 ∧ d ≥ 0 → [ x ′ := y ][ y ′ := − ω 2 x − 2 d ω y ]2 ω 2 xx ′ + 2 yy ′ ≤ 0 ω 2 x 2 + y 2 ≤ c 2 → [ x ′ = y , y ′ = − ω 2 x − 2 d ω y & ( ω ≥ 0 ∧ d ≥ 0)] ω 2 x 2 + y 2 ≤ c 2 1.0 x 0.5 1 2 3 4 5 6 y � 0.5 � 1.0 � 1.5 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 24 / 40

Differential Invariants for Differential Equations ω ≥ 0 ∧ d ≥ 0 → 2 ω 2 xy + 2 y ( − ω 2 x − 2 d ω y ) ≤ 0 ω ≥ 0 ∧ d ≥ 0 → [ x ′ := y ][ y ′ := − ω 2 x − 2 d ω y ]2 ω 2 xx ′ + 2 yy ′ ≤ 0 ω 2 x 2 + y 2 ≤ c 2 → [ x ′ = y , y ′ = − ω 2 x − 2 d ω y & ( ω ≥ 0 ∧ d ≥ 0)] ω 2 x 2 + y 2 ≤ c 2 1.0 x 0.5 1 2 3 4 5 6 y � 0.5 � 1.0 � 1.5 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 24 / 40

Differential Invariants for Differential Equations ∗ ω ≥ 0 ∧ d ≥ 0 → 2 ω 2 xy + 2 y ( − ω 2 x − 2 d ω y ) ≤ 0 ω ≥ 0 ∧ d ≥ 0 → [ x ′ := y ][ y ′ := − ω 2 x − 2 d ω y ]2 ω 2 xx ′ + 2 yy ′ ≤ 0 ω 2 x 2 + y 2 ≤ c 2 → [ x ′ = y , y ′ = − ω 2 x − 2 d ω y & ( ω ≥ 0 ∧ d ≥ 0)] ω 2 x 2 + y 2 ≤ c 2 1.0 x 0.5 1 2 3 4 5 6 y � 0.5 � 1.0 � 1.5 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 24 / 40

Differential Invariants for Differential Equations ∗ ω ≥ 0 ∧ d ≥ 0 → 2 ω 2 xy + 2 y ( − ω 2 x − 2 d ω y ) ≤ 0 ω ≥ 0 ∧ d ≥ 0 → [ x ′ := y ][ y ′ := − ω 2 x − 2 d ω y ]2 ω 2 xx ′ + 2 yy ′ ≤ 0 ω 2 x 2 + y 2 ≤ c 2 → [ x ′ = y , y ′ = − ω 2 x − 2 d ω y & ( ω ≥ 0 ∧ d ≥ 0)] ω 2 x 2 + y 2 ≤ c 2 1.0 x 0.5 1 2 3 4 5 6 y � 0.5 � 1.0 � 1.5 Andr´ e Platzer (CMU) Foundations of Cyber-Physical Systems AVACS 24 / 40