Logical Foundations of Cyber-Physical Systems Andr Platzer Andr - PowerPoint PPT Presentation

Axiom Schema Matches Many Formulas But Not All Algorithm [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ � [ x := x + 1 ∪ x ′ = x 2 ] x ≥ 0 ↔ [ x := x + 1 ] x ≥ 0 ∧ [ x ′ = x 2 ] x ≥ 0 Same φ Match Schema � [ x ′ = 5 ∪ x ′ = − x ] x 2 ≥ 5 ↔ [ x ′ = 5 ] x 2 ≥ 5 ∧ [ x ′ = − x ] x 2 ≥ 5 shape variable every- × [ v := v + 1 ; x ′ = v ∪ x ′ = 2 ] x ≥ 5 ↔ [ v := v + 1 ; x ′ = v ] x ≥ 5 ∧ [ x ′ = 2 ] x ≥ 4 α ∪ β α match where V φ → [ α ] φ ( FV ( φ ) ∩ BV ( α ) = / 0 ) � y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 rule out × x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 by side � y ≥ z → [ x ′ = − 5 ] y ≥ z conditions [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) ( θ free for x in φ ) � [ x := x + y ] x ≤ y 2 ↔ x + y ≤ y 2 no x oc- Match Replace × [ x := x + y ][ y := 5 ] x ≥ 0 ↔ [ y := 5 ] x + y ≥ 0 currence all free by θ � [ y := 2 b ][( x := x + y ; x ′ = y ) ∗ ] x ≥ y ↔ [( x := x + 2 b ; x ′ = 2 b ) ∗ ] x ≥ 2 b where x occur- every- θ bound rences where � [ x := x + y ][ x := x + 1 ] x ≥ 0 ↔ [ x := x + y + 1 ] x ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 5 / 24

Axiom Schema Side Conditions: ODE Solving [ ′ ] [ x ′ = θ ] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 6 / 24

Axiom Schema Side Conditions: ODE Solving [ ′ ] [ x ′ = θ ] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ ( t fresh and y ′ ( t ) = θ ) Axiom schema with side conditions: Occurs check: t fresh 1 Solution check: y ( · ) solves the ODE y ′ ( t ) = θ 2 with y ( · ) plugged in for x in term θ Initial value check: y ( · ) solves the symbolic IVP y ( 0 ) = x 3 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 6 / 24

Axiom Schema Side Conditions: ODE Solving [ ′ ] [ x ′ = θ ] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ ( t fresh and y ′ ( t ) = θ ) Axiom schema with side conditions: Occurs check: t fresh 1 Solution check: y ( · ) solves the ODE y ′ ( t ) = θ 2 with y ( · ) plugged in for x in term θ Initial value check: y ( · ) solves the symbolic IVP y ( 0 ) = x 3 y ( · ) covers all solutions parametrically 4 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 6 / 24

Axiom Schema Side Conditions: ODE Solving [ ′ ] [ x ′ = θ ] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ ( t fresh and y ′ ( t ) = θ ) Axiom schema with side conditions: Occurs check: t fresh 1 Solution check: y ( · ) solves the ODE y ′ ( t ) = θ 2 with y ( · ) plugged in for x in term θ Initial value check: y ( · ) solves the symbolic IVP y ( 0 ) = x 3 y ( · ) covers all solutions parametrically 4 x ′ cannot occur free in φ 5 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 6 / 24

Axiom Schema Side Conditions: ODE Solving [ ′ ] [ x ′ = θ ] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ ( t fresh and y ′ ( t ) = θ ) Axiom schema with side conditions: Occurs check: t fresh 1 Solution check: y ( · ) solves the ODE y ′ ( t ) = θ 2 with y ( · ) plugged in for x in term θ Initial value check: y ( · ) solves the symbolic IVP y ( 0 ) = x 3 y ( · ) covers all solutions parametrically 4 x ′ cannot occur free in φ 5 Quite nontrivial soundness-critical side condition algorithms . . . André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 6 / 24

What Axioms Want V φ → [ α ] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

What Axioms Want V φ → [ α ] φ V p → [ a ] p V predicate symbol p of arity 0 has no bound variable of HP a free “Formula p has no explicit permission to depend on anything” (except implicitly on what doesn’t change in a anyhow) V program constant symbol a could have arbitrary behavior André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

What Axioms Want V φ → [ α ] φ V p → [ a ] p [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) V predicate symbol p of arity 0 has no bound variable of HP a free “Formula p has no explicit permission to depend on anything” (except implicitly on what doesn’t change in a anyhow) V program constant symbol a could have arbitrary behavior André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

What Axioms Want V φ → [ α ] φ V p → [ a ] p [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) V predicate symbol p of arity 0 has no bound variable of HP a free “Formula p has no explicit permission to depend on anything” (except implicitly on what doesn’t change in a anyhow) [:=] predicate symbol p of arity 1 has different arguments in different places “Formula p ( x ) has explicit permission to depend on x ” [:=] function symbol c of arity 0 takes no arguments V program constant symbol a could have arbitrary behavior André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

What Axioms Want [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ V φ → [ α ] φ V p → [ a ] p [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) V predicate symbol p of arity 0 has no bound variable of HP a free “Formula p has no explicit permission to depend on anything” (except implicitly on what doesn’t change in a anyhow) [:=] predicate symbol p of arity 1 has different arguments in different places “Formula p ( x ) has explicit permission to depend on x ” [:=] function symbol c of arity 0 takes no arguments V program constant symbol a could have arbitrary behavior André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

What Axioms Want [ ∪ ] [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ x ) V φ → [ α ] φ V p → [ a ] p [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) V predicate symbol p of arity 0 has no bound variable of HP a free “Formula p has no explicit permission to depend on anything” (except implicitly on what doesn’t change in a anyhow) [:=] predicate symbol p of arity 1 has different arguments in different places “Formula p ( x ) has explicit permission to depend on x ” [ ∪ ] predicate symbol p of arity n takes all variables ¯ x as arguments “Formula p (¯ x ) has explicit permission to depend on all variables ¯ x ” [:=] function symbol c of arity 0 takes no arguments V program constant symbol a could have arbitrary behavior André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

Outline Learning Objectives 1 Axioms Versus Axiom Schemata 2 Differential Dynamic Logic with Interpretations 3 Syntax Semantics 4 Uniform Substitution Uniform Substitution Application Uniform Substitution Lemmas 5 Axiomatic Proof Calculus for dL Summary 6 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 7 / 24

Differential Dynamic Logic with Interpretations: Syntax Definition (Hybrid program α ) α , β ::= a | x := θ | ? Q | x ′ = f ( x )& Q | α ∪ β | α ; β | α ∗ Definition (dL Formula φ ) φ , ψ ::= p ( θ 1 ,..., θ k ) | θ ≥ η | ¬ φ | φ ∧ ψ | ∀ x φ | ∃ x φ | [ α ] φ | � α � φ Definition (Term θ ) θ , η ::= f ( θ 1 ,..., θ k ) | x | θ + η | θ · η | ( θ ) ′ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 8 / 24

Differential Dynamic Logic with Interpretations: Syntax Discrete Test Differential Nondet. Seq. Nondet. Assign Equation Compose Repeat Condition Choice Definition (Hybrid program α ) α , β ::= a | x := θ | ? Q | x ′ = f ( x )& Q | α ∪ β | α ; β | α ∗ Definition (dL Formula φ ) φ , ψ ::= p ( θ 1 ,..., θ k ) | θ ≥ η | ¬ φ | φ ∧ ψ | ∀ x φ | ∃ x φ | [ α ] φ | � α � φ Definition (Term θ ) θ , η ::= f ( θ 1 ,..., θ k ) | x | θ + η | θ · η | ( θ ) ′ All All Some Some Reals Reals Runs Runs André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 8 / 24

Differential Dynamic Logic with Interpretations: Syntax Program Symbol Definition (Hybrid program α ) α , β ::= a | x := θ | ? Q | x ′ = f ( x )& Q | α ∪ β | α ; β | α ∗ Definition (dL Formula φ ) φ , ψ ::= p ( θ 1 ,..., θ k ) | θ ≥ η | ¬ φ | φ ∧ ψ | ∀ x φ | ∃ x φ | [ α ] φ | � α � φ Definition (Term θ ) θ , η ::= f ( θ 1 ,..., θ k ) | x | θ + η | θ · η | ( θ ) ′ Function Predicate Differential Symbol Symbol André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 8 / 24

Differential Dynamic Logic with Interpretations: Semantics ( [ [ · ] ] : Trm → ( S → R ) ) Definition (Term semantics) I ( f ) : R k → R smooth � � ω [ [ f ( θ 1 ,..., θ k )] ] = I ( f ) ω [ [ θ 1 ] ] ,..., ω [ [ θ k ] ] ω ( x ′ ) ∂ [ [ θ ] ] ] = ∑ [( θ ) ′ ] ω [ ∂ x ( ω ) x ( [ [ · ] ] : Fml → ℘ ( S ) ) Definition (dL semantics) I ( p ) ⊆ R k [ [ p ( θ 1 ,..., θ k )] ] = { ω : ( ω [ [ θ 1 ] ] ,..., ω [ [ θ k ] ]) ∈ I ( p ) } [ [ � α � φ ] ] = [ [ α ] ] ◦ [ [ φ ] ] P valid iff ω ∈ [ [ P ] ] for all states ω of all interpretations I ( [ [ · ] ] : HP → ℘ ( S × S ) ) Definition (Program semantics) [ [ a ] ] = I ( a ) I ( a ) ⊆ S × S [ x ′ = f ( x )& Q ] = x ′ = f ( x ) ∧ Q } [ ] = { ( ϕ ( 0 ) | { x ′ } ∁ , ϕ ( r )) : ϕ | [ [ α ∪ β ] ] = [ [ α ] ] ∪ [ [ β ] ] [ [ α ; β ] ] = [ [ α ] ] ◦ [ [ β ] ] � ∗ = � [ α ∗ ] � [ α n ] [ ] = [ [ α ] ] n ∈ N [ ] André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 9 / 24

Soundness Proofs for Axioms Lemma (V vacuous axiom) V p → [ a ] p Lemma ( [:=] assignment axiom) [:=] [ x := c ] p ( x ) ↔ p ( c ) André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 10 / 24

Soundness Proofs for Axioms Lemma (V vacuous axiom) V p → [ a ] p Proof. Truth of an arity 0 predicate symbol p depends only on interpretation I . I interprets p as true : ω ∈ [ [ p ] ] for all ω , so ω ∈ [ [[ a ] p ] ] especially. 1 I interprets p as false : ω �∈ [ [ p ] ] for all ω , so p → [ a ] p vacuously. 2 Lemma ( [:=] assignment axiom) [:=] [ x := c ] p ( x ) ↔ p ( c ) Proof. p is true of x after assigning the new value c to x ( ω ∈ [ [[ x := c ] p ( x )] ] ) iff p is true of the new value c ( ω ∈ [ [ p ( c )] ] ). André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 10 / 24

Outline Learning Objectives 1 Axioms Versus Axiom Schemata 2 Differential Dynamic Logic with Interpretations 3 Syntax Semantics 4 Uniform Substitution Uniform Substitution Application Uniform Substitution Lemmas 5 Axiomatic Proof Calculus for dL Summary 6 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 10 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 11 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 11 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) function sym. f ( θ ) for any θ by η ( θ ) α program sym. a by [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 11 / 24

Uniform Substitution: First-Order Examples ( ¬¬ p ) ↔ p σ = { p �→ [ x ′ = x 2 ] x ≥ 0 } ( ¬¬ [ x ′ = x 2 ] x ≥ 0 ) ↔ [ x ′ = x 2 ] x ≥ 0 ( ∀ x p ) ↔ p σ = { p �→ x ≥ 0 } ∀ x ( x ≥ 0 ) ↔ x ≥ 0 ( ∀ x p ) ↔ p σ = { p �→ y ≥ 0 } ∀ x ( y ≥ 0 ) ↔ y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 12 / 24

Uniform Substitution: First-Order Examples Correct ( ¬¬ p ) ↔ p σ = { p �→ [ x ′ = x 2 ] x ≥ 0 } ( ¬¬ [ x ′ = x 2 ] x ≥ 0 ) ↔ [ x ′ = x 2 ] x ≥ 0 ( ∀ x p ) ↔ p σ = { p �→ x ≥ 0 } ∀ x ( x ≥ 0 ) ↔ x ≥ 0 ( ∀ x p ) ↔ p σ = { p �→ y ≥ 0 } ∀ x ( y ≥ 0 ) ↔ y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 12 / 24

Uniform Substitution: First-Order Examples Correct ( ¬¬ p ) ↔ p σ = { p �→ [ x ′ = x 2 ] x ≥ 0 } ( ¬¬ [ x ′ = x 2 ] x ≥ 0 ) ↔ [ x ′ = x 2 ] x ≥ 0 FV Clash BV ( ∀ x p ) ↔ p σ = { p �→ x ≥ 0 } ∀ x ( x ≥ 0 ) ↔ x ≥ 0 ( ∀ x p ) ↔ p σ = { p �→ y ≥ 0 } ∀ x ( y ≥ 0 ) ↔ y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 12 / 24

Uniform Substitution: First-Order Examples Correct ( ¬¬ p ) ↔ p σ = { p �→ [ x ′ = x 2 ] x ≥ 0 } ( ¬¬ [ x ′ = x 2 ] x ≥ 0 ) ↔ [ x ′ = x 2 ] x ≥ 0 Clash ( ∀ x p ) ↔ p σ = { p �→ x ≥ 0 } ∀ x ( x ≥ 0 ) ↔ x ≥ 0 Correct ( ∀ x p ) ↔ p σ = { p �→ y ≥ 0 } ∀ x ( y ≥ 0 ) ↔ y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 12 / 24

Uniform Substitution: Argument Examples [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution: Argument Examples Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution: Argument Examples Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution: Argument Examples Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 FV Clash BV [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x [ x [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution: Argument Examples Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution: Argument Examples Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ 0 ) } [ x := x 2 − 1 ] x ≥ 0 ↔ x 2 − 1 ≥ 0 Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ x ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ · ) } [ x := x 2 − 1 ] x ≥ x ↔ x 2 − 1 ≥ x 2 − 1 Correct [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x 2 − 1 , p ( · ) �→ ( · ≥ y ) } [ x := x 2 − 1 ] x ≥ y ↔ x 2 − 1 ≥ y André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 13 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) function sym. f ( θ ) for any θ by η ( θ ) α program sym. a by [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 14 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) provided FV ( σ | Σ( θ ) ) ∩ BV ( ⊗ ( · )) = / 0 for each operation ⊗ ( θ ) in φ i.e. bound variables U = BV ( ⊗ ( · )) of no operator ⊗ are free in the substitution on its argument θ ( U -admissible) Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) function sym. f ( θ ) for any θ by η ( θ ) α program sym. a by [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 14 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) provided FV ( σ | Σ( θ ) ) ∩ BV ( ⊗ ( · )) = / 0 for each operation ⊗ ( θ ) in φ i.e. bound variables U = BV ( ⊗ ( · )) of no operator ⊗ are free in the substitution on its argument θ ( U -admissible) If you bind a free variable, you go to logic jail! Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) function sym. f ( θ ) for any θ by η ( θ ) α program sym. a by [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 14 / 24

Uniform Substitution: Recursive Application σ ( x ) = for variable x ∈ V σ ( f ( θ )) = for function symbol f ∈ σ def = σ ( θ + η ) = σ (( θ ) ′ ) = σ ( p ( θ )) ≡ for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = for function symbol f ∈ σ def = σ ( θ + η ) = σ (( θ ) ′ ) = σ ( p ( θ )) ≡ for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ (( θ ) ′ ) = σ ( p ( θ )) ≡ for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = σ ( p ( θ )) ≡ for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ x ′ = σ ( θ )& σ ( Q ) if σ { x , x ′ } -admissible for θ , Q σ (? Q ) ≡ σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ x ′ = σ ( θ )& σ ( Q ) if σ { x , x ′ } -admissible for θ , Q σ (? Q ) ≡ ? σ ( Q ) σ ( α ∪ β ) ≡ σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ x ′ = σ ( θ )& σ ( Q ) if σ { x , x ′ } -admissible for θ , Q σ (? Q ) ≡ ? σ ( Q ) σ ( α ∪ β ) ≡ σ ( α ) ∪ σ ( β ) σ ( α ; β ) ≡ σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ x ′ = σ ( θ )& σ ( Q ) if σ { x , x ′ } -admissible for θ , Q σ (? Q ) ≡ ? σ ( Q ) σ ( α ∪ β ) ≡ σ ( α ) ∪ σ ( β ) σ ( α ; β ) ≡ σ ( α ); σ ( β ) if σ BV ( σ ( α )) -admissible for β σ ( α ∗ ) ≡ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Recursive Application σ ( x ) = x for variable x ∈ V σ ( f ( θ )) = ( σ ( f ))( σ ( θ )) for function symbol f ∈ σ def = {· �→ σ ( θ ) } ( σ f ( · )) σ ( θ + η ) = σ ( θ )+ σ ( η ) σ (( θ ) ′ ) = ( σ ( θ )) ′ if σ V -admissible for θ σ ( p ( θ )) ≡ ( σ ( p ))( σ ( θ )) for predicate symbol p ∈ σ σ ( φ ∧ ψ ) ≡ σ ( φ ) ∧ σ ( ψ ) σ ( ∀ x φ ) = ∀ x σ ( φ ) if σ { x } -admissible for φ σ ([ α ] φ ) = [ σ ( α )] σ ( φ ) if σ BV ( σ ( α )) -admissible for φ σ ( a ) ≡ σ a for program symbol a ∈ σ σ ( x := θ ) ≡ x := σ ( θ ) σ ( x ′ = θ & Q ) ≡ x ′ = σ ( θ )& σ ( Q ) if σ { x , x ′ } -admissible for θ , Q σ (? Q ) ≡ ? σ ( Q ) σ ( α ∪ β ) ≡ σ ( α ) ∪ σ ( β ) σ ( α ; β ) ≡ σ ( α ); σ ( β ) if σ BV ( σ ( α )) -admissible for β σ ( α ∗ ) ≡ ( σ ( α )) ∗ if σ BV ( σ ( α )) -admissible for α André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 15 / 24

Uniform Substitution: Examples [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples FV Clash BV [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x Correct [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x Correct [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } FV Clash BV p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ′ = − 5 ] x ≥ 0 x ≥ 0 → [ p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution: Examples Clash [ x := c ] p ( x ) ↔ p ( c ) σ = { c �→ x + 1 , p ( · ) �→ ( · � = x ) } [ x := x + 1 ] x � = x ↔ x + 1 � = x Correct [ x := c ] p ( x ) ↔ p ( c ) [ x := x 2 ][( y := x + y ) ∗ ] x ≥ y ↔ [( y := x 2 + y ) ∗ ] x 2 ≥ y σ = { c �→ x 2 , p ( · ) �→ [( y := · + y ) ∗ ]( · ≥ y ) } Clash p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ x ≥ 0 } x ≥ 0 → [ x ′ = − 5 ] x ≥ 0 Correct p → [ a ] p σ = { a �→ x ′ = − 5 , p �→ y ≥ 0 } y ≥ 0 → [ x ′ = − 5 ] y ≥ 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 16 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) provided FV ( σ | Σ( θ ) ) ∩ BV ( ⊗ ( · )) = / 0 for each operation ⊗ ( θ ) in φ i.e. bound variables U = BV ( ⊗ ( · )) of no operator ⊗ are free in the substitution on its argument θ ( U -admissible) If you bind a free variable, you go to logic jail! Uniform substitution σ replaces all occurrences of p ( θ ) for any θ by ψ ( θ ) function sym. f ( θ ) for any θ by η ( θ ) α program sym. a by [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := v + 1 ∪ x ′ = v ] x > 0 ↔ [ v := v + 1 ] x > 0 ∧ [ x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 17 / 24

Correctness of Uniform Substitutions “Syntactic uniform substitution = semantic replacement” Lemma (Uniform substitution lemma) Uniform substitution σ and its adjoint interpretation σ ∗ ω I to σ for I , ω have the same semantics: ] iff ω ∈ σ ∗ ω ∈ I [ [ σ ( φ )] ω I [ [ φ ] ] φ σ ( φ ) ω ∈ I [ [ σ ( φ )] ] σ I σ ∗ ω I ω ∈ σ ∗ ω I [ [ φ ] ] σ ∗ ω I ( f ) : R → R ; d �→ I d · ω [ [ σ f ( · )] ] σ ∗ ω I ( p ) = { d ∈ R : ω ∈ I d . [ [ σ p ( · )] ] } σ ∗ ω I ( a ) = I [ [ σ a ] ] André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 18 / 24

Uniform Substitution Theorem (Soundness) replace all occurrences of p ( · ) φ US σ ( φ ) provided FV ( σ | Σ( θ ) ) ∩ BV ( ⊗ ( · )) = / 0 for each operation ⊗ ( θ ) in φ Proof. If premise φ valid, i.e. ω ∈ I [ [ φ ] ] in all I , ω ] iff ω ∈ σ ∗ Then conclusion σ ( φ ) valid, because ω ∈ I [ [ σ ( φ )] ω I [ [ φ ] ] André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 19 / 24

Outline Learning Objectives 1 Axioms Versus Axiom Schemata 2 Differential Dynamic Logic with Interpretations 3 Syntax Semantics 4 Uniform Substitution Uniform Substitution Application Uniform Substitution Lemmas 5 Axiomatic Proof Calculus for dL Summary 6 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 19 / 24

Differential Dynamic Logic: Comparison Part I Part IV [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [?] [? χ ] φ ↔ ( χ → φ ) [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ [;] [ α ; β ] φ ↔ [ α ][ β ] φ [ ∗ ] [ α ∗ ] φ ↔ φ ∧ [ α ][ α ∗ ] φ K [ α ]( φ → ψ ) → ([ α ] φ → [ α ] ψ ) I [ α ∗ ] φ ↔ φ ∧ [ α ∗ ]( φ → [ α ] φ ) V φ → [ α ] φ [ ′ ] [ x ′ = f ( x )] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 20 / 24

Differential Dynamic Logic: Comparison Part I Part IV [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) [?] [? χ ] φ ↔ ( χ → φ ) [?] [? q ] p ↔ ( q → p ) [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ [ ∪ ] [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) [;] [ a ; b ] p (¯ x ) ↔ [ a ][ b ] p (¯ [;] [ α ; β ] φ ↔ [ α ][ β ] φ x ) [ ∗ ] [ α ∗ ] φ ↔ φ ∧ [ α ][ α ∗ ] φ [ ∗ ] [ a ∗ ] p (¯ x ) ∧ [ a ][ a ∗ ] p (¯ x ) ↔ p (¯ x ) K [ a ]( p (¯ x ) → q (¯ x )) → ([ a ] p (¯ x ) → [ a ] q (¯ K [ α ]( φ → ψ ) → ([ α ] φ → [ α ] ψ ) x )) I [ α ∗ ] φ ↔ φ ∧ [ α ∗ ]( φ → [ α ] φ ) I [ a ∗ ] p (¯ x ) ∧ [ a ∗ ]( p (¯ x ) ↔ p (¯ x ) → [ a ] p (¯ x )) V φ → [ α ] φ V p → [ a ] p [ ′ ] [ x ′ = f ( x )] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 20 / 24

Differential Dynamic Logic: Comparison Infinite axiom schema Axiom = one formula [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) [?] [? χ ] φ ↔ ( χ → φ ) [?] [? q ] p ↔ ( q → p ) Schema Axiom [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ [ ∪ ] [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) [;] [ a ; b ] p (¯ x ) ↔ [ a ][ b ] p (¯ [;] [ α ; β ] φ ↔ [ α ][ β ] φ x ) [ ∗ ] [ α ∗ ] φ ↔ φ ∧ [ α ][ α ∗ ] φ [ ∗ ] [ a ∗ ] p (¯ x ) ∧ [ a ][ a ∗ ] p (¯ x ) ↔ p (¯ x ) K [ a ]( p (¯ x ) → q (¯ x )) → ([ a ] p (¯ x ) → [ a ] q (¯ K [ α ]( φ → ψ ) → ([ α ] φ → [ α ] ψ ) x )) I [ α ∗ ] φ ↔ φ ∧ [ α ∗ ]( φ → [ α ] φ ) I [ a ∗ ] p (¯ x ) ∧ [ a ∗ ]( p (¯ x ) ↔ p (¯ x ) → [ a ] p (¯ x )) Schema Axiom V φ → [ α ] φ V p → [ a ] p [ ′ ] [ x ′ = f ( x )] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 20 / 24

Example Proof [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { a �→ ( v := 2 ∪ v := x ) , b �→ x ′ = v , p (¯ x ) �→ x > 0 } [ a ; b ] p (¯ x ) ↔ [ a ][ b ] p (¯ x ) US [( v := 2 ∪ v := x ); x ′ = v ] x > 0 ↔ [( v := 2 ∪ v := x )][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof x ) �→ [ x ′ = v ] x > 0 } σ = { a �→ v := 2 , b �→ v := x , p (¯ [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) US [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 ↔ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { c �→ 2 , p ( · ) �→ [ x ′ = · ] x > 0 } σ = { c �→ x , p ( · ) �→ [ x ′ = · ] x > 0 } [ v := c ] p ( v ) ↔ p ( c ) [ v := c ] p ( v ) ↔ p ( c ) [ v := 2 ][ x ′ = v ] x > 0 ↔ [ x ′ = 2 ] x > 0 [ v := x ][ x ′ = v ] x > 0 ↔ [ x ′ = x ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { c �→ 2 , p ( · ) �→ [ x ′ = · ] x > 0 } σ = { c �→ x , p ( · ) �→ [ x ′ = · ] x > 0 } � [ v := c ] p ( v ) ↔ p ( c ) [ v := c ] p ( v ) ↔ p ( c ) [ v := 2 ][ x ′ = v ] x > 0 ↔ [ x ′ = 2 ] x > 0 [ v := x ][ x ′ = v ] x > 0 ↔ [ x ′ = x ] x > 0 [ ′ ] j ( x ) ⊢ [ x ′ = 2 ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { c �→ v , p ( · ) �→ · > 0 } v can’t have ODE [ x ′ = c ] p ( x ) ↔ ∀ t ≥ 0 [ x := x + ct ] p ( x ) US [ x ′ = v ] x > 0 ↔ ∀ t ≥ 0 [ x := x + vt ] x > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 [ x := x + 2 t ] x > 0 ∧ [ v := x ] ∀ t ≥ 0 [ x := x + vt ] x > 0 [ ′ ] j ( x ) ⊢ [ x ′ = 2 ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { c �→ x , p ( · ) �→ ∀ t ≥ 0 [ x := x +( · ) t ] x > 0 } [ v := c ] p ( v ) ↔ p ( c ) US [ v := x ] ∀ t ≥ 0 [ x := x + vt ] x > 0 ↔ ∀ t ≥ 0 [ x := x + xt ] x > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 [ x := x + xt ] x > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 [ x := x + 2 t ] x > 0 ∧ [ v := x ] ∀ t ≥ 0 [ x := x + vt ] x > 0 [ ′ ] j ( x ) ⊢ [ x ′ = 2 ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof σ = { c �→ x + xt , p ( · ) �→ · > 0 } [ x := c ] p ( x ) ↔ p ( c ) US [ x := x + xt ] x > 0 ↔ x + xt > 0 j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 x + xt > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 [ x := x + xt ] x > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 [ x := x + 2 t ] x > 0 ∧ [ v := x ] ∀ t ≥ 0 [ x := x + vt ] x > 0 [ ′ ] j ( x ) ⊢ [ x ′ = 2 ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 x + xt > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 [ x := x + xt ] x > 0 [:=] j ( x ) ⊢ ∀ t ≥ 0 [ x := x + 2 t ] x > 0 ∧ [ v := x ] ∀ t ≥ 0 [ x := x + vt ] x > 0 [ ′ ] j ( x ) ⊢ [ x ′ = 2 ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [:=] j ( x ) ⊢ [ v := 2 ][ x ′ = v ] x > 0 ∧ [ v := x ][ x ′ = v ] x > 0 [ ∪ ] j ( x ) ⊢ [ v := 2 ∪ v := x ][ x ′ = v ] x > 0 [;] j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof Summarize: j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 x + xt > 0 j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Example Proof Summarize: j ( x ) ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 x + xt > 0 j ( x ) ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 Using σ = { j ( · ) �→ · > 0 } on above derived rule proves: ∗ R x > 0 ⊢ ∀ t ≥ 0 x + 2 t > 0 ∧∀ t ≥ 0 x + xt > 0 USR x > 0 ⊢ [( v := 2 ∪ v := x ); x ′ = v ] x > 0 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Outline Learning Objectives 1 Axioms Versus Axiom Schemata 2 Differential Dynamic Logic with Interpretations 3 Syntax Semantics 4 Uniform Substitution Uniform Substitution Application Uniform Substitution Lemmas 5 Axiomatic Proof Calculus for dL Summary 6 André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 21 / 24

Axiom vs. Axiom Schema: Philosophy Affects Provers � Soundness easier: literal formula, not instantiation mechanism � An axiom is one formula. Axiom schema is a decision algorithm. � Generic formula, not some shape with characterization of exceptions � No schema variable or meta variable algorithms � No matching mechanisms / unification in prover kernel � No side condition subtlety or occurrence pattern checks (per schema) × Need other means of instantiating axioms: uniform substitution (US) � US + renaming: isolate static semantics � US independent from axioms: modular logic vs. prover separation � More flexible by syntactic contextual equivalence × Extra proofs branches since instantiation is explicit proof step André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 22 / 24

Axiom vs. Axiom Schema: Philosophy Affects Provers � Soundness easier: literal formula, not instantiation mechanism � An axiom is one formula. Axiom schema is a decision algorithm. � Generic formula, not some shape with characterization of exceptions � No schema variable or meta variable algorithms � No matching mechanisms / unification in prover kernel � No side condition subtlety or occurrence pattern checks (per schema) × Need other means of instantiating axioms: uniform substitution (US) � US + renaming: isolate static semantics � US independent from axioms: modular logic vs. prover separation � More flexible by syntactic contextual equivalence × Extra proofs branches since instantiation is explicit proof step ∑ Net win for soundness since significantly simpler prover André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 22 / 24

Differential Dynamic Logic: Comparison Part I Part IV [:=] [ x := θ ] φ ( x ) ↔ φ ( θ ) [:=] [ x := c ] p ( x ) ↔ p ( c ) [?] [? χ ] φ ↔ ( χ → φ ) [?] [? q ] p ↔ ( q → p ) [ ∪ ] [ α ∪ β ] φ ↔ [ α ] φ ∧ [ β ] φ [ ∪ ] [ a ∪ b ] p (¯ x ) ↔ [ a ] p (¯ x ) ∧ [ b ] p (¯ x ) [;] [ a ; b ] p (¯ x ) ↔ [ a ][ b ] p (¯ [;] [ α ; β ] φ ↔ [ α ][ β ] φ x ) [ ∗ ] [ α ∗ ] φ ↔ φ ∧ [ α ][ α ∗ ] φ [ ∗ ] [ a ∗ ] p (¯ x ) ∧ [ a ][ a ∗ ] p (¯ x ) ↔ p (¯ x ) K [ a ]( p (¯ x ) → q (¯ x )) → ([ a ] p (¯ x ) → [ a ] q (¯ K [ α ]( φ → ψ ) → ([ α ] φ → [ α ] ψ ) x )) I [ α ∗ ] φ ↔ φ ∧ [ α ∗ ]( φ → [ α ] φ ) I [ a ∗ ] p (¯ x ) ∧ [ a ∗ ]( p (¯ x ) ↔ p (¯ x ) → [ a ] p (¯ x )) V φ → [ α ] φ V p → [ a ] p [ ′ ] [ x ′ = f ( x )] φ ↔ ∀ t ≥ 0 [ x := y ( t )] φ André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 23 / 24

Uniform Substitution for Differential Dynamic Logic differential dynamic logic φ [ α ] φ φ US α dL = DL + HP σ ( φ ) Uniform substitution � axioms not schemata KeYmaera X Modular: Logic � Prover Straightforward to implement Prover microkernel Sound & complete / ODE Fast contextual equivalence André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 24 / 24

Uniform Substitution of Rules and Proofs p (¯ x ) G [ a ] p (¯ x ) André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 25 / 24

Uniform Substitution of Rules and Proofs x 2 ≥ 0 p (¯ x ) G implies [ x := x + 1 ;( x ′ = x ∪ x ′ = − 2 )] x 2 ≥ 0 [ a ] p (¯ x ) (FV ( σ ) = / Theorem (Soundness) 0 ) φ 1 φ n σ ( φ 1 ) σ ( φ n ) ... ... locally sound implies locally sound ψ σ ( ψ ) André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 25 / 24

Uniform Substitution of Rules and Proofs x 2 ≥ 0 p (¯ x ) G implies [ x := x + 1 ;( x ′ = x ∪ x ′ = − 2 )] x 2 ≥ 0 [ a ] p (¯ x ) (FV ( σ ) = / Theorem (Soundness) 0 ) φ 1 φ n σ ( φ 1 ) σ ( φ n ) ... ... locally sound implies locally sound ψ σ ( ψ ) Locally sound The conclusion is valid in any interpretation I in which the premises are. André Platzer (CMU) LFCPS/18: Axioms & Uniform Substitutions LFCPS/18 25 / 24