ModelPlex: Verified Runtime Validation of Verified Cyber-Physical - PowerPoint PPT Presentation

ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models Stefan Mitsch Andr´ e Platzer Computer Science Department, Carnegie Mellon University RV’14, Sept. 24, 2014 Simplex for Hybrid System Models Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 1 of 15

Formal Verification in CPS Development Real CPS safe Proof Reachability Analysis . . . Verification Results Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

Formal Verification in CPS Development Real CPS safe abstract Model α ∗ Proof Control α ctrl v := v + 1 Reachability safe sense Analysis act . . . Plant α plant x ′ = v Verification Results Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

Formal Verification in CPS Development Real CPS safe Challenge Verification results about models abstract only apply if CPS fits to the model Model α ∗ � Verifiably correct runtime model validation Proof Control α ctrl v := v + 1 Reachability safe sense Analysis act . . . Plant α plant x ′ = v Verification Results Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

ModelPlex Runtime Model Validation ModelPlex ensures that verification results about models apply to CPS implementations predict turn plant Model α ctrl i − 1 i +1 i . . . model adequate? control safe? until next cycle? Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 3 of 15

ModelPlex Runtime Model Validation ModelPlex ensures that verification results about models apply to CPS implementations Contributions predict turn Verification results transfer to CPS when validating model compliance Compliance with model is characterizable in logic Compliance formula transformed by proof to plant Model α ctrl i − 1 i +1 i executable monitor . . . model adequate? control safe? until next cycle? Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 3 of 15

ModelPlex at Runtime . . . “Simplex for Models” Controller Sensors Actuators Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 4 of 15

ModelPlex at Runtime . . . “Simplex for Models” Controller ModelPlex Compliance Fallback Monitor Sensors Actuators Compliance Monitor Checks CPS for compliance with model at runtime Model Monitor: model adequate? Controller Monitor: control safe? Prediction Monitor: until next cycle? Fallback Safe action, executed when monitor is not satisfied Challenge What conditions do the monitors need to check to be safe? Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 4 of 15

ModelPlex Approach . . . Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states observation observation observation CPS . . . ⊆ ⊆ Model Model α Model α . . . i − 1 i +1 i time Detect non-compliance as soon as possible to initiate safe fallback actions Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

ModelPlex Approach . . . Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states observation observation observation CPS . . . fits to ⊆ ⊆ Model Model α Model α . . . i − 1 i +1 i time Detect non-compliance as soon as possible to initiate safe fallback actions Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

ModelPlex Approach . . . Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states observation observation observation Challenge CPS Model describes behavior, . . . fits to but at runtime we get sampled observations � Transform model into observation-monitor ⊆ ⊆ Model Model α Model α . . . i − 1 i +1 i time Detect non-compliance as soon as possible to initiate safe fallback actions Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

Outline predict turn plant Model α ctrl i − 1 i +1 i . . . Model Monitor Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 6 of 15

Monitor Characterization . . . When are two states linked through a run of model α ? ⊆ Model α i − 1 i Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

Monitor Characterization . . . When are two states linked through a run of model α ? a prior state char- a posterior state ⊆ acterized by x − characterized by x + Model α i − 1 i ( x − , x + ) ∈ ρ ( α ) reachability relation of α Semantical: Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

Monitor Characterization . . . When are two states linked through a run of model α ? a prior state char- a posterior state ⊆ acterized by x − characterized by x + Model α i − 1 i Offline starting at x = x − ( x − , x + ) ∈ ρ ( α ) Semantical: exists a run of α to a � Theorem state where x = x + ( x = x − ) → � α ( x ) � ( x = x + ) Logic (d L ): Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

Monitor Characterization . . . When are two states linked through a run of model α ? a prior state char- a posterior state ⊆ acterized by x − characterized by x + Model α i − 1 i Offline starting at x = x − ( x − , x + ) ∈ ρ ( α ) Semantical: exists a run of α to a � Theorem state where x = x + ( x = x − ) → � α ( x ) � ( x = x + ) Logic (d L ): � d L proof F ( x − , x + ) Real arithmetic: check at runtime (efficient) Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

Monitor Characterization . . . When are two states linked through a run of model α ? a prior state char- a posterior state ⊆ acterized by x − characterized by x + Model α i − 1 i Offline starting at x = x − ( x − , x + ) ∈ ρ ( α ) Semantical: exists a run of α to a � Theorem state where x = x + ( x = x − ) → � α ( x ) � ( x = x + ) Logic (d L ): ⇑ d L proof F ( x − , x + ) Real arithmetic: check at runtime (efficient) Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

Provably Correct Synthesis of Monitors . . . Proof calculus of d L executes models symbolically Model α prior state x − posterior state x + i − 1 i proof attempt ( x = x − ) → � α ( x ) � ( x = x + ) Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

Provably Correct Synthesis of Monitors . . . Proof calculus of d L executes models symbolically Model α climb prior state x − posterior state x + i − 1 i descend proof attempt ( x = x − ) → � climb ∪ descend � ( x = x + ) �∪�� climb � φ ∨ � descend � φ � climb ∪ descend � φ Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

Provably Correct Synthesis of Monitors . . . Proof calculus of d L executes models symbolically Model α climb prior state x − posterior state x + i − 1 i descend proof attempt ( x = x − ) → � climb ∪ descend � ( x = x + ) ∨ � climb � ( x = x + ) � descend � ( x = x + ) Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

Provably Correct Synthesis of Monitors . . . Proof calculus of d L executes models symbolically Model α climb prior state x − posterior state x + i − 1 i descend proof attempt ( x = x − ) → � climb ∪ descend � ( x = x + ) ∨ � climb � ( x = x + ) � descend � ( x = x + ) F 1 ( x − , x + ) F 2 ( x − , x + ) Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

Provably Correct Synthesis of Monitors . . . Proof calculus of d L executes models symbolically Model α climb prior state x − posterior state x + i − 1 i descend proof attempt ( x = x − ) → � climb ∪ descend � ( x = x + ) ∨ � climb � ( x = x + ) � descend � ( x = x + ) F 1 ( x − , x + ) F 2 ( x − , x + ) F 1 ( x − , x + ) ∨ F 2 ( x − , x + ) Monitor: The subgoals that cannot be proved express all the conditions on the relations of variables imposed by the model � execute at runtime Stefan Mitsch , Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15