Refactoring, Refinement, and Reasoning A Logical Characterization - PowerPoint PPT Presentation

Introduction Refactoring Refactoring Operations Conclusion Refactoring, Refinement, and Reasoning A Logical Characterization for Hybrid Systems Stefan Mitsch 1 , 2 Jan-David Quesel 1 e Platzer 1 Andr´ 1 Computer Science Department, Carnegie Mellon University 2 Cooperative Information Systems, Johannes Kepler University May 14, 2014 Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 1 of 14

Introduction Refactoring Refactoring Operations Conclusion Hybrid Systems 3.5 3.0 Hybrid Systems are Challenging 2.5 2.0 1.5 ◮ Computation + Physical behavior 1.0 0.5 ◮ Sensor uncertainty 0.0 0 1 2 3 4 6 5 ◮ Disturbance ◮ Computation delay ◮ Many components a 1.0 v p 0.2 8 0.8 10 t 2 4 6 8 6 0.6 � 0.2 p x 4 0.4 � 0.4 � 0.6 0.2 2 p y � 0.8 10 t 10 t 2 4 6 8 2 4 6 8 Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 2 of 14

Introduction Refactoring Refactoring Operations Conclusion Hybrid Systems 3.5 3.0 Hybrid Systems are Challenging 2.5 2.0 1.5 ◮ Computation + Physical behavior 1.0 Challenge 0.5 ◮ Sensor uncertainty 0.0 0 1 2 3 4 6 Hybrid systems are almost impossible to get right 5 ◮ Disturbance without proper analysis ◮ Computation delay � Formal verification ◮ Many components a 1.0 v p 0.2 8 0.8 10 t 2 4 6 8 6 0.6 � 0.2 p x 4 0.4 � 0.4 � 0.6 0.2 2 p y � 0.8 10 t 10 t 2 4 6 8 2 4 6 8 Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 2 of 14

Introduction Refactoring Refactoring Operations Conclusion Formal Verification model Hybrid System Theorem Proving model α β α β γ ◮ Symbolic execution of model ◮ Model structure reflected in proof proof proof ◮ Correctness properties Safety Always stay safe γ α Liveness Ultimately complete α a task β β β Our Tools KeYmaera Hybrid systems theorem prover S ϕ nx Hybrid systems modeling Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 3 of 14

Introduction Refactoring Refactoring Operations Conclusion Iterative Development Hybrid Systems Theorem Proving is Challenging ◮ Differential equations ◮ Complicated arithmetic Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 4 of 14

Introduction Refactoring Refactoring Operations Conclusion Iterative Development Hybrid Systems Theorem Proving is Challenging ◮ Differential equations ◮ Complicated arithmetic model α β Manage complexity proof ◮ Start simple — verify α β Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 4 of 14

Introduction Refactoring Refactoring Operations Conclusion Iterative Development Hybrid Systems Theorem Proving is Challenging ◮ Differential equations ◮ Complicated arithmetic model model α β α β γ Manage complexity proof proof ◮ Start simple — verify ◮ Improve — verify — repeat γ α α β β β Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 4 of 14

Introduction Refactoring Refactoring Operations Conclusion Iterative Development Hybrid Systems Theorem Proving is Challenging ◮ Differential equations ◮ Complicated arithmetic model Challenge model α β Proof-aware refactoring α β γ Manage complexity instead of reverification on every change (retain soundness without redoing the proof) proof proof ◮ Start simple — verify ◮ Improve — verify — repeat γ α α β β β Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 4 of 14

Introduction Refactoring Refactoring Operations Conclusion Proof-aware Refactoring Refactoring Operation ◮ Transforms a source model into a refactored model ◮ Syntactic rewriting rule For example conditions α ; β � ( α ∪ γ ); β source refactored α β α β γ Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 5 of 14

Introduction Refactoring Refactoring Operations Conclusion How to Retain Soundness Structural Refactoring Always retains soundness model β model α α β γ γ β proof proof ≡ γ γ α α β β β β Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 6 of 14

Introduction Refactoring Refactoring Operations Conclusion How to Retain Soundness Structural Refactoring Behavioral Refactoring Always retains soundness Proof patch retains soundness model β model model α model α β α β α β γ γ γ β proof proof proof proof ≡ patch γ γ γ α α α α β β β β β β β Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 6 of 14

Introduction Refactoring Refactoring Operations Conclusion Patching Necessity by Correctness Property Add Behavior model model α β ⊑ V α β γ safety safety patch liveness liveness reuse Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 7 of 14

Introduction Refactoring Refactoring Operations Conclusion Patching Necessity by Correctness Property Add Behavior Remove Behavior model model model model α β α β ⊑ V ⊒ V α β α β γ γ safety safety safety safety patch reuse liveness liveness liveness liveness reuse patch Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 7 of 14

Introduction Refactoring Refactoring Operations Conclusion Patching Necessity by Correctness Property Add Behavior Remove Behavior Projective Relational Refinement model model α ⊑ V γ iff ρ ( α ) | V ⊆ ρ ( γ ) | V model model α β α β ⊑ V ⊒ V α β α β γ γ ρ ( α ) reachability relation of α α, γ hybrid systems models safety safety safety safety patch V ⊆ Σ relevant set of variables reuse | V projection of relations or states to the variables in V liveness liveness liveness liveness reuse patch Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 7 of 14

Introduction Refactoring Refactoring Operations Conclusion Sound Refactoring Catalog Structural Refactorings Behavioral Refactorings ◮ Extract Common Program ◮ Introduce Control Path ◮ Extract Continuous ◮ Introduce Complementary Dynamics Continuous Dynamics ◮ Drop Implied Evolution ◮ Event- to Time-Triggered Domain Constraint Architecture Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 8 of 14

Introduction Refactoring Refactoring Operations Conclusion Extract Common Program Motivation Reduce model duplication Mechanics (R1) ( α ; γ ) ∪ ( β ; γ ) � ( α ∪ β ); γ γ α α extract (R1) γ γ β β Variation Inline program (R2) ( α ∪ β ); γ � ( α ; γ ) ∪ ( β ; γ ) Proof patch Safety None Liveness None Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 9 of 14

Introduction Refactoring Refactoring Operations Conclusion Introduce Control Path Motivation Add control decisions Mechanics (R3) α ; β � ( α ∪ γ ); β β α β introduce (R3) α γ Variation Remove Control Path (R4) ( α ∪ γ ); β � α ; β Proof patch Safety Prove safety of the added branch Liveness None Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 10 of 14

Introduction Refactoring Refactoring Operations Conclusion Event- to Time-Triggered Architecture Motivation Derive a time-triggered controller α ; ( x ′ = θ & F ∧ ψ ) � (?[ α ; c := 0; η ] ψ ; α ); c := 0; η Mechanics (R5) Event γ ≡ ( x ′ 1 = θ 1 , . . . , x ′ n = θ n & F ∧ ψ ) α β ∗ event- to time-triggered (R5) η ≡ ( x ′ 1 = θ 1 , . . . , x ′ n = θ n , � � c ′ = 1 & F ∧ c ≤ ε ) ? [ α ; c := 0; η ] ψ c := 0 α � � β ? [ β ; c := 0; η ] ψ ∗ Clock Proof Patch Safety Composes several refactorings + prove safety of derived tests Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 11 of 14

Introduction Refactoring Refactoring Operations Conclusion Summary Benefits of Proof-aware Refactorings ◮ easier to evolve correct systems ◮ easier to get simple systems correct ◮ still want to handle complex systems, but not pay the price of reverification ◮ co-evolve model and proof Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 12 of 14

Introduction Refactoring Refactoring Operations Conclusion Future Work Refactoring Catalog Theory ◮ Pull and merge tests ◮ Liveness proof patches ◮ Weaken/strengthen test ◮ Distance measurement ◮ Switch sequence ◮ Refinement based on games ◮ Introduce computation delay ◮ Introduce uncertainty Implementation ◮ Introduce disturbance ◮ S ϕ nx and KeYmaera ◮ Change norm (2/ ∞ norm) ◮ Background proving ◮ . . . Stefan Mitsch , Jan-David Quesel, Andr´ e Platzer CMU,JKU Refactoring, Refinement, and Reasoning 13 of 14