[PPT] - 19: Game Proofs & Separations 15-424: Foundations of PowerPoint Presentation

SLIDE 1

19: Game Proofs & Separations

15-424: Foundations of Cyber-Physical Systems Andr´ e Platzer

aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 24

SLIDE 2

Outline

1

Learning Objectives

2

Hybrid Game Proofs Soundness Separations Soundness & Completeness Expressiveness Example Proofs

3

Differential Hybrid Games Syntax Example: Zeppelin Differential Game Invariants Example: Zeppelin Proof

4

Summary

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 2 / 24

SLIDE 3

Outline

1

Learning Objectives

2

Hybrid Game Proofs Soundness Separations Soundness & Completeness Expressiveness Example Proofs

3

Differential Hybrid Games Syntax Example: Zeppelin Differential Game Invariants Example: Zeppelin Proof

4

Summary

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 2 / 24

SLIDE 4

Learning Objectives

Game Proofs & Separations

CT M&C CPS rigorous reasoning for adversarial dynamics miracle of soundness power of completeness expressiveness separations axiomatization of dGL multi-dynamical systems game invariants discrete+adversarial continuous+adversarial multi-scale feedback

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 3 / 24

SLIDE 5

Differential Game Logic: Syntax

Definition (Hybrid game α)

x := e | ?Q | x′ = f (x) | α ∪ β | α; β | α∗ | αd

Definition (dGL Formula P)

p(e1, . . . , en) | e ≥ ˜ e | ¬P | P ∧ Q | ∀x P | ∃x P | αP | [α]P Discrete Assign Test Game Differential Equation Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Angel Wins Demon Wins TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 4 / 24

SLIDE 6

Differential Game Logic: Denotational Semantics

Definition (Hybrid game α) [ [·] ] : HG → (℘(S) → ℘(S))

ςx:=e(X) = {ω ∈ S : ω[

[e] ]ω x

∈ X} ςx′=f (x)(X) = {ϕ(0) ∈ S : ϕ(r) ∈ X, d ϕ(t)(x)

dt

(ζ) = [ [f (x)] ]ϕ(ζ) for all ζ} ς?Q(X) = [ [Q] ] ∩ X ςα∪β(X) = ςα(X) ∪ ςβ(X) ςα;β(X) = ςα(ςβ(X)) ςα∗(X) = {Z ⊆ S : X ∪ ςα(Z) ⊆ Z} ςαd(X) = (ςα(X ∁))∁

Definition (dGL Formula P) [ [·] ] : Fml → ℘(S)

[ [e1 ≥ e2] ] = {ω ∈ S : [ [e1] ]ω ≥ [ [e2] ]ω} [ [¬P] ] = ([ [P] ])∁ [ [P ∧ Q] ] = [ [P] ] ∩ [ [Q] ] [ [αP] ] = ςα([ [P] ]) [ [[α]P] ] = δα([ [P] ])

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 5 / 24

SLIDE 7

Differential Game Logic: Axiomatization

[·] [α]P ↔ ¬α¬P := x := ep(x) ↔ p(e) ′ x′ = f (x)P ↔ ∃t≥0 x := y(t)P ? ?QP ↔ (Q ∧ P) ∪ α ∪ βP ↔ αP ∨ βP ; α; βP ↔ αβP ∗ α∗P ↔ P ∨ αα∗P d αdP ↔ ¬α¬P M P → Q αP → αQ FP P ∨ αQ → Q α∗P → Q MP P P → Q Q ∀ p → Q p → ∀x Q (x ∈ FV(p)) US ϕ ϕψ(·)

p(·)

TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 6 / 24

SLIDE 8

Outline

1

Learning Objectives

2

Hybrid Game Proofs Soundness Separations Soundness & Completeness Expressiveness Example Proofs

3

Differential Hybrid Games Syntax Example: Zeppelin Differential Game Invariants Example: Zeppelin Proof

4

Summary

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 6 / 24

SLIDE 9

Differential Game Logic: Axiomatization

[·] [α]P ↔ ¬α¬P := x := ep(x) ↔ p(e) ′ x′ = f (x)P ↔ ∃t≥0 x := y(t)P ? ?QP ↔ (Q ∧ P) ∪ α ∪ βP ↔ αP ∨ βP ; α; βP ↔ αβP ∗ α∗P ↔ P ∨ αα∗P d αdP ↔ ¬α¬P M P → Q αP → αQ FP P ∨ αQ → Q α∗P → Q MP P P → Q Q ∀ p → Q p → ∀x Q (x ∈ FV(p)) US ϕ ϕψ(·)

p(·)

TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 7 / 24

SLIDE 10

Soundness

Theorem (Soundness)

dGL proof calculus is sound

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 8 / 24

SLIDE 11

Soundness

Theorem (Soundness)

dGL proof calculus is sound Do we have to prove anything at all?

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 8 / 24

SLIDE 12

More Axioms

K [α](P → Q) → ([α]P → [α]Q) M[·] P → Q [α]P → [α]Q ← − M α(P ∨ Q) → αP ∨ αQ M αP ∨ αQ → α(P ∨ Q) I [α∗](P → [α]P) → (P → [α∗]P) ∀I Cl∀ (P→[α]P) → (P→[α∗]P) B α∃x P → ∃x αP (x∈α) ← − B ∃x αP → α∃x P G P [α]P M[·] P → Q [α]P → [α]Q R P1 ∧ P2 → Q [α]P1 ∧ [α]P2 → [α]Q M[·] P1 ∧ P2 → Q [α](P1 ∧ P2) → [α]Q FA α∗P → P ∨ α∗(¬P ∧ αP)

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 9 / 24

SLIDE 13

More Axioms ???

K [α](P → Q) → ([α]P → [α]Q) M[·] P → Q [α]P → [α]Q ← − M α(P ∨ Q) → αP ∨ αQ M αP ∨ αQ → α(P ∨ Q) I [α∗](P → [α]P) → (P → [α∗]P) ∀I Cl∀ (P→[α]P) → (P→[α∗]P) B α∃x P → ∃x αP (x∈α) ← − B ∃x αP → α∃x P G P [α]P M[·] P → Q [α]P → [α]Q R P1 ∧ P2 → Q [α]P1 ∧ [α]P2 → [α]Q M[·] P1 ∧ P2 → Q [α](P1 ∧ P2) → [α]Q FA α∗P → P ∨ α∗(¬P ∧ αP)

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 9 / 24

SLIDE 14

Separating Axioms

Theorem (Axiomatic separation: hybrid systems vs. hybrid games)

Axiomatic separation is exactly K, I, C, B, V, G. dGL is a subregular, sub-Barcan, monotonic modal logic without loop induction axioms. K [α](P → Q) → ([α]P → [α]Q) M[·] P → Q [α]P → [α]Q ← − M α(P ∨ Q) → αP ∨ αQ M αP ∨ αQ → α(P ∨ Q) I [α∗](P → [α]P) → (P → [α∗]P) ∀I Cl∀ (P→[α]P) → (P→[α∗]P) B α∃x P → ∃x αP (x∈α) ← − B ∃x αP → α∃x P G P [α]P M[·] P → Q [α]P → [α]Q R P1 ∧ P2 → Q [α]P1 ∧ [α]P2 → [α]Q M[·] P1 ∧ P2 → Q [α](P1 ∧ P2) → [α]Q FA α∗P → P ∨ α∗(¬P ∧ αP)

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 9 / 24

SLIDE 15

Soundness

Theorem (Soundness)

dGL proof calculus is sound Do we have to prove anything at all?

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 10 / 24

SLIDE 16

Soundness

Theorem (Soundness)

dGL proof calculus is sound i.e. all provable formulas are valid Axiomatics Syntax Semantics

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 10 / 24

SLIDE 17

Soundness

Theorem (Soundness)

dGL proof calculus is sound i.e. all provable formulas are valid

Proof.

∪ α ∪ βP ↔ αP ∨ βP ; α; βP ↔ αβP [·] [α]P ↔ ¬α¬P M P → Q αP → αQ

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 10 / 24

SLIDE 18

Soundness

Theorem (Soundness)

dGL proof calculus is sound i.e. all provable formulas are valid

Proof.

∪ [ [α ∪ βP] ] = ςα∪β([ [P] ]) = ςα([ [P] ]) ∪ ςβ([ [P] ]) = [ [αP] ] ∪ [ [βP] ] = [ [αP ∨ βP] ] ∪ α ∪ βP ↔ αP ∨ βP ; [ [α; βP] ] = ςα;β([ [P] ]) = ςα(ςβ([ [P] ])) = ςα([ [βP] ]) = [ [αβP] ] ; α; βP ↔ αβP [·] is sound by determinacy [·] [α]P ↔ ¬α¬P M Assume the premise P → Q is valid, i.e. [ [P] ] ⊆ [ [Q] ]. Then the conclusion αP → αQ is valid, i.e. [ [αP] ] = ςα([ [P] ]) ⊆ ςα([ [Q] ]) = [ [αQ] ] by monotonicity. M P → Q αP → αQ

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 10 / 24

SLIDE 19

The Miracle of Soundness

Soundness links semantics and axiomatics in perfect unison! Compositional Soundness Soundness: If P provable then P valid ⊢ P implies P Conditio sine qua non for logic Every formula that it proves with any proof has to be valid. Fortunately, proofs are composed from axioms by proof rules. Sufficient:

1 All axioms are sound: valid formulas.

CADE’15

2 All proof rules are sound: take valid premises to valid conclusions.

Then Proof is a long combination of many simple arguments. Each individual step is a sound axiom or sound proof rule, so sound.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 11 / 24

SLIDE 20

The Miracle of Soundness

Soundness+Completeness links semantics and axiomatics in perfect unison! Compositional Soundness Soundness: If P provable then P valid ⊢ P implies P Conditio sine qua non for logic Every formula that it proves with any proof has to be valid. Fortunately, proofs are composed from axioms by proof rules. Sufficient:

1 All axioms are sound: valid formulas.

CADE’15

2 All proof rules are sound: take valid premises to valid conclusions.

Then Proof is a long combination of many simple arguments. Each individual step is a sound axiom or sound proof rule, so sound.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 11 / 24

SLIDE 21

Soundness & Completeness

Theorem (Completeness)

dGL calculus is a sound & complete axiomatization of hybrid games relative to any (differentially) expressive logic L. ϕ iff TautL ⊢ ϕ TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 12 / 24

SLIDE 22

Soundness & Completeness: Consequences

Corollary (Constructive)

Constructive and Moschovakis-coding-free. (Minimal: x′ = f (x), ∃, [α∗])

Remark (Coquand & Huet) (Inf.Comput’88)

Modal analogue for α∗ of characterizations in Calculus of Constructions

Corollary (Meyer & Halpern) (J.ACM’82)

F → αG semidecidable for uninterpreted programs.

Corollary (Schmitt) (Inf.Control.’84)

[α]-free semidecidable for uninterpreted programs.

Corollary

Uninterpreted game logic with even d in α is semidecidable.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 13 / 24

SLIDE 23

Soundness & Completeness: Consequences

Corollary

Harel’77 convergence rule unnecessary for hybrid games, hybrid systems, discrete programs.

Corollary (Characterization of hybrid game challenges)

[α∗]G: Succinct invariants discrete Π0

2

[x′ = f (x)]G and x′ = f (x)G: Succinct differential (in)variants ∆1

1

∃x G: Complexity depends on Herbrand disjunctions: discrete Π1

1

uninterpreted reals × ∃x [α∗]G Π1

1-complete for discrete α

Corollary (Hybrid version of Parikh’s result) (FOCS’83)

∗-free dGL complete relative to dL, relative to continuous, or to discrete d-free dGL complete relative to dL, relative to continuous, or to discrete

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 14 / 24

SLIDE 24

Expressiveness

Theorem (Expressive Power: hybrid systems < hybrid games)

dGL for hybrid games strictly more expressive than dL for hybrid games: dL < dGL “≤” For every dL formula ϕ there is a dGL formula ˜ ϕ that is equivalent. “≥” Not the other way around. TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 15 / 24

SLIDE 25

Expressiveness

Theorem (Expressive Power: hybrid systems < hybrid games)

dGL for hybrid games strictly more expressive than dL for hybrid games: dL < dGL “≤” For every dL formula ϕ there is a dGL formula ˜ ϕ that is equivalent. Easy: same formula where Angel plays for nondeterminism. “≥” Not the other way around. Hard: see proof. TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 15 / 24

SLIDE 26

Expressiveness

Theorem (Expressive Power: hybrid systems < hybrid games)

dGL for hybrid games strictly more expressive than dL for hybrid games: dL < dGL “≤” For every dL formula ϕ there is a dGL formula ˜ ϕ that is equivalent. Easy: same formula where Angel plays for nondeterminism. “≥” Not the other way around. Hard: see proof.

Corollary

Hybrid games are strictly more than hybrid systems. TOCL’15

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 15 / 24

SLIDE 27

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 28

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 29

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

US

∀x (0≤x<2∨αα∗0≤x<2 → α∗0≤x<2) → (true → α∗0≤x<2)

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 30

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

∪,d

∀x (0≤x<2 ∨ αp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<2∨αα∗0≤x<2 → α∗0≤x<2) → (true → α∗0≤x<2)

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 31

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

:=

∀x (0≤x<2 ∨ βp(x) ∧ γp(x) → p(x)) → (true → p(x))

∪,d

∀x (0≤x<2 ∨ αp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<2∨αα∗0≤x<2 → α∗0≤x<2) → (true → α∗0≤x<2)

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 32

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

R

∀x (0≤x<2 ∨ p(x − 1) ∧ p(x − 2) → p(x)) → (true → p(x))

:=

∀x (0≤x<2 ∨ βp(x) ∧ γp(x) → p(x)) → (true → p(x))

∪,d

∀x (0≤x<2 ∨ αp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<2∨αα∗0≤x<2 → α∗0≤x<2) → (true → α∗0≤x<2)

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 33

Example Proof: 2-Nim-type Game

x ≥ 0 → (x := x − 1

β

∩ x := x − 2

γ
α

)∗0 ≤ x < 2

Fixpoint style proof technique

∗

R

∀x (0≤x<2 ∨ p(x − 1) ∧ p(x − 2) → p(x)) → (true → p(x))

:=

∀x (0≤x<2 ∨ βp(x) ∧ γp(x) → p(x)) → (true → p(x))

∪,d

∀x (0≤x<2 ∨ αp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<2∨αα∗0≤x<2 → α∗0≤x<2) → (true → α∗0≤x<2)

∗,∀,MP

true → α∗0≤x<2

R

x ≥ 0 → α∗0≤x<2

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 16 / 24

SLIDE 34

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 35

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 36

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 37

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

;,d

∀x (0≤x<1 ∨ βp(x) ∨ γp(x) → p(x)) → (true → p(x))

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 38

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

′

∀x (0≤x<1 ∨ x := 1¬x′ = 1¬p(x) ∨ p(x−1) → p(x)) → (true → p(x))

;,d

∀x (0≤x<1 ∨ βp(x) ∨ γp(x) → p(x)) → (true → p(x))

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 39

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

:= ∀x (0≤x<1∨x := 1¬∃t≥0 x := x+t¬p(x)∨p(x−1)→p(x)) → (true→p(x)) ′

∀x (0≤x<1 ∨ x := 1¬x′ = 1¬p(x) ∨ p(x−1) → p(x)) → (true → p(x))

;,d

∀x (0≤x<1 ∨ βp(x) ∨ γp(x) → p(x)) → (true → p(x))

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 40

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

R

∀x (0≤x<1 ∨ ∀t≥0 p(1 + t) ∨ p(x − 1) → p(x)) → (true → p(x))

:= ∀x (0≤x<1∨x := 1¬∃t≥0 x := x+t¬p(x)∨p(x−1)→p(x)) → (true→p(x)) ′

∀x (0≤x<1 ∨ x := 1¬x′ = 1¬p(x) ∨ p(x−1) → p(x)) → (true → p(x))

;,d

∀x (0≤x<1 ∨ βp(x) ∨ γp(x) → p(x)) → (true → p(x))

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 41

Example Proof: Hybrid Game

(x := 1; x′ = 1d

β

∪ x := x − 1

γ

)

α

∗0 ≤ x < 1

Fixpoint style proof technique

∗

R

∀x (0≤x<1 ∨ ∀t≥0 p(1 + t) ∨ p(x − 1) → p(x)) → (true → p(x))

:= ∀x (0≤x<1∨x := 1¬∃t≥0 x := x+t¬p(x)∨p(x−1)→p(x)) → (true→p(x)) ′

∀x (0≤x<1 ∨ x := 1¬x′ = 1¬p(x) ∨ p(x−1) → p(x)) → (true → p(x))

;,d

∀x (0≤x<1 ∨ βp(x) ∨ γp(x) → p(x)) → (true → p(x))

∪

∀x (0≤x<1 ∨ β ∪ γp(x) → p(x)) → (true → p(x))

US

∀x (0≤x<1∨αα∗0≤x<1 → α∗0≤x<1) → (true → α∗0≤x<1)

∗

true → α∗0≤x<1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 42

Outline

1

Learning Objectives

2

Hybrid Game Proofs Soundness Separations Soundness & Completeness Expressiveness Example Proofs

3

Differential Hybrid Games Syntax Example: Zeppelin Differential Game Invariants Example: Zeppelin Proof

4

Summary

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 17 / 24

SLIDE 43

CPSs are Multi-Dynamical Systems

d i s c r e t e c

n

t i n u

u

s nondet stochastic a d v e r s a r i a l

CPS Dynamics

CPS are characterized by multiple facets of dynamical systems.

CPS Compositions

CPS combine multiple simple dynamical effects.

Tame Parts

Exploiting compositionality tames CPS complexity.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 18 / 24

SLIDE 44

Differential Game Logic: Syntax

Definition (Differential hybrid game α)

x := e | ?Q | x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z | α ∪ β | α; β | α∗ | αd

Definition (dGL Formula P)

e ≥ ˜ e | ¬P | P ∧ Q | ∀x P | ∃x P | αP | [α]P Discrete Assign Test Game Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Angel Wins Demon Wins arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 19 / 24

SLIDE 45

Differential Game Logic: Syntax

Definition (Differential hybrid game α)

x := e | ?Q | x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z | α ∪ β | α; β | α∗ | αd

Definition (dGL Formula P)

e ≥ ˜ e | ¬P | P ∧ Q | ∀x P | ∃x P | αP | [α]P Discrete Assign Test Game Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Angel Wins Demon Wins Differential Game arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 19 / 24

SLIDE 46

Differential Game Logic: Syntax

Definition (Differential hybrid game α)

x := e | ?Q | x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z | α ∪ β | α; β | α∗ | αd

Definition (dGL Formula P)

e ≥ ˜ e | ¬P | P ∧ Q | ∀x P | ∃x P | αP | [α]P Discrete Assign Test Game Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Angel Wins Demon Wins Differential Game Demon controls y ∈ Y Angel controls z ∈ Z Angel knows Demon’s y Angel controls duration arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 19 / 24

SLIDE 47

Zeppelin Obstacle Parcours

avoid obstacles changing wind local turbulence arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 20 / 24

SLIDE 48

Zeppelin Obstacle Parcours

avoid obstacles changing wind local turbulence arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 20 / 24

SLIDE 49

Zeppelin Obstacle Parcours

c > 0 ∧ x − o2 ≥ c2 →

v := ∗; o := ∗; c := ∗; ?C;

{x′ = v + py + rz&

dy ∈ B&z ∈ B}

∗ x − o2 ≥ c2 airship at x ∈ R2 propeller p controlled in any direction y ∈ B, i.e. y2

1 + y2 2 ≤ 1

× sporadically changing homogeneous wind field v ∈ R2 × sporadically changing obstacle o ∈ R2 of size c subject to C × continuously local turbulence of magnitude r in any direction z ∈ B

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 21 / 24

SLIDE 50

Zeppelin Obstacle Parcours

c > 0 ∧ x − o2 ≥ c2 →

v := ∗; o := ∗; c := ∗; ?C;

{x′ = v + py + rz&

dy ∈ B&z ∈ B}

∗ x − o2 ≥ c2 r > p p > v + r v + r > p > r airship at x ∈ R2 propeller p controlled in any direction y ∈ B, i.e. y2

1 + y2 2 ≤ 1

× sporadically changing homogeneous wind field v ∈ R2 × sporadically changing obstacle o ∈ R2 of size c subject to C × continuously local turbulence of magnitude r in any direction z ∈ B

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 21 / 24

SLIDE 51

Zeppelin Obstacle Parcours

c > 0 ∧ x − o2 ≥ c2 →

v := ∗; o := ∗; c := ∗; ?C;

{x′ = v + py + rz&

dy ∈ B&z ∈ B}

∗ x − o2 ≥ c2 × r > p hopeless p > v + r v + r > p > r airship at x ∈ R2 propeller p controlled in any direction y ∈ B, i.e. y2

1 + y2 2 ≤ 1

× sporadically changing homogeneous wind field v ∈ R2 × sporadically changing obstacle o ∈ R2 of size c subject to C × continuously local turbulence of magnitude r in any direction z ∈ B

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 21 / 24

SLIDE 52

Zeppelin Obstacle Parcours

c > 0 ∧ x − o2 ≥ c2 →

v := ∗; o := ∗; c := ∗; ?C;

{x′ = v + py + rz&

dy ∈ B&z ∈ B}

∗ x − o2 ≥ c2 × r > p hopeless p > v + r super-powered v + r > p > r airship at x ∈ R2 propeller p controlled in any direction y ∈ B, i.e. y2

1 + y2 2 ≤ 1

× sporadically changing homogeneous wind field v ∈ R2 × sporadically changing obstacle o ∈ R2 of size c subject to C × continuously local turbulence of magnitude r in any direction z ∈ B

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 21 / 24

SLIDE 53

Zeppelin Obstacle Parcours

c > 0 ∧ x − o2 ≥ c2 →

v := ∗; o := ∗; c := ∗; ?C;

{x′ = v + py + rz&

dy ∈ B&z ∈ B}

∗ x − o2 ≥ c2 × r > p hopeless p > v + r super-powered ? v + r > p > r our challenge airship at x ∈ R2 propeller p controlled in any direction y ∈ B, i.e. y2

1 + y2 2 ≤ 1

× sporadically changing homogeneous wind field v ∈ R2 × sporadically changing obstacle o ∈ R2 of size c subject to C × continuously local turbulence of magnitude r in any direction z ∈ B

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 21 / 24

SLIDE 54

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

[x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

¬ ¬F

F F

arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 55

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

[x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 56

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

[x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 57

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

[x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 58

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

∀u ∈ U ∃y ∈ Y ∀z ∈ Z ∃v ∈ V ∀x (f (x, y, z) = g(x, u, v)) [x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 59

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

∀u ∈ U ∃y ∈ Y ∀z ∈ Z ∃v ∈ V ∀x (f (x, y, z) = g(x, u, v)) [x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

DGI1≤x3 ⊢ [x′ = −1+2y+z& dy ∈ I&z ∈ I]1≤x3

where y ∈ I

def

≡ −1 ≤ y ≤ 1 arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 60

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

∀u ∈ U ∃y ∈ Y ∀z ∈ Z ∃v ∈ V ∀x (f (x, y, z) = g(x, u, v)) [x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

[′:=]

⊢ ∃y∈I ∀z∈I [x′:=−1+2y+z]0≤3x2x′

DGI1≤x3 ⊢ [x′ = −1+2y+z& dy ∈ I&z ∈ I]1≤x3

where y ∈ I

def

≡ −1 ≤ y ≤ 1 arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 61

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

∀u ∈ U ∃y ∈ Y ∀z ∈ Z ∃v ∈ V ∀x (f (x, y, z) = g(x, u, v)) [x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

R

⊢ ∃y∈I ∀z∈I 0 ≤ 3x2(−1+2y+z)

[′:=]

⊢ ∃y∈I ∀z∈I [x′:=−1+2y+z]0≤3x2x′

DGI1≤x3 ⊢ [x′ = −1+2y+z& dy ∈ I&z ∈ I]1≤x3

where y ∈ I

def

≡ −1 ≤ y ≤ 1 arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 62

Differential Game Invariants

Theorem (Differential Game Invariants)

DGI ∃y ∈ Y ∀z ∈ Z [x′:=f (x, y, z)](F)′ F → [x′ = f (x, y, z)&

dy ∈ Y &z ∈ Z]F

Theorem (Differential Game Refinement)

∀u ∈ U ∃y ∈ Y ∀z ∈ Z ∃v ∈ V ∀x (f (x, y, z) = g(x, u, v)) [x′ = g(x, u, v)&

du ∈ U&v ∈ V ]F → [x′ = f (x, y, z)& dy ∈ Y &z ∈ Z]F

F

¬F

∗

R

⊢ ∃y∈I ∀z∈I 0 ≤ 3x2(−1+2y+z)

[′:=]

⊢ ∃y∈I ∀z∈I [x′:=−1+2y+z]0≤3x2x′

DGI1≤x3 ⊢ [x′ = −1+2y+z& dy ∈ I&z ∈ I]1≤x3

where y ∈ I

def

≡ −1 ≤ y ≤ 1 arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 22 / 24

SLIDE 63

Zeppelin Obstacle Parcours

avoid obstacles changing wind local turbulence arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 23 / 24

SLIDE 64

Zeppelin Obstacle Parcours

avoid obstacles changing wind local turbulence arXiv

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 23 / 24

SLIDE 65

Outline

1

Learning Objectives

2

Hybrid Game Proofs Soundness Separations Soundness & Completeness Expressiveness Example Proofs

3

Differential Hybrid Games Syntax Example: Zeppelin Differential Game Invariants Example: Zeppelin Proof

4

Summary

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 23 / 24

SLIDE 66

Summary

differential game logic

dGL = GL + HG = dL + d

αϕ ϕ

Logic for hybrid games Compositional PL + logic Discrete + continuous + adversarial Winning region iteration ≥ωCK

1

Sound & rel. complete axiomatization Hybrid games > hybrid systems

d radical challenge yet smooth extension

d i s c r e t e c

n

t i n u

u

s nondet stochastic a d v e r s a r i a l

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 24 / 24

SLIDE 67

Outline

5

Convergence for Repetitive Diamonds

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 0 / 1

SLIDE 68

Proving Repetitive Diamonds by Convergence

con Γ ⊢ α∗Q, ∆

x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 69

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆

x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 70

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 71

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R

x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 72

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R con x≥0 ⊢ ∃n x<n+1

x<n+2 ∧ n+1>0 ⊢ x := x−1x<n+1 ∃n≤0 x<n+1 ⊢ x<1 x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 73

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R con

R

∗ x≥0 ⊢ ∃n x<n+1 x<n+2 ∧ n+1>0 ⊢ x := x−1x<n+1 ∃n≤0 x<n+1 ⊢ x<1 x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 74

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R con

R

∗ x≥0 ⊢ ∃n x<n+1

:=

x<n+2 ∧ n+1>0 ⊢ x−1<n+1 x<n+2 ∧ n+1>0 ⊢ x := x−1x<n+1 ∃n≤0 x<n+1 ⊢ x<1 x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 75

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R con

R

∗ x≥0 ⊢ ∃n x<n+1

:=

R

∗ x<n+2 ∧ n+1>0 ⊢ x−1<n+1 x<n+2 ∧ n+1>0 ⊢ x := x−1x<n+1 ∃n≤0 x<n+1 ⊢ x<1 x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 76

Proving Repetitive Diamonds by Convergence

con Γ ⊢ ∃v p(v), ∆ ∀v>0 (p(v) → αp(v − 1)) ∃v≤0 p(v) ⊢ Q Γ ⊢ α∗Q, ∆ v ∈ α

→R con

R

∗ x≥0 ⊢ ∃n x<n+1

:=

R

∗ x<n+2 ∧ n+1>0 ⊢ x−1<n+1 x<n+2 ∧ n+1>0 ⊢ x := x−1x<n+1

R

∗ ∃n≤0 x<n+1 ⊢ x<1 x ≥ 0 ⊢ (x := x − 1)∗x < 1 x ≥ 0 → (x := x − 1)∗x < 1

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 77

Andr´ e Platzer. Foundations of cyber-physical systems. Lecture Notes 15-424/624, Carnegie Mellon University, 2016. URL: http://www.cs.cmu.edu/~aplatzer/course/fcps16.html. Andr´ e Platzer. Differential game logic. ACM Trans. Comput. Log., 17(1):1:1–1:51, 2015. doi:10.1145/2817824. Andr´ e Platzer. Differential hybrid games. CoRR, abs/1507.04943, 2015. arXiv:1507.04943. Andr´ e Platzer. Logics of dynamical systems. In LICS, pages 13–24. IEEE, 2012. doi:10.1109/LICS.2012.13. Andr´ e Platzer.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1

SLIDE 78

Differential dynamic logic for hybrid systems.

J. Autom. Reas., 41(2):143–189, 2008.

doi:10.1007/s10817-008-9103-8. Andr´ e Platzer. A uniform substitution calculus for differential dynamic logic. In Amy Felty and Aart Middeldorp, editors, CADE, volume 9195 of LNCS, pages 467–481. Springer, 2015. doi:10.1007/978-3-319-21401-6_32.

Andr´ e Platzer (CMU) FCPS / 19: Game Proofs & Separations 1 / 1