Combining Deduction and Algebraic Constraints for Hybrid System - - PowerPoint PPT Presentation

▶
combining deduction and algebraic constraints for hybrid
SMART_READER_LITE
LIVE PREVIEW

Combining Deduction and Algebraic Constraints for Hybrid System - - PowerPoint PPT Presentation

Aug 14, 2023 367 likes •977 views

Combining Deduction and Algebraic Constraints for Hybrid System Analysis Andr e Platzer University of Oldenburg, Department of Computing Science, Germany Verify07 at CADE07 Andr e Platzer (University of Oldenburg) Combining

slide-1
SLIDE 1

Combining Deduction and Algebraic Constraints for Hybrid System Analysis

Andr´ e Platzer

University of Oldenburg, Department of Computing Science, Germany

Verify’07 at CADE’07

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 1 / 23

slide-2
SLIDE 2

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 1 / 23

slide-3
SLIDE 3

Deductively Verifying Hybrid Systems

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-4
SLIDE 4

Deductively Verifying Hybrid Systems

Hybrid Systems

continuous evolution along differential equations + discrete change

t z v

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-5
SLIDE 5

Deductively Verifying Hybrid Systems

Hybrid Systems

continuous evolution along differential equations + discrete change Standard paradigm: model checking HyTech, CheckMate, PHAVer, . . . find bugs Verification is difficult, because of

numerical issues, numerical approximation termination of abstraction refinement unbounded regions Parameter SB = 10000?

t z v

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-6
SLIDE 6

Deductively Verifying Hybrid Systems

Hybrid Systems

continuous evolution along differential equations + discrete change

differential dynamic logic

dL = DL + HP

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-7
SLIDE 7

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-8
SLIDE 8

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 2 / 23

slide-9
SLIDE 9

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition)

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 3 / 23

slide-10
SLIDE 10

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition) ETCS ≡ (ctrl ; drive)∗ ctrl ≡ (?MA − z ≤ SB; a := −b) ∪ (?MA − z ≥ SB; a := . . .) drive ≡ z′′ = a

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 3 / 23

slide-11
SLIDE 11

Differential Logic dL: Syntax

Definition (Formulas φ)

¬, ∧, ∨, →, ∀x , ∃x , =, ≤, +, · (R-first-order part) [α]φ, αφ (dynamic part) ψ → [(ctrl ; drive)∗] z ≤ MA All trains respect MA ⇒ system safe

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 3 / 23

slide-12
SLIDE 12

Differential Logic dL: Semantics

Definition (Formulas φ)

v [α]φ φ φ φ α-transitions

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 4 / 23

slide-13
SLIDE 13

Differential Logic dL: Semantics

Definition (Formulas φ)

v αφ φ α-transitions

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 4 / 23

slide-14
SLIDE 14

Verification Calculus for Differential Logic dL

Dynamic Rules

11 dynamic rules (D1) φ ∧ ψ ?φψ (D2) φ → ψ [?φ]ψ (D3) αφ ∨ βφ α ∪ βφ (D4) [α]φ ∧ [β]φ [α ∪ β]φ (D5) φ ∨ α; α∗φ α∗φ (D6) φ ∧ [α; α∗]φ [α∗]φ (D7) αβφ α; βφ (D8) φθ

x

x := θφ (D9) ∃t≥0 (¯ χ ∧ x := yx x′ = θ & χφ (D10) ∀t≥0 (¯ χ → [x := y [x′ = θ & χ]φ (D11) ⊢ p ⊢ [α∗](p → [α]p) ⊢ [α∗]p

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 5 / 23

slide-15
SLIDE 15

Verification Calculus for dL

Propositional/Quantifier Rules

9 propositional rules + 4 quantifier rules (P1) ⊢ φ ¬φ ⊢ (P2) φ ⊢ ⊢ ¬φ (P3) φ ⊢ ψ ⊢ φ → ψ (P4) φ, ψ ⊢ φ ∧ ψ ⊢ (P5) ⊢ φ ⊢ ψ ⊢ φ ∧ ψ (P6) ⊢ φ ψ ⊢ φ → ψ ⊢ (P7) φ ⊢ ψ ⊢ φ ∨ ψ ⊢ (P8) ⊢ φ, ψ ⊢ φ ∨ ψ (P9) φ ⊢ φ (F1) QE(∃x

i(Γi ⊢ ∆i))

Γ ⊢ ∆, ∃x φ (F2) QE(∀x

i(Γi ⊢ ∆i))

Γ, ∃x φ ⊢ ∆ (F3) QE(∀x

i(Γi ⊢ ∆i))

Γ ⊢ ∆, ∀x φ (F4) QE(∃x

i(Γi ⊢ ∆i))

Γ, ∀x φ ⊢ ∆

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 6 / 23

slide-16
SLIDE 16

Concise Theory! But End of the Story?

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 6 / 23

slide-17
SLIDE 17

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 6 / 23

slide-18
SLIDE 18

Analysing European Train Control System (ETCS)

ψ → [(ctrl ; drive)∗] z ≤ MA ctrl ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a := 0) drive ≡ τ := 0; z′ = v, v ′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 7 / 23

slide-19
SLIDE 19

Analysing European Train Control System (ETCS)

provable automatically using invariant!

ψ → [(ctrl ; drive)∗] z ≤ MA ctrl ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a := 0) drive ≡ τ := 0; z′ = v, v ′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [ctrl][drive]p p⊢ [ctrl ; drive]p Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 7 / 23

slide-20
SLIDE 20

Full European Train Control System (ETCS)

system :

  • poll; (negot ∪ (speedControl; atp; move))

∗ init : drive := 0; brake := 1 poll : SB := v2−d2

2b

+ amax

b

+ 1 amax

2 ε2 + εv

  • ; ST := ∗

negot : (?m − z > ST) ∪ (?m − z ≤ ST; rbc) rbc : (vdes := ∗; ?vdes > 0) ∪ (state := brake) ∪

  • dold := d; mold := m; m := ∗; d := ∗;

?d ≥ 0 ∧ d2

  • ld − d2 ≤ 2b(m − mold)
  • speedCtrl

: (?state = brake; a := −b) ∪

  • ?state = drive;
  • (?v ≤ vdes; a := ∗; ? − b ≤ a ≤ amax)

∪(?v ≥ vdes; a := ∗; ?0 > a ≥ − b)

  • atp

: (?m − z ≤ SB; a := −b) ∪ (?m − z > SB) move : t := 0; {˙ z = v, ˙ v = a, ˙ t = 1, (v ≥ 0 ∧ t ≤ ε)}

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 8 / 23

slide-21
SLIDE 21

Full European Train Control System (ETCS)

not provable automatically! 52 user interactions! system :

  • poll; (negot ∪ (speedControl; atp; move))

∗ init : drive := 0; brake := 1 poll : SB := v2−d2

2b

+ amax

b

+ 1 amax

2 ε2 + εv

  • ; ST := ∗

negot : (?m − z > ST) ∪ (?m − z ≤ ST; rbc) rbc : (vdes := ∗; ?vdes > 0) ∪ (state := brake) ∪

  • dold := d; mold := m; m := ∗; d := ∗;

?d ≥ 0 ∧ d2

  • ld − d2 ≤ 2b(m − mold)
  • speedCtrl

: (?state = brake; a := −b) ∪

  • ?state = drive;
  • (?v ≤ vdes; a := amax)

∪(?v ≥ vdes; a := − b)

  • atp

: (?m − z ≤ SB; a := −b) ∪ (?m − z > SB) move : t := 0; {˙ z = v, ˙ v = a, ˙ t = 1, (v ≥ 0 ∧ t ≤ ε)}

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 8 / 23

slide-22
SLIDE 22

Full European Train Control System (ETCS)

state = 0, 2 * b * (m - z) >= v ^ 2 - d ^ 2, v >= 0, d >= 0, v >= 0, ep > 0, b > 0, amax > 0, d >= 0 ==> v <= vdes

  • > \forall R a_3;

( a_3 >= 0 & a_3 <= amax

  • >

( m - z <= (amax / b + 1) * ep * v + (v ^ 2 - d ^ 2) / (2 * b) + (amax / b + 1) * amax * ep ^ 2 / 2

  • > \forall R t0;

( t0 >= 0

  • > \forall R ts0;

(0 <= ts0 & ts0 <= t0 -> -b * ts0 + v >= 0 & ts0 + 0 <= ep)

  • >

2 * b * (m - 1 / 2 * (-b * t0 ^ 2 + 2 * t0 * v + 2 * z)) >= (-b * t0 + v) ^ 2

  • d ^ 2

& -b * t0 + v >= 0 & d >= 0)) & ( m - z > (amax / b + 1) * ep * v + (v ^ 2 - d ^ 2) / (2 * b) + (amax / b + 1) * amax * ep ^ 2 / 2

  • > \forall R t2;

( t2 >= 0

  • > \forall R ts2;

(0 <= ts2 & ts2 <= t2 -> a_3 * ts2 + v >= 0 & ts2 + 0 <= ep)

  • >

2 * b * (m - 1 / 2 * (a_3 * t2 ^ 2 + 2 * t2 * v + 2 * z)) >= (a_3 * t2 + v) ^ 2

  • d ^ 2

& a_3 * t2 + v >= 0 & d >= 0))) Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 10 / 23

slide-23
SLIDE 23

Practice Seems Disturbingly Bad!

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 10 / 23

slide-24
SLIDE 24

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 10 / 23

slide-25
SLIDE 25

Modular Combination of Provers

ψ ⊢ [α]φ Deductive Prover QE(Φ) Φ R-Algebraic Elimination

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 11 / 23

slide-26
SLIDE 26

Modular Combination of Provers

ψ ⊢ [α]φ Deductive Prover QE(Φ) Φ R-Algebraic Elimination key

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 11 / 23

slide-27
SLIDE 27

Modular Combination of Provers

ψ ⊢ [α]φ Deductive Prover QE(Φ) Φ R-Algebraic Elimination key QE(key)

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 11 / 23

slide-28
SLIDE 28

Tableaux Procedure for dL

while tableaux T has open branches do B := selectBranch (T) (∗ B−nondeterminism ∗) M := selectMode (B) (∗ M−nondeterminism ∗) F := s e l e c t F o r m u l a s (B,M) (∗ F−nondeterminism ∗) i f M = foreground then B2 := r e s u l t

  • f

applying a D −r u l e

  • r P−r u l e

to F i r e p l a c e B by B2 in T else send key F to background d e c i s i o n procedure QE receive r e s u l t R from QE apply a r u l e F3−F4 to T with QE−r e s u l t R end i f end while

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 13 / 23

slide-29
SLIDE 29

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-30
SLIDE 30

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M B branch selection

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-31
SLIDE 31

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M M mode selection

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-32
SLIDE 32

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M F formula selection

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-33
SLIDE 33

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M no nondeterminism from closing substitutions

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-34
SLIDE 34

Tableaux Procedure for dL: Nondeterminisms

ψ ⊢ [α]φ F M B Deductive Prover QE(Φ) Φ R-Algebraic Elimination M uninterpreted FOL interpreted dL uninterpreted symbols interpreted symbols close by substitution close by arithmetic close needs backtracking equivalent QE elimination closing is cheap arithmetic is O(22n)

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 14 / 23

slide-35
SLIDE 35

Nondeterminisms in Branch Selection

harmless because no closing substitutions ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 15 / 23

slide-36
SLIDE 36

Nondeterminisms in Formula Selection

In principle: simple Φ closes ⇒ Ψ ⊇ Φ closes ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 16 / 23

slide-37
SLIDE 37

Nondeterminisms in Formula Selection

In principle: simple Φ closes ⇒ Ψ ⊇ Φ closes In practice: irrelevant formulas distract QE considerably Partially necessary ETCS constraint: SB ≥ v2 2b + a b + 1 a 2ε2 + εv

  • ψ ⊢ [α]φ

F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 16 / 23

slide-38
SLIDE 38

Nondeterminisms in Formula Selection

In principle: simple Φ closes ⇒ Ψ ⊇ Φ closes In practice: irrelevant formulas distract QE considerably ψ ⊢ [α]φ F M B M t > 0, a + 1/tv ≥ 0, ε ≥ t, t ≥ 0, m − z ≥ v2/(2b) + (a/b + 1)(a/2ε2 + εv), 2b(m − z) ≥ v2, v ≥ 0, 2b(m − z0) ≥ v2

0 , v0 ≥ 0,

ε ≥ 0, b > 0, a ≥ 0 ⊢ (at + v)2 ≤ 2b(m − 1/2(at2 + 2tv + 2z)) ≫ 24h

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 16 / 23

slide-39
SLIDE 39

Nondeterminisms in Formula Selection

In principle: simple Φ closes ⇒ Ψ ⊇ Φ closes In practice: irrelevant formulas distract QE considerably ψ ⊢ [α]φ F M B M t > 0, a + 1/tv ≥ 0, ε ≥ t, t ≥ 0, m − z ≥ v2/(2b) + (a/b + 1)(a/2ε2 + εv), 2b(m − z) ≥ v2, v ≥ 0, 2b(m − z0) ≥ v2

0 , v0 ≥ 0,

(initial state) ε ≥ 0, b > 0, a ≥ 0 ⊢ (at + v)2 ≤ 2b(m − 1/2(at2 + 2tv + 2z)) ≫ 24h

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 16 / 23

slide-40
SLIDE 40

Nondeterminisms in Formula Selection

In principle: simple Φ closes ⇒ Ψ ⊇ Φ closes In practice: irrelevant formulas distract QE considerably ψ ⊢ [α]φ F M B M t > 0, a + 1/tv ≥ 0, ε ≥ t, t ≥ 0, m − z ≥ v2/(2b) + (a/b + 1)(a/2ε2 + εv), 2b(m − z) ≥ v2, v ≥ 0, ε ≥ 0, b > 0, a ≥ 0 ⊢ (at + v)2 ≤ 2b(m − 1/2(at2 + 2tv + 2z)) ≪ 1s

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 16 / 23

slide-41
SLIDE 41

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-42
SLIDE 42

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-43
SLIDE 43

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-44
SLIDE 44

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate ψ ⊢ [α]φ F M B M eager: infeasible

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-45
SLIDE 45

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate ψ ⊢ [α]φ F M B M eager: infeasible lazy: waste

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-46
SLIDE 46

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate ψ ⊢ [α]φ F M B M eager: infeasible lazy: waste

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-47
SLIDE 47

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate Syntactic representational redundancy ψ ⊢ [α]φ F M B M ψ ⊢ v2 ≤ 2b(m − z) ψ ⊢ (z ≥ 0 → v ≤ 0) ψ ⊢ v2 ≤ 2b(m − z) ∧ (z ≥ 0 → v ≤ 0) redundant duplication or case distinction improvement?

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-48
SLIDE 48

Nondeterminisms in Mode Selection

In principle: only background closure, anything could close In practice: some QE “never” terminate Syntactic representational redundancy Semantic representational redundancy ψ ⊢ [α]φ F M B M ⊢ b ≥ v2/(2m − 2z) ∨ m ≤ z z < m ⊢ v2 ≤ 2b(m − z) valid “reduction” but perfectly useless ( ⇒ proof loops)

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-49
SLIDE 49

How to Navigate among Nondeterminisms?

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 17 / 23

slide-50
SLIDE 50

Proof Strategy Priorities for Formula Selection

“accept QE if variable eliminated” ensures progress and termination

1 arithmetic rules if variable eliminated 2 propositional rules P1–P4, P8–P9 on

modalities

3 dynamic rules 4 splitting rules P5–P7 on modalities 5 arithmetic rules if variable eliminated 6 propositional rules P1–P9 on first-order

formulas ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 18 / 23

slide-51
SLIDE 51

Iterative Background Closure (IBC) Strategy

1 2 2 4 4 8 8 16 16 16 ∗ ∗

background timeout 1 2 4 8 16 ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 19 / 23

slide-52
SLIDE 52

Iterative Background Closure (IBC) Strategy

1 2 2 4 4 8 8 16 16 16 ∗ ∗

background timeout 1 2 4 8 16 Periodical background arithmetic with increasing timeout after split Avoid splitting in average case Split prohibitively complicated cases ψ ⊢ [α]φ F M B M

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 19 / 23

slide-53
SLIDE 53

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 19 / 23

slide-54
SLIDE 54

Full European Train Control System

system :

  • poll; (negot ∪ (speedControl; atp; move))

∗ init : drive := 0; brake := 1 poll : SB := v2−d2

2b

+ amax

b

+ 1 amax

2 ε2 + εv

  • ; ST := ∗

negot : (?m − z > ST) ∪ (?m − z ≤ ST; rbc) rbc : (vdes := ∗; ?vdes > 0) ∪ (state := brake) ∪

  • dold := d; mold := m; m := ∗; d := ∗;

?d ≥ 0 ∧ d2

  • ld − d2 ≤ 2b(m − mold)
  • speedCtrl

: (?state = brake; a := −b) ∪

  • ?state = drive;
  • (?v ≤ vdes; a := ∗; ? − b ≤ a ≤ amax)

∪(?v ≥ vdes; a := ∗; ?0 > a ≥ − b)

  • atp

: (?m − z ≤ SB; a := −b) ∪ (?m − z > SB) move : t := 0; {˙ z = v, ˙ v = a, ˙ t = 1, (v ≥ 0 ∧ t ≤ ε)}

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 20 / 23

slide-55
SLIDE 55

Full European Train Control System

provable automatically with IBC!

  • nly 1 ≪ 52 user interaction + reduced verification time!

system :

  • poll; (negot ∪ (speedControl; atp; move))

∗ init : drive := 0; brake := 1 poll : SB := v2−d2

2b

+ amax

b

+ 1 amax

2 ε2 + εv

  • ; ST := ∗

negot : (?m − z > ST) ∪ (?m − z ≤ ST; rbc) rbc : (vdes := ∗; ?vdes > 0) ∪ (state := brake) ∪

  • dold := d; mold := m; m := ∗; d := ∗;

?d ≥ 0 ∧ d2

  • ld − d2 ≤ 2b(m − mold)
  • speedCtrl

: (?state = brake; a := −b) ∪

  • ?state = drive;
  • (?v ≤ vdes; a := amax)

∪(?v ≥ vdes; a := − b)

  • atp

: (?m − z ≤ SB; a := −b) ∪ (?m − z > SB) move : t := 0; {˙ z = v, ˙ v = a, ˙ t = 1, (v ≥ 0 ∧ t ≤ ε)}

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 20 / 23

slide-56
SLIDE 56

Preliminary Experimental Results

Case Study Interactions IBC No IBC ETCS-binary 1 89s >8h ETCS-binary 2 <89s 1184s ETCS-binary 3 <89s 30s ETCS 1 3000s ∞ ETCS 2 500s ∞ ETCS 10 427s ETCS-optimal 2 >3h ∞ ETCS-binary 1 89s ETCS 1 1381s ETCS 2 271s Water tank 1 4.7s

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 21 / 23

slide-57
SLIDE 57

Outline

1

Motivation

2

Differential Logic dL Syntax Semantics Verification Calculus

3

Analysis of the European Train Control System

4

Combining Deduction and Algebraic Constraints Nondeterminisms in Branch Selection Nondeterminisms in Formula Selection Nondeterminisms in Mode Selection Iterative Background Closure Strategy

5

Experimental Results

6

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 21 / 23

slide-58
SLIDE 58

Future Work

More experimental evaluation

More examples (currently: 4) Effect of strategy variations

Guide variable selection

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 22 / 23

slide-59
SLIDE 59

Conclusions

differential dynamic logic

dL = DL + HP Deductively verify hybrid systems Practical perspective Surprisingly challenging nondeterminism Tremendous impact of Iterative Background Closure (IBC) Train control (ETCS) verification Verification tool HyKeY

Andr´ e Platzer (University of Oldenburg) Combining Deduction & Algebraic Constraints / Hybrid Systems Verify’07 23 / 23