Cyber-Physical Systems Verification with KeYmaera X Andr Platzer - - PowerPoint PPT Presentation

▶
cyber physical systems verification with keymaera x
SMART_READER_LITE
LIVE PREVIEW

Cyber-Physical Systems Verification with KeYmaera X Andr Platzer - - PowerPoint PPT Presentation

Nov 21, 2022 142 likes •911 views

Cyber-Physical Systems Verification with KeYmaera X Andr Platzer Andr Platzer Logical Foundations of Cyber-Physical Systems Andr Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS20 1 / 25 Outline

slide-1
SLIDE 1

Cyber-Physical Systems Verification with KeYmaera X

André Platzer Logical Foundations of Cyber-Physical Systems

André Platzer

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 1 / 25

slide-2
SLIDE 2

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 1 / 25

slide-3
SLIDE 3

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 1 / 25

slide-4
SLIDE 4

Cyber-Physical Systems Safety

Prospects: Safety & Efficiency

(Autonomous) cars Pilot support Robots near humans

Cyber-Physical Systems

CPSs combine cyber capabilities with physical capabilities to solve problems that neither part could solve alone.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-5
SLIDE 5

Cyber-Physical Systems Safety

Prospects: Safety & Efficiency

(Autonomous) cars Pilot support Robots near humans

Cyber-Physical Systems

CPSs combine cyber capabilities with physical capabilities to solve problems that neither part could solve alone.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-6
SLIDE 6

Cyber-Physical Systems Safety

Prospects: Safety & Efficiency

(Autonomous) cars Pilot support Robots near humans

Cyber-Physical Systems

CPSs combine cyber capabilities with physical capabilities to solve problems that neither part could solve alone.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-7
SLIDE 7

Cyber-Physical Systems Safety

Prospects: Safety & Efficiency

(Autonomous) cars Pilot support Robots near humans

Cyber-Physical Systems

CPSs combine cyber capabilities with physical capabilities to solve problems that neither part could solve alone.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-8
SLIDE 8

Cyber-Physical Systems Safety

Prospects: Safety & Efficiency

(Autonomous) cars Pilot support Robots near humans

Cyber-Physical Systems

CPSs combine cyber capabilities with physical capabilities to solve problems that neither part could solve alone.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-9
SLIDE 9

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 2 / 25

slide-10
SLIDE 10

Approach: Proofs for Cyber-Physical Systems KeYmaera X

generates proofs actions: {acc,brake} motion: x′′ = a CPS Model Safety Compliance Monitor Model Proof and invariant search ModelPlex proof synthesizes Monitor transfers safety

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 3 / 25

slide-11
SLIDE 11

CPS Analysis

Concept (Differential Dynamic Logic) (JAR’08,LICS’12) [α]ϕ ϕ α [ ]x = m

x = m x = m x = m

1 2 3 4 5 6 7 t 2.5 2.0 1.5 1.0 0.5 0.0 0.5a 1 2 3 4 5 6 7 t 2 2 4 6v

m

1 2 3 4 5 6 7 t 2 2 4 6 8 10

x

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 4 / 25

slide-12
SLIDE 12

CPS Analysis

Concept (Differential Dynamic Logic) (JAR’08,LICS’12) [α]ϕ ϕ α [ ]x = m

x = m x = m x = m

  • (if(SB(x,m))

a:=−b) ; x′ = v,v′ = a

∗

x = m

post

1 2 3 4 5 6 7 t 2.5 2.0 1.5 1.0 0.5 0.0 0.5a 1 2 3 4 5 6 7 t 2 2 4 6v

m

1 2 3 4 5 6 7 t 2 2 4 6 8 10

x

all runs

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 4 / 25

slide-13
SLIDE 13

CPS Analysis

Concept (Differential Dynamic Logic) (JAR’08,LICS’12) [α]ϕ ϕ α [ ]x = m

x = m x = m x = m x = m ∧ b > 0

  • init

→

  • (if(SB(x,m))

a:=−b) ; x′ = v,v′ = a

∗

x = m

post

1 2 3 4 5 6 7 t 2.5 2.0 1.5 1.0 0.5 0.0 0.5a 1 2 3 4 5 6 7 t 2 2 4 6v

m

1 2 3 4 5 6 7 t 2 2 4 6 8 10

x

all runs

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 4 / 25

slide-14
SLIDE 14

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP dL P → [α]Q Hoare {P}α {Q}

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-15
SLIDE 15

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP Not And Or Imply All reals Some real All runs Some runs

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-16
SLIDE 16

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω

P P P

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-17
SLIDE 17

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω [α]P

P P P dL P → [α]Q Hoare {P}α {Q}

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-18
SLIDE 18

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω αP

P

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-19
SLIDE 19

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω

P P P

α-span [α]P

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-20
SLIDE 20

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω

P P P

α-span [α]P βP β-span

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-21
SLIDE 21

Differential Dynamic Logic dL

Definition (Hybrid program) α,β ::= x := e | ?Q | x′ = f(x)&Q | α ∪β | α;β | α∗

x Q r

′

z x′ = f(x)

ω µ ν α ;β α β ω ω1 ω2 ν α∗ α α α ω ν1 ν2 α β α ∪β Definition (Differential dynamic logic)

P,Q ::= e ≥ ˜ e | ¬P | P ∧ Q | P ∨ Q | P → Q | ∀x P | ∃x P | [α]P | αP

ω

P P P

α-span [α]P βP β-span β[α]-span

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 5 / 25

slide-22
SLIDE 22

Differential Dynamic Logic: Axiomatization

[:=] [x := e]P(x) ↔ P(e) [?] [?Q]P ↔ (Q → P) [′] [x′ = f(x)]P ↔ ∀t≥0[x := y(t)]P

(y′(t) = f(y))

[∪] [α ∪β]P ↔ [α]P ∧[β]P [;] [α;β]P ↔ [α][β]P [∗] [α∗]P ↔ P ∧[α][α∗]P

K [α](P → Q) → ([α]P → [α]Q) I [α∗]P ↔ P ∧[α∗](P → [α]P) C [α∗]∀v>0(P(v) → αP(v−1)) → ∀v (P(v) → α∗∃v≤0P(v)) equations of truth LICS’12,JAR’17

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 6 / 25

slide-23
SLIDE 23

Completeness for Differential Equation Invariants

LICS’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 7 / 25

slide-24
SLIDE 24

Differential Equation Axiomatization

Theorem (Algebraic Completeness) (LICS’18)

dL calculus is a sound & complete axiomatization of algebraic invariants of polynomial differential equations. They are decidable by DI,DC,DG

Theorem (Semialgebraic Completeness) (LICS’18)

dL calculus with RI is a sound & complete axiomatization of semialgebraic invariants of differential equations. They are decidable in dL

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 8 / 25

slide-25
SLIDE 25

Differential Equation Axiomatization

Theorem (Algebraic Completeness) (LICS’18)

dL calculus is a sound & complete axiomatization of algebraic invariants of polynomial differential equations. They are decidable with a derived axiom (on open Q for completeness): DRI [x′ = f(x)&Q]p = 0 ↔

  • Q → p·(∗) = 0
  • Theorem (Semialgebraic Completeness)

(LICS’18)

dL calculus with RI is a sound & complete axiomatization of semialgebraic invariants of differential equations. They are decidable with derived axiom SAI ∀x (P → [x′ = f(x)]P) ↔ ∀x

  • P → P·(∗)

∧∀x

  • ¬P → (¬P)·(−∗)

Definable p·(∗) is short for all/significant Lie derivative w.r.t. ODE Definable p·(−∗) is w.r.t. backwards ODE. Also for DNF P.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 8 / 25

slide-26
SLIDE 26

Differential Invariants for Differential Equations

Differential Invariant Q ⊢ [x′ := f(x)](P)′ P ⊢ [x′ = f(x)&Q]P

x w u r x′ = f(x) & Q P w Q

Differential Cut P ⊢ [x′ = f(x)&Q]C P ⊢ [x′ = f(x)&Q∧C]P P ⊢ [x′ = f(x)&Q]P

x Q w u r x′ = f(x) & Q C w Q

Differential Ghost P ↔ ∃y G G ⊢ [x′ = f(x),y′ = g(x,y)&Q]G P ⊢ [x′ = f(x)&Q]P

x Q w u r x′ = f(x) & Q

deductive power added DI ≺ DI+DC ≺ DI+DC+DG

ω[ [(e)′] ] = ∑

x

ω(x′)∂[ [e] ] ∂x (ω)

JLogComput’10,LMCS’12, LICS’12,JAR’17,LICS’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 10 / 25

slide-27
SLIDE 27

Differential Invariants for Differential Equations

Differential Invariant Q ⊢ [x′ := f(x)](P)′ P ⊢ [x′ = f(x)&Q]P

x w u r x′ = f(x) & Q P w Q

Differential Cut P ⊢ [x′ = f(x)&Q]C P ⊢ [x′ = f(x)&Q∧C]P P ⊢ [x′ = f(x)&Q]P

x Q w u r x′ = f(x) & Q C w Q

Differential Ghost P ↔ ∃y G G ⊢ [x′ = f(x),y′ = g(x,y)&Q]G P ⊢ [x′ = f(x)&Q]P

x Q w u r x′ = f(x) & Q

if g(x,y) = a(x)y + b(x), so has long solution!

JLogComput’10,LMCS’12, LICS’12,JAR’17,LICS’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 10 / 25

slide-28
SLIDE 28

Ex: Runaround Robot

(x,y) (v,w) ω

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 11 / 25

slide-29
SLIDE 29

Ex: Runaround Robot

(x,y) (v,w) ω

Example ( Runaround Robot)

  • (ω :=−1∪ω := 1∪ω := 0);

{x′ = v,y′ = w,v′ = ωw,w′ = −ωv} ∗

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 11 / 25

slide-30
SLIDE 30

Ex: Runaround Robot

(x,y) (v,w) ω

Example ( Runaround Robot) (x,y) = o →

  • (ω :=−1∪ω := 1∪ω := 0);

{x′ = v,y′ = w,v′ = ωw,w′ = −ωv} ∗ (x,y) = o

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 11 / 25

slide-31
SLIDE 31

Ex: Runaround Robot

(x,y) (v,w) ω

Example ( Runaround Robot) (x,y) = o →

  • (?Q−1;ω :=−1∪?Q1;ω := 1∪?Q0;ω := 0);

{x′ = v,y′ = w,v′ = ωw,w′ = −ωv} ∗ (x,y) = o

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 11 / 25

slide-32
SLIDE 32

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 11 / 25

slide-33
SLIDE 33

Approach: Proofs for Cyber-Physical Systems KeYmaera X

generates proofs actions: {acc,brake} motion: x′′ = a CPS Model Safety Compliance Monitor Model Proof and invariant search ModelPlex proof synthesizes Monitor transfers safety

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 12 / 25

slide-34
SLIDE 34

Formal Verification in CPS Development

Real CPS Proof Reachability Analysis . . . Verification Results safe

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 13 / 25

slide-35
SLIDE 35

Formal Verification in CPS Development

Real CPS Model α∗ Control αctrl v := v + 1 Plant αplant x′ = v sense act abstract Proof Reachability Analysis . . . Verification Results safe safe

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 13 / 25

slide-36
SLIDE 36

Formal Verification in CPS Development

Real CPS Model α∗ Control αctrl v := v + 1 Plant αplant x′ = v sense act abstract Proof Reachability Analysis . . . Verification Results safe safe Challenge Verification results about models

  • nly apply if CPS fits to the model

Verifiably correct runtime model validation

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 13 / 25

slide-37
SLIDE 37

ModelPlex Runtime Model Validation

ModelPlex ensures that verification results about models apply to CPS implementations i−1 i i+1 Model α ctrl plant . . . model adequate? control safe? until next cycle? turn predict FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 14 / 25

slide-38
SLIDE 38

ModelPlex Runtime Model Validation

ModelPlex ensures that verification results about models apply to CPS implementations i−1 i i+1 Model α ctrl plant . . . model adequate? control safe? until next cycle? turn predict Insights Verification results about models transfer to CPS when validating model compliance Compliance with model is characterizable in logic Compliance formula transformed by proof to monitor Correct-by-construction provably correct model validation at runtime FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 14 / 25

slide-39
SLIDE 39

Characterizing State Relations in Logic

When are two states linked through a run of model α?

ω ν

a prior state char- acterized by x− a posterior state characterized by x+ Model α

⊆ (ω,ν) ∈ [ [α] ]

Semantical: reachability relation of α FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-40
SLIDE 40

Characterizing State Relations in Logic

When are two states linked through a run of model α?

ω ν

a prior state char- acterized by x− a posterior state characterized by x+ Model α

⊆

Offline

(ω,ν) ∈ [ [α] ]

Semantical:

Lemma (ω,ν) | = α(x = x+)

Logical dL: exists a run of α to a state where x = x+ FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-41
SLIDE 41

Characterizing State Relations in Logic

When are two states linked through a run of model α?

ω ν

a prior state char- acterized by x− a posterior state characterized by x+ Model α

⊆

Offline

(ω,ν) ∈ [ [α] ]

Semantical:

Lemma (ω,ν) | = α(x = x+)

Logical dL: exists a run of α to a state where x = x+

  • (ω,ν) |

= F(x−,x+)

Arithmetical: dL proof check at runtime (efficient) FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-42
SLIDE 42

Characterizing State Relations in Logic

When are two states linked through a run of model α?

ω ν

a prior state char- acterized by x− a posterior state characterized by x+ Model α

⊆

Offline

(ω,ν) ∈ [ [α] ]

Semantical:

Lemma (ω,ν) | = α(x = x+)

Logical dL: exists a run of α to a state where x = x+

⇑ (ω,ν) | = F(x−,x+)

Arithmetical: dL proof check at runtime (efficient) FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-43
SLIDE 43

Logical Reductions for Model Safety Transfer

Logic reduces CPS safety to runtime monitor with offline proof

ω ν

dL proof A → [α]S Init ω ∈ [

[A] ]

Safe ν ∈ [

[S] ]

Model α

⊆

Offline

(ω,ν) ∈ [ [α] ]

Semantical:

Lemma (ω,ν) | = α(x = x+)

Logical dL:

⇑ (ω,ν) | = F(x−,x+)

Arithmetical: dL proof check at runtime (efficient) FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-44
SLIDE 44

Logical Reductions for Model Safety Transfer

Logic reduces CPS safety to runtime monitor with offline proof

ω ν

dL proof A → [α]S Init ω ∈ [

[A] ]

Safe ν ∈ [

[S] ]

Model α

⊆

Offline

(ω,ν) ∈ [ [α] ]

Semantical:

Lemma (ω,ν) | = α(x = x+)

Logical dL:

⇑ (ω,ν) | = F(x−,x+)

Arithmetical: dL proof check at runtime (efficient) FMSD’16

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-45
SLIDE 45

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 15 / 25

slide-46
SLIDE 46

Approach: Proofs for Cyber-Physical Systems KeYmaera X

generates proofs actions: {acc,brake} motion: x′′ = a CPS Model Safety Compliance Monitor Model Proof and invariant search ModelPlex proof synthesizes Monitor transfers safety

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 16 / 25

slide-47
SLIDE 47

VeriPhy: Automatic, Verified EXEs from Controllers

PLDI’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 17 / 25

slide-48
SLIDE 48

VeriPhy: Automatic, Verified EXEs from Controllers

PLDI’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 17 / 25

slide-49
SLIDE 49

VeriPhy: Automatic, Verified EXEs from Controllers

PLDI’18

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 17 / 25

slide-50
SLIDE 50

VeriPhy: Takeaway Metaphor

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 18 / 25

slide-51
SLIDE 51

VeriPhy: Takeaway Metaphor

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 18 / 25

slide-52
SLIDE 52

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 18 / 25

slide-53
SLIDE 53

Airborne Collision Avoidance System ACAS X: Verify

Developed by the FAA to replace current TCAS in aircraft Approximately optimizes Markov Decision Process on a grid Advisory from lookup tables with numerous 5D interpolation regions

1 1 2 3 4 5 6

delay δ

case7 case8 case9

1

Identified safe region for each advisory symbolically

2

Proved safety for hybrid systems flight model in KeYmaera X STTT’17

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 19 / 25

slide-54
SLIDE 54

Airborne Collision Avoidance System ACAS X: Compare

ACAS X table comparison shows safe advisory in 97.7% of the 648,591,384,375 states compared (15,160,434,734 counterexamples). ACAS X issues DNC advisory, which induces collision unless corrected STTT’17

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 20 / 25

slide-55
SLIDE 55

Airborne Collision Avoidance System ACAS X: Refine

Conservative, so too many counterexamples Settle for: safe for a little while, with safe future advisory possibility Safeable advisory: a subsequent advisory can safely avoid collision

initial upper 1 lower 1 strengthening reversal

ε

1

Identified safeable region for each advisory symbolically

2

Proved safety for hybrid systems flight model in KeYmaera X STTT’17

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 21 / 25

slide-56
SLIDE 56

Learning to Act in a CPS

act

  • bserve

Reinforcement Learning learns from experience of trying actions AAAI’18,TACAS’19

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-57
SLIDE 57

Learning to Act in a CPS

  • bserve

accel∪ brake RL chooses an action, observes outcome, reinforces in policy if successful AAAI’18,TACAS’19

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-58
SLIDE 58

Learning to Act Safely in a CPS

  • bserve

accel∪ brake

accel accel

ModelPlex monitor inspects each decision, vetoes if unsafe AAAI’18,TACAS’19

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-59
SLIDE 59

Learning to Act Safely in a CPS

  • bserve

accel∪ brake

∪ br

brak

ModelPlex monitor gives early feedback about possible future problems. No need to wait till disaster strikes and propagate back. AAAI’18,TACAS’19

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-60
SLIDE 60

Learning to Act Safely in a CPS

  • bserve

accel∪ brake

accel∪ accel∪ br

dL benefits from RL optimization. RL benefits from dL safety signal. AAAI’18,TACAS’19

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-61
SLIDE 61

Outline

1

Cyber-Physical Systems

2

Foundation: Differential Dynamic Logic

3

ModelPlex: Model Safety Transfer

4

VeriPhy: Executable Proof Transfer

5

Applications Airborne Collision Avoidance System Safe Learning in CPS

6

Summary

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 22 / 25

slide-62
SLIDE 62

Acknowledgments

Logical Systems Lab at Carnegie Mellon University, Computer Science Yong Kiam Tan, Brandon Bohrer, Nathan Fulton, Sarah Loos, Katherine Cordwell Stefan Mitsch, Khalil Ghorbal, Jean-Baptiste Jeannin, Andrew Sogokon

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 23 / 25

slide-63
SLIDE 63

Cyber-Physical Systems Verification with KeYmaera X

differential dynamic logic

dL = DL+ HP

Logical Foundations of Cyber-Physical Systems

André Platzer

Compositional formal verification Logic & proofs for CPS Small soundness core Proof by pointing Interactive proof clicking Tactical proof programming Proof search automation Flexible + modular API KeYmaera X

http://keymaeraX.org/

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 24 / 25

slide-64
SLIDE 64

Further CPS Topics

Verified CPS systems by ModelPlex FMSD’16 Verified CPS execution by VeriPhy PLDI’18 CPS proof and tactic languages+libraries ITP’17 Big CPS built from safe components STTT’18 Stochastic hybrid systems CADE’11 Invariant generation FM’19 Safe AI autonomy in CPS AAAI’18 TACAS’19 Correct model transformation FM’14 Refinement + system property proofs LICS’16 Automatic ODE proofs LICS’18 CPS information flow LICS’18 Hybrid games TOCL ’15 CPSs deserve proofs as safety evidence!

d i s c r e t e c

  • n

t i n u

  • u

s nondet stochastic a d v e r s a r i a l

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 25 / 25

slide-65
SLIDE 65
  • A. Platzer. Logical Foundations of Cyber-Physical Systems. Springer 2018

I Part: Elementary Cyber-Physical Systems

  • 2. Differential Equations & Domains
  • 3. Choice & Control
  • 4. Safety & Contracts
  • 5. Dynamical Systems & Dynamic Axioms
  • 6. Truth & Proof
  • 7. Control Loops & Invariants
  • 8. Events & Responses
  • 9. Reactions & Delays

II Part: Differential Equations Analysis

  • 10. Differential Equations & Differential Invariants
  • 11. Differential Equations & Proofs
  • 12. Ghosts & Differential Ghosts
  • 13. Differential Invariants & Proof Theory

III Part: Adversarial Cyber-Physical Systems 14-17. Hybrid Systems & Hybrid Games IV Part: Comprehensive CPS Correctness

Logical Foundations of Cyber-Physical Systems

André Platzer

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 26 / 25

slide-66
SLIDE 66

KeYmaera X Microkernel for Soundness 1 700 LOC

25,000 50,000 75,000 100,000 KeYmaera X KeYmaera KeY Nuprl MetaPRL Isabelle/Pure Coq HOL Light PHAVer HSolver SpaceEx Cora Flow* dReal HyCreate2

1,652

Disclaimer: Self-reported estimates of the soundness-critical lines of code + rules

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 27 / 25

slide-67
SLIDE 67

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σ(φ)

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible)

US

[a∪ b]p(¯

x) ↔ [a]p(¯ x)∧[b]p(¯ x)

[x := x + 1∪ x′ = 1]x ≥ 0 ↔ [x := x + 1]x ≥ 0∧[x′ = 1]x ≥ 0

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 28 / 25

slide-68
SLIDE 68

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σ(φ)

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible)

[v := f]p(v) ↔ p(f) [v :=−x][x′ = v]x ≥ 0 ↔ [x′ = −x]x ≥ 0

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 28 / 25

slide-69
SLIDE 69

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σ(φ)

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible) If you bind a free variable, you go to logic jail! Modular interface: Prover vs. Logic

[v := f]p(v) ↔ p(f) [v :=−x][x′ = v]x ≥ 0 ↔ [x′ = −x]x ≥ 0

Clash

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 28 / 25

slide-70
SLIDE 70

Differential Dynamic Logic dL: Semantics

Definition (Hybrid program semantics) ([

[·] ] : HP →℘(S ×S ))

[ [x := e] ] = {(ω,ν) : ν = ω except ν[ [x] ] = ω[ [e] ]} [ [?Q] ] = {(ω,ω) : ω ∈ [ [Q] ]} [ [x′ = f(x)] ] = {(ϕ(0),ϕ(r)) : ϕ | = x′ = f(x) for some duration r} [ [α ∪β] ] = [ [α] ] ∪[ [β] ] [ [α;β] ] = [ [α] ] ◦[ [β] ] [ [α∗] ] = [ [α] ]∗ =

  • n∈N

[ [αn] ] Definition (dL semantics) ([

[·] ] : Fml →℘(S ))

[ [e ≥ ˜

e]

] = {ω : ω[ [e] ] ≥ ω[ [˜

e]

]} [ [¬P] ] = [ [P] ]∁ [ [P ∧ Q] ] = [ [P] ]∩[ [Q] ] [ [αP] ] = [ [α] ] ◦[ [P] ] = {ω : ν ∈ [ [P] ] for someν : (ω,ν) ∈ [ [α] ]} [ [[α]P] ] = [ [¬α¬P] ] = {ω : ν ∈ [ [P] ] for all ν : (ω,ν) ∈ [ [α] ]} [ [∃x P] ] = {ω : ωr

x ∈ [

[P] ] for some r ∈ R}

compositional semantics

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-71
SLIDE 71

André Platzer. Logical Foundations of Cyber-Physical Systems. Springer, Cham, 2018. URL: http://www.springer.com/978-3-319-63587-3,

doi:10.1007/978-3-319-63588-0.

André Platzer. Differential dynamic logic for hybrid systems.

  • J. Autom. Reas., 41(2):143–189, 2008.

doi:10.1007/s10817-008-9103-8.

André Platzer. Logics of dynamical systems. In LICS [19], pages 13–24.

doi:10.1109/LICS.2012.13.

André Platzer. A complete uniform substitution calculus for differential dynamic logic.

  • J. Autom. Reas., 59(2):219–265, 2017.

doi:10.1007/s10817-016-9385-1.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-72
SLIDE 72

André Platzer. The complete proof theory of hybrid systems. In LICS [19], pages 541–550.

doi:10.1109/LICS.2012.64.

André Platzer and Yong Kiam Tan. Differential equation axiomatization: The impressive power of differential ghosts. In Anuj Dawar and Erich Grädel, editors, LICS, pages 819–828, New York, 2018. ACM.

doi:10.1145/3209108.3209147.

André Platzer. Differential-algebraic dynamic logic for differential-algebraic programs.

  • J. Log. Comput., 20(1):309–352, 2010.

doi:10.1093/logcom/exn070.

André Platzer and Edmund M. Clarke. Computing differential invariants of hybrid systems as fixedpoints.

  • Form. Methods Syst. Des., 35(1):98–120, 2009.

Special issue for selected papers from CAV’08.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-73
SLIDE 73

doi:10.1007/s10703-009-0079-8.

André Platzer. The structure of differential invariants and differential cut elimination.

  • Log. Meth. Comput. Sci., 8(4:16):1–38, 2012.

doi:10.2168/LMCS-8(4:16)2012.

André Platzer. A differential operator approach to equational differential invariants. In Lennart Beringer and Amy Felty, editors, ITP, volume 7406 of LNCS, pages 28–48, Berlin, 2012. Springer.

doi:10.1007/978-3-642-32347-8_3.

Stefan Mitsch and André Platzer. ModelPlex: Verified runtime validation of verified cyber-physical system models.

  • Form. Methods Syst. Des., 49(1-2):33–74, 2016.

Special issue of selected papers from RV’14.

doi:10.1007/s10703-016-0241-z.

Jean-Baptiste Jeannin, Khalil Ghorbal, Yanni Kouskoulas, Aurora Schmidt, Ryan Gardner, Stefan Mitsch, and André Platzer.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-74
SLIDE 74

A formally verified hybrid system for safe advisories in the next-generation airborne collision avoidance system. STTT, 19(6):717–741, 2017.

doi:10.1007/s10009-016-0434-1.

Nathan Fulton and André Platzer. Safe reinforcement learning via formal methods: Toward safe control through proof and learning. In Sheila A. McIlraith and Kilian Q. Weinberger, editors, AAAI, pages 6485–6492. AAAI Press, 2018. URL: https://www.aaai.org/ocs/index.php/AAAI/

AAAI18/paper/view/17376.

Nathan Fulton and André Platzer. Verifiably safe off-model reinforcement learning. In Tomas Vojnar and Lijun Zhang, editors, TACAS, Part I, volume 11427

  • f LNCS, pages 413–430. Springer, 2019.

doi:10.1007/978-3-030-17462-0_28.

André Platzer.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-75
SLIDE 75

Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics. Springer, Heidelberg, 2010. URL: http://www.springer.com/978-3-642-14508-7,

doi:10.1007/978-3-642-14509-4.

Nathan Fulton, Stefan Mitsch, Brandon Bohrer, and André Platzer. Bellerophon: Tactical theorem proving for hybrid systems. In Mauricio Ayala-Rincón and César A. Muñoz, editors, ITP, volume 10499 of LNCS, pages 207–224. Springer, 2017.

doi:10.1007/978-3-319-66107-0_14.

André Platzer. Stochastic differential dynamic logic for stochastic hybrid programs. In Nikolaj Bjørner and Viorica Sofronie-Stokkermans, editors, CADE, volume 6803 of LNCS, pages 446–460, Berlin, 2011. Springer.

doi:10.1007/978-3-642-22438-6_34.

André Platzer. Differential game logic. ACM Trans. Comput. Log., 17(1):1:1–1:51, 2015.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25

slide-76
SLIDE 76

doi:10.1145/2817824.

Logic in Computer Science (LICS), 2012 27th Annual IEEE Symposium

  • n, Los Alamitos, 2012. IEEE.

André Platzer (CMU) Cyber-Physical Systems Verification with KeYmaera X LFCS’20 29 / 25