Deductive Safety and Liveness Verification for Ordinary Differential - PowerPoint PPT Presentation

Deductive Safety and Liveness Verification for Ordinary Differential Equations Yong Kiam Tan Computer Science Department, Carnegie Mellon University INRIA, 30th Apr 2020 1 / 34

Motivation: Cyber-Physical Systems (CPSs) Cyber-Physical System: Discrete software controller: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise × Testing control software on the real CPS is expensive and unsafe. 2 / 34

Motivation: Cyber-Physical Systems (CPSs) Cyber-Physical System: Discrete software controller: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise v x Continuous dynamics: x ′ = v , v ′ = a � �� � Ordinary Differential Equations (ODEs) t t × Testing control software on the real CPS is expensive and unsafe. 2 / 34

Motivation: Cyber-Physical Systems (CPSs) Cyber-Physical System: Discrete software controller: if (v > speed_limit) a := -1; //apply brakes else a := 0; //cruise v x Continuous dynamics: x ′ = v , v ′ = a � �� � Need formal proofs for ODEs t t × Testing control software on the real CPS is expensive and unsafe. � Formal proofs give highest level of confidence in correctness of CPSs. 2 / 34

Outline ODEs, Safety, and Liveness 1 ODE Safety Proofs 2 ODE Liveness Proofs 3 ODE Liveness Example 4 Conclusion 5 3 / 34

Outline ODEs, Safety, and Liveness 1 ODE Safety Proofs 2 ODE Liveness Proofs 3 ODE Liveness Example 4 Conclusion 5 4 / 34

Correctness Specifications for CPSs � Safe: always drives below the speed limit 5 / 34

Correctness Specifications for CPSs � Safe: always drives below the speed limit � Safe: always drives below the speed limit 5 / 34

Correctness Specifications for CPSs � Safe: always drives below the speed limit � Live: eventually gets to its destination � Safe: always drives below the speed limit × Not live: stuck in a train repair bay 5 / 34

ODEs & Domain Constraints ODE : Models for the continuous physics of CPSs x ′ = y , y ′ = (1 − x 2 ) y − x Visualization: Van der Pol equations modeling an oscillating electrical circuit. 6 / 34

ODEs & Domain Constraints ODE : Models for the continuous physics of CPSs Analogy: Trains are driving on tracks given by ODE solutions. x' = f ( x ) Ordinary Differential Equation (ODE) � �� � x ′ = f ( x ) 6 / 34

ODEs & Domain Constraints ODE : Models for the continuous physics of CPSs Analogy: Trains are driving on tracks given by ODE solutions. Domain : Specifies the domain of x' = f ( x ) Q definition for ODEs Analogy: Domains make description ODE with domain Q � �� � of train tracks more precise. x ′ = f ( x ) & Q 6 / 34

✓ ✓ ⨯ ✓ Safety & Liveness for ODEs P Q ODE with domain Q � �� � x ′ = f ( x ) & Q ] P Safety: [ ���� Safe region � Train always stays in Pittsburgh ( P ) along its trajectory. 7 / 34

✓ ✓ ⨯ ✓ ✓ ⨯ ⨯⨯ Safety & Liveness for ODEs P P Q Q ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q ] P x ′ = f ( x ) & Q � P Safety: [ Liveness: � ���� ���� Safe region Goal region � Train always stays in Pittsburgh � Train can eventually be driven to ( P ) along its trajectory. Pittsburgh ( P ). 7 / 34

⨯ ✓ ⨯⨯ ✓ ✓ ⨯ ✓ Safety & Liveness for ODEs P P Q Q ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q � P Safety: ¬� Liveness: � ���� ���� Unsafe region Goal region � Train can not eventually be driven � Train can eventually be driven to out of Pittsburgh ( ¬ P ). Pittsburgh ( P ). 7 / 34

✓ ✓ ⨯ ✓ ✓ ⨯ ⨯⨯ Safety & Liveness for ODEs P P Q Q ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q ] ¬ P Safety: ¬� Liveness: ¬ [ ���� ���� Unsafe region Not at goal � Train can not eventually be driven � Train does not always stay out of out of Pittsburgh ( ¬ P ). Pittsburgh ( ¬ P ). 7 / 34

✓ ✓ ⨯ ✓ ✓ ⨯ ⨯⨯ Safety & Liveness for ODEs P P Q Q ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q ] ¬ P Safety: ¬� Liveness: ¬ [ ���� ���� Unsafe region Not at goal This talk: Exploiting logical duality in proofs of ODE safety and liveness. 7 / 34

⨯ ✓ ⨯⨯ Safety & Liveness for ODEs ODE Safety Proofs 2 Rigorous proofs of ODE safety using ODE invariants. P Q ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q ] ¬ P Safety: ¬� Liveness: ¬ [ ���� ���� Unsafe region Not at goal This talk: Exploiting logical duality in proofs of ODE safety and liveness. 7 / 34

Safety & Liveness for ODEs ODE Safety Proofs 2 ODE Liveness Proofs 3 Rigorous proofs of ODE safety Rigorous proofs of ODE liveness using ODE invariants. using ODE safety. ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q ] ¬ P Safety: ¬� Liveness: ¬ [ ���� ���� Unsafe region Not at goal This talk: Exploiting logical duality in proofs of ODE safety and liveness. 7 / 34

Safety & Liveness for ODEs ODE Safety Proofs 2 ODE Liveness Proofs 3 Rigorous proofs of ODE safety Rigorous proofs of ODE liveness using ODE invariants. using ODE safety. ODE Liveness Example 4 An example application of formal ODE liveness arguments. ODE with domain Q ODE with domain Q � �� � � �� � x ′ = f ( x ) & Q � ¬ P x ′ = f ( x ) & Q ] ¬ P Safety: ¬� Liveness: ¬ [ ���� ���� Unsafe region Not at goal This talk: Exploiting logical duality in proofs of ODE safety and liveness. 7 / 34

Outline ODEs, Safety, and Liveness 1 ODE Safety Proofs 2 ODE Liveness Proofs 3 ODE Liveness Example 4 Conclusion 5 8 / 34

⨯ From ODE Safety to ODE Invariance Pennsylvanian ( PA ) regional trains in Pittsburgh ( P ) always stay out of Canada ( ¬ C ): P → [ x ′ = f ( x )] ¬ C PA Pitt. 9 / 34

⨯ From ODE Safety to ODE Invariance Pennsylvanian ( PA ) regional trains in Pittsburgh ( P ) always stay out of Canada ( ¬ C ): P → [ x ′ = f ( x )] ¬ C 1 Trains in Pittsburgh are in Pennsylvania: P → PA PA Pitt. 9 / 34

⨯ From ODE Safety to ODE Invariance Pennsylvanian ( PA ) regional trains in Pittsburgh ( P ) always stay out of Canada ( ¬ C ): P → [ x ′ = f ( x )] ¬ C 1 Trains in Pittsburgh are in Pennsylvania: P → PA 2 Trains in Pennsylvania are not in Canada: PA → ¬ C PA Pitt. 9 / 34

⨯ From ODE Safety to ODE Invariance Pennsylvanian ( PA ) regional trains in Pittsburgh ( P ) always stay out of Canada ( ¬ C ): P → [ x ′ = f ( x )] ¬ C 1 Trains in Pittsburgh are in Pennsylvania: P → PA 2 Trains in Pennsylvania are not in Canada: PA → ¬ C PA 3 PA regional trains always stay in-state: Pitt. PA → [ x ′ = f ( x )] PA Claim: PA is an invariant of the ODE 9 / 34

⨯ From ODE Safety to ODE Invariance Pennsylvanian ( PA ) regional trains in Pittsburgh ( P ) always stay out of Canada ( ¬ C ): P → [ x ′ = f ( x )] ¬ C 1 Trains in Pittsburgh are in Pennsylvania: P → PA 2 Trains in Pennsylvania are not in Canada: PA → ¬ C PA 3 PA regional trains always stay in-state: Pitt. PA → [ x ′ = f ( x )] PA Claim: PA is an invariant of the ODE Idea 1: ODE safety questions reduce to ODE invariance questions. 9 / 34

Why take a logical approach? (ODE Safety) Theorem (Completeness for invariants [LICS’18]) The differential dynamic logic ( dL ) proof calculus is a sound and complete axiomatization for invariants of polynomial ODEs. In fact, it decides invariance for polynomial ODEs and formulas. Takeaway: Logic yields a complete understanding of ODE invariance. Benefit: Powerful automation for ODE safety from sound foundations. 10 / 34

Why take a logical approach? (ODE Safety) Theorem (Completeness for invariants [LICS’18]) The differential dynamic logic ( dL ) proof calculus is a sound and complete axiomatization for invariants of polynomial ODEs. In fact, it decides invariance for polynomial ODEs and formulas. Takeaway: Logic yields a complete understanding of ODE invariance. Benefit: Powerful automation for ODE safety from sound foundations. 3 PA regional trains always stay in-state: PA → [ x ′ = f ( x )] PA Claim: PA is an invariant of the ODE � �� � � or × answer can be computed mechanically with proof. 10 / 34

Why take a logical approach? (ODE Safety) Theorem (Completeness for invariants [LICS’18]) The differential dynamic logic ( dL ) proof calculus is a sound and complete axiomatization for invariants of polynomial ODEs. In fact, it decides invariance for polynomial ODEs and formulas. Polynomial ODEs (Non-Polynomial) Solutions x ′ = x , x (0) = x 0 x ( t ) = x 0 e t x ′ = y , y ′ = − x , x (0) = 0 , y (0) = 1 x ( t ) = sin t , y ( t ) = cos t x ′ = y , y ′ = (1 − x 2 ) y − x Van der Pol equations (No polynomial solutions) How is this completeness result possible? 10 / 34