Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix - - PowerPoint PPT Presentation

▶

differential algebraic dynamic logic for keymaera x

Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix - - PowerPoint PPT Presentation

Jan 31, 2023 177 likes •786 views

Differential-Algebraic Dynamic Logic for KeYmaera X CPS Grand Prix Benjamin Lim Yao Chong Lim School of Computer Science, Carnegie Mellon University December 11, 2018 Benjamin Lim, Yao Chong Lim (SCS) dA L for KeYmaeraX December 11, 2018 1 /

slide-1

SLIDE 1

Differential-Algebraic Dynamic Logic for KeYmaera X

CPS Grand Prix Benjamin Lim Yao Chong Lim

School of Computer Science, Carnegie Mellon University

December 11, 2018

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 1 / 19

slide-2

SLIDE 2

Motivation

Imprecision is everywhere in actual Cyber-Physical systems...

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 2 / 19

slide-3

SLIDE 3

Motivation

Imprecision is everywhere in actual Cyber-Physical systems... but how do we precisely model its semantics and prove guarantees?

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 2 / 19

slide-4

SLIDE 4

Differential-Algebraic Dynamic Logic (dAL)

x ≤ m →

{x′ = v, v′ = a & v ≥ 0}
x ≤ m

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 3 / 19

slide-5

SLIDE 5

Differential-Algebraic Dynamic Logic (dAL)

x ≤ m →

{x′ = v, v′ = a & v ≥ 0}
x ≤ m

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 3 / 19

slide-6

SLIDE 6

Differential-Algebraic Dynamic Logic (dAL)

x ≤ m →

{∃ δ. (x′ = v, v′ = a + δ & v ≥ 0 ∧ δ2 ≤ |v|

100)}

x ≤ m

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 3 / 19

slide-7

SLIDE 7

Differential-Algebraic Dynamic Logic (dAL)

dAL = dL + existentially quantified ODEs {∃ ¯

y. (x′

1 = θ1, x′ 2 = θ2, · · · , x′ n = θn & Q)}

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 3 / 19

slide-8

SLIDE 8

dAL Example (Perturbed Circular Motion)

x2 + y2 = 1 →

{x′ = −y, y′ = x}
x2 + y2 ≤ 1

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 4 / 19

slide-9

SLIDE 9

dAL Example (Perturbed Circular Motion)

x2 + y2 = 1 →

{∃e.(x′ = −y + e, y′ = x & x · e ≤ 0)}
x2 + y2 ≤ 1

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 4 / 19

slide-10

SLIDE 10

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-11

SLIDE 11

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-12

SLIDE 12

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-13

SLIDE 13

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-14

SLIDE 14

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0 Invalid instance!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-15

SLIDE 15

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0 Invalid instance!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-16

SLIDE 16

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0 Invalid instance! Side conditions necessary...

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-17

SLIDE 17

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0 Invalid instance! Side conditions necessary...but which ones?

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-18

SLIDE 18

Uniform Substitution (Abridged)

[x := e]P(x) → P(e) Axiom Schema [x := x + x][y := 3]x > 0 → [y := 3]x + x > 0 Valid instance! [x := x + y][y := 3]x > 0 → [y := 3]x + y > 0 Invalid instance! Side conditions necessary...but which ones? Key observation: Never bind a free variable that was free!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 5 / 19

slide-19

SLIDE 19

Uniform Substitution (Abridged)

Instead of schema each with their own unique side conditions... [x := e]P(x) → P(e) (+some set of side conditions)

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 6 / 19

slide-20

SLIDE 20

Uniform Substitution (Abridged)

Instead of schema each with their own unique side conditions... [x := e]P(x) → P(e) (+some set of side conditions) You have substitution axioms (without side conditions)... [x := c()]p(x) → p(c())

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 6 / 19

slide-21

SLIDE 21

Uniform Substitution (Abridged)

Instead of schema each with their own unique side conditions... [x := e]P(x) → P(e) (+some set of side conditions) You have substitution axioms (without side conditions)... [x := c()]p(x) → p(c()) and generic admissibility rules for each logical construct (checked recursively) preventing capture of free variables.

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 6 / 19

slide-22

SLIDE 22

Uniform Substitution (Abridged)

Upshot: A significantly reduced soundness-critical core that is easier to maintain and understand

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 7 / 19

slide-23

SLIDE 23

Plan of Attack

Modernize dAL, providing a uniform substitution calculus for it similar to that for dL.

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 8 / 19

slide-24

SLIDE 24

Plan of Attack

Modernize dAL, providing a uniform substitution calculus for it similar to that for dL. Implement uniform substitution axioms into KeYmaeraX.

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 8 / 19

slide-25

SLIDE 25

Plan of Attack

Modernize dAL, providing a uniform substitution calculus for it similar to that for dL. Implement uniform substitution axioms into KeYmaeraX. Implement derived axioms and tactics into KeYmaeraX.

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 8 / 19

slide-26

SLIDE 26

Plan of Attack

Modernize dAL, providing a uniform substitution calculus for it similar to that for dL. Implement uniform substitution axioms into KeYmaeraX. Implement derived axioms and tactics into KeYmaeraX. Prove stuff!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 8 / 19

slide-27

SLIDE 27

dL Recap

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 9 / 19

slide-28

SLIDE 28

dL Recap

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 9 / 19

slide-29

SLIDE 29

dL Recap

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 9 / 19

slide-30

SLIDE 30

dL Recap

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 9 / 19

slide-31

SLIDE 31

Attempts at Uniformity

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 10 / 19

slide-32

SLIDE 32

Attempts at Uniformity

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 10 / 19

slide-33

SLIDE 33

Attempts at Uniformity

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′ ([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 10 / 19

slide-34

SLIDE 34

Attempts at Uniformity

DW [c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x)](q(¯ x) → p(¯ x)) DC ([c & q(¯ x)]p(¯ x) ↔ [c & q(¯ x) ∧ r(¯ x)]p(¯ x)) ← [c & q(¯ x)]r(¯ x) DE [x′ = f (¯ x), c & q(¯ x)]p(¯ x) ↔ [x′ = f (¯ x), c & q(¯ x)][x′ := f (¯ x)]p(¯ x) DI ([c & q(¯ x)]p(¯ x) ↔ [?q(¯ x)]p(¯ x)) ← [c & q(¯ x)](p(¯ x))′ ([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Wrong!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 10 / 19

slide-35

SLIDE 35

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-36

SLIDE 36

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Counterexample: (

{∃y.(x′ = y, z′ = −1 & y ≥ z)}
x ≥ 0 ↔ ∀y. [?y ≥ z] x ≥ 0)

← ∀y.

{x′ = y, z′ = −1 & y ≥ z}
(x ≥ 0)′

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-37

SLIDE 37

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Counterexample: (

{∃y.(x′ = y, z′ = −1 & y ≥ z)}
x ≥ 0 ↔ ∀y. [?y ≥ z] x ≥ 0)

← ∀y.

{x′ = y, z′ = −1 & y ≥ z}
(x ≥ 0)′

Pick a state with x ≥ 0 ∧ z ≥ 0:

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-38

SLIDE 38

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Counterexample: (

{∃y.(x′ = y, z′ = −1 & y ≥ z)}
x ≥ 0 ↔ ∀y. [?y ≥ z] x ≥ 0)

← ∀y.

{x′ = y, z′ = −1 & y ≥ z}
(x ≥ 0)′

Pick a state with x ≥ 0 ∧ z ≥ 0: Premise 1: ∀y. [{x′ = y, z′ = −1 & y ≥ z}] (x ≥ 0)′ True!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-39

SLIDE 39

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Counterexample: (

{∃y.(x′ = y, z′ = −1 & y ≥ z)}
x ≥ 0 ↔ ∀y. [?y ≥ z] x ≥ 0)

← ∀y.

{x′ = y, z′ = −1 & y ≥ z}
(x ≥ 0)′

Pick a state with x ≥ 0 ∧ z ≥ 0: Premise 1: ∀y. [{x′ = y, z′ = −1 & y ≥ z}] (x ≥ 0)′ True! Premise 2: ∀y. [?y ≥ z] x ≥ 0 True!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-40

SLIDE 40

Attempts at Uniformity

([∃¯ y.(c & q(¯ x, ¯ y))]p(¯ x) ↔ ∀¯ y.[?q(¯ x, ¯ y)]p(¯ x)) ← ∀¯ y.[c & q(¯ x, ¯ y)](p(¯ x))′ Counterexample: (

{∃y.(x′ = y, z′ = −1 & y ≥ z)}
x ≥ 0 ↔ ∀y. [?y ≥ z] x ≥ 0)

← ∀y.

{x′ = y, z′ = −1 & y ≥ z}
(x ≥ 0)′

Pick a state with x ≥ 0 ∧ z ≥ 0: Premise 1: ∀y. [{x′ = y, z′ = −1 & y ≥ z}] (x ≥ 0)′ True! Premise 2: ∀y. [?y ≥ z] x ≥ 0 True! Conclusion: [{∃y.(x′ = y, z′ = −1 & y ≥ z)}] x ≥ 0 False??

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 11 / 19

slide-41

SLIDE 41

Uniform Substitution for dAL

DC ([c & q]p ↔ [c & q ∧ r]p) ← [c & q]r DI ([c & q]p ↔ [?q]p) ← [c & q](p)′ DW [c & q]p ↔ [c & q](q → p) DE [x′ = f , c & q]p ↔ [x′ = f , c & q][x′ := f ]p DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 12 / 19

slide-42

SLIDE 42

Uniform Substitution for dAL

DC ([c & q]p ↔ [c & q ∧ r]p) ← [c & q]r DI ([c & q]p ↔ [?q]p) ← [c & q](p)′ DW [c & q]p ↔ [c & q](q → p) DE [x′ = f , c & q]p ↔ [x′ = f , c & q][x′ := f ]p DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 12 / 19

slide-43

SLIDE 43

Uniform Substitution for dAL

DC ([c & q]p ↔ [c & q ∧ r]p) ← [c & q]r DI ([c & q]p ↔ [?q]p) ← [c & q](p)′ DW [c & q]p ↔ [c & q](q → p) DE [x′ = f , c & q]p ↔ [x′ = f , c & q][x′ := f ]p DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 12 / 19

slide-44

SLIDE 44

Uniform Substitution for dAL

DC ([c & q]p ↔ [c & q ∧ r]p) ← [c & q]r DI ([c & q]p ↔ [?q]p) ← [c & q](p)′ DW [c & q]p ↔ [c & q](q → p) DE [x′ = f , c & q]p ↔ [x′ = f , c & q][x′ := f ]p DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 12 / 19

slide-45

SLIDE 45

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 13 / 19

slide-46

SLIDE 46

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 13 / 19

slide-47

SLIDE 47

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAW [{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q)}] (q → p) DAE

{∃¯

y.(x′ = f , c & q)}

p ↔ ∀¯

y.

{∃¯

y.(x′ = f , c & q)} x′ := f

p

DAE too weak for technical reasons, DAW actually unnecessary!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 13 / 19

slide-48

SLIDE 48

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAS [{∃¯ y.(c & q)}] p ↔ ∀¯

y. [{∃¯

y.(c & q)}] [{c & q}] p What we actually need is a ’differential algebraic stutter’ axiom (DAS)!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 14 / 19

slide-49

SLIDE 49

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAS [{∃¯ y.(c & q)}] p ↔ ∀¯

y. [{∃¯

y.(c & q)}] [{c & q}] p

Theorem (Soundness of Uniform Substitution Calculus for dAL)

The above substitution axioms for dAL are sound.

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 14 / 19

slide-50

SLIDE 50

Uniform Substitution for dAL

DAC ([{∃¯ y.(c & q)}] p ↔ [{∃¯ y.(c & q ∧ r)}] p) ← [{∃¯ y.(c & q)}] r DAI ([{∃¯ y.(c & q)}] p ↔ ∀¯

y. [?q] p) ← [{∃¯

y.(c & q)}] (p)′ DAS [{∃¯ y.(c & q)}] p ↔ ∀¯

y. [{∃¯

y.(c & q)}] [{c & q}] p

Theorem (Soundness of Uniform Substitution Calculus for dAL)

The above substitution axioms for dAL are sound. We have created a sound and ’minimal’ uniform substitution calculus for dAL that we can implement into KeYmaeraX!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 14 / 19

slide-51

SLIDE 51

Implementation Details

Modified the parser and core data structures in KeYmaeraX to support dAL We support singly-quantified differential systems (due to lack of vectorial support and significant compatibility changes required) Modified to unification, uniform substitution and other necessary algorithms supported by KeYmaeraX Uniform Substitution axioms added to trusted axiom base Derived axioms and derived tactics proven from trusted axioms Tested proving examples using derived axioms and tactics

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 15 / 19

slide-52

SLIDE 52

Implementation Details

Modified the parser and core data structures in KeYmaeraX to support dAL We support singly-quantified differential systems (due to lack of vectorial support and significant compatibility changes required) Modified to unification, uniform substitution and other necessary algorithms supported by KeYmaeraX Uniform Substitution axioms added to trusted axiom base Derived axioms and derived tactics proven from trusted axioms Tested proving examples using derived axioms and tactics A successful extension that minimally extends the trusted core!

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 15 / 19

slide-53

SLIDE 53

Derived Tactics

Q(x, ¯ y) ⊢ P(x) dAW Γ ⊢

{∃¯

y.(x′ = f (x, ¯ y) & Q(x, ¯ y))}

P(x), ∆

Q(x, ¯ y) ⊢

x′ := f (x, ¯

y)

(P(x))′

dAI P(x) ⊢

{∃¯

y.(x′ = f (x, ¯ y) & Q(x, ¯ y))}

P(x)

Γ ⊢ [{∃¯ y.(c & Q ∧ R)}] P, ∆ Γ ⊢ [{∃¯ y.(c & Q)}] R, ∆ dAC Γ ⊢ [{∃¯ y.(c & Q)}] P, ∆

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 16 / 19

slide-54

SLIDE 54

Example (Perturbed Circular Motion)

∗ R x · e ≤ 0 ⊢ 2x(−y + e) + 2yx ≤ 0 [′:=] x · e ≤ 0 ⊢

x′ := −y + e

y′ := x

2xx′ + 2yy′ ≤ 0

[′], [; ] x · e ≤ 0 ⊢

x′ := −y + e; y′ := x
(x2 + y2 ≤ 1)′

dAI x2 + y2 = 1 ⊢

{∃e.(x′ = −y + e, y′ = x & x · e ≤ 0)}
x2 + y2 ≤ 1

→R ⊢ x2 + y2 = 1 →

{∃e.(x′ = −y + e, y′ = x & x · e ≤ 0)}
x2 + y2 ≤ 1

Q(x, ¯ y) ⊢

x′ := f (x, ¯

y)

(P(x))′

dAI P(x) ⊢

{∃¯

y.(x′ = f (x, ¯ y) & Q(x, ¯ y))}

P(x)

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 17 / 19

slide-55

SLIDE 55

Conclusion and Future Work

Constructed a uniform substitution calculus for dAL Implemented it in KeYmaeraX for a single existentially quantified variable Constructed derived axioms and rules for actual use Future extensions:

◮ Support for multiple quantifiers ◮ WebUI support ◮ ’Desugared’ syntax ◮ Support for more derived rules ◮ Support for hybrid games with differential-algebraic components Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 18 / 19

slide-56

SLIDE 56

Conclusion and Future Work

Constructed a uniform substitution calculus for dAL Implemented it in KeYmaeraX for a single existentially quantified variable Constructed derived axioms and rules for actual use Future extensions:

◮ Support for multiple quantifiers ◮ WebUI support ◮ ’Desugared’ syntax ◮ Support for more derived rules ◮ Support for hybrid games with differential-algebraic components Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 18 / 19

slide-57

SLIDE 57

Conclusion and Future Work

Constructed a uniform substitution calculus for dAL Implemented it in KeYmaeraX for a single existentially quantified variable Constructed derived axioms and rules for actual use Future extensions:

◮ Support for multiple quantifiers ◮ WebUI support ◮ ’Desugared’ syntax ◮ Support for more derived rules ◮ Support for hybrid games with differential-algebraic components Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 18 / 19

slide-58

SLIDE 58

Conclusion and Future Work

Constructed a uniform substitution calculus for dAL Implemented it in KeYmaeraX for a single existentially quantified variable Constructed derived axioms and rules for actual use Future extensions:

◮ Support for multiple quantifiers ◮ WebUI support ◮ ’Desugared’ syntax ◮ Support for more derived rules ◮ Support for hybrid games with differential-algebraic components Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 18 / 19

slide-59

SLIDE 59

Conclusion and Future Work

Constructed a uniform substitution calculus for dAL Implemented it in KeYmaeraX for a single existentially quantified variable Constructed derived axioms and rules for actual use Future extensions:

◮ Support for multiple quantifiers ◮ WebUI support ◮ ’Desugared’ syntax ◮ Support for more derived rules ◮ Support for hybrid games with differential-algebraic components Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 18 / 19

slide-60

SLIDE 60

Questions?

Benjamin Lim, Yao Chong Lim (SCS) dAL for KeYmaeraX December 11, 2018 19 / 19