Differential Dynamic Logic for Hybrid Systems e Platzer 1 , 2 Andr 1 - - PowerPoint PPT Presentation

▶
differential dynamic logic for hybrid systems
SMART_READER_LITE
LIVE PREVIEW

Differential Dynamic Logic for Hybrid Systems e Platzer 1 , 2 Andr 1 - - PowerPoint PPT Presentation

Jan 18, 2024 283 likes •1k views

Differential Dynamic Logic for Hybrid Systems e Platzer 1 , 2 Andr 1 University of Oldenburg, Department of Computing Science, Germany 2 Carnegie Mellon University, Computer Science Department, Pittsburgh, PA, USA KeY07 Andr e Platzer

slide-1
SLIDE 1

Differential Dynamic Logic for Hybrid Systems

Andr´ e Platzer1,2

1University of Oldenburg, Department of Computing Science, Germany 2Carnegie Mellon University, Computer Science Department, Pittsburgh, PA, USA

KeY’07

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 1 / 16

slide-2
SLIDE 2

Outline

1

Motivation

2

Differential Logic dL Design Motives Syntax Transition Semantics Speed Supervision in Train Control

3

Verification Calculus for dL Sequent Calculus Modular Combination by Side Deduction Verifying Speed Supervision in Train Control Soundness

4

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 1 / 16

slide-3
SLIDE 3

Verifying Parametric Hybrid Systems

RBC MA ST SB negot corr far

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-4
SLIDE 4

Verifying Parametric Hybrid Systems

RBC MA ST SB negot corr far

Hybrid Systems

continuous evolution along differential equations + discrete change

t z v

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-5
SLIDE 5

Verifying Parametric Hybrid Systems

RBC MA ST SB negot corr far

Parametric Hybrid Systems

continuous evolution along differential equations + discrete change Fix parameter SB = 10000 and hope? Handle SB as free symbolic parameter? Which constraints for SB? ∀MA ∃SB [Train]safe

t z v

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-6
SLIDE 6

Verifying Parametric Hybrid Systems

RBC MA ST SB negot corr far

Parametric Hybrid Systems

continuous evolution along differential equations + discrete change

differential dynamic logic

dL = DL + HP

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-7
SLIDE 7

Outline

1

Motivation

2

Differential Logic dL Design Motives Syntax Transition Semantics Speed Supervision in Train Control

3

Verification Calculus for dL Sequent Calculus Modular Combination by Side Deduction Verifying Speed Supervision in Train Control Soundness

4

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-8
SLIDE 8

Outline

1

Motivation

2

Differential Logic dL Design Motives Syntax Transition Semantics Speed Supervision in Train Control

3

Verification Calculus for dL Sequent Calculus Modular Combination by Side Deduction Verifying Speed Supervision in Train Control Soundness

4

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 2 / 16

slide-9
SLIDE 9

dL Motives: Regions in First-order Logic

differential dynamic logic

dL = DL + HP

RBC MA ST SB negot corr far

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-10
SLIDE 10

dL Motives: Regions in First-order Logic

differential dynamic logic

dL = FOL

RBC MA ST SB negot corr far

MA − z v MA v2 ≤ 2b(MA − z)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-11
SLIDE 11

dL Motives: Regions in First-order Logic

differential dynamic logic

dL = FOL

RBC MA ST SB negot corr far

MA − z v MA v2 ≤ 2b(MA − z) ∀t after(train-runs(t))(v2 ≤ 2b(MA − z))

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-12
SLIDE 12

dL Motives: State Transitions in Dynamic Logic

differential dynamic logic

dL = FOL + DL

RBC MA ST SB negot corr far

MA − z v MA v2 ≤ 2b(MA − z) ∀t after(train-runs(t))(v2 ≤ 2b(MA − z)) [train-runs]v2 ≤ 2b(MA − z)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-13
SLIDE 13

dL Motives: Hybrid Programs as Uniform Model

differential dynamic logic

dL = FOL + DL + HP

RBC MA ST SB negot corr far

[train-runs]v2 ≤ 2b(MA − z)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-14
SLIDE 14

dL Motives: Hybrid Programs as Uniform Model

differential dynamic logic

dL = FOL + DL + HP

RBC MA ST SB negot corr far

[ ]v2 ≤ 2b(MA − z)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-15
SLIDE 15

dL Motives: Hybrid Programs as Uniform Model

differential dynamic logic

dL = FOL + DL + HP

RBC MA ST SB negot corr far

far neg cor rec fsa

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-16
SLIDE 16

dL Motives: Hybrid Programs as Uniform Model

differential dynamic logic

dL = FOL + DL + HP

RBC MA ST SB negot corr far

far neg cor rec fsa

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-17
SLIDE 17

dL Motives: Hybrid Programs as Uniform Model

differential dynamic logic

dL = FOL + DL + HP

RBC MA ST SB negot corr far

far neg cor rec fsa not compositional

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 3 / 16

slide-18
SLIDE 18

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution ) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-19
SLIDE 19

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution ) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition) ETCS ≡ (cor; drive)∗ cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a := 0) drive ≡ τ := 0; z′′ = a & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-20
SLIDE 20

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution ) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition) ETCS ≡ (cor; drive)∗ cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a ≤ amax) drive ≡ τ := 0; z′′ = a & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-21
SLIDE 21

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) (continuous evolution ) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition) ETCS ≡ (cor; drive)∗ cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a ≤ amax) drive ≡ τ := 0; z′ = v, v′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-22
SLIDE 22

Differential Logic dL: Syntax

Definition (Hybrid program α)

x′ = f (x) & χ (continuous evolution within invariant region) x := θ (discrete jump) ?χ (conditional execution) α; β (seq. composition) α ∪ β (nondet. choice) α∗ (nondet. repetition) ETCS ≡ (cor; drive)∗ cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a ≤ amax) drive ≡ τ := 0; z′ = v, v′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-23
SLIDE 23

Differential Logic dL: Syntax

Definition (Formulas φ)

¬, ∧, ∨, →, ∀x , ∃x , =, ≤, +, · (first-order part) [α]φ, αφ (dynamic part) ψ → [(cor ; drive)∗] z ≤ MA All trains respect MA ⇒ system safe

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 4 / 16

slide-24
SLIDE 24

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w x := θ x . = val(v, θ)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-25
SLIDE 25

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w x′ = f (x) t x w v ϕ(t) x′ = f (x)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-26
SLIDE 26

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w x′ = f (x) & χ t x χ w v ϕ(t) x′ = f (x)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-27
SLIDE 27

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w x′ = f (x) & χ t x χ w v ϕ(t) x′ = f (x)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-28
SLIDE 28

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v s w α; β α β

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-29
SLIDE 29

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v s w α; β α β t x s v w

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-30
SLIDE 30

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v s w α; β α β t x s v w

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-31
SLIDE 31

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v s1 s2 sn w α∗ α α α

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-32
SLIDE 32

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v s1 s2 sn w α∗ α α α t x v w

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-33
SLIDE 33

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w1 w2 α β α ∪ β

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-34
SLIDE 34

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v w1 w2 α β α ∪ β t x v w1 w2

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-35
SLIDE 35

Differential Logic dL: Transition Semantics

Definition (Hybrid programs α: transition semantics)

v ?χ if v | = χ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 5 / 16

slide-36
SLIDE 36

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v [α]φ φ φ φ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-37
SLIDE 37

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v αφ φ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-38
SLIDE 38

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v α-span [α]φ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-39
SLIDE 39

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v α-span [α]φ βφ β-span

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-40
SLIDE 40

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v α-span [α]φ βφ β-span β[α]-span

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-41
SLIDE 41

Differential Logic dL: Transition Semantics

Definition (Formulas φ)

v α-span [α]φ βφ β-span β[α]-span compositional semantics!

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-42
SLIDE 42

Outline

1

Motivation

2

Differential Logic dL Design Motives Syntax Transition Semantics Speed Supervision in Train Control

3

Verification Calculus for dL Sequent Calculus Modular Combination by Side Deduction Verifying Speed Supervision in Train Control Soundness

4

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 6 / 16

slide-43
SLIDE 43

Verification Calculus for dL

φθ

x

[x := θ]φ v w φθ

x

x := θ φ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 7 / 16

slide-44
SLIDE 44

Verification Calculus for dL

φθ

x

[x := θ]φ v w φθ

x

x := θ φ ∃t≥0 x := yx(t)φ x′ = f (x)φ v w x′ = f (x) φ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 7 / 16

slide-45
SLIDE 45

Verification Calculus for dL

φθ

x

[x := θ]φ v w φθ

x

x := θ φ ∃t≥0 x := yx(t)φ x′ = f (x)φ v w x′ = f (x) φ x := yx(t)

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 7 / 16

slide-46
SLIDE 46

Verification Calculus for dL

φθ

x

[x := θ]φ v w φθ

x

x := θ φ ∃t≥0 x := yx(t)φ x′ = f (x)φ v w x′ = f (x) φ x := yx(t) ∃t≥0 (¯ χ ∧ x := yx(t)φ) x′ = f (x) & χφ v w x′ = f (x) & χ φ x := yx(t) x : = yx ( s ) χ ¯ χ ≡ ∀0≤s≤t x := yx(s)χ

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 7 / 16

slide-47
SLIDE 47

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-48
SLIDE 48

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-49
SLIDE 49

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA QE not applicable!

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-50
SLIDE 50

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA v > 0, z < MA ⊢ t ≥ 0 ∧ z := −b

2t2 + vt + zz ≥ MA

start side

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-51
SLIDE 51

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA v > 0, z < MA ⊢ t≥0 v > 0, z < MA ⊢ −b

2t2 + vt + z ≥ MA

v > 0, z < MA ⊢ z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ t ≥ 0 ∧ z := −b

2t2 + vt + zz ≥ MA

start side

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-52
SLIDE 52

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ v2 ≥ 2b(MA − z) v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA v > 0, z < MA ⊢ t≥0 v > 0, z < MA ⊢ −b

2t2 + vt + z ≥ MA

v > 0, z < MA ⊢ z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ t ≥ 0 ∧ z := −b

2t2 + vt + zz ≥ MA

start side QE

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-53
SLIDE 53

Modular Combination by Side Deduction

RBC MA ST SB negot corr far

v > 0, z < MA ⊢ v2 ≥ 2b(MA − z) v > 0, z < MA ⊢ ∃t≥0 z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ z′ = v, v′ = −bz ≥ MA ⊢ v > 0 ∧ z < MA → z′ = v, v′ = −b z ≥ MA v > 0, z < MA ⊢ t≥0 v > 0, z < MA ⊢ −b

2t2 + vt + z ≥ MA

v > 0, z < MA ⊢ z := −b

2t2 + vt + zz ≥ MA

v > 0, z < MA ⊢ t ≥ 0 ∧ z := −b

2t2 + vt + zz ≥ MA

start side QE

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 8 / 16

slide-54
SLIDE 54

Verification Calculus for dL

Dynamic Rules

11 dynamic rules (D1) φ ∧ ψ ?φψ (D2) φ → ψ [?φ]ψ (D3) αφ ∨ βφ α ∪ βφ (D4) [α]φ ∧ [β]φ [α ∪ β]φ (D5) φ ∨ α; α∗φ α∗φ (D6) φ ∧ [α; α∗]φ [α∗]φ (D7) αβφ α; βφ (D8) φθ

x

x := θφ (D9) ∃t≥0 (¯ χ ∧ x := yx x′ = θ & χφ (D10) ∀t≥0 (¯ χ → [x := y [x′ = θ & χ]φ (D11) ⊢ p ⊢ [α∗](p → [α]p) ⊢ [α∗]p

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 9 / 16

slide-55
SLIDE 55

Verification Calculus for dL

Propositional/Quantifier Rules

9 propositional rules + 4 quantifier rules (P1) ⊢ φ ¬φ ⊢ (P2) φ ⊢ ⊢ ¬φ (P3) φ ⊢ ψ ⊢ φ → ψ (P4) φ, ψ ⊢ φ ∧ ψ ⊢ (P5) ⊢ φ ⊢ ψ ⊢ φ ∧ ψ (P6) ⊢ φ ψ ⊢ φ → ψ ⊢ (P7) φ ⊢ ψ ⊢ φ ∨ ψ ⊢ (P8) ⊢ φ, ψ ⊢ φ ∨ ψ (P9) φ ⊢ φ (F1) QE(∃x

i(Γi ⊢ ∆i))

Γ ⊢ ∆, ∃x φ (F2) QE(∀x

i(Γi ⊢ ∆i))

Γ, ∃x φ ⊢ ∆ (F3) QE(∀x

i(Γi ⊢ ∆i))

Γ ⊢ ∆, ∀x φ (F4) QE(∃x

i(Γi ⊢ ∆i))

Γ, ∀x φ ⊢ ∆

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 10 / 16

slide-56
SLIDE 56

Verify Safety in Train Control

ψ → [(cor ; drive)∗] z ≤ MA cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a := 0) drive ≡ τ := 0; z′ = v, v ′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-57
SLIDE 57

Verify Safety in Train Control

ψ → [(cor ; drive)∗] z ≤ MA cor ≡ (?MA − z < SB; a := −b) ∪ (?MA − z ≥ SB; a := 0) drive ≡ τ := 0; z′ = v, v ′ = a, τ ′ = 1 & v ≥ 0 ∧ τ ≤ ε

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-58
SLIDE 58

Verify Safety in Train Control

v2 ≤ 2b(MA − εv − z)

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-59
SLIDE 59

Verify Safety in Train Control

v2 ≤ 2b(MA − εv − z) SB ≥ εv + v2

2b

QE

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-60
SLIDE 60

Verify Safety in Train Control

v2 ≤ 2b(MA − εv − z) SB ≥

v2 2b +

a

b + 1

a

2ε2 + εv

  • QE

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-61
SLIDE 61

Verify Safety in Train Control

inv ≡ v2 ≤ 2b(MA − z)

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-62
SLIDE 62

Verify Safety in Train Control

inv ≡ v2 ≤ 2b(MA − z) MA − z v

RBC MA ST SB negot corr far ∗ p⊢ ∀t≥0 (v := −bt + vv ≥ 0 → z := − b

2 t2 + vt + z; v := −bt + vp)

p⊢ [z′ = v, v′ = −b & v ≥ 0]p p⊢ a := −b[drive]p . . . p, MA−z≥SB⊢ v2 ≤ 2b(MA − εv − z) p, MA−z≥SB⊢ ∀t≥0 (τ := tτ ≤ ε → z := vt + p, MA−z≥SB⊢ τ := 0∀t≥0 (τ := t + ττ ≤ ε p, MA−z≥SB⊢ τ := 0[z′ = v, v′ = 0, τ′ = 1 & p, MA−z≥SB⊢ a := 0τ := 0[z′ = v, v′ = a, τ p, MA−z≥SB⊢ a := 0[drive]p p⊢ [?MA−z≥SB; a := 0][drive]p p⊢ [cor][drive]p p⊢ [cor ; drive]p Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 11 / 16

slide-63
SLIDE 63

Verified ETCS Model

system :

  • poll; (negot ∪ (speedControl; atp; move))

∗ init : drive := 0; brake := 1 poll : SB := v2−d2

2b

+ amax

b

+ 1 amax

2 ε2 + εv

  • ; ST := ∗

negot : (?m − z > ST) ∪ (?m − z ≤ ST; rbc) rbc : (vdes := ∗; ?vdes > 0) ∪ (state := brake) ∪

  • dold := d; mold := m; m := ∗; d := ∗;

?d ≥ 0 ∧ d2

  • ld − d2 ≤ 2b(m − mold)
  • speedCtrl

: (?state = brake; a := −b) ∪

  • ?state = drive;
  • (?v ≤ vdes; a := ∗; ? − b ≤ a ≤ amax)

∪(?v ≥ vdes; a := ∗; ?0 > a ≥ − b)

  • atp

: (?m − z ≤ SB; a := −b) ∪ (?m − z > SB) move : t := 0; {˙ z = v, ˙ v = a, ˙ t = 1, (v ≥ 0 ∧ t ≤ ε)}

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 12 / 16

slide-64
SLIDE 64

Distance Profile

d m vdes vdes vdes vdes

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 13 / 16

slide-65
SLIDE 65

Distance Profile

d m vdes vdes vdes vdes

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 13 / 16

slide-66
SLIDE 66

Soundness

Theorem (Soundness)

dL calculus is sound. x′ = f (x) Side deductions

Proposition (Incompleteness)

The discrete or continuous fragments of dL are inherently incomplete. (Yet, reachability in hybrid systems is not semidecidable) (x := x + 1)∗ x = n s′′ = −s, τ ′ = 1(s = 0 ∧ τ = n) s = sin

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 14 / 16

slide-67
SLIDE 67

Outline

1

Motivation

2

Differential Logic dL Design Motives Syntax Transition Semantics Speed Supervision in Train Control

3

Verification Calculus for dL Sequent Calculus Modular Combination by Side Deduction Verifying Speed Supervision in Train Control Soundness

4

Conclusions & Future Work

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 14 / 16

slide-68
SLIDE 68

Conclusions

differential dynamic logic

dL = DL + HP Deductively verify hybrid systems Train control (ETCS) verification Constructive deduction modulo by side deduction Verification tool HyKeY Parameter discovery

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 15 / 16

slide-69
SLIDE 69

Future Work

Prove relative completeness of dL/(ODE + Inv) Dynamic reconfiguration of system structures

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 16 / 16

slide-70
SLIDE 70
  • J. M. Davoren and A. Nerode.

Logics for hybrid systems. Proceedings of the IEEE, 88(7):985–1010, July 2000.

  • M. R¨
  • nkk¨
  • , A. P. Ravn, and K. Sere.

Hybrid action systems.

  • Theor. Comput. Sci., 290(1):937–973, 2003.
  • W. C. Rounds.

A spatial logic for the hybrid π-calculus. In R. Alur and G. J. Pappas, editors, HSCC, volume 2993 of LNCS, pages 508–522. Springer, 2004.

  • C. Zhou, A. P. Ravn, and M. R. Hansen.

An extended duration calculus for hybrid real-time systems. In R. L. Grossman, A. Nerode, A. P. Ravn, and H. Rischel, editors, Hybrid Systems, volume 736 of LNCS, pages 36–59. Springer, 1992.

Andr´ e Platzer (University of Oldenburg) Differential Dynamic Logic for Hybrid Systems KeY’07 16 / 16