[PPT] - Formal Verification of Curved Flight Collision Avoidance Maneuvers PowerPoint Presentation

SLIDE 1

Formal Verification of Curved Flight Collision Avoidance Maneuvers

A Case Study Andr´ e Platzer Edmund M. Clarke

Carnegie Mellon University, Computer Science Department, Pittsburgh, PA

Formal Methods, FM, Eindhoven, November 2009

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 1 / 17

SLIDE 2

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 1 / 17

SLIDE 3

Air Traffic Control: Straight Lines & Instant Turns

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 2 / 17

SLIDE 4

Air Traffic Control: Straight Lines & Instant Turns

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 2 / 17

SLIDE 5

Air Traffic Control: Straight Lines & Instant Turns

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 2 / 17

SLIDE 6

Air Traffic Control: Hybrid Systems & Curves

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 7

Air Traffic Control: Hybrid Systems & Curves

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 8

Air Traffic Control: Hybrid Systems & Curves

Hybrid Systems

continuous evolution along differential equations + discrete change

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 9

Air Traffic Control: Hybrid Systems & Curves

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̺ − ω   

Hybrid Systems

continuous evolution along differential equations + discrete change

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 10

Air Traffic Control: Hybrid Systems & Curves

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̺ − ω   

Example (“Solving” differential equations)

x1(t) = 1 ω̺

x1ω̺ cos tω − v2ω cos tω sin ϑ + v2ω cos tω cos t̺ sin ϑ − v1̺ sin tω

+ x2ω̺ sin tω − v2ω cos ϑ cos t̺ sin tω − v2ω

1 − sin ϑ2 sin tω

+ v2ω cos ϑ cos tω sin t̺ + v2ω sin ϑ sin tω sin t̺

. . .

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 11

Air Traffic Control: Hybrid Systems & Curves

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̺ − ω   

Example (“Solving” differential equations)

∀t≥0 1 ω̺

x1ω̺ cos tω − v2ω cos tω sin ϑ + v2ω cos tω cos t̺ sin ϑ − v1̺ sin tω

+ x2ω̺ sin tω − v2ω cos ϑ cos t̺ sin tω − v2ω

1 − sin ϑ2 sin tω

+ v2ω cos ϑ cos tω sin t̺ + v2ω sin ϑ sin tω sin t̺

. . .

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 12

Air Traffic Control: Hybrid Systems & Curves

Hybrid Systems

continuous evolution along differential equations + discrete change

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 3 / 17

SLIDE 13

Introduce: Flyable Roundabout Maneuver

Problem ⇒ Solution

Unrealistic instant turns can cause problems

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 14

Introduce: Flyable Roundabout Maneuver

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 15

Introduce: Flyable Roundabout Maneuver

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 16

Introduce: Flyable Roundabout Maneuver

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 17

Introduce: Flyable Roundabout Maneuver

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 18

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 19

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 20

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 21

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 22

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

e x i t

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 23

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

e x i t

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 24

Introduce: Flyable Roundabout Maneuver

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Problem ⇒ Solution

Unrealistic instant turns can cause problems ( ⇒ smooth curves) Geometric intuition can be misleading ( ⇒ hybrid system model) ⇒ Introduce smoothly curved flyable maneuver as hybrid system model Verification for: nonlinear curve dynamics + mode switching?

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 25

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 26

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 4 / 17

SLIDE 27

Differential Dynamic Logic for Hybrid Programs

differential dynamic logic

dL = FOLR + ML v ≥ 1 v ≥ 1 v ≥ 1 | = v ≥ 1

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 5 / 17

SLIDE 28

Differential Dynamic Logic for Hybrid Programs

differential dynamic logic

dL = FOLR + DL v ≥ 1 v ≥ 1 v ≥ 1 [ ] v ≥ 1

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 5 / 17

SLIDE 29

Differential Dynamic Logic for Hybrid Programs

differential dynamic logic

dL = FOLR + DL + HP v ≥ 1 v ≥ 1 v ≥ 1 [d′

1 = −ωd2, d′ 2 = ωd1] v ≥ 1

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 5 / 17

SLIDE 30

Differential Dynamic Logic for Hybrid Programs

differential dynamic logic

dL = FOLR + DL + HP v ≥ 1 v ≥ 1 v ≥ 1 [if(x1 > 0) ω := 1; d′

1 = −ωd2, d′ 2 = ωd1] v ≥ 1

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 5 / 17

SLIDE 31

Differential Dynamic Logic for Hybrid Programs

differential dynamic logic

dL = FOLR + DL + HP v ≥ 1 v ≥ 1 v ≥ 1 [ if(x1 > 0) ω := 1; d′

1 = −ωd2, d′ 2 = ωd1

hybrid program

] v ≥ 1

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 5 / 17

SLIDE 32

Differential Dynamic Logic for Hybrid Programs

Definition (dL Formula φ)

θ1 ≥ θ2 | ¬φ | φ ∧ ψ | φ ∨ ψ | φ → ψ | ∀x φ | ∃x φ | [α]φ | αφ with terms θ1, θ2 of nonlinear real arithmetic (+, ·)

Definition (Hybrid program α)

x′ = f(x) ∧ H (continuous evolution) x := f(x) (discrete jump)

jump & test

?H (conditional execution) α; β (seq. composition)

Kleene algebra

α ∪ β (nondet. choice) α∗ (nondet. repetition)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 6 / 17

SLIDE 33

Differential Dynamic Logic for Compositional Verification

free agree entry circ exit entry

c x

entry exit

y

Example

safe ∧ far → [entry](safe ∧ tangential) where safe ≡ (x1 − y1)2 + (x2 − y2)2 ≥ p2

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 7 / 17

SLIDE 34

Differential Dynamic Logic for Compositional Verification

free agree entry circ exit entry

c x

entry exit

y

Example

safe ∧ far → [entry](safe ∧ tangential) safe ∧ tangential → [other subsystem]safe where safe ≡ (x1 − y1)2 + (x2 − y2)2 ≥ p2

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 7 / 17

SLIDE 35

Differential Dynamic Logic for Compositional Verification

free agree entry circ exit entry

c x

entry exit

y

Example

safe ∧ far → [entry](safe ∧ tangential)

conjunction

safe ∧ tangential → [other subsystem]safe where safe ≡ (x1 − y1)2 + (x2 − y2)2 ≥ p2

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 7 / 17

SLIDE 36

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 8 / 17

SLIDE 37

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 8 / 17

SLIDE 38

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 8 / 17

SLIDE 39

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 8 / 17

SLIDE 40

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 41

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ far → [agree](safe ∧ far ∧ compatible)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 42

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ far ∧ compatible → [entry](safe ∧ tangential)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 43

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ tangential → [circ](safe ∧ tangential)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 44

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

e x i t

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ tangential → [exit](safe ∧ far)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 45

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

e x i t

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ far → [free](safe ∧ far)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 9 / 17

SLIDE 46

Verification Loop for Air Traffic Control

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Example (dL formula of verification subgoal)

safe ∧ tangential → [circ](safe ∧ tangential)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 10 / 17

SLIDE 47

Verify Roundabout Flight with Differential Invariants

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

x y c

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 48

Verify Roundabout Flight with Differential Invariants

∂x−y2 ∂x1

x′

1 + ∂x−y2 ∂y1

y′

1 + ∂x−y2 ∂x2

x′

2 + ∂x−y2 ∂y2

y′

2 ≥ ∂p2 ∂x1 x′ 1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

x y c

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 49

Verify Roundabout Flight with Differential Invariants

∂x−y2 ∂x1

x′

1 + ∂x−y2 ∂y1

y′

1 + ∂x−y2 ∂x2

x′

2 + ∂x−y2 ∂y2

y′

2 ≥ ∂p2 ∂x1 x′ 1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

x y c

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 50

Verify Roundabout Flight with Differential Invariants

∂x−y2 ∂x1

d1 + ∂x−y2

∂y1

e1 + ∂x−y2

∂x2

d2 + ∂x−y2

∂y2

e2 ≥ ∂p2

∂x1 d1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

x y c

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 51

Verify Roundabout Flight with Differential Invariants

2(x1 − y1)(d1 − e1) + 2(x2 − y2)(d2 − e2) ≥ 0

∂x−y2 ∂x1

d1 + ∂x−y2

∂y1

e1 + ∂x−y2

∂x2

d2 + ∂x−y2

∂y2

e2 ≥ ∂p2

∂x1 d1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

x y c

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 52

Verify Roundabout Flight with Differential Invariants

2(x1 − y1)(d1 − e1) + 2(x2 − y2)(d2 − e2) ≥ 0

∂x−y2 ∂x1

d1 + ∂x−y2

∂y1

e1 + ∂x−y2

∂x2

d2 + ∂x−y2

∂y2

e2 ≥ ∂p2

∂x1 d1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

c x y d e x − y e d − e

[d′

1 = − ωd2, e′ 1 = − ωe2, x′ 2 = d2, d′ 2 = ωd1..]d1 − e1 = −ω(x2 − y2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 53

Verify Roundabout Flight with Differential Invariants

2(x1 − y1)(d1 − e1) + 2(x2 − y2)(d2 − e2) ≥ 0

∂x−y2 ∂x1

d1 + ∂x−y2

∂y1

e1 + ∂x−y2

∂x2

d2 + ∂x−y2

∂y2

e2 ≥ ∂p2

∂x1 d1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

Proposition (Differential saturation)

F differential invariant of [x′ = θ ∧ H]S, then [x′ = θ ∧ H]S iff [x′ = θ ∧ H ∧ F]S [d′

1 = − ωd2, e′ 1 = − ωe2, x′ 2 = d2, d′ 2 = ωd1..]d1 − e1 = −ω(x2 − y2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 54

Verify Roundabout Flight with Differential Invariants

2(x1 − y1)(−ω(x2 − y2)) + 2(x2 − y2)ω(x1 − y1) ≥ 0 2(x1 − y1)(d1 − e1) + 2(x2 − y2)(d2 − e2) ≥ 0

∂x−y2 ∂x1

d1 + ∂x−y2

∂y1

e1 + ∂x−y2

∂x2

d2 + ∂x−y2

∂y2

e2 ≥ ∂p2

∂x1 d1 . . .

[x′

1 = d1, d′ 1 = −ωd2, x′ 2 = d2, d′ 2 = ωd1 . . .](x1 − y1)2 + (x2 − y2)2 ≥ p2

Proposition (Differential saturation)

F differential invariant of [x′ = θ ∧ H]S, then [x′ = θ ∧ H]S iff [x′ = θ ∧ H ∧ F]S [d′

1 = − ωd2, e′ 1 = − ωe2, x′ 2 = d2, d′ 2 = ωd1..]d1 − e1 = −ω(x2 − y2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 11 / 17

SLIDE 55

Flyable Roundabout Maneuver: Entry

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c r r h x

ω < ω > 0

y

Example (dL formula of verification subgoal: reach tangential)

(rω)2 = d2 ∧ x − c = √ 3r ∧ ∃λ≥0 (x + λd = c) ∧ h − c = 2r ∧ d = −ω(x − h)⊥ → [F(−ω) ∧ x − c ≥ r]

x − c ≤ r → d = ω(x − c)⊥

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 12 / 17

SLIDE 56

Flyable Roundabout Maneuver: Entry

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far x d ω y e ≥ p

Example (dL formula of verification subgoal: stay separate)

x − y ≥ √ 2(p + 2bT) ∧ p ≥ 0 ∧ d2 ≤ e2 ≤ b2 ∧ b ≥ 0 ∧ T ≥ 0 → [entry] (x − y ≥ p)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 12 / 17

SLIDE 57

Flyable Roundabout Maneuver: Entry

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far x d ω y e ≥ p

Example (dL formula of verification subgoal: limited progress)

x = z ∧ d2 ≤ b2 ∧ b ≥ 0 → [τ := 0; ∃ω F(ω) ∧ τ ′ = 1] (x − z∞ ≤ τb)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 12 / 17

SLIDE 58

Flyable Roundabout Maneuver: Exit

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

Example (dL formula of verification subgoal: separated exit)

T ∧ x − y2 ≥ p2 → [x′ = d ∧ y′ = e] (x − y2 ≥ p2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 59

Flyable Roundabout Maneuver: Exit

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

Example (dL formula of verification subgoal: separate directions)

T ∧ x − y2 ≥ p2 → [x′ = d; y′ = e] (x − y2 ≥ p2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 60

Flyable Roundabout Maneuver: Exit

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

Example (dL formula of verification subgoal: separate directions)

T ∧ x − y2 ≥ p2 → [x′ = d; y′ = e] (x − y2 ≥ p2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 61

Flyable Roundabout Maneuver: Exit

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

Example (dL formula of verification subgoal: separate directions)

T ∧ x − y2 ≥ p2 → [x′ = d; y′ = e] (x − y2 ≥ p2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 62

Flyable Roundabout Maneuver: Exit

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

Example (dL formula of verification subgoal: far separability)

T ∧ d = e → ∀a x′ = d ∧ y′ = e (x − y2 > a2)

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 63

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 13 / 17

SLIDE 64

Flyable Roundabout Maneuver: Summary

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 14 / 17

SLIDE 65

Flyable Roundabout Maneuver: Summary

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 14 / 17

SLIDE 66

Flyable Roundabout Maneuver: Summary

free agree entry circ exit S ∧ f a r S ∧ far ∧ compat S ∧ T S ∧ T S ∧ far

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Theorem (Collision freedom)

FTRM is collision free: x − y ≥ far ∧ . . . → [FTRM]x − y ≥ p

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 14 / 17

SLIDE 67

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 14 / 17

SLIDE 68

Experimental Results

Case Study Time(s) Mem(Mb) Steps Dim tangential roundabout (2a/c) 10.4 6.8 197 13 tangential roundabout (3a/c) 253.6 7.2 342 18 tangential roundabout (4a/c) 382.9 10.2 520 23 tangential roundabout (5a/c) 1882.9 39.1 735 28 bounded maneuver speed 0.5 6.3 14 4 flyable roundabout entry∗ 10.1 9.6 132 8 flyable entry feasible∗ 104.5 87.9 16 10 flyable entry circular 3.2 7.6 81 5 limited entry progress 1.9 6.5 60 8 entry separation 140.1 20.1 512 16 mutual negotiation successful 0.8 6.4 60 12 mutual negotiation feasible∗ 7.5 23.8 21 11 mutual far negotiation 2.4 8.1 67 14 simultaneous exit separation∗ 4.3 12.9 44 9 different exit directions 3.1 11.1 42 11

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 15 / 17

SLIDE 69

Outline

1

Motivation

2

Differential Dynamic Logic for Hybrid Systems Compositional Verification Logic Differential Invariants

3

Curved Flight Air Traffic Collision Avoidance Maneuver Compositional Verification Plan Verifying Roundabout Flight Safe Flyable Entry Separation Safe Exit Separation Successful Negotiation & Synchronization

4

Flyable Tangential Roundabout Maneuver

4

Experimental Results

5

Conclusions & Future Work

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 15 / 17

SLIDE 70

Future Work

Scaling verification technology Scaling air traffic control scenarios Relax remaining modeling assumptions (e.g., synch) Proof structure is general but computational complexity challenging Develop and verify other entry procedure, maneuver choices, ...

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 16 / 17

SLIDE 71

Conclusions

differential dynamic logic

dL = DL + HP

c

entry

r r h x r

ω < 0

exit

ω > 0

circ

y

Real aircraft follow smooth curves Geometric intuition may mislead Flyable Roundabout Maneuver Verification in logic dL Differential invariants instead of reachability along solutions Formal verification can scale to real aircraft maneuvers! KeYmaera

Andr´ e Platzer, Edmund M. Clarke (CMU) Formal Verification of Curved Flight Collision Avoidance FM’09 17 / 17