Hybrid Systems Verification and Robotics Andr e Platzer - - PowerPoint PPT Presentation

▶
hybrid systems verification and robotics
SMART_READER_LITE
LIVE PREVIEW

Hybrid Systems Verification and Robotics Andr e Platzer - - PowerPoint PPT Presentation

Apr 11, 2024 148 likes •1.07k views

Hybrid Systems Verification and Robotics Andr e Platzer aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA http://symbolaris.com/ 0.5 0.4 0.3 0.2 1.0 0.1 0.8 0.6 0.4 0.2 Andr e Platzer

slide-1
SLIDE 1

Hybrid Systems Verification and Robotics

Andr´ e Platzer

aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA

http://symbolaris.com/

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 1 / 25

slide-2
SLIDE 2

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 1 / 25

slide-3
SLIDE 3

Can you trust a computer to control physics?

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 2 / 25

slide-4
SLIDE 4

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 2 / 25

slide-5
SLIDE 5

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.3 0.2 0.1 0.1 0.2a 2 4 6 8 10 t 0.2 0.4 0.6 0.8

v

2 4 6 8 10 t 0.5 1.0 1.5 2.0 2.5

p

px py Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 3 / 25

slide-6
SLIDE 6

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.3 0.2 0.1 0.1 0.2a 2 4 6 8 10 t 0.00002 0.00004 0.00006 0.00008

Ω

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0

d

dx dy Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 3 / 25

slide-7
SLIDE 7

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0v 2 4 6 8 10 t 2 4 6 8

p

px py Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 4 / 25

slide-8
SLIDE 8

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 1.0 0.5 0.5

Ω

2 4 6 8 10 t 0.5 0.5 1.0

d

dx dy Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 4 / 25

slide-9
SLIDE 9

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 4 3 2 1

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0v 2 4 6 8 10 t 1 2 3 4

p

px py Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 5 / 25

slide-10
SLIDE 10

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 4 3 2 1

a

2 4 6 8 10 t 1.0 0.5 0.5

Ω

2 4 6 8 10 t 0.5 0.5 1.0

d

dx dy Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 5 / 25

slide-11
SLIDE 11

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.6 0.4 0.2 0.2 0.4

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0 1.2v 2 4 6 8 10 t 1 2 3 4 5 6 7p

px py Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 6 / 25

slide-12
SLIDE 12

Hybrid Systems Analysis

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

2 4 6 8 10 t 0.6 0.4 0.2 0.2 0.4

a

2 4 6 8 10 t 1.0 0.5 0.5

Ω

2 4 6 8 10 t 0.5 0.5 1.0

d

dx dy Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 6 / 25

slide-13
SLIDE 13

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 6 / 25

slide-14
SLIDE 14

Logic for Hybrid Systems

differential dynamic logic

dL = DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-15
SLIDE 15

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

z v M v2 ≤ 2b(M − z)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-16
SLIDE 16

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

z v M v ≤ 1

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-17
SLIDE 17

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

z v M v ≤ 1 ∧ v2 ≤ 2b(M − z)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-18
SLIDE 18

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

z v M v ≤ 1 ∨ v2 ≤ 2b(M − z)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-19
SLIDE 19

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

∀M ∃SB . . . ∀t≥0 . . . z v M v ≤ 1 ∨ v2 ≤ 2b(M − z)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-20
SLIDE 20

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR +

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-21
SLIDE 21

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + ML

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-22
SLIDE 22

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b [ ] v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-23
SLIDE 23

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b [z′′ = a] v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-24
SLIDE 24

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b [if(z > SB) a := −b; z′′ = a] v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-25
SLIDE 25

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b [ if(z > SB) a := −b; z′′ = a

  • hybrid program

] v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-26
SLIDE 26

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

  • hybrid program

] v2 ≤ 2b

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-27
SLIDE 27

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

  • hybrid program

] v2 ≤ 2b Initial condition

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-28
SLIDE 28

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

  • hybrid program

] v2 ≤ 2b Initial condition System dynamics

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-29
SLIDE 29

Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

  • hybrid program

] v2 ≤ 2b Initial condition System dynamics Post condition

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-30
SLIDE 30

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 7 / 25

slide-31
SLIDE 31

Follow all transitions of the system from a set of states ≈ set-valued simulation

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 8 / 25

slide-32
SLIDE 32

Model Checking in a Nutshell

Definition (Model Checking Problem)

Given initial states Q0 ⊆ Q and bad states B ⊆ Q for a transition system, check whether there is a trace from some q0 ∈ Q0 to some qb ∈ B. B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-33
SLIDE 33

Model Checking in a Nutshell

Definition (Model Checking Problem)

Given initial states Q0 ⊆ Q and bad states B ⊆ Q for a transition system, check whether there is a trace from some q0 ∈ Q0 to some qb ∈ B. B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-34
SLIDE 34

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-35
SLIDE 35

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} B Q0

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-36
SLIDE 36

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} B Q0 Q1 = PostA(Q0) PostA(Q0)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-37
SLIDE 37

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} B Q0 Q1 = PostA(Q0) PostA(Q0) Q2 = Post2

A(Q0)

PostA(Q1)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-38
SLIDE 38

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} B Q0 Q1 = PostA(Q0) PostA(Q0) Q2 = Post2

A(Q0)

PostA(Q1) Q3 = Post3

A(Q0)

PostA(Q2)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-39
SLIDE 39

Model Checking in a Nutshell

Definition (Image Computation)

PostA(Y ) := {q+ ∈ Q : q

a

− → q+ for some q ∈ Y , a ∈ A} Post∗

A(Y ) :=

  • n∈N

Postn

A(Y ) = µZ.(Y ∪ Z ∪ PostA(Z))

B Q0 Q1 = PostA(Q0) PostA(Q0) Q2 = Post2

A(Q0)

PostA(Q1) Q3 = Post3

A(Q0)

PostA(Q2)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 9 / 25

slide-40
SLIDE 40

Uncountably state spaces require extra care

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 10 / 25

slide-41
SLIDE 41

Image Computation in Hybrid Systems

I Analyse image computation problem in hybrid systems Approximation refinement techniques and their limits Representation of regions in state space Numerical versus symbolic algorithms 1.421 ∈ Q versus x2 + 2xy term computations

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 11 / 25

slide-42
SLIDE 42

Image Computation in Hybrid Systems

I H Analyse image computation problem in hybrid systems Approximation refinement techniques and their limits Representation of regions in state space Numerical versus symbolic algorithms 1.421 ∈ Q versus x2 + 2xy term computations

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 11 / 25

slide-43
SLIDE 43

Image Computation in Hybrid Systems

I H H Analyse image computation problem in hybrid systems Approximation refinement techniques and their limits Representation of regions in state space Numerical versus symbolic algorithms 1.421 ∈ Q versus x2 + 2xy term computations

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 11 / 25

slide-44
SLIDE 44

Image Computation in Hybrid Systems

I H H B Analyse image computation problem in hybrid systems Approximation refinement techniques and their limits Representation of regions in state space Numerical versus symbolic algorithms 1.421 ∈ Q versus x2 + 2xy term computations

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 11 / 25

slide-45
SLIDE 45

Image Computation in Hybrid Systems

I H H B Image Computation Model Checking Analyse image computation problem in hybrid systems Approximation refinement techniques and their limits Representation of regions in state space Numerical versus symbolic algorithms 1.421 ∈ Q versus x2 + 2xy term computations

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 11 / 25

slide-46
SLIDE 46

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-47
SLIDE 47

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I H B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-48
SLIDE 48

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I H A B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-49
SLIDE 49

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I H A +ǫ B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-50
SLIDE 50

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I H A +ǫ B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-51
SLIDE 51

AMC: Approximation Refinement Model Checking

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

I H A +ǫ B

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-52
SLIDE 52

AMC: Exact Image Computation

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

Proposition (Semialgebraic images) (HSCC’07)

check and blur can be implemented for I and B semialgebraic (propositional combinations of p ≥ 0) A with polynomial flows over R +Piecewise definitions +Rational extensions (e.g. multivariate rational splines)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-53
SLIDE 53

AMC: Image Approximation

AMC(B reachable from I in H):

1 A := approx(H) uniformly 2 blur by uniform approximation error +ǫ 3 check(B reachable from I in A + ǫ) 4 B not reachable ⇒ H safe

Proposition (Existence of approximations) (HSCC’07)

approx exists for all uniform errors ǫ > 0 when using polynomials to build A Flows ϕ ∈ C (D, Rn) of H D ⊂ R × Rn compact closure of an open set

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 12 / 25

slide-54
SLIDE 54

Approximation can solve problems without effective exact solution

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 13 / 25

slide-55
SLIDE 55

Existence of solutions may be computationally insufficient

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 14 / 25

slide-56
SLIDE 56

Summary: Model Checking

Image computation in hybrid systems model checking HSCC’07

1

approx uniformly

2

blur by uniform error

3

check for B

flows approx / image computation

continuous uniform approx exists, but. . . smooth undecidable by evaluation bounded by b decidable bound probabilities probabilistically decidable ODE ℓ-Lipschitz decidable Combine numerical algorithms with symbolic analysis Roundabout maneuver unsafe

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 15 / 25

slide-57
SLIDE 57

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 15 / 25

slide-58
SLIDE 58

Verify using many simple symbolic proof steps

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 16 / 25

slide-59
SLIDE 59

Differential Dynamic Logic: Axiomatization

[:=] [x := θ][(x)]φx ↔ [(x)]φθ [?] [?H]φ ↔ (H → φ) [′] [x′ = f (x)]φ ↔ ∀t≥0 [x := y(t)]φ (y′(t) = f (y)) [∪] [α ∪ β]φ ↔ [α]φ ∧ [β]φ [;] [α; β]φ ↔ [α][β]φ [∗] [α∗]φ ↔ φ ∧ [α][α∗]φ K [α](φ → ψ) → ([α]φ → [α]ψ) I [α∗](φ → [α]φ) → (φ → [α∗]φ) C [α∗]∀v>0 (ϕ(v) → αϕ(v − 1)) → ∀v (ϕ(v) → α∗∃v≤0 ϕ(v))

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 17 / 25

slide-60
SLIDE 60

Proofs for Hybrid Systems

φθ

x

[x := θ]φ v w φθ

x

x := θ φ

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 18 / 25

slide-61
SLIDE 61

Proofs for Hybrid Systems

φθ

x

[x := θ]φ v w φθ

x

x := θ φ ∀t≥0 [x := yx(t)]φ [x′ = f (x)]φ v w x′ = f (x) φ

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 18 / 25

slide-62
SLIDE 62

Proofs for Hybrid Systems

φθ

x

[x := θ]φ v w φθ

x

x := θ φ ∀t≥0 [x := yx(t)]φ [x′ = f (x)]φ v w x′ = f (x) φ x := yx(t)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 18 / 25

slide-63
SLIDE 63

Proofs for Hybrid Systems

compositional semantics ⇒ compositional rules!

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 19 / 25

slide-64
SLIDE 64

Proofs for Hybrid Systems

[α]φ ∧ [β]φ [α ∪ β]φ v w1 w2 α φ β φ α ∪ β

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 19 / 25

slide-65
SLIDE 65

Proofs for Hybrid Systems

[α]φ ∧ [β]φ [α ∪ β]φ v w1 w2 α φ β φ α ∪ β [α][β]φ [α; β]φ v s w α; β [α][β]φ α [β]φ β φ

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 19 / 25

slide-66
SLIDE 66

Proofs for Hybrid Systems

[α]φ ∧ [β]φ [α ∪ β]φ v w1 w2 α φ β φ α ∪ β [α][β]φ [α; β]φ v s w α; β [α][β]φ α [β]φ β φ φ (φ → [α]φ) [α∗]φ v w α∗ φ α φ → [α]φ α α φ

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 19 / 25

slide-67
SLIDE 67

Deduction Modulo (Free Variables for Automation)

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-68
SLIDE 68

Deduction Modulo (Free Variables for Automation)

v ≥ 0, z < m →T≥0 v ≥ 0, z < m →− b

2T 2 + vT + z > m

v ≥ 0, z < m →z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →T ≥ 0 ∧ z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-69
SLIDE 69

Deduction Modulo (Free Variables for Automation)

v ≥ 0, z < m → ∃T (. . . T≥0 ∧ − b

2T 2 + vT + z > m)

v ≥ 0, z < m →T≥0 v ≥ 0, z < m →− b

2T 2 + vT + z > m

v ≥ 0, z < m →z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →T ≥ 0 ∧ z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-70
SLIDE 70

Deduction Modulo (Free Variables for Automation)

v ≥ 0, z < m →QE

  • ∃T (. . . T≥0 ∧ − b

2T 2 + vT + z > m)

  • v ≥ 0, z < m →T≥0

v ≥ 0, z < m →− b

2T 2 + vT + z > m

v ≥ 0, z < m →z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →T ≥ 0 ∧ z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-71
SLIDE 71

Deduction Modulo (Free Variables for Automation)

v ≥ 0, z < m →v2 > 2b(m − z) v ≥ 0, z < m →T≥0 v ≥ 0, z < m →− b

2T 2 + vT + z > m

v ≥ 0, z < m →z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →T ≥ 0 ∧ z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-72
SLIDE 72

Deduction Modulo (Free Variables for Automation)

For requantification, not for unification v ≥ 0, z < m →QE

  • ∃T (. . . T≥0 ∧ − b

2T 2 + vT + z > m)

  • v ≥ 0, z < m →T≥0

v ≥ 0, z < m →− b

2T 2 + vT + z > m

v ≥ 0, z < m →z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →T ≥ 0 ∧ z := − b

2T 2 + vT + zz > m

v ≥ 0, z < m →∃t≥0 z := − b

2t2 + vt + zz>m

v ≥ 0, z < m →z′ = v, v′ = −bz > m v ≥ 0 ∧ z < m → z′ = v, v′ = −bz > m

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 20 / 25

slide-73
SLIDE 73

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15pp Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-74
SLIDE 74

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15pp

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10pp Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-75
SLIDE 75

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15pp

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10pp

System Continuous Discrete Hybrid

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-76
SLIDE 76

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15pp

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10pp

System Continuous Discrete Hybrid Hybrid Theory Discrete Theory Contin. Theory

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-77
SLIDE 77

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15pp

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10pp

Corollary (Relative Decidability)

Verification & synthesis decidable relative to differential equations.

Corollary (Relative Extension)

All research on differential equations extends to hybrid systems.

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-78
SLIDE 78

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 21 / 25

slide-79
SLIDE 79

¬ ¬F

F F χ

F

[α]φ φ α αPφ P(φ)

ψ → [α]φ ψ → [α]φ ψ → [α]φ ψ → [α]φ ψ → [α]φ

Strategy Rule Engine Proof Input File Rule base Mathematica QEPCAD Orbital KeYmaera Prover Solvers

1 2 2 4 4 8 8 16 16 16 ∗ ∗

16 8 4 2 1

c

  • ∪

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 22 / 25

slide-80
SLIDE 80

Successful Hybrid Systems Proofs

far neg cor rec fsa

* 1 [SB := ((amax / b + 1) * ep * v + (v ^ 2 - d ^ 2) / (2 * b) + ((amax / b + 1) * amax * ep ^ 2) / 2)] 7 17 6 [?d >= 0 & do ^ 2 - d ^ 2 <= 2 * b * (m - mo) & vdes >= 0] 5 [vdes := *] 4 [d := *] 3 [m := *] 2 [mo := m] [do := d] 8 [state := brake] 10 [?v <= vdes] 13 [?v >= vdes] 22 31 21 [{z‘ = v, v‘ = a, t‘ = 1, v >= 0 & t <= ep}] 18 28 17 [a := -b] 12 24 11 [?a >= 0 & a <= amax] [a := *] 15 14 [?a <= 0 & a >= -b] [a := *] 19 [t := 0] * [?m - z <= SB | state = brake] [?m - z >= SB & state != brake]

x y c

 

c

  • x

e n t r y e x i t

  • y

c

  • x1

x2 y1 y2 d ω e ¯ ϑ ̟

c

  • x
  • y
  • z

x Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 23 / 25

slide-81
SLIDE 81

Successful Hybrid Systems Proofs

ey fy xb (lx, ly) ex fx (rx, ry) (vx, vy)

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 23 / 25

slide-82
SLIDE 82

Successful Hybrid Systems Proofs

c

  • x
  • y
  • z

2minri

m i n r

  • i
  • di

xi disci xi xj p xk xl xm

1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 1 2 3 4 5 6 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5

5 10 15 20 0.3 0.2 0.1 0.1 0.2 0.3

0.2 0.4 0.6 0.8 1.0 1 1

  • 0.3

0.2 0.1 0.0 0.1 0.2 0.3 Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 23 / 25

slide-83
SLIDE 83

Outline

1

Hybrid Systems Applications

2

Logic for Hybrid Systems

3

Model Checking Successive Image Computation Image Computation in Hybrid Systems Approximation Refinement Model Checking Summary

4

Proofs for Hybrid Systems Proof Rules Soundness and Completeness

5

Survey

6

Summary

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 23 / 25

slide-84
SLIDE 84

Hybrid Systems Verification and Robotics

Hybrid system models Discrete dynamics Continuous dynamics Correctness properties Safety, liveness . . . [α]φ φ α Model checking Logic & proofs Cyber-physical systems Differential invariants KeYmaera

d i s c r e t e c

  • n

t i n u

  • u

s nondet stochastic a d v e r s a r i a l

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 24 / 25

slide-85
SLIDE 85

Logical Foundations

  • f

Cyber-Physical Systems

Logic

Model Checking Theorem Proving Proof Theory Modal Logic

Algebra

Computer Algebra Algebraic Geometry Differential Algebra Lie Algebra

Analysis

Differential Equations Dynamical Systems Differ- entiation Limit Processes

Stochastics

Stochastic Differential Equations Differential Generators Dynkin’s Infinitesimal Generators Doob’s Super- martingales

Numerics

Error Analysis Numerical Quadrature Hermite Interpolation Weierstraß Approx- imation

Algorithms

Decision Procedures Proof Search Fixpoints & Lattices Closure Ordinals

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25

slide-86
SLIDE 86

Logical Foundations

  • f

Cyber-Physical Systems

Logic

Model Checking Theorem Proving Proof Theory Modal Logic

Algebra

Computer Algebra Algebraic Geometry Differential Algebra Lie Algebra

Analysis

Differential Equations Dynamical Systems Differ- entiation Limit Processes

Stochastics

Stochastic Differential Equations Differential Generators Dynkin’s Infinitesimal Generators Doob’s Super- martingales

Numerics

Error Analysis Numerical Quadrature Hermite Interpolation Weierstraß Approx- imation

Algorithms

Decision Procedures Proof Search Fixpoints & Lattices Closure Ordinals

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25

slide-87
SLIDE 87

Thomas A. Henzinger. The theory of hybrid automata. In LICS, pages 278–292, Los Alamitos, 1996. IEEE Computer Society. Rajeev Alur. Formal verification of hybrid systems. In Samarjit Chakraborty, Ahmed Jerraya, Sanjoy K. Baruah, and Sebastian Fischmeister, editors, EMSOFT, pages 273–278. ACM, 2011. Andr´ e Platzer. Logics of dynamical systems. In LICS, pages 13–24. IEEE, 2012. Andr´ e Platzer. Differential dynamic logic for hybrid systems.

  • J. Autom. Reas., 41(2):143–189, 2008.

Andr´ e Platzer. Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics.

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25

slide-88
SLIDE 88

Springer, Heidelberg, 2010. Andr´ e Platzer and Jan-David Quesel. KeYmaera: A hybrid theorem prover for hybrid systems. In Alessandro Armando, Peter Baumgartner, and Gilles Dowek, editors, IJCAR, volume 5195 of LNCS, pages 171–178. Springer, 2008. Ian M. Mitchell and Jeremy A. Templeton. A toolbox of Hamilton-Jacobi solvers for analysis of nondeterministic continuous and hybrid systems. In Manfred Morari and Lothar Thiele, editors, HSCC, volume 3414 of LNCS, pages 480–494. Springer, 2005. Stefan Ratschan and Zhikun She. Safety verification of hybrid systems by constraint propagation-based abstraction refinement.

  • Trans. on Embedded Computing Sys., 6(1):8, 2007.

Goran Frehse, Colas Le Guernic, Alexandre Donz´ e, Scott Cotton, Rajarshi Ray, Olivier Lebeltel, Rodolfo Ripado, Antoine Girard, Thao Dang, and Oded Maler.

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25

slide-89
SLIDE 89

SpaceEx: Scalable verification of hybrid systems. In Ganesh Gopalakrishnan and Shaz Qadeer, editors, CAV, volume 6806 of LNCS, pages 379–395. Springer, 2011. Goran Frehse. PHAVer: algorithmic verification of hybrid systems past HyTech. STTT, 10(3):263–279, 2008. Andr´ e Platzer and Edmund M. Clarke. The image computation problem in hybrid systems model checking. In Alberto Bemporad, Antonio Bicchi, and Giorgio Buttazzo, editors, HSCC, volume 4416 of LNCS, pages 473–486. Springer, 2007. Pieter Collins. Optimal semicomputable approximations to reachable and invariant sets. Theory Comput. Syst., 41(1):33–48, 2007. Edmund M. Clarke, Ansgar Fehnker, Zhi Han, Bruce H. Krogh, Jo¨ el Ouaknine, Olaf Stursberg, and Michael Theobald.

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25

slide-90
SLIDE 90

Abstraction and counterexample-guided refinement in model checking

  • f hybrid systems.
  • Int. J. Found. Comput. Sci., 14(4):583–604, 2003.

Alongkrit Chutinan and Bruce H. Krogh. Computational techniques for hybrid system verification. IEEE T. Automat. Contr., 48(1):64–75, 2003. Carla Piazza, Marco Antoniotti, Venkatesh Mysore, Alberto Policriti, Franz Winkler, and Bud Mishra. Algorithmic algebraic model checking I: Challenges from systems biology. In Kousha Etessami and Sriram K. Rajamani, editors, CAV, volume 3576 of LNCS, pages 5–19. Springer, 2005.

Andr´ e Platzer (CMU) Hybrid Systems Verification and Robotics RSS-FMRA 25 / 25