KeYmaera X: Theorem Proving for Hybrid Systems Nathan Fulton - PowerPoint PPT Presentation

KeYmaera X: Theorem Proving for Hybrid Systems Nathan Fulton Carnegie Mellon University May 6, 2016 1

Milieu Safety-critical control software is pervasive and increasingly complicated. 2

Milieu Safety-critical control software is pervasive and increasingly complicated. 2

KeYmaera X Small Core Increases trust, enables experimentation System LOC KeYmaera X 1 682 Isabelle/Pure 8 113 Coq 20 000 dReal 50 000 SpaceEx 100 000 3

KeYmaera X Small Core Increases trust, enables experimentation System LOC KeYmaera X 1 682 Isabelle/Pure 8 113 Coq 20 000 dReal 50 000 SpaceEx 100 000 Tactics Maintainable and readable proof automation 3

KeYmaera X Small Core Increases trust, enables experimentation System LOC KeYmaera X 1 682 Isabelle/Pure 8 113 Coq 20 000 dReal 50 000 SpaceEx 100 000 Tactics Maintainable and readable proof automation GUI A point-and-prove interface for interacting with deeply nested formulas 3

Hybrid Programs Assign x := θ Sequence α ; β Iteration α ∗ Choice α ∪ β Test ? ϕ ODEs { x ′ 1 = θ 1 , . . . , x ′ n = θ n & P } 4

A Hybrid System Specification vel ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ acc := A ∪ acc := − B } ; { pos ′ = vel , vel ′ = acc & vel ≥ 0 }} ∗ ] vel ≥ 0 5

A Hybrid System Specification vel ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ acc := A ∪ acc := − B } ; { pos ′ = vel , vel ′ = acc & vel ≥ 0 }} ∗ ] vel ≥ 0 5

Core: Uniform Substitution UniformSubstitution φ σ ( φ ) Where σ performs admissible substitutions on functions, predicates, and program constants. 6

Core: Axioms Axiom "K�modal�modus�ponens". [a;](p(?)->q(?)) -> (([a;]p(?)) -> ([a;]q(?))) End. Axiom "DC�differential �cut". ([c&H(?);]p(?) <-> [c&(H(?)&r(?));]p(?)) <- [c&H(?);]r(? End. Axiom "[++]�choice". [a ++ b]p(?) <-> ([a;]p(?) & [b;]p(?)). End. 7

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 2. Identify System Loop Invariant 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 2. Identify System Loop Invariant 3. Symbolically Execute Control Program 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 2. Identify System Loop Invariant 3. Symbolically Execute Control Program 4. Solve ODE or identify Differential Invariant(s) 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 2. Identify System Loop Invariant 3. Symbolically Execute Control Program 4. Solve ODE or identify Differential Invariant(s) 5. Appeal to Decision Procedure for Real Arithmetic 8

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: 1. Propositional Reasoning 2. Identify System Loop Invariant 3. Symbolically Execute Control Program 4. Solve ODE or identify Differential Invariant(s) 5. Appeal to Decision Procedure for Real Arithmetic 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ImplyR & 2. Identify System Loop Invariant 3. Symbolically Execute Control Program 4. Solve ODE or identify Differential Invariant(s) 5. Appeal to Decision Procedure for Real Arithmetic 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ImplyR & Loop(" v ≥ 0 ")<(QE,QE, 3. Symbolically Execute Control Program 4. Solve ODE or identify Differential Invariant(s) 5. Appeal to Decision Procedure for Real Arithmetic 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ImplyR & Loop(" v ≥ 0 ")<(QE,QE, Seq & Choice & BoxAssign & 4. Solve ODE or identify Differential Invariant(s) 5. Appeal to Decision Procedure for Real Arithmetic 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ImplyR & Loop(" v ≥ 0 ")<(QE,QE, Seq & Choice & BoxAssign & DiffInv(" v ≥ 0 ") & 5. Appeal to Decision Procedure for Real Arithmetic 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ImplyR & Loop(" v ≥ 0 ")<(QE,QE, Seq & Choice & BoxAssign & DiffInv(" v ≥ 0 ") & Arithmetic & Close ) 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: ⇐ Prop & Loop(" v ≥ 0 ")<(QE,QE, ⇐ SymbolicExecution & DiffInv(" v ≥ 0 ") & Arithmetic & Close ) 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: Prop & Loop(" v ≥ 0 ")<(QE,QE, SymbolicExecution & ⇐ DiffInv(DIGen) & Arithmetic & Close ) 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: Prop & ⇐ Loop(LoopInvGen)<(QE,QE & SymbolicExecution & DiffInv(DIGen) & Arithmetic & Close ) 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: Prop & Loop(LoopInvGen)<(QE,QE & SymbolicExecution & DiffInv(DIGen) & ⇐ Arithmetic & Close ) 9

Tactics: Sketching and Searching Theorem v ≥ 0 ∧ A > 0 ∧ B > 0 → [ {{ a := A ∪ a := − B } ; { x ′ = v , v ′ = a & v ≥ 0 }} ∗ ] v ≥ 0 A Prototypical Proof Outline for a ϕ → [ { ctrl; plant } ∗ ] ψ Model: Prop & Loop(LoopInvGen) <(QE,QE & SymbolicExecution & DiffInv(DIGen) & Arithmetic & Close ) 9

Applications and Uses ◮ Education: Foundations of CPS Course at CMU ◮ ACAS X ◮ ModelPlex 10

Challenge 1: Steep learning curve ◮ Commonplace mathematical objects are not primitives e , π , sin ( x ), cos ( x ), . . . 11

Challenge 1: Steep learning curve ◮ Commonplace mathematical objects are not primitives e , π , sin ( x ), cos ( x ), . . . ◮ Subtle modeling mistakes are easy Vacuous models: [? H ] P , [ x ′ = θ ∧ H ] P , . . . Non-implementable models . . . 11

Challenge 1: Steep learning curve ◮ Commonplace mathematical objects are not primitives e , π , sin ( x ), cos ( x ), . . . ◮ Subtle modeling mistakes are easy Vacuous models: [? H ] P , [ x ′ = θ ∧ H ] P , . . . Non-implementable models . . . ◮ Abrupt transitions as models become more difficult ◮ From automated proving to interactive proving ◮ From web UI to custom tactics 11

Challenge 2: Large Proofs are Difficult and Fragile ACAS X ◮ Existing implementation: MDP ⇒ large lookup table. ◮ Idea: Verify model, compare to outputs. ◮ Possible! But painful. 12