Logical Foundations of Cyber-Physical Systems Andr Platzer Andr - - PowerPoint PPT Presentation

▶
logical foundations of cyber physical systems
SMART_READER_LITE
LIVE PREVIEW

Logical Foundations of Cyber-Physical Systems Andr Platzer Andr - - PowerPoint PPT Presentation

May 19, 2023 250 likes •1.45k views

07: Control Loops & Invariants Logical Foundations of Cyber-Physical Systems Andr Platzer Logical Foundations of Cyber-Physical Systems Andr Platzer Andr Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 1 / 16

slide-1
SLIDE 1

07: Control Loops & Invariants

Logical Foundations of Cyber-Physical Systems

Logical Foundations of Cyber-Physical Systems

André Platzer

André Platzer

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 1 / 16

slide-2
SLIDE 2

Outline

1

Learning Objectives

2

Induction for Loops Iteration Axiom Induction Axiom Induction Rule for Loops Loop Invariants Simple Example Contextual Soundness Requirements

3

Operationalize Invariant Construction Bouncing Ball Rescuing Misplaced Constants Safe Quantum

4

Summary

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 2 / 16

slide-3
SLIDE 3

Outline

1

Learning Objectives

2

Induction for Loops Iteration Axiom Induction Axiom Induction Rule for Loops Loop Invariants Simple Example Contextual Soundness Requirements

3

Operationalize Invariant Construction Bouncing Ball Rescuing Misplaced Constants Safe Quantum

4

Summary

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 2 / 16

slide-4
SLIDE 4

Learning Objectives

Control Loops & Invariants

CT M&C CPS rigorous reasoning for repetitions identifying and expressing invariants global vs. local reasoning relating iterations to invariants finitely accessible infinities

  • perationalize invariant construction

splitting & generalizations control loops feedback mechanisms dynamics of iteration semantics of control loops

  • perational effects of control

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 3 / 16

slide-5
SLIDE 5

Outline

1

Learning Objectives

2

Induction for Loops Iteration Axiom Induction Axiom Induction Rule for Loops Loop Invariants Simple Example Contextual Soundness Requirements

3

Operationalize Invariant Construction Bouncing Ball Rescuing Misplaced Constants Safe Quantum

4

Summary

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 3 / 16

slide-6
SLIDE 6

Iteration Axiom

[∗] [α∗]P ↔ P ∧[α][α∗]P ω ν α∗

P ∧[α][α∗]P

α [α∗]P α α

P

α∗

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 4 / 16

slide-7
SLIDE 7

Iteration Axiom

[∗] [α∗]P ↔ P ∧[α][α∗]P ω ν α∗

P ∧[α][α∗]P

α [α∗]P α α

P

α∗

Problem: Proof for [α∗]P needs proof of [α][α∗]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 4 / 16

slide-8
SLIDE 8

Induction Axiom

Lemma ( )

I [α∗]P ↔ P ∧

ω ν

P

α∗ α α α

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-9
SLIDE 9

Induction Axiom

Lemma ( )

I [α∗]P ↔ P ∧

(P → [α]P) ω ν

P

α∗ α α α α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-10
SLIDE 10

Induction Axiom

Lemma ( )

I [α∗]P ↔ P ∧

(P → [α]P) ω ν

P

α∗ α

P

α α α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-11
SLIDE 11

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α α α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-12
SLIDE 12

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α

P

α α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-13
SLIDE 13

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α

P

α α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-14
SLIDE 14

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α

P

α

P

α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-15
SLIDE 15

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α

P

α

P

α∗

P → [α]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-16
SLIDE 16

Induction Axiom

Lemma (I is sound)

I [α∗]P ↔ P ∧[α∗](P → [α]P)

ω ν

P

α∗ α

P

α

P

α

P

α∗

P → [α]P Problem: Inductive proof for [α∗]P needs proof of [α∗](P → [α]P)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 5 / 16

slide-17
SLIDE 17

Induction Rule for Loops

Generalize induction step [α∗](P → [α]P) by Gödel G P

[α]P Lemma (Loop induction rule ind is sound)

ind P ⊢ [α]P P ⊢ [α∗]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 6 / 16

slide-18
SLIDE 18

Induction Rule for Loops

Generalize induction step [α∗](P → [α]P) by Gödel G P

[α]P Lemma (Loop induction rule ind is sound)

ind P ⊢ [α]P P ⊢ [α∗]P

Proof (Derived rule). ∗

idP ⊢ P

P ⊢ [α]P

→R

⊢ P → [α]P

G P ⊢ [α∗](P → [α]P)

∧R

P ⊢ P ∧[α∗](P → [α]P)

I

P ⊢ [α∗]P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 6 / 16

slide-19
SLIDE 19

Induction Rule for Loops

Generalize induction step [α∗](P → [α]P) by Gödel G P

[α]P Lemma (Loop induction rule ind is sound)

ind P ⊢ [α]P P ⊢ [α∗]P

Proof (Derived rule). ∗

idP ⊢ P

P ⊢ [α]P

→R

⊢ P → [α]P

G P ⊢ [α∗](P → [α]P)

∧R

P ⊢ P ∧[α∗](P → [α]P)

I

P ⊢ [α∗]P Problem: Rule ind is no equivalence. Its use of G may lose information:

[α∗](P → [α]P) true but P ⊢ [α]P is not valid.

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 6 / 16

slide-20
SLIDE 20

Loop Invariants

Generalize postcondition to strong loop invariant J by M[·] P → Q

[α]P → [α]Q Lemma (Loop invariant rule loop is sound)

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆ ω ν α∗

J

[α∗]P α

J → [α]J

α α

J → P

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 7 / 16

slide-21
SLIDE 21

Loop Invariants

Generalize postcondition to strong loop invariant J by M[·] P → Q

[α]P → [α]Q Lemma (Loop invariant rule loop is sound)

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆ Proof (Derived rule).

J ⊢ [α]J

ind J ⊢ [α∗]J

→RΓ ⊢ J → [α∗]J,∆

Γ ⊢ J,∆

J ⊢ P

M[·][α∗]J ⊢ [α∗]P

→LΓ,J → [α∗]J ⊢ [α∗]P,∆

cut

Γ ⊢ [α∗]P,∆

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 7 / 16

slide-22
SLIDE 22

Loop Invariants

Generalize postcondition to strong loop invariant J by M[·] P → Q

[α]P → [α]Q Lemma (Loop invariant rule loop is sound)

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆ Proof (Derived rule).

J ⊢ [α]J

ind J ⊢ [α∗]J

→RΓ ⊢ J → [α∗]J,∆

Γ ⊢ J,∆

J ⊢ P

M[·][α∗]J ⊢ [α∗]P

→LΓ,J → [α∗]J ⊢ [α∗]P,∆

cut

Γ ⊢ [α∗]P,∆

Problem: Finding invariant J can be a challenge. Misplaced [α∗] suggests that J needs to carry along info about α∗ history.

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 7 / 16

slide-23
SLIDE 23

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-24
SLIDE 24

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-25
SLIDE 25

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-26
SLIDE 26

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0 weaker: Changes immediately

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-27
SLIDE 27

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0 weaker: Changes immediately

3

J ≡ x ≥ 0∧ y ≥ 0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-28
SLIDE 28

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0 weaker: Changes immediately

3

J ≡ x ≥ 0∧ y ≥ 0 no: y may become negative if x < y

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-29
SLIDE 29

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0 weaker: Changes immediately

3

J ≡ x ≥ 0∧ y ≥ 0 no: y may become negative if x < y

4

J ≡ x ≥ y ∧ y ≥ 0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-30
SLIDE 30

A Simple Discrete Loop Example

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

→R

loop

x≥8∧ 5≥y ∧ y≥0 ⊢ J J ⊢ [x := x + y; y := x − 2· y]J J ⊢ x ≥ 0 x≥8∧ 5≥y ∧ y≥0 ⊢ [(x := x + y; y := x − 2· y)∗]x ≥ 0

⊢ x≥8∧ 5≥y ∧ y≥0 → [(x := x + y; y := x − 2· y)∗]x ≥ 0

1

J ≡ x ≥ 0 stronger: Lacks info about y

2

J ≡ x ≥ 8∧ 5 ≥ y ∧ y ≥ 0 weaker: Changes immediately

3

J ≡ x ≥ 0∧ y ≥ 0 no: y may become negative if x < y

4

J ≡ x ≥ y ∧ y ≥ 0 correct loop invariant

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 8 / 16

slide-31
SLIDE 31

Forgot to Add Sequent Context Γ,∆ to Premises

Γ ⊢ J,∆ Γ??,J ⊢ [α]J,∆?? Γ??,J ⊢ P,∆?? Γ ⊢ [α∗]P,∆

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 9 / 16

slide-32
SLIDE 32

Forgot to Add Sequent Context Γ,∆ to Premises

Γ ⊢ J,∆ Γ??,J ⊢ [α]J,∆?? Γ??,J ⊢ P,∆?? Γ ⊢ [α∗]P,∆

  • x = 0 ⊢ x ≤ 1

x = 0,x ≤ 1 ⊢ [x := x + 1]x ≤ 1 x ≤ 1 ⊢ x ≤ 1 x = 0,x ≤ 1 ⊢ [(x := x + 1)∗]x ≤ 1

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 9 / 16

slide-33
SLIDE 33

Forgot to Add Sequent Context Γ,∆ to Premises

Γ ⊢ J,∆ Γ??,J ⊢ [α]J,∆?? Γ??,J ⊢ P,∆?? Γ ⊢ [α∗]P,∆

  • x = 0 ⊢ x ≤ 1

x = 0,x ≤ 1 ⊢ [x := x + 1]x ≤ 1 x ≤ 1 ⊢ x ≤ 1 x = 0,x ≤ 1 ⊢ [(x := x + 1)∗]x ≤ 1

  • x = 0 ⊢ x ≥ 0

x ≥ 0 ⊢ [x := x + 1]x ≥ 0 x = 0,x ≥ 0 ⊢ x = 0 x = 0 ⊢ [(x := x + 1)∗]x = 0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 9 / 16

slide-34
SLIDE 34

Forgot to Add Sequent Context Γ,∆ to Premises

Γ ⊢ J,∆ Γ??,J ⊢ [α]J,∆?? Γ??,J ⊢ P,∆?? Γ ⊢ [α∗]P,∆

  • x = 0 ⊢ x ≤ 1

x = 0,x ≤ 1 ⊢ [x := x + 1]x ≤ 1 x ≤ 1 ⊢ x ≤ 1 x = 0,x ≤ 1 ⊢ [(x := x + 1)∗]x ≤ 1

  • x = 0 ⊢ x ≥ 0

x ≥ 0 ⊢ [x := x + 1]x ≥ 0 x = 0,x ≥ 0 ⊢ x = 0 x = 0 ⊢ [(x := x + 1)∗]x = 0 Unsound! Be careful where your assumptions go,

  • r your CPS might go where it shouldn’t.

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 9 / 16

slide-35
SLIDE 35

Outline

1

Learning Objectives

2

Induction for Loops Iteration Axiom Induction Axiom Induction Rule for Loops Loop Invariants Simple Example Contextual Soundness Requirements

3

Operationalize Invariant Construction Bouncing Ball Rescuing Misplaced Constants Safe Quantum

4

Summary

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 9 / 16

slide-36
SLIDE 36

Proving Quantum the Acrophobic Bouncing Ball

A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-37
SLIDE 37

Proving Quantum the Acrophobic Bouncing Ball

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-38
SLIDE 38

Proving Quantum the Acrophobic Bouncing Ball

j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-39
SLIDE 39

Proving Quantum the Acrophobic Bouncing Ball

[;]

j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-40
SLIDE 40

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-41
SLIDE 41

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪] j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-42
SLIDE 42

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)

j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-43
SLIDE 43

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R [;] j(x,v) ⊢ [?x=0][v:=−cv]j(x,v)

j(x,v) ⊢ [?x=0;v:=−cv]j(x,v) j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-44
SLIDE 44

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R [;] [?],→R j(x,v),x=0 ⊢ [v:=−cv]j(x,v)

j(x,v) ⊢ [?x=0][v:=−cv]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v) j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-45
SLIDE 45

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R [;] [?],→R [:=]

j(x,v),x=0 ⊢ j(x,−cv) j(x,v),x=0 ⊢ [v:=−cv]j(x,v) j(x,v) ⊢ [?x=0][v:=−cv]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v) j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-46
SLIDE 46

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R [;] [?],→R [:=]

j(x,v),x=0 ⊢ j(x,−cv) j(x,v),x=0 ⊢ [v:=−cv]j(x,v) j(x,v) ⊢ [?x=0][v:=−cv]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)

[?]

j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-47
SLIDE 47

Proving Quantum the Acrophobic Bouncing Ball

[;]

MR

j(x,v) ⊢ [grav]j(x,v) [∪]

∧R [;] [?],→R [:=]

j(x,v),x=0 ⊢ j(x,−cv) j(x,v),x=0 ⊢ [v:=−cv]j(x,v) j(x,v) ⊢ [?x=0][v:=−cv]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)

[?]

j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ [?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv]j(x,v)∧[?x=0]j(x,v) j(x,v) ⊢ [?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav][?x=0;v:=−cv ∪?x=0]j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v)

loop

A ⊢ j(x,v) j(x,v) ⊢ [grav;(?x=0;v:=−cv ∪?x=0)]j(x,v) j(x,v) ⊢ B(x,v) A ⊢ [

  • grav;(?x=0;v:=−cv ∪?x=0)

∗]B(x,v)

A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 10 / 16

slide-48
SLIDE 48

Proving Quantum the Acrophobic Bouncing Ball

A ⊢ j(x,v) j(x,v) ⊢ [grav](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ B(x,v) A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-49
SLIDE 49

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-50
SLIDE 50

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-51
SLIDE 51

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-52
SLIDE 52

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-53
SLIDE 53

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-54
SLIDE 54

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-55
SLIDE 55

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-56
SLIDE 56

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-57
SLIDE 57

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-58
SLIDE 58

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-59
SLIDE 59

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ j(x,v) j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v)) j(x,v),x=0 ⊢ j(x,(−cv)) j(x,v),x=0 ⊢ j(x,v) j(x,v) ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x A ≡ 0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 B(x,v) ≡ 0 ≤ x ∧ x ≤ H grav ≡ {x′ = v,v′ = −g &x ≥ 0}

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-60
SLIDE 60

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0) 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-61
SLIDE 61

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0) 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-62
SLIDE 62

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1... 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-63
SLIDE 63

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1... 2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-64
SLIDE 64

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0

2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-65
SLIDE 65

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0

2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-66
SLIDE 66

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

because g > 0

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-67
SLIDE 67

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

because g > 0

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-68
SLIDE 68

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0

2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

because g > 0

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-69
SLIDE 69

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0

2gx=2gH−v2 ∧ x≥0 ⊢ [{x′=v,v′=−g &x≥0}](2gx=2gH−v2 ∧ x≥0)

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

because g > 0

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-70
SLIDE 70

Proving Quantum the Acrophobic Bouncing Ball

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 ≥ c ≥ 0 ⊢ 2gx=2gH−v2 ∧ x≥0

j(x,v) ⊢ [{x′=v,v′=−g &x≥0}](j(x,v))

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−(−cv)2 ∧ x≥0

if c = 1...

2gx=2gH−v2 ∧ x≥0,x=0 ⊢ 2gx=2gH−v2 ∧ x≥0 2gx=2gH−v2 ∧ x≥0 ⊢ 0 ≤ x ∧ x ≤ H

because g > 0

1

j(x,v) ≡ x ≥ 0 weaker: fails postcondition if x > H

2

j(x,v) ≡ 0 ≤ x ∧ x ≤ H weak: fails ODE if v ≫ 0

3

j(x,v) ≡ x = 0∧ v = 0 strong: fails initial condition if x > 0

4

j(x,v) ≡ x = 0∨ x = H ∧ v = 0 no space for intermediate states

5

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0 works: implicitly links v and x

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 11 / 16

slide-71
SLIDE 71

Proving Quantum the Acrophobic Bouncing Ball

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-72
SLIDE 72

Proving Quantum the Acrophobic Bouncing Ball

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-73
SLIDE 73

Proving Quantum the Acrophobic Bouncing Ball

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-74
SLIDE 74

Proving Quantum the Acrophobic Bouncing Ball

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-75
SLIDE 75

Proving Quantum the Acrophobic Bouncing Ball

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-76
SLIDE 76

Proving Quantum the Acrophobic Bouncing Ball

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-77
SLIDE 77

Proving Quantum the Acrophobic Bouncing Ball

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-78
SLIDE 78

Proving Quantum the Acrophobic Bouncing Ball

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v) j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-79
SLIDE 79

Proving Quantum the Acrophobic Bouncing Ball

∧R

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-80
SLIDE 80

Proving Quantum the Acrophobic Bouncing Ball

∧R R

∗

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-81
SLIDE 81

Proving Quantum the Acrophobic Bouncing Ball

∧R R

∗

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2 id

∗

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-82
SLIDE 82

Proving Quantum the Acrophobic Bouncing Ball

∧R R

∗

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2 id

∗

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v) Is Quantum done with his safety proof?

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-83
SLIDE 83

Proving Quantum the Acrophobic Bouncing Ball

∧R R

∗

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2 id

∗

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v) Is Quantum done with his safety proof? Oh no! The solutions we sneaked into [′] only solve the ODE/IVP if x = H,v = 0 which assumption j(x,v) can’t guarantee!

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-84
SLIDE 84

Proving Quantum the Acrophobic Bouncing Ball

∧R R

∗

2gx=2gH−v2 ⊢ 2g(H− g

2t2)=2gH−(gt)2 id

∗

H− g

2t2≥0 ⊢ H− g 2t2≥0

2gx=2gH−v2∧x≥0,H− g

2t2≥0 ⊢ 2g(H− g 2t2)=2gH−(gt)2∧(H− g 2t2)≥0

j(x,v),t≥0,H− g

2t2≥0 ⊢ j(H− g

2 t2,−gt)

→R

j(x,v) ⊢ t≥0 → H− g

2t2≥0 → j(H− g

2 t2,−gt)

∀R

j(x,v) ⊢ ∀t≥0(H− g

2t2≥0 → j(H− g

2 t2,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2](x≥0 → j(x,−gt))

[:=]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2][v:=−gt](x≥0 → j(x,v))

[;]

j(x,v) ⊢ ∀t≥0[x:=H− g

2t2;v:=−gt](x≥0 → j(x,v))

[′]

j(x,v) ⊢ [x′=v,v′=−g &x≥0]j(x,v) Is Quantum done with his safety proof? Oh no! The solutions we sneaked into [′] only solve the ODE/IVP if x = H,v = 0 which assumption j(x,v) can’t guarantee! Never use solutions without proof!

Todo redo proof with true solution André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 12 / 16

slide-85
SLIDE 85

Clumsy Quantum Misplaced the Constants

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-86
SLIDE 86

Clumsy Quantum Misplaced the Constants

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

3

J ≡ j(x,v)∧ p as loop invariant

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-87
SLIDE 87

Clumsy Quantum Misplaced the Constants

∗

RA ⊢ j(x,v)∧p []∧

j(x,v)∧ p ⊢ [α](j(x,v)∧ p)

Rj(x,v)∧p ⊢ B(x,v)

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

3

J ≡ j(x,v)∧ p as loop invariant

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-88
SLIDE 88

Clumsy Quantum Misplaced the Constants

[]∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q ∗

RA ⊢ j(x,v)∧p

above j(x,v)∧p ⊢ [α]j(x,v) Vj(x,v)∧p ⊢ [α]p

∧R

j(x,v)∧ p ⊢ [α]j(x,v)∧[α]p

[]∧

j(x,v)∧ p ⊢ [α](j(x,v)∧ p)

Rj(x,v)∧p ⊢ B(x,v)

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

3

J ≡ j(x,v)∧ p as loop invariant

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-89
SLIDE 89

Clumsy Quantum Misplaced the Constants

[]∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

V p → [α]p

(FV(p)∩ BV(α) = / 0) ∗

RA ⊢ j(x,v)∧p

above j(x,v)∧p ⊢ [α]j(x,v)

∗

Vj(x,v)∧p ⊢ [α]p

∧R

j(x,v)∧ p ⊢ [α]j(x,v)∧[α]p

[]∧

j(x,v)∧ p ⊢ [α](j(x,v)∧ p)

Rj(x,v)∧p ⊢ B(x,v)

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

3

J ≡ j(x,v)∧ p as loop invariant

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-90
SLIDE 90

Clumsy Quantum Misplaced the Constants

[]∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

V p → [α]p

(FV(p)∩ BV(α) = / 0) ∗

RA ⊢ j(x,v)∧p

above j(x,v)∧p ⊢ [α]j(x,v)

∗

Vj(x,v)∧p ⊢ [α]p

∧R

j(x,v)∧ p ⊢ [α]j(x,v)∧[α]p

[]∧

j(x,v)∧ p ⊢ [α](j(x,v)∧ p)

∗

Rj(x,v)∧p ⊢ B(x,v)

loop

A ⊢ [α∗]B(x,v)

1

j(x,v) ≡ 2gx=2gH−v2 ∧ x≥0

2

p ≡ c=1∧ g>0

3

J ≡ j(x,v)∧ p as loop invariant Note: constants c = 1∧ g > 0 that never change are usually elided from J

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 13 / 16

slide-91
SLIDE 91

Quantum the Provably Safe Bouncing Ball

Proposition (Quantum can bounce around safely)

0 ≤ x ∧ x = H ∧ v = 0∧ g > 0∧ 1 = c →

[

  • {x′ = v,v′ = −g &x ≥ 0};(?x = 0;v:=−cv ∪?x = 0)

∗](0 ≤ x ∧x ≤ H)

requires(0 ≤ x ∧ x = H ∧ v = 0) requires(g > 0∧ 1 = c) ensures(0 ≤ x ∧ x ≤ H)

  • {x′ = v,v′ = −g &x ≥ 0};

(?x = 0;v:=−cv ∪?x = 0)) ∗@invariant(2gx = 2gH − v2 ∧ x ≥ 0)

Invariant Contracts Invariants play a crucial rôle in CPS design. Capture them if you can. Use @invariant() contracts in your hybrid programs.

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 14 / 16

slide-92
SLIDE 92

Outline

1

Learning Objectives

2

Induction for Loops Iteration Axiom Induction Axiom Induction Rule for Loops Loop Invariants Simple Example Contextual Soundness Requirements

3

Operationalize Invariant Construction Bouncing Ball Rescuing Misplaced Constants Safe Quantum

4

Summary

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 14 / 16

slide-93
SLIDE 93

Invariants

The lion’s share of understanding comes from understanding what does change (variants/progress measures) and what doesn’t change (invariants).

Invariants are a fundamental force of CS Variants are another fundamental force of CS

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 15 / 16

slide-94
SLIDE 94

Summary: Loops, Generalizations, Splittings

I [α∗]P ↔ P ∧[α∗](P → [α]P) G P

[α]P

M[·] P → Q

[α]P → [α]Q

loop Γ ⊢ J,∆ J ⊢ [α]J J ⊢ P

Γ ⊢ [α∗]P,∆

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆ []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

V p → [α]p (FV(p)∩ BV(α) = /

0)

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 16 / 16

slide-95
SLIDE 95

Outline

5

Appendix Iteration Axiom Iterations & Splitting the Box Iteration & Generalizations

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 16 / 16

slide-96
SLIDE 96

Iteration Axiom

compositional semantics ⇒ compositional rules!

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 17 / 16

slide-97
SLIDE 97

Loops of Proofs: Iterations

[∗] [α∗]P ↔ P ∧[α][α∗]P

A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-98
SLIDE 98

Loops of Proofs: Iterations

[∗] [α∗]P ↔ P ∧[α][α∗]P

[∗]

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-99
SLIDE 99

Loops of Proofs: Iterations

[∗] [α∗]P ↔ P ∧[α][α∗]P

[∗] [∗]

A ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-100
SLIDE 100

Loops of Proofs: Iterations

[∗] [α∗]P ↔ P ∧[α][α∗]P

[∗] [∗] [∗]

A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-101
SLIDE 101

Loops of Proofs: Iterations & Splitting the Box

[∗] [α∗]P ↔ P ∧[α][α∗]P []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

[∗] [∗] [∗] []∧

A ⊢ B ∧[α]B ∧[α][α](B ∧[α][α∗]B) A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-102
SLIDE 102

Loops of Proofs: Iterations & Splitting the Box

[∗] [α∗]P ↔ P ∧[α][α∗]P []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

[∗] [∗] [∗] []∧ []∧

A ⊢ B ∧[α]B ∧[α]([α]B ∧[α][α][α∗]B) A ⊢ B ∧[α]B ∧[α][α](B ∧[α][α∗]B) A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-103
SLIDE 103

Loops of Proofs: Iterations & Splitting the Box

[∗] [α∗]P ↔ P ∧[α][α∗]P []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

[∗] [∗] [∗] []∧ []∧ []∧

A ⊢ B ∧[α]B ∧[α][α]B ∧[α][α][α][α∗]B A ⊢ B ∧[α]B ∧[α]([α]B ∧[α][α][α∗]B) A ⊢ B ∧[α]B ∧[α][α](B ∧[α][α∗]B) A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-104
SLIDE 104

Loops of Proofs: Iterations & Splitting the Box

[∗] [α∗]P ↔ P ∧[α][α∗]P []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

[∗] [∗] [∗] []∧ []∧ []∧ ∧R

A ⊢ B A ⊢ [α]B A ⊢ [α][α]B A ⊢ [α][α][α][α∗]B A ⊢ B ∧[α]B ∧[α][α]B ∧[α][α][α][α∗]B A ⊢ B ∧[α]B ∧[α]([α]B ∧[α][α][α∗]B) A ⊢ B ∧[α]B ∧[α][α](B ∧[α][α∗]B) A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-105
SLIDE 105

Loops of Proofs: Iterations & Splitting the Box

[∗] [α∗]P ↔ P ∧[α][α∗]P []∧ [α](P ∧ Q) ↔ [α]P ∧[α]Q

[∗] [∗] [∗] []∧ []∧ []∧ ∧R

A ⊢ B A ⊢ [α]B A ⊢ [α][α]B A ⊢ [α][α][α][α∗]B A ⊢ B ∧[α]B ∧[α][α]B ∧[α][α][α][α∗]B A ⊢ B ∧[α]B ∧[α]([α]B ∧[α][α][α∗]B) A ⊢ B ∧[α]B ∧[α][α](B ∧[α][α∗]B) A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

1

Simple approach . . . if we don’t mind unrolling until the end of time

2

Useful for finding counterexamples

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 18 / 16

slide-106
SLIDE 106

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

[∗] [∗] [∗]

A ⊢ B ∧[α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-107
SLIDE 107

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-108
SLIDE 108

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J1 J1 ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-109
SLIDE 109

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J1 ∧R J1 ⊢ B J1 ⊢ [α](B ∧[α][α∗]B) J1 ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-110
SLIDE 110

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J1 ∧R J1 ⊢ B MR J1 ⊢ [α]J2 J2 ⊢ B ∧[α][α∗]B J1 ⊢ [α](B ∧[α][α∗]B) J1 ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-111
SLIDE 111

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J1 ∧R J1 ⊢ B MR J1 ⊢ [α]J2 ∧R J2 ⊢ B J2 ⊢ [α][α∗]B J2 ⊢ B ∧[α][α∗]B J1 ⊢ [α](B ∧[α][α∗]B) J1 ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-112
SLIDE 112

Loops of Proofs: Iterations & Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J1 ∧R J1 ⊢ B MR J1 ⊢ [α]J2 ∧R J2 ⊢ B J2 ⊢ [α]J3

...

J2 ⊢ [α][α∗]B J2 ⊢ B ∧[α][α∗]B J1 ⊢ [α](B ∧[α][α∗]B) J1 ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-113
SLIDE 113

Loops of Proofs: Common Generalizations

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J

∧R

J ⊢ B MR J ⊢ [α]J

∧R

J ⊢ B J ⊢ [α]J

...

J ⊢ [α][α∗]B J ⊢ B ∧[α][α∗]B J ⊢ [α](B ∧[α][α∗]B) J ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-114
SLIDE 114

Loops of Proofs: Extracting a Proof Rule

J ⊢ B A ⊢ [α∗]B

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J

∧R

J ⊢ B MR J ⊢ [α]J

∧R

J ⊢ B J ⊢ [α]J

...

J ⊢ [α][α∗]B J ⊢ B ∧[α][α∗]B J ⊢ [α](B ∧[α][α∗]B) J ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-115
SLIDE 115

Loops of Proofs: Extracting a Proof Rule

J ⊢ [α]J J ⊢ B A ⊢ [α∗]B

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J

∧R

J ⊢ B MR J ⊢ [α]J

∧R

J ⊢ B J ⊢ [α]J

...

J ⊢ [α][α∗]B J ⊢ B ∧[α][α∗]B J ⊢ [α](B ∧[α][α∗]B) J ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-116
SLIDE 116

Loops of Proofs: Extracting a Proof Rule

A ⊢ J J ⊢ [α]J J ⊢ B A ⊢ [α∗]B

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J

∧R

J ⊢ B MR J ⊢ [α]J

∧R

J ⊢ B J ⊢ [α]J

...

J ⊢ [α][α∗]B J ⊢ B ∧[α][α∗]B J ⊢ [α](B ∧[α][α∗]B) J ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-117
SLIDE 117

Loops of Proofs: Loop Invariants

loop A ⊢ J J ⊢ [α]J J ⊢ B A ⊢ [α∗]B Invariant J generalized intermediate condition

[∗] [α∗]P ↔ P ∧[α][α∗]P

MR Γ ⊢ [α]Q,∆ Q ⊢ P

Γ ⊢ [α]P,∆

[∗] [∗] [∗] ∧R

A ⊢ B MR A ⊢ [α]J

∧R

J ⊢ B MR J ⊢ [α]J

∧R

J ⊢ B J ⊢ [α]J

...

J ⊢ [α][α∗]B J ⊢ B ∧[α][α∗]B J ⊢ [α](B ∧[α][α∗]B) J ⊢ B ∧[α](B ∧[α][α∗]B) A ⊢ [α]

  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α]
  • B ∧[α](B ∧[α][α∗]B)
  • A ⊢ B ∧[α](B ∧[α][α∗]B)

A ⊢ B ∧[α][α∗]B A ⊢ [α∗]B

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16

slide-118
SLIDE 118

André Platzer. Logical Foundations of Cyber-Physical Systems. Springer, Switzerland, 2018. URL: http://www.springer.com/978-3-319-63587-3,

doi:10.1007/978-3-319-63588-0.

André Platzer. Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics. Springer, Heidelberg, 2010.

doi:10.1007/978-3-642-14509-4.

André Platzer. The complete proof theory of hybrid systems. In LICS, pages 541–550, Los Alamitos, 2012. IEEE.

doi:10.1109/LICS.2012.64.

André Platzer (CMU) LFCPS/07: Control Loops & Invariants LFCPS/07 19 / 16