ModelPlex: Verified Runtime Monitors and Verified Test Oracles for - PowerPoint PPT Presentation

ModelPlex: Verified Runtime Monitors and Verified Test Oracles for Safety of Cyber-Physical Systems Stefan Mitsch Computer Science Department, Carnegie Mellon University CPS V&V I&F Workshop 2017 May 12, 2017 joint work with Andr´ e Platzer Stefan Mitsch—ModelPlex 1 of 9

Formal Verification of Cyber-Physical Systems Analyze the physical effect of software Proof guarantees KeYmaera Control Proof Strategy Hybrid System Model Counterexample Sensors Actuators Monitor correctly checks deviation Discrete computation + continuous physics 6 9 4 0 − 1 t − 3 t 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 Stefan Mitsch—ModelPlex 2 of 9

Formal Verification of Cyber-Physical Systems Theorem proving ensures correct model Proof guarantees correct model KeYmaera X Proof Strategy Proof Hybrid System Monitor Model Specification Counterexample Monitor correctly checks deviation of model from reality Safety Proof Never collide Stefan Mitsch—ModelPlex 2 of 9

Formal Verification of Cyber-Physical Systems Runtime monitoring ensures model compliance KeYmaera X Control Proof Monitor Specification Counterexample Sensors Monitor Actuators checks deviation of model from reality Monitor desired effect + safe environment ◮ Runtime: ensure safety and detect anomalies ◮ Testing: generate and analyze test cases Stefan Mitsch—ModelPlex 2 of 9

How to Achieve Safety Guarantees at Runtime? Real CPS safe Proof Reachability Analysis . . . Verification Results Stefan Mitsch—ModelPlex 3 of 9

How to Achieve Safety Guarantees at Runtime? Real CPS safe abstract Model α ∗ Proof Control α ctrl v := v + 1 Reachability safe sense Analysis act . . . Plant α plant x ′ = v Verification Results Stefan Mitsch—ModelPlex 3 of 9

How to Achieve Safety Guarantees at Runtime? Real CPS safe synthesize abstract Model α ∗ Proof Control α ctrl v := v + 1 Reachability safe sense Analysis act . . . Plant α plant x ′ = v Verification Results Stefan Mitsch—ModelPlex 3 of 9

How to Achieve Safety Guarantees at Runtime? Real CPS safe synthesize abstract Model α ∗ Proof v := K p e ( t ) + � t 0 e ( τ ) d τ + K d de Reachability K i dt safe sense Analysis act x ′ ≤ v , v ′ = . . . Te xg xd n − 1 2 C d A ρ v 2 rw Verification Results Stefan Mitsch—ModelPlex 3 of 9

How to Achieve Safety Guarantees at Runtime? Real CPS Challenge safe ◮ Others may not satisfy the model assumptions ◮ Non-verified implementation may have bugs synthesize abstract Model α ∗ � Verification results about models Proof only apply if CPS fits to the model v := K p e ( t ) + � t 0 e ( τ ) d τ + K d de Reachability K i dt safe sense Analysis act x ′ ≤ v , v ′ = . . . Te xg xd n − 1 2 C d A ρ v 2 rw Verification Results Stefan Mitsch—ModelPlex 3 of 9

ModelPlex at Runtime Controller Sensors Actuators Stefan Mitsch—ModelPlex 4 of 9

ModelPlex at Runtime Controller ModelPlex Compliance Fallback Monitor Sensors Actuators Compliance Monitor Checks CPS for compliance with model at runtime Want: Monitor satisfied at runtime → Real state safe ModelPlex Which conditions guarantee safety? Derive monitoring conditions from model by proof Fallback Safe control, executed when monitor is not satisfied Stefan Mitsch—ModelPlex 4 of 9

Principle Behind a ModelPlex Monitor Model p v + v + ˆ check ∋ { v := − v . . . . . . . . . ∪ ? v = 0 } p + p + v p ′ = v ˆ measure measure evolve, e.g., p move p + prior state posterior state Stefan Mitsch—ModelPlex 5 of 9

Principle Behind a ModelPlex Monitor Hard to execute, impossible to check Model p v + v + ˆ check ∋ { v := − v . . . . . . . . . ∪ ? v = 0 } p + p + v p ′ = v ˆ measure measure evolve, e.g., p move p + prior state posterior state Stefan Mitsch—ModelPlex 5 of 9

Principle Behind a ModelPlex Monitor v + , ˆ p + ) Monitor: efficient arithmetic check F ( p , v , ˆ ⇑ derive Hard to execute, impossible to check Model p v + v + ˆ check ∋ { v := − v . . . . . . . . . ∪ ? v = 0 } p + p + v p ′ = v ˆ measure measure evolve, e.g., p move p + prior state posterior state Stefan Mitsch—ModelPlex 5 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α . . . i − 2 i − 1 i Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α ω ν Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α ω ν ( ω, ν ) ∈ ρ ( α ) reachability relation of α Semantical: Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? a prior state a posterior state ⊆ characterized by x + characterized by x Model α ω ν ( ω, ν ) ∈ ρ ( α ) Semantical: exists a run of α to a � Lemma state where x = x + ? = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? a prior state a posterior state ⊆ characterized by x + characterized by x Model α ω ν ( ω, ν ) ∈ ρ ( α ) Semantical: exists a run of α to a � Lemma state where x = x + ? = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): � d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: check at runtime (efficient) Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? a prior state a posterior state ⊆ characterized by x + characterized by x Model α ω ν Offline ( ω, ν ) ∈ ρ ( α ) Semantical: exists a run of α to a � Lemma state where x = x + ? = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: check at runtime (efficient) Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α ω ν Offline ( ω, ν ) ∈ ρ (if ( z > 7) y := − y else z ′ = y ) Semantical: � �� � α Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α ω ν Offline ( ω, ν ) ∈ ρ (if ( z > 7) y := − y else z ′ = y ) Semantical: � �� � � α = � if ( z > 7) y := − y else z ′ = y � ( y = y + ∧ z = z + ) ( ω, ν ) | Logic (d L ): Stefan Mitsch—ModelPlex 6 of 9

How to Construct Monitor F ( x , x + ) When are two states linked through a run of model α ? ⊆ Model α ω ν Offline ( ω, ν ) ∈ ρ (if ( z > 7) y := − y else z ′ = y ) Semantical: � �� � � α = � if ( z > 7) y := − y else z ′ = y � ( y = y + ∧ z = z + ) ( ω, ν ) | Logic (d L ): ⇑ = z > 7 ∧ − y = y + ∨ � z ≤ 7 ∧ z + y ∆ t = z + � Real arithmetic: ( ω, ν ) | Stefan Mitsch—ModelPlex 6 of 9

Logical Reductions for Model Safety Transfer Logic reduces CPS safety to runtime monitor with offline proof ⊆ Model α ω ν Offline ( ω, ν ) ∈ ρ ( α ) Semantical: � Lemma = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: Stefan Mitsch—ModelPlex 6 of 9

Logical Reductions for Model Safety Transfer Logic reduces CPS safety to runtime monitor with offline proof ⊆ Model α ω ν ν ∈ [ [ S ] ] Safe Offline ( ω, ν ) ∈ ρ ( α ) Semantical: � Lemma = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: Stefan Mitsch—ModelPlex 6 of 9

Logical Reductions for Model Safety Transfer Logic reduces CPS safety to runtime monitor with offline proof ⊆ Model α ω ν ω ∈ [ [ A ] ] Init Offline ( ω, ν ) ∈ ρ ( α ) Semantical: � Lemma = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: check at runtime (efficient) Stefan Mitsch—ModelPlex 6 of 9

Logical Reductions for Model Safety Transfer Logic reduces CPS safety to runtime monitor with offline proof ⊆ Model α d L proof A → [ α ] S ω ν Offline ( ω, ν ) ∈ ρ ( α ) Semantical: � Lemma = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: Stefan Mitsch—ModelPlex 6 of 9

Logical Reductions for Model Safety Transfer Logic reduces CPS safety to runtime monitor with offline proof ⊆ Model α Conclusion ω ν Runtime validation is required to guarantee safety Offline ( ω, ν ) ∈ ρ ( α ) Semantical: � Lemma = � α ( x ) � ( x = x + ) ( ω, ν ) | Logic (d L ): ⇑ d L proof = F ( x , x + ) ( ω, ν ) | Real arithmetic: Stefan Mitsch—ModelPlex 6 of 9