ModelPlex: Verified Runtime Validation of Verified Cyber-Physical - - PowerPoint PPT Presentation

▶
modelplex verified runtime validation of verified cyber
SMART_READER_LITE
LIVE PREVIEW

ModelPlex: Verified Runtime Validation of Verified Cyber-Physical - - PowerPoint PPT Presentation

Apr 17, 2023 341 likes •846 views

ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models Stefan Mitsch Andr e Platzer Computer Science Department, Carnegie Mellon University RV14, Sept. 24, 2014 Simplex for Hybrid System Models Stefan Mitsch ,

slide-1
SLIDE 1

ModelPlex: Verified Runtime Validation

  • f Verified Cyber-Physical System Models

Stefan Mitsch Andr´ e Platzer

Computer Science Department, Carnegie Mellon University

RV’14, Sept. 24, 2014 Simplex for Hybrid System Models

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 1 of 15

slide-2
SLIDE 2

Formal Verification in CPS Development

Real CPS Proof Reachability Analysis . . . Verification Results safe

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

slide-3
SLIDE 3

Formal Verification in CPS Development

Real CPS Model α∗ Control αctrl v := v + 1 Plant αplant x′ = v sense act abstract Proof Reachability Analysis . . . Verification Results safe safe

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

slide-4
SLIDE 4

Formal Verification in CPS Development

Real CPS Model α∗ Control αctrl v := v + 1 Plant αplant x′ = v sense act abstract Proof Reachability Analysis . . . Verification Results safe safe Challenge Verification results about models

  • nly apply if CPS fits to the model

Verifiably correct runtime model validation

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 15

slide-5
SLIDE 5

ModelPlex Runtime Model Validation

ModelPlex ensures that verification results about models apply to CPS implementations i−1 i i+1 Model α ctrl plant . . . model adequate? control safe? until next cycle? turn predict

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 3 of 15

slide-6
SLIDE 6

ModelPlex Runtime Model Validation

ModelPlex ensures that verification results about models apply to CPS implementations i−1 i i+1 Model α ctrl plant . . . model adequate? control safe? until next cycle? turn predict Contributions Verification results transfer to CPS when validating model compliance Compliance with model is characterizable in logic Compliance formula transformed by proof to executable monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 3 of 15

slide-7
SLIDE 7

ModelPlex at Runtime

. . .

Sensors Controller Actuators “Simplex for Models”

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 4 of 15

slide-8
SLIDE 8

ModelPlex at Runtime

. . .

ModelPlex Sensors Controller Compliance Monitor Fallback Actuators Compliance Monitor Checks CPS for compliance with model at runtime Model Monitor: model adequate? Controller Monitor: control safe? Prediction Monitor: until next cycle? Fallback Safe action, executed when monitor is not satisfied Challenge What conditions do the monitors need to check to be safe? “Simplex for Models”

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 4 of 15

slide-9
SLIDE 9

ModelPlex Approach

. . .

Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states

  • bservation
  • bservation
  • bservation

. . . i−1 i i+1 . . . Model α Model α ⊆ ⊆ CPS Model time Detect non-compliance as soon as possible to initiate safe fallback actions

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

slide-10
SLIDE 10

ModelPlex Approach

. . .

Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states

  • bservation
  • bservation
  • bservation

. . . i−1 i i+1 . . . Model α Model α ⊆ ⊆ fits to CPS Model time Detect non-compliance as soon as possible to initiate safe fallback actions

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

slide-11
SLIDE 11

ModelPlex Approach

. . .

Is current CPS behavior included in the behavior of the model? CPS observed through sensors Model describes behavior of CPS between states

  • bservation
  • bservation
  • bservation

. . . i−1 i i+1 . . . Model α Model α ⊆ ⊆ fits to CPS Model time Detect non-compliance as soon as possible to initiate safe fallback actions Challenge Model describes behavior, but at runtime we get sampled observations Transform model into observation-monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 15

slide-12
SLIDE 12

Outline

i−1 i i+1 Model α ctrl plant . . . turn predict Model Monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 6 of 15

slide-13
SLIDE 13

Monitor Characterization

. . .

When are two states linked through a run of model α? i−1 i Model α ⊆

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

slide-14
SLIDE 14

Monitor Characterization

. . .

When are two states linked through a run of model α? i−1 i a prior state char- acterized by x− a posterior state characterized by x+ Model α ⊆ (x−, x+) ∈ ρ(α) Semantical: reachability relation of α

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

slide-15
SLIDE 15

Monitor Characterization

. . .

When are two states linked through a run of model α? i−1 i a prior state char- acterized by x− a posterior state characterized by x+ Model α ⊆ Offline (x−, x+) ∈ ρ(α) Semantical: Theorem (x = x−) → α(x) (x = x+) Logic (dL): starting at x = x− exists a run of α to a state where x = x+

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

slide-16
SLIDE 16

Monitor Characterization

. . .

When are two states linked through a run of model α? i−1 i a prior state char- acterized by x− a posterior state characterized by x+ Model α ⊆ Offline (x−, x+) ∈ ρ(α) Semantical: Theorem (x = x−) → α(x) (x = x+) Logic (dL): starting at x = x− exists a run of α to a state where x = x+

  • F (x−, x+)

Real arithmetic: check at runtime (efficient) dL proof

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

slide-17
SLIDE 17

Monitor Characterization

. . .

When are two states linked through a run of model α? i−1 i a prior state char- acterized by x− a posterior state characterized by x+ Model α ⊆ Offline (x−, x+) ∈ ρ(α) Semantical: Theorem (x = x−) → α(x) (x = x+) Logic (dL): starting at x = x− exists a run of α to a state where x = x+ ⇑ F (x−, x+) Real arithmetic: check at runtime (efficient) dL proof

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 15

slide-18
SLIDE 18

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically i−1 i prior state x− posterior state x+ Model α proof attempt (x = x−) → α(x) (x = x+)

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-19
SLIDE 19

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically Model α i−1 i prior state x− posterior state x+ climb descend proof attempt (x = x−) → climb ∪ descend (x = x+) ∪climbφ ∨ descendφ climb ∪ descendφ

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-20
SLIDE 20

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically Model α i−1 i prior state x− posterior state x+ climb descend proof attempt (x = x−) → climb ∪ descend (x = x+) ∨ climb (x = x+) descend (x = x+)

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-21
SLIDE 21

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically Model α i−1 i prior state x− posterior state x+ climb descend proof attempt (x = x−) → climb ∪ descend (x = x+) ∨ climb (x = x+) descend (x = x+) F1 (x−, x+) F2 (x−, x+)

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-22
SLIDE 22

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically Model α i−1 i prior state x− posterior state x+ climb descend proof attempt (x = x−) → climb ∪ descend (x = x+) ∨ climb (x = x+) descend (x = x+) F1 (x−, x+) F2 (x−, x+) F1(x−, x+) ∨ F2(x−, x+) Monitor: The subgoals that cannot be proved express all the conditions on the relations of variables imposed by the model execute at runtime

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-23
SLIDE 23

Provably Correct Synthesis of Monitors

. . .

Proof calculus of dL executes models symbolically Model α i−1 i prior state x− posterior state x+ climb descend proof attempt (x = x−) → climb ∪ descend (x = x+) ∨ climb (x = x+) descend (x = x+) F1 (x−, x+) F2 (x−, x+) F1(x−, x+) ∨ F2(x−, x+) Monitor: The subgoals that cannot be proved express all the conditions on the relations of variables imposed by the model execute at runtime Model Monitor Immediate detection of model violation Mitigates safety issues with safe fallback action

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 15

slide-24
SLIDE 24

Outline

For typical models ctrl; plant we can check earlier i−1 i i+1 Model α ctrl plant . . . turn predict Controller Monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 9 of 15

slide-25
SLIDE 25

Early Compliance Checks for Controllers

. . .

i−1 i prior state x− posterior state x+ Model α Model Monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 15

slide-26
SLIDE 26

Early Compliance Checks for Controllers

. . .

Model α i−1 i prior state x− ctrl plant Controller Monitor before actuation posterior state x+ (x−, x+) ∈ ρ(ctrl) Semantical: reachability relation of ctrl

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 15

slide-27
SLIDE 27

Early Compliance Checks for Controllers

. . .

Model α Offline i−1 i prior state x− ctrl plant Controller Monitor before actuation posterior state x+ (x−, x+) ∈ ρ(ctrl) Semantical: Theorem (x = x−) → ctrl(x) (x = x+) Logic (dL): starting at x = x− exists a run of ctrl to a state where x = x+

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 15

slide-28
SLIDE 28

Early Compliance Checks for Controllers

. . .

Model α Offline i−1 i prior state x− ctrl plant Controller Monitor before actuation posterior state x+ (x−, x+) ∈ ρ(ctrl) Semantical: Theorem (x = x−) → ctrl(x) (x = x+) Logic (dL): starting at x = x− exists a run of ctrl to a state where x = x+ ⇑ dL proof F (x−, x+) Real arithmetic:

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 15

slide-29
SLIDE 29

Early Compliance Checks for Controllers

. . .

Model α Offline i−1 i prior state x− ctrl plant Controller Monitor before actuation posterior state x+ (x−, x+) ∈ ρ(ctrl) Semantical: Theorem (x = x−) → ctrl(x) (x = x+) Logic (dL): starting at x = x− exists a run of ctrl to a state where x = x+ ⇑ dL proof F (x−, x+) Real arithmetic: Controller Monitor Immediate detection of unsafe control before actuation Safe execution of unverified implementations in perfect environments

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 15

slide-30
SLIDE 30

Outline

Safe despite evolution with disturbance? i−1 i i+1 Model α ctrl plant . . . turn predict Prediction Monitor

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 11 of 15

slide-31
SLIDE 31

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− posterior state x+ ctrl plant

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-32
SLIDE 32

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− . . . . . . Prediction Monitor before actuation posterior state x+ ctrl plant plant of the form

  • x′ = θ & H
  • Stefan Mitsch, Andr´

e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-33
SLIDE 33

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− . . . . . . Prediction Monitor before actuation posterior state x+ ctrl plant time bound t := 0;

  • x′ = θ, t′ = 1 & H ∧ t ≤ ε
  • states reachable

within ε time

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-34
SLIDE 34

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− . . . . . . Prediction Monitor before actuation posterior state x+ ctrl plant disturbance t := 0;

  • θ − δ ≤ x′ ≤ θ + δ, t′ = 1 & H ∧ t ≤ ε
  • states reachable

within ε time

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-35
SLIDE 35

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− . . . . . . Prediction Monitor before actuation posterior state x+ ctrl plant disturbance t := 0;

  • θ − δ ≤ x′ ≤ θ + δ, t′ = 1 & H ∧ t ≤ ε
  • states reachable

within ε time Offline (x = x−) → ctrl(x)

  • x = x+ ∧ [plant(x)]ϕ
  • Invariant state ϕ implies safety

(known from safety proof) Logic (dL): ⇑ dL proof F (x−, x+) Real arithmetic:

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-36
SLIDE 36

Compliance Checks despite Disturbance

. . .

Model α i−1 i prior state x− . . . . . . Prediction Monitor before actuation posterior state x+ ctrl plant disturbance t := 0;

  • θ − δ ≤ x′ ≤ θ + δ, t′ = 1 & H ∧ t ≤ ε
  • states reachable

within ε time Offline (x = x−) → ctrl(x)

  • x = x+ ∧ [plant(x)]ϕ
  • Invariant state ϕ implies safety

(known from safety proof) Logic (dL): ⇑ dL proof F (x−, x+) Real arithmetic: Prediction Monitor with Disturbance Proactive detection of unsafe control before actuation despite disturbance Safety in realistic environments

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 12 of 15

slide-37
SLIDE 37

Evaluation

Evaluated on hybrid system case studies

Water tank Cruise control

c

Volvo

Traffic control

c

ASFINAG

Ground robots

c

Black-I Robotics

Train control

c

Harald Eisenberger

Model sizes: 5–16 variables Monitor sizes: 20–150 operations

with automated simplification to remove redundant checks improvement potential: simplification for any monitor

Theorem: ModelPlex is decidable and monitor synthesis fully automated in important classes

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 13 of 15

slide-38
SLIDE 38

Conclusion

ModelPlex ensures that proofs apply to real CPS Validate model compliance Characterize compliance with model in logic Prover transforms compliance formula to executable monitor i−1 i i+1 Model α ctrl plant . . . Model Monitor model adequate? Controller Monitor control safe? Prediction Monitor until next cycle?

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 14 of 15

slide-39
SLIDE 39

Proof Model safe! safe! Stefan Mitsch smitsch@cs.cmu.edu www.cs.cmu.edu/∼smitsch

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 15 of 15

slide-40
SLIDE 40

Theorems

State Recall (Online Monitoring) Model Monitor Correctness Controller Monitor Correctness Prediction Monitor Correctness Decidability and Computability

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 1 of 11

slide-41
SLIDE 41

State Recall

V set of variables whose state we want to recall Υ−

V ≡ x∈V x = x− characterizes a state prior to a run of α (fresh

variables x− occur solely in Υ−

V and recall this state)

Υ+

V ≡ x∈V x = x+ characterizes the posterior states (fresh x+)

Programs hybrid program α, α∗ repeats α arbitrarily many times Assume all consecutive pairs of states (νi−1, νi) ∈ ρ(α) of n ∈ N+ executions, whose valuations are recalled with Υi

V ≡ x∈V x = xi and Υi−1 V

are plausible w.r.t. the model α, i. e., | =

1≤i≤n

  • Υi−1

V

→ αΥi

V

  • with Υ−

V = Υ0 V and

Υ+

V = Υn V .

Then the sequence of states originates from an α∗ execution from Υ0

V to Υn V , i. e., |

= Υ−

V → α∗Υ+ V .

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 2 of 11

slide-42
SLIDE 42

Model Monitor Correctness

| = φ → [α∗]ψ α∗ is provably safe Definitions Let Vm = BV (α) ∪ FV (ψ); let ν0, ν1, ν2, ν3 . . . ∈ Rn be a sequence of states, with ν0 | = φ and that agree on Σ\Vm,

  • i. e., ν0|Σ\Vm = νk|Σ\Vm for all k.

Model Monitor (ν, νi+1) | = χm as χm evaluated in the state resulting from ν by interpreting x+ as νi+1(x) for all x ∈ Vm, i. e., ννi+1(x)

x+

| = χm Correctness If (νi, νi+1) | = χm for all i < n then we have νn | = ψ where χm ≡

  • φ|const → αΥ+

Vm

  • and φ|const denotes the conditions of φ that involve only

constants that do not change in α, i. e., FV (φ|const) ∩ BV (α) = ∅.

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 3 of 11

slide-43
SLIDE 43

Controller Monitor Correctness

| = φ → [α∗]ψ α∗ is provably safe with invariant ϕ Definitions Let α of the canonical form αctrl; αplant; let ν | = φ|const ∧ ϕ, as checked by χm; let ˜ ν be a post-controller state. Controller Monitor (ν, ˜ ν) | = χc as χc evaluated in the state resulting from ν by interpreting x+ as ˜ ν(x) for all x ∈ Vc, i. e., ν˜

ν(x) x+

| = χc Correctness If (ν, ˜ ν) | = χc where χc ≡ φ|const → αctrlΥ+

Vc

then we have that (ν, ˜ ν) ∈ ρ(αctrl) and ˜ ν | = ϕ.

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 4 of 11

slide-44
SLIDE 44

Prediction Monitor Correctness

| = φ → [α∗]ψ α∗ is provably safe with invariant ϕ Definitions Let Vp = BV (α) ∪ FV ([α]ϕ). Let ν | = φ|const ∧ ϕ, as checked by χm. Further assume ˜ ν such that (ν, ˜ ν) ∈ ρ(αctrl), as checked by χc. Prediction Monitor (ν, ˜ ν) | = χp as χp evaluated in the state resulting from ν by interpreting x+ as ˜ ν(x) for all x ∈ Vp, i. e., ν˜

ν(x) x+

| = χp Correctness If (ν, ˜ ν) | = χp where χp ≡ (φ|const ∧ ϕ) → αctrl(Υ+

Vp ∧ [αδplant]ϕ)

then we have for all (˜ ν, ω) ∈ ρ(αδplant) that ω | = ϕ

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 5 of 11

slide-45
SLIDE 45

Decidability and Computability

Assumptions canonical models α ≡ αctrl; αplant without nested loops with solvable differential equations in αplant disturbed plants αδplant with constant additive disturbance δ Decidability Monitor correctness is decidable, i. e., the formulas χm → αΥ+

V

χc → αctrlΥ+

V

χp → α(Υ+

V ∧ [αδplant]φ)

are decidable Computability Monitor synthesis is computable, i. e., the functions synthm : αΥ+

V → χm

synthc : αctrlΥ+

V → χc

synthp : α(Υ+

V ∧ [αδplant]φ) → χp

are computable

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 6 of 11

slide-46
SLIDE 46

Water Tank Example: Monitor Conjecture

Variables

x current level m maximum level ε control cycle f flow

Model and Safety Property

0 ≤ x ≤ m ∧ ε > 0

  • φ

→

f := ∗; ? −1 ≤ f ≤ m−x

ε

;

t := 0; (x′ = f , t′ = 1 & x ≥ 0 ∧ t ≤ ε)

∗

(0 ≤ x ≤ m)

  • ψ

Model Monitor Specification Conjecture

ε > 0

φ|const

→

  • f := ∗; ?

−1 ≤ f ≤ m−x

ε

;

t := 0; (x′ = f , t′ = 1 & x ≥ 0 ∧ t ≤ ε)

  • Υ+

Vm

  • (x = x+ ∧ f = f + ∧ t =

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 7 of 11

slide-47
SLIDE 47

Water Tank Example: Nondeterministic Assignment

Proof Rules

(∗)∃Xx := Xφ x := ∗φ

1

(∃r)Γ ⊢ φ(θ), ∃x φ(x), ∆ Γ ⊢ ∃x φ(x), ∆

2

(Wr) Γ ⊢ ∆ Γ ⊢ φ, ∆

1 X is a new logical variable 2 θ is an arbitrary term, often a new (existential) logical variable X.

Sequent Deduction

φ ⊢ f := F?−1 ≤ f ≤ m−x

ε plantΥ+ ∃r,Wrφ ⊢ ∃Ff := F?−1 ≤ f ≤ m−x ε plantΥ+ ∗ φ ⊢ f := ∗; ?−1 ≤ f ≤ m−x ε plantΥ+

φ ⊢ f := f + ?−1 ≤ f ≤ m−x

ε plantΥ+ ∃r,Wr . . .

with Opt. 1 (anticipate f = f + from Υ+) w/o Opt. 1

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 8 of 11

slide-48
SLIDE 48

Water Tank Example: Differential Equations

Proof Rules

(′)∃T≥0

(∀0≤˜

t≤T x := y(˜ t)H) ∧ x := y(T)φ

  • x′ = θ & Hφ

1

(QE) QE(φ) φ

2

1 T and ˜

t are fresh logical variables and x := y(T) is the discrete assignment belonging to the solution y of the differential equation with constant symbol x as symbolic initial value

2 iff φ ≡ QE(φ), φ is a first-order real arithmetic formula, QE(φ) is an equivalent

quantifier-free formula

Sequent Deduction

φ ⊢ F = f + ∧ x + = x + Ft+ ∧ t+ ≥ 0 ∧ x ≥ 0 ∧ ε ≥ t+ ≥ 0 ∧ Ft+ + x ≥ 0

QE φ ⊢ ∀0≤˜

t≤T (x + f +˜ t ≥ 0 ∧ ˜ t ≤ ε) ∧ F = f + ∧ x + = x + Ft+ ∧ t+ = t+

∃r,Wrφ ⊢ ∃T≥0((∀0≤˜

t≤T (x + f +˜ t ≥ 0 ∧ ˜ t ≤ ε)) ∧ F = f + ∧ (x + = x + FT ∧ t+ = T))

′ φ ⊢ f := F; t := 0{x ′ = f , t′ = 1 & x ≥ 0 ∧ t ≤ ε}Υ+ Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 9 of 11

slide-49
SLIDE 49

Evaluation

Case Study Model Monitor

  • dim. proof size

dim. steps (open seq.) proof steps size (branches) w/ Opt. 1 auto (branches) χm Water tank 5 38 (4) 3 16 (2) 20 (2) 64 (5) 32 Cruise control 11 969 (124) 7 127 (13) 597 (21) 19514 (1058) 1111 Speed limit 9 410 (30) 6 487 (32) 5016 (126) 64311 (2294) 19850 χc Water tank 5 38 (4) 1 12 (2) 14 (2) 40 (3) 20 Cruise control 11 969 (124) 7 83 (13) 518 (106) 5840 (676) 84 Ground robot 14 3350 (225) 11 94 (10) 1210 (196) 26166 (2854) 121 ETCS safety 16 193 (10) 13 162 (13) 359 (37) 16770 (869) 153 χp Water tank 8 80 (6) 1 135 (4) N/A 307 (12) 43

Theorem: ModelPlex is decidable and monitor synthesis can be automated in important classes

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 10 of 11

slide-50
SLIDE 50

Monitor Synthesis Algorithm

Algorithm 1: ModelPlex monitor synthesis

input : A hybrid program α, a set of variables V ⊆ BV (α), an initial condition φ such that | = φ → [α∗]ψ.

  • utput: A monitor χm such that |

= χm ≡ φ|const → αΥ+. begin S ← − ∅ Υ+ ← −

x∈V x = x + with fresh variables x + i

// Monitor conjecture G ← − {⊢ φ|const → αΥ+}

1

while G = ∅ do // Analyze monitor conjecture foreach g ∈ G do G ← − G − {g} if g is first-order then if | = g then S ← − S ∪ {g} else ˜ g ← − apply dL proof rule to g G ← − G ∪ {˜ g} χm ← −

s∈S s

// Collect open sequents

Stefan Mitsch, Andr´ e Platzer—ModelPlex: Verified Runtime Validation of Verified Cyber-Physical System Models 11 of 11