Pegasus: a framework for sound continuous invariant generation Andrew Sogokon 2 , 1 , Stefan Mitsch 1 , Yong Kiam Tan 1 , Katherine Cordwell 1 , e Platzer 1 and Andr´ 1 Carnegie Mellon University, USA 2 University of Southampton, UK FM 2019, 3rd World Congress on Formal Methods, Porto October 20, 2019
Introduction What this talk is about Theorem proving in cyber-physical systems (CPS). Why? Fully rigorous proofs of correctness . Important for safety-critical embedded systems. , Pegasus: a framework for sound continuous invariant generation 1/24
Introduction What this talk is about Theorem proving in cyber-physical systems (CPS). Why? Fully rigorous proofs of correctness . Important for safety-critical embedded systems. Problem : Theorem proving in CPS is not fully automatic . Safety verification relies on finding the right invariants . , Pegasus: a framework for sound continuous invariant generation 1/24
Invariants in verification invariant , Pegasus: a framework for sound continuous invariant generation 2/24
Invariants in verification inductive invariant invariant , Pegasus: a framework for sound continuous invariant generation 3/24
Continuous invariants ODEs: x ′ = f ( � x ) � x ∈ R n � Init ⊆ R n , Pegasus: a framework for sound continuous invariant generation 4/24
Continuous invariants ODEs: x ′ = f ( � x ) � x ∈ R n � Init ⊆ R n , Pegasus: a framework for sound continuous invariant generation 5/24
Checking continuous invariants Checking whether a formula defines a continuous (inductive) invariant is decidable (Liu, Zhan & Zhao, EMSOFT 2011). , Pegasus: a framework for sound continuous invariant generation 6/24
Checking continuous invariants Checking whether a formula defines a continuous (inductive) invariant is decidable (Liu, Zhan & Zhao, EMSOFT 2011). LZZ procedure yes/no formula, ODE , Pegasus: a framework for sound continuous invariant generation 6/24
Checking continuous invariants Checking whether a formula defines a continuous (inductive) invariant is decidable (Liu, Zhan & Zhao, EMSOFT 2011). LZZ procedure yes/no formula, ODE A complete axiomatization of continuous invariants in differential dynamic logic dL (Platzer & Tan, LICS 2018). , Pegasus: a framework for sound continuous invariant generation 6/24
Checking continuous invariants Checking whether a formula defines a continuous (inductive) invariant is decidable (Liu, Zhan & Zhao, EMSOFT 2011). LZZ procedure yes/no formula, ODE A complete axiomatization of continuous invariants in differential dynamic logic dL (Platzer & Tan, LICS 2018). formal proof dL prover prover formula, ODE of invariance ( KeYmaera X ) , Pegasus: a framework for sound continuous invariant generation 6/24
Handling decidable problems Design choices in proof assistants decision procedure axioms ⊢ goal goal tactics yes/no goal prover prover assistant assistant Formal proof using tactics Using external oracles , Pegasus: a framework for sound continuous invariant generation 7/24
Handling invariants Design choices in proof assistants LZZ procedure dL axioms ⊢ goal goal dL tactics yes/no goal KeYmaera X prover assistant assistant LCF-style “PVS-style” , Pegasus: a framework for sound continuous invariant generation 8/24
Handling invariants Design choices in proof assistants LZZ Less soundness-critical code procedure dL axioms ⊢ goal goal dL tactics yes/no goal KeYmaera X prover assistant assistant LCF-style “PVS-style” , Pegasus: a framework for sound continuous invariant generation 9/24
Generating continuous invariants Excellent progress made this decade on the invariant checking problem . { inv } ODE { inv } ( in dL inv → [ ODE ] inv ) , Pegasus: a framework for sound continuous invariant generation 10/24
Generating continuous invariants Excellent progress made this decade on the invariant checking problem . { inv } ODE { inv } ( in dL inv → [ ODE ] inv ) The invariant generation problem is much more difficult. { pre } ODE { post } ( in dL pre → [ ODE ] post ) , Pegasus: a framework for sound continuous invariant generation 10/24
Generating continuous invariants Excellent progress made this decade on the invariant checking problem . { inv } ODE { inv } ( in dL inv → [ ODE ] inv ) The invariant generation problem is much more difficult. { pre } ODE { post } ( in dL pre → [ ODE ] post ) pre → inv inv → [ ODE ] inv inv → post pre → [ ODE ] post , Pegasus: a framework for sound continuous invariant generation 10/24
Generating continuous invariants Excellent progress made this decade on the invariant checking problem . { inv } ODE { inv } ( in dL inv → [ ODE ] inv ) The invariant generation problem is much more difficult. { pre } ODE { post } ( in dL pre → [ ODE ] post ) pre → inv inv → [ ODE ] inv inv → post pre → [ ODE ] post Practical bottleneck for proof automation. , Pegasus: a framework for sound continuous invariant generation 10/24
Generating continuous invariants In theory, we can search for invariants using template formulas : a 0 + a 1 x + a 2 y + a 3 x 2 + a 4 xy + a 5 y 2 < 0 ∧ b 0 + b 1 x + b 2 y ≥ 0 , Pegasus: a framework for sound continuous invariant generation 11/24
Generating continuous invariants In theory, we can search for invariants using template formulas : a 0 + a 1 x + a 2 y + a 3 x 2 + a 4 xy + a 5 y 2 < 0 ∧ b 0 + b 1 x + b 2 y ≥ 0 Searching for the coefficients using algorithms from real algebraic geometry (e.g. CAD). , Pegasus: a framework for sound continuous invariant generation 11/24
Generating continuous invariants In theory, we can search for invariants using template formulas : a 0 + a 1 x + a 2 y + a 3 x 2 + a 4 xy + a 5 y 2 < 0 ∧ b 0 + b 1 x + b 2 y ≥ 0 Searching for the coefficients using algorithms from real algebraic geometry (e.g. CAD). ∗ (However, this is hardly practical) Doubly-exponential time complexity in the number of variables (here the number of coefficients ). , Pegasus: a framework for sound continuous invariant generation 11/24
Generating continuous invariants In theory, we can search for invariants using template formulas : a 0 + a 1 x + a 2 y + a 3 x 2 + a 4 xy + a 5 y 2 < 0 ∧ b 0 + b 1 x + b 2 y ≥ 0 Searching for the coefficients using algorithms from real algebraic geometry (e.g. CAD). ∗ (However, this is hardly practical) Doubly-exponential time complexity in the number of variables (here the number of coefficients ). More practical alternatives are needed. , Pegasus: a framework for sound continuous invariant generation 11/24
Generating continuous invariants More practical methods for invariant generation exist. These are ◮ more specialized, ◮ incomplete, ◮ have different strengths and limitations, ◮ create a wide spectrum for what can be tried. , Pegasus: a framework for sound continuous invariant generation 12/24
Generating continuous invariants More practical methods for invariant generation exist. These are ◮ more specialized, ◮ incomplete, ◮ have different strengths and limitations, ◮ create a wide spectrum for what can be tried. Challenge : ◮ build a system for navigating this spectrum , ◮ use it to improve proof automation in KeYmaera X. , Pegasus: a framework for sound continuous invariant generation 12/24
Continuous invariant generator Pegasus is an automatic continuous invariant generator. Pegasus { pre } ODE { post } continuous invariant (hopefully) http://pegasus.keymaeraX.org As of version 1.0, Pegasus (implemented in Wolfram Language) has ◮ a simple continuous safety verification problem classifier, ◮ implementation of invariant generation methods, ◮ a strategy for combining invariant generation methods, ◮ proof hints for KeYmaera X. , Pegasus: a framework for sound continuous invariant generation 13/24
Sound integration architecture , Pegasus: a framework for sound continuous invariant generation 14/24
Discrete abstraction Partition R n into discrete states S 1 , . . . , S k defined by some predicates. Compute the discrete transition relation. , Pegasus: a framework for sound continuous invariant generation 15/24
Qualitative analysis In essence : discrete abstraction using information in the problem. Some sources of predicates: ◮ right-hand sides of ODEs, their factors, etc. ◮ functions defining the pre/postcondition ◮ physically meaningful quantities (e.g. divergence of the vector field) , Pegasus: a framework for sound continuous invariant generation 16/24
First integrals and Darboux polynomials Conserved quantities in the continuous system. Functions p such that p ′ = 0 (i.e. the rate of change of p w.r.t. f is 0). Searching for polynomial first integrals (of bounded degree) can be done using linear algebra. , Pegasus: a framework for sound continuous invariant generation 17/24
First integrals and Darboux polynomials Conserved quantities in the continuous system. Functions p such that p ′ = 0 (i.e. the rate of change of p w.r.t. f is 0). Searching for polynomial first integrals (of bounded degree) can be done using linear algebra. Darboux polynomials : p ′ = αp , where α is a polynomial. , Pegasus: a framework for sound continuous invariant generation 17/24
Recommend
More recommend
