Reachability Analysis in the KeYmaera X Theorem Prover SNR 2017 | - - PowerPoint PPT Presentation

▶
reachability analysis in the keymaera x theorem prover
SMART_READER_LITE
LIVE PREVIEW

Reachability Analysis in the KeYmaera X Theorem Prover SNR 2017 | - - PowerPoint PPT Presentation

Jul 25, 2023 353 likes •936 views

Reachability Analysis in the KeYmaera X Theorem Prover SNR 2017 | Uppsala, Sweden | April 22, 2017 Nathan Fulton Other System Contributors: Stefan Mitsch, Andr Platzer, Brandon Bohrer, Yong Kiam Tan, Jan-David Quesel, ... Trustworthy

slide-1
SLIDE 1

Reachability Analysis in the KeYmaera X Theorem Prover

SNR 2017 | Uppsala, Sweden | April 22, 2017 Nathan Fulton

Other System Contributors: Stefan Mitsch, André Platzer, Brandon Bohrer, Yong Kiam Tan, Jan-David Quesel, ...

slide-2
SLIDE 2

Trustworthy Foundations Interactive Reachability Analysis

➢ Demonstration ➢ Bellerophon language and library

Automation and Tooling Conclusions & Resources

slide-3
SLIDE 3

Trustworthy Foundations

KeYmaera X enables trustworthy automation for hybrid systems analysis:

  • A well defined logical foundations,
  • implemented in a small trustworthy core
  • that ensures correctness of automation and tooling.
slide-4
SLIDE 4

Trustworthy Foundations

Hybrid Programs

a := t

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

slide-5
SLIDE 5

Trustworthy Foundations

Hybrid Programs

a := t

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

a;b

a;b a b

slide-6
SLIDE 6

Trustworthy Foundations

Hybrid Programs

a := t ?P

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

a;b

a;b a b If P is true: no change If P is false: terminate

slide-7
SLIDE 7

Trustworthy Foundations

Hybrid Programs

a := t a∪b ?P

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

a;b

a;b a b If P is true: no change If P is false: terminate

slide-8
SLIDE 8

Trustworthy Foundations

Hybrid Programs

a := t a∪b ?P a*

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

a;b

a;b a b a ...a... If P is true: no change If P is false: terminate

slide-9
SLIDE 9

Trustworthy Foundations

Hybrid Programs

a := t a∪b ?P a* x’=f

a=a0 b=b0 c=c0

...

a=t b=b0 c=c0

...

x=x0 ... x=F(0) ... x=F(T) ... ⋮

a;b

a;b a b a ...a... If P is true: no change If P is false: terminate

slide-10
SLIDE 10

Trustworthy Foundations

Hello, World

{ {?Dive ∪ r := rp}; t:=0; {x’ = v, V’ = f(v,g,r), t’=1 & 0≤x & t≤T} }*

Control: Continue diving if safe, else open parachute. Plant: Downward velocity determined by gravity, air resistance.

x v’=f(v,g,r)

slide-11
SLIDE 11

Trustworthy Foundations

Hello, World

{ {?Dive ∪ r := rp}; t:=0; {x’ = v, V’ = f(v,g,r), t’=1 & 0≤x & t≤T} }*

Control: Continue diving if safe, else open parachute. Plant: Downward velocity determined by gravity, air resistance.

x v’=f(v,g,r)

slide-12
SLIDE 12

Trustworthy Foundations

Hello, World

{ {?Dive ∪ r := rp}; t:=0; {x’ = v, V’ = f(v,g,r), t’=1 & 0≤x & t≤T} }*

Control: Continue diving if safe, else open parachute. Plant: Downward velocity determined by gravity, air resistance.

x v’=f(v,g,r)

slide-13
SLIDE 13

Trustworthy Foundations

Hello, World

{ {?Dive ∪ r := rp}; t:=0; {x’ = v, V’ = f(v,g,r), t’=1 & 0≤x & t≤T} }*

Control: Continue diving if safe, else open parachute. Plant: Downward velocity determined by gravity, air resistance.

x v’=f(v,g,r)

slide-14
SLIDE 14

Trustworthy Foundations

Hello, World

{ {?Dive ∪ r := rp}; t:=0; {x’ = v, V’ = f(v,g,r), t’=1 & 0≤x & t≤T} }*

Control: Continue diving if safe, else open parachute. Plant: Downward velocity determined by gravity, air resistance.

x v’=f(v,g,r)

slide-15
SLIDE 15

Trustworthy Foundations

Reachability Specifications

[a]P

“after every execution of a, P”

<a>P

“after some execution of a, P”

slide-16
SLIDE 16

(Dive & g>0 & …)→ [{ {?Dive ∪ r := rp}; {x’ = v, V’ = f(v,g,r) & 0≤x} }*](x=0→m≤v)

x v’=f(v,g,r)

Trustworthy Foundations

Reachability Specifications

slide-17
SLIDE 17

(Dive & g>0 & …)→ [{ {?Dive ∪ r := rp}; {x’ = v, V’ = f(v,g,r) & 0≤x} }*](x=0→m≤v)

x v’=f(v,g,r) If the parachuter is on the ground, their speed is safe (m≤v≤0)

Trustworthy Foundations

Reachability Specifications

slide-18
SLIDE 18

Introduction to Differential Dynamic Logic

Dynamical Axioms

[x:=t]f(x) ↔ f(t) [a;b]P ↔ [a][b]P [a∪b]P ↔ ([a]P & [b]P) [a*]P ↔ (J→P & J→[b]J) [x’=f&H]P ↔ H→P

...

slide-19
SLIDE 19

Introduction to Differential Dynamic Logic

Trusted Core

[x:=t]f(x) ↔ f(t) [a;b]P ↔ [a][b]P [a∪b]P ↔ ([a]P & [b]P) [a*]P↔(J→P & J→[b]J) [x’=f&H]P ↔ H→P ...

AXIOM BASE

KeYmaera X Core

Q.E.D.

slide-20
SLIDE 20

Introduction to Differential Dynamic Logic

Trustworthy Implementations

[x:=t]f(x) ↔ f(t) [a;b]P ↔ [a][b]P [a∪b]P ↔ ([a]P & [b]P) [a*]P ↔ (J→P & J→[b]J) [x’=f&H]P ↔ H→P ...

AXIOM BASE

KeYmaera X Core

Q.E.D. Automated Analyses Control Software Tooling

slide-21
SLIDE 21

Introduction to Differential Dynamic Logic

Prover Core Comparison Tool Trusted LOC (approx.)

KeYmaera X 1,682 (out of 100,000+) KeYmaera 65,989 Isabelle/Pure 8,113 Coq 20,000 HSolver 20,000 dReal 50,000 SpaceEx 100,000

slide-22
SLIDE 22

Interactive Reachability Analysis in KeYmaera X

KeYmaera X enables interactive verification and tool development:

slide-23
SLIDE 23

Interactive Reachability Analysis in KeYmaera X

KeYmaera X enables interactive verification and tool development:

  • A standard library of common proof

techniques.

slide-24
SLIDE 24

Interactive Reachability Analysis in KeYmaera X

KeYmaera X enables interactive verification and tool development:

  • A standard library of common proof

techniques.

  • A combinator language/library for

decomposing theorems and composing proof strategies.

slide-25
SLIDE 25

Interactive Reachability Analysis in KeYmaera X

Bellerophon

Tactic Meaning prop Applies propositional reasoning exhaustively. unfold Symbolically executes discrete, loop-free programs. loop(J, i) Applies loop invariance axiom to position i. dI,dG,dC,dW Reasoning principles for differential equations.

slide-26
SLIDE 26

Interactive Reachability Analysis in KeYmaera X

Bellerophon

Tactic Meaning prop Applies propositional reasoning exhaustively. unfold Symbolically executes discrete, loop-free programs. loop(J, 1) Applies loop invariance axiom to position i. dI,dG,dC,dW Reasoning principles for differential equations. 100+

slide-27
SLIDE 27

Interactive Reachability Analysis in KeYmaera X

Bellerophon

Combinator Meaning A ; B Execute A on current goal, then execute B on the result. A | B Try executing A on current goal. If A fails, execute B on current goal. A* Run A until it no longer applies. A<( B0,B1, … ,BN ) Execute A on current goal to create N subgoals. Run Bi on subgoal i. Tactic Meaning prop Applies propositional reasoning exhaustively. unfold Symbolically executes discrete, loop-free programs. loop(J, i) Applies loop invariance axiom to position i. dI,dG,dC,dW Reasoning principles for differential equations. 100+

slide-28
SLIDE 28

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions

(Dive & g>0 & …)→ [{ }*](x=0→m≤v)

slide-29
SLIDE 29

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions

(Dive & g>0 & …)→ [{ }*](x=0→m≤v) prop ; loop(J,1) (Dive & g>0 & …)→ J J → x=0→m≤v J→[ ]J

Loop invariant holds initially Loop invariant is preserved Loop invariant implies safety

slide-30
SLIDE 30

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions

(Dive & g>0 & …)→ [{ }*](x=0→m≤v) prop ; loop(J,1) (Dive & g>0 & …)→ J J → x=0→m≤v J→[ ]J

Loop invariant holds initially Loop invariant is preserved Loop invariant implies safety

slide-31
SLIDE 31

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions

(Dive & g>0 & …)→ [{ }*](x=0→m≤v) prop ; loop(J,1) (Dive & g>0 & …)→ J J → x=0→m≤v J→[ ]J u n f

  • l

d J & Dive & r=ra→ [x’=v,v’=...]J J & r=rp→ [x’=v,v’=...]J

slide-32
SLIDE 32

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions

(Dive & g>0 & …)→ [{ }*](x=0→m≤v) prop ; loop(J,1) (Dive & g>0 & …)→ J J → x=0→m≤v J→[ ]J u n f

  • l

d J & Dive & r=ra→ [x’=v,v’=...]J J & r=rp→ [x’=v,v’=...]J

slide-33
SLIDE 33

Interactive Reachability Analysis in KeYmaera X

Isolating Interesting Questions prop ; loop(J, 1) <( QE, /* Real arith. solver */ QE, Unfold <( … /* parachute open case */ … /* parachute closed case */ ) )

slide-34
SLIDE 34

Interactive Reachability Analysis in KeYmaera X

Differential Induction J = v > -sqrt(g/pr) > m & … Parachute Open Case: v ≥ v0 - gt ≥ v0 - gT > -sqrt(g/pr) x v’=rv2-g Inductive invariants

slide-35
SLIDE 35

Interactive Reachability Analysis in KeYmaera X

Differential Induction DI Axiom: [x’=f&H]P↔(P & (H→[x’:=f]P’))

slide-36
SLIDE 36

Interactive Reachability Analysis in KeYmaera X

Differential Induction DI Axiom: [x’=f&H]P↔(P & (H→[x’:=f]P’)) Example: [v’=rpv2-g,t’=1]v ≥ v0 - gt

slide-37
SLIDE 37

Interactive Reachability Analysis in KeYmaera X

Differential Induction DI Axiom: [x’=f&H]P↔(P & (H→[x’:=f]P’)) Example: [v’=rpv2-g,t’=1]v ≥ v0 - gt ↔ … ↔ [v’:=rpv2-g][t’:=1]v’ ≥ -g*t’ ↔ rpv2-g ≥ -g ↔ rp≥0

slide-38
SLIDE 38

Interactive Reachability Analysis in KeYmaera X

Differential Induction DI Axiom: [x’=f&H]P↔(P & (H→[x’:=f]P’)) Example: [v’=rpv2-g,t’=1]v ≥ v0 - gt ↔ … ↔ [v’:=rpv2-g][t’:=1]v’ ≥ -g*t’ ↔ rpv2-g ≥ -g ↔ H→rp≥0

Side derivation: (v ≥ v0 - gt)’ ↔ (v)’≥ (v0 - gt)’ ↔ (v)’≥ (v0 - gt)’ ↔ (v)’≥ (v0)’-(gt) ’ ↔

(v)’≥(v

0)’- (t(g)’+g(t’)) ↔

V’ ≥v0’- (tg’+gt’)

dI Tactic:

H=rp≥0 & ra≥0 & g>0 & ...

slide-39
SLIDE 39

Interactive Reachability Analysis in KeYmaera X

Differential Induction DI Axiom: [x’=f&H]P↔(P & (H→[x’:=f]P’)) Example: [v’=rpv2-g,t’=1]v ≥ v0 - gt ↔ … ↔ [v’:=rpv2-g][t’:=1]v’ ≥ -g*t’ ↔ rpv2-g ≥ -g ↔ H→rp≥0 Tactics recover a useful level of abstraction.

Side derivation: (v ≥ v0 - gt)’ ↔ (v)’≥ (v0 - gt)’ ↔ (v)’≥ (v0 - gt)’ ↔ (v)’≥ (v0)’-(gt) ’ ↔

(v)’≥(v

0)’- (t(g)’+g(t’)) ↔

V’ ≥v0’- (tg’+gt’) H=rp≥0 & ra≥0 & g>0 & ...

dI Tactic:

slide-40
SLIDE 40

Interactive Reachability Analysis in KeYmaera X

Reasoning about Differential Equations

Pedantry is the price of trust.

slide-41
SLIDE 41

Interactive Reachability Analysis in KeYmaera X

Reasoning about Differential Equations

Pedantry is the price of trust. Bellerophon automates pedantic deductions.

slide-42
SLIDE 42

Automation and Tooling

Hybrid Systems Analyses can be built

  • n top of KeYmaera X.

Examples:

  • ODE Solver
  • Runtime Monitoring
slide-43
SLIDE 43

Toward Automated Deduction

Solving Differential Equations

[x:=t]f(x) ↔ f(t) [a;b]P ↔ [a][b]P [a∪b]P ↔ ([a]P & [b]P) [a*]P ↔ (J→P & J→[b]J) [x’=f&H]P ↔ H→P ...

AXIOM BASE

KeYmaera X Core Q.E.D.

Untrusted ODE Solver Axiomatic Solver (Bellerophon Program)

1. Use untrusted code to find a conjecture. 2. Prove the conjecture systematically.

slide-44
SLIDE 44

Toward Automated Deduction

ModelPlex Tactic

slide-45
SLIDE 45

Toward Automated Deduction

Learning how to be Safe =>

slide-46
SLIDE 46

Toward Automated Deduction

Other Proof Automation & Tooling

  • Automated Analysis for nonlinear systems:

○ Pretty decent automation for systems with univariate nonlinearities. ○ Heuristics for multi-variate systems.

slide-47
SLIDE 47

Toward Automated Deduction

Other Proof Automation & Tooling

  • Automated Analysis for nonlinear systems:

○ Pretty decent automation for systems with univariate nonlinearities. ○ Heuristics for multi-variate systems.

  • Heuristic loop invariant generation for control loops
slide-48
SLIDE 48

Toward Automated Deduction

Other Proof Automation & Tooling

  • Automated Analysis for nonlinear systems:

○ Pretty decent automation for systems with univariate nonlinearities. ○ Heuristics for multi-variate systems.

  • Heuristic loop invariant generation for control loops
  • Taylor Approximations
  • ...
slide-49
SLIDE 49

Toward Automated Deduction

Other Proof Automation & Tooling

  • Automated Analysis for nonlinear systems:

○ Pretty decent automation for systems with univariate nonlinearities. ○ Heuristics for multi-variate systems.

  • Heuristic loop invariant generation for control loops
  • Taylor Approximations
  • ...
  • Component-based Verification Tooling

Mueller et al., Change and Delay Contracts for Hybrid System Component Verification, FASE’17 -- Thursday 10:30-12:30

slide-50
SLIDE 50

Conclusion KeYmaera X is a hybrid systems theorem prover with:

  • A small and trustworthy prover core and
  • Excellent infrastructure for interactively verifying complex

systems and implementing automated analyses.

slide-51
SLIDE 51

Conclusion KeYmaera X is a hybrid systems theorem prover with:

  • A small and trustworthy prover core and
  • Excellent infrastructure for interactively verifying complex

systems and implementing automated analyses.

Project Website (start here) keymaeraX.org Online Demo web.keymaeraX.org GPL’d Source Code github.com/ls-lab/KeYmaeraX-release Course Materials symbolaris.com/course/fcps17.html

slide-52
SLIDE 52

Developers:

  • Stefan Mitsch
  • Nathan Fulton
  • Andre Platzer
  • Jan-David Quesel
  • Brandon Bohrer
  • Yong Kiam Tan
  • Markus Voelp

Special Thanks:

  • 15-424 students, Jean-Baptiste Jeanin, Khalil Ghorbal,

Daniel Ricketts

slide-53
SLIDE 53
slide-54
SLIDE 54

Interactive Reachability Analysis in KeYmaera X

Differential Ghosts Parachute Closed: J & t=0 & r=rp → [x’=v,v’=rv2-g & 0≤x & t≤T]v>-sqrt(g/pr) > m x v’=rv2-g Proof requires a differential ghost because the property is not inductive.

slide-55
SLIDE 55

Interactive Reachability Analysis in KeYmaera X

Differential Ghosts An example differential ghost. x>0 → [x’=-x]x>0

slide-56
SLIDE 56

Interactive Reachability Analysis in KeYmaera X

Differential Ghosts An example differential ghost. x>0 → [x’=-x]x>0 Ghost: y’=y/2 Conserved: 1=xy2

slide-57
SLIDE 57

Interactive Reachability Analysis in KeYmaera X

Differential Ghosts An example differential ghost. x>0 → [x’=-x]x>0 Ghost: y’=y/2 Conserved: 1=xy2 Notice: x>0 ↔ ∃y.1=xy2 Therefore, suffices to show: 1=xy2→∃y.[x’=-x,y’=y/2]1=xy2