Uniform Substitution At One Fell Swoop Andr Platzer In Shakespeares - - PowerPoint PPT Presentation

▶
uniform substitution at one fell swoop
SMART_READER_LITE
LIVE PREVIEW

Uniform Substitution At One Fell Swoop Andr Platzer In Shakespeares - - PowerPoint PPT Presentation

Oct 22, 2022 283 likes •883 views

Uniform Substitution At One Fell Swoop Andr Platzer In Shakespeares 1611 play, at one fell swoop was likened to the suddenness with which a bird of prey fiercely attacks a whole nest at once. Andr Platzer (CMU) Uniform

slide-1
SLIDE 1

Uniform Substitution At One Fell Swoop

André Platzer In Shakespeare’s 1611 play, “at one fell swoop” was likened to the suddenness with which a bird of prey fiercely attacks a whole nest at once.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 1 / 23

slide-2
SLIDE 2

Outline

1

Motivation Parsimonious Hybrid Game Proofs Foundation for Verification

2

Differential Game Logic Syntax Example: Push-around Cart Denotational Semantics

3

Uniform Substitution Application Uniform Substitution Lemma Uniform Substitution of Rules Static Semantics Axioms Differential Hybrid Games

4

Summary

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 1 / 23

slide-3
SLIDE 3

Outline

1

Motivation Parsimonious Hybrid Game Proofs Foundation for Verification

2

Differential Game Logic Syntax Example: Push-around Cart Denotational Semantics

3

Uniform Substitution Application Uniform Substitution Lemma Uniform Substitution of Rules Static Semantics Axioms Differential Hybrid Games

4

Summary

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 1 / 23

slide-4
SLIDE 4

CPS Analysis: Robot Control

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Discrete dynamics (control decisions) Continuous dynamics (differential equations)

2 4 6 8 10 t 0.8 0.6 0.4 0.2 0.2

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0v 2 4 6 8 10 t 2 4 6 8

p

px py

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 2 / 23

slide-5
SLIDE 5

CPS Analysis: Robot Control

Challenge (Games)

Game rules describing play evolution with both Angelic choices (player ⋄ Angel) Demonic choices (player

⋄

Demon) 0,0 2,1 1,2 3,1

⋄\ ⋄

Tr Pl Trash 1,2 0,0 Plant 0,0 2,1

8 rmbl0skZ 7 ZpZ0ZpZ0 6 0Zpo0ZpZ 5 o0ZPo0Zp 4 PZPZPZ0O 3 Z0Z0ZPZ0 2 0O0J0ZPZ 1 SNAQZBMR a b c d e f g h André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 3 / 23

slide-6
SLIDE 6

CPS Analysis: Robot Control

Challenge (Hybrid Games)

Game rules describing play evolution with Discrete dynamics (control decisions) Continuous dynamics (differential equations) Adversarial dynamics (Angel ⋄ vs. Demon

⋄

)

2 4 6 8 10 t 0.6 0.4 0.2 0.2 0.4

a

2 4 6 8 10 t 0.2 0.4 0.6 0.8 1.0 1.2v 2 4 6 8 10 t 1 2 3 4 5 6 7p

px py

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 4 / 23

slide-7
SLIDE 7

CPS Analysis: RoboCup Soccer

Challenge (Hybrid Games)

Game rules describing play evolution with Discrete dynamics (control decisions) Continuous dynamics (differential equations) Adversarial dynamics (Angel ⋄ vs. Demon

⋄

)

2 4 6 8 10 t 0.6 0.4 0.2 0.2 0.4

a

2 4 6 8 10 t 1.0 0.5 0.5

Ω

2 4 6 8 10 t 0.5 0.5 1.0

d

dx dy

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 5 / 23

slide-8
SLIDE 8

Foundation for Verification

− − − − − − − − − →

Foundation for

− − − − − − − − − →

FOL Functional Language Imperative Language Formula Functional program Imperative program/game Predicate calculus Function calculus Program calculus Subst + rename

α,β,η-conversion

USubst + rename

Functional α-conversion

for bound variables

β-reduction

capture-avoiding subst.

η-conversion

versus free variables

Imperative

Uniform substitution replaces predicate/function/program sym. mindful of free/bound variables Substitution is fundamental but subtle. Henkin wants it banished! Now: Make USubst even more subtle, but faster, and still sound. Beware: Imperative free and bound variables may overlap!

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 6 / 23

slide-9
SLIDE 9

KeYmaera X Microkernel for Soundness 1 700 LOC

25,000 50,000 75,000 100,000 KeYmaera X KeYmaera KeY Nuprl MetaPRL Isabelle/Pure Coq HOL Light PHAVer HSolver SpaceEx Cora Flow* dReal HyCreate2

1,652

Games: months

ց

minutes

Disclaimer: Self-reported estimates of the soundness-critical lines of code + rules

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 7 / 23

slide-10
SLIDE 10

Experiments

Church checks exponentially (sometimes & in unoptimized implementations)

10000 20000 30000 40000 20 40 60 80 Church One-pass

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 7 / 23

slide-11
SLIDE 11

Experiments

Church checks quadratically (invasive space-time tradeoff optimizations)

225 450 675 900 550 1100 1650 2200 y = 3.596E-5x2 - 0.0107x + 2.4344 y = 0.0002x2 - 0.0409x + 10.772 Church-opt One-pass

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 7 / 23

slide-12
SLIDE 12

Outline

1

Motivation Parsimonious Hybrid Game Proofs Foundation for Verification

2

Differential Game Logic Syntax Example: Push-around Cart Denotational Semantics

3

Uniform Substitution Application Uniform Substitution Lemma Uniform Substitution of Rules Static Semantics Axioms Differential Hybrid Games

4

Summary

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 7 / 23

slide-13
SLIDE 13

Differential Game Logic: Syntax

Definition (Hybrid game α)

a | x :=θ | ?q | x′ = θ | α ∪β | α;β | α∗ | αd

Definition (dGL Formula φ)

p(θ1,...,θn) | θ ≥ η | ¬φ | φ ∧ψ | ∀x φ | ∃x φ | αφ | [α]φ TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 8 / 23

slide-14
SLIDE 14

Differential Game Logic: Syntax

Definition (Hybrid game α)

a | x :=θ | ?q | x′ = θ | α ∪β | α;β | α∗ | αd

Definition (dGL Formula φ)

p(θ1,...,θn) | θ ≥ η | ¬φ | φ ∧ψ | ∀x φ | ∃x φ | αφ | [α]φ Discrete Assign Test Game Differential Equation Choice Game Seq. Game Repeat Game All Reals Some Reals TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 8 / 23

slide-15
SLIDE 15

Differential Game Logic: Syntax

Definition (Hybrid game α)

a | x :=θ | ?q | x′ = θ | α ∪β | α;β | α∗ | αd

Definition (dGL Formula φ)

p(θ1,...,θn) | θ ≥ η | ¬φ | φ ∧ψ | ∀x φ | ∃x φ | αφ | [α]φ Discrete Assign Test Game Differential Equation Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Game Symb. TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 8 / 23

slide-16
SLIDE 16

Differential Game Logic: Syntax

Definition (Hybrid game α)

a | x :=θ | ?q | x′ = θ | α ∪β | α;β | α∗ | αd

Definition (dGL Formula φ)

p(θ1,...,θn) | θ ≥ η | ¬φ | φ ∧ψ | ∀x φ | ∃x φ | αφ | [α]φ Discrete Assign Test Game Differential Equation Choice Game Seq. Game Repeat Game All Reals Some Reals Dual Game Game Symb. Angel Wins Demon Wins TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 8 / 23

slide-17
SLIDE 17

Example: Push-around Cart

x v d a v ≥ 1 →

  • (d := 1∪ d :=−1)d;(a:= 1∪ a:=−1);{x′ = v,v′ = a+ d}

∗

v ≥ 0

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 9 / 23

slide-18
SLIDE 18

Example: Push-around Cart

x v d a

v ≥ 1 →

d before a can compensate

  • (d := 1∩ d :=−1);(a:= 1∪ a:=−1);{x′ = v,v′ = a+ d}

∗

v ≥ 0

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 9 / 23

slide-19
SLIDE 19

Example: Push-around Cart

x v d a

v ≥ 1 →

d before a can compensate

  • (d := 1∩ d :=−1);(a:= 1∪ a:=−1);{x′ = v,v′ = a+ d}

∗

v ≥ 0

  • (d := 1∩ d :=−1); (a:= 1∪ a:=−1);

t := 0; {x′ = v,v′ = a+ d,t′ = 1&t ≤ 1}

∗

x2 ≥ 100

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 9 / 23

slide-20
SLIDE 20

Example: Push-around Cart

x v d a

v ≥ 1 →

d before a can compensate

  • (d := 1∩ d :=−1);(a:= 1∪ a:=−1);{x′ = v,v′ = a+ d}

∗

v ≥ 0

  • (d := 1∩ d :=−1); (a:= 1∪ a:=−1);

a := d then a := signv t := 0; {x′ = v,v′ = a+ d,t′ = 1&t ≤ 1}

∗

x2 ≥ 100

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 9 / 23

slide-21
SLIDE 21

Differential Game Logic: Denotational Semantics

Definition (Hybrid game α)

[ [·] ] : HG → (℘(S) →℘(S))

[ [x := θ] ]

  • X
  • = {ω ∈ S : ωω[

[θ] ]

x

∈ X} [ [x′ = θ] ]

  • X
  • = {ϕ(0) ∈ S : ϕ(r) ∈ X, dϕ(t)(x)

dt

(ζ) = ϕ(ζ)[ [θ] ] for all ζ} [ [?q] ]

  • X
  • = [

[q] ]∩ X [ [α ∪β] ]

  • X
  • = [

[α] ]

  • X
  • ∪[

[β] ]

  • X
  • [

[α;β] ]

  • X
  • = [

[α] ]

  • [

[β] ]

  • X
  • [

[α∗] ]

  • X
  • = {Z ⊆ S : X ∪[

[α] ]

  • Z
  • ⊆ Z}

[ [αd] ]

  • X
  • = ([

[α] ]

  • X ∁

)∁ Definition (dGL Formula φ)

[ [·] ] : Fml →℘(S)

[ [θ ≥ η] ] = {ω ∈ S : ω[ [θ] ] ≥ ω[ [η] ]} [ [¬φ] ] = ([ [φ] ])∁ [ [φ ∧ψ] ] = [ [φ] ]∩[ [ψ] ] [ [αφ] ] = [ [α] ]

  • [

[φ] ]

  • [

[[α]φ] ] = [ [α] ]

  • [

[φ] ]∁∁

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 10 / 23

slide-22
SLIDE 22

Differential Game Logic: Denotational Semantics

X

[ [x :=θ] ]

  • X
  • X

x

′

= θ [ [x′ = θ] ]

  • X
  • X

[ [q] ] [ [?q] ]

  • X
  • [

[α] ]

  • X
  • [

[β] ]

  • X
  • X

[ [α ∪β] ]

  • X
  • [

[α] ]

  • [

[β] ]

  • X
  • [

[β] ]

  • X
  • X

[ [α;β] ]

  • X
  • [

[α] ]

  • [

[α∗] ]

  • X
  • \[

[α∗] ]

  • X
  • /

[ [α] ]∞(X) ··· [ [α] ]3(X) [ [α] ]2(X) [ [α] ](X)

X

[ [α∗] ]

  • X
  • X ∁

X

[ [α] ]

  • X ∁

[ [α] ]

  • X ∁∁

[ [αd] ]

  • X
  • André Platzer (CMU)

Uniform Substitution At One Fell Swoop CADE’19 11 / 23

slide-23
SLIDE 23

Outline

1

Motivation Parsimonious Hybrid Game Proofs Foundation for Verification

2

Differential Game Logic Syntax Example: Push-around Cart Denotational Semantics

3

Uniform Substitution Application Uniform Substitution Lemma Uniform Substitution of Rules Static Semantics Axioms Differential Hybrid Games

4

Summary

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 12 / 23

slide-24
SLIDE 24

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σφ

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible)

US

a∪ bp(¯

x) ↔ ap(¯ x)∨bp(¯ x)

v := v + 1∪ x′ = vx > 0 ↔ v := v + 1x > 0∨x′ = vx > 0

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 13 / 23

slide-25
SLIDE 25

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σφ

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible)

v := fp(v) ↔ p(f) v :=−xx′ = vx ≥ 0 ↔ x′ = −xx ≥ 0

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 13 / 23

slide-26
SLIDE 26

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σφ

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible) If you bind a free variable, you go to logic jail! Modular interface: Prover vs. Logic

v := fp(v) ↔ p(f) v :=−xx′ = vx ≥ 0 ↔ x′ = −xx ≥ 0

Clash

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 13 / 23

slide-27
SLIDE 27

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σφ

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible) If you bind a free variable, you go to logic jail! Modular interface: Prover vs. Logic

x′ = f(x),y′ = a(x)yx ≥ 1 ↔ x′ = f(x)x ≥ 1 x′ = x2,y′ = zyyx ≥ 1 ↔ x′ = x2x ≥ 1

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 13 / 23

slide-28
SLIDE 28

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σφ

provided FV(σ|Σ(θ))∩ BV(⊗(·)) = /

0 for each operation ⊗(θ) in φ

i.e. bound variables U = BV(⊗(·)) of no operator ⊗ are free in the substitution on its argument θ (U-admissible) If you bind a free variable, you go to logic jail! Modular interface: Prover vs. Logic

x′ = f(x),y′ = a(x)yx ≥ 1 ↔ x′ = f(x)x ≥ 1 x′ = x2,y′ = zyyx ≥ 1 ↔ x′ = x2x ≥ 1

Clash

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 13 / 23

slide-29
SLIDE 29

Uniform Substitution Application: Church-style

σ(f(θ)) = (σf)(σθ)

def

= {· → σθ}σf(·) σ(θ +η) = σθ +ση σ((θ)′) = (σθ)′

if σ V-admissible for θ

σ(p(θ)) = (σp)(σθ) σ(φ ∧ψ) = σφ ∧σψ σ(∀x φ) = ∀x σφ

if σ {x}-admissible for φ

σ(αφ) = σασφ

if σ BV(σα)-admissible for φ

σ(a) = σa σ(x :=θ) = x :=σθ σ(x′ = θ &q) = x′ = σθ &σq

if σ {x,x′}-admissible for θ,q

σ(α ∪β) = σα ∪σβ σ(α;β) = σα;σβ

if σ BV(σα)-admissible for β

σ(α∗) = (σα)∗

if σ BV(σα)-admissible for α

σ(αd) = (σα)d

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 14 / 23

slide-30
SLIDE 30

Uniform Substitution Application: Church-style

σ(f(θ)) = (σf)(σθ)

def

= {· → σθ}σf(·) σ(θ +η) = σθ +ση σ((θ)′) = (σθ)′

if σ V-admissible for θ

σ(p(θ)) = (σp)(σθ) σ(φ ∧ψ) = σφ ∧σψ σ(∀x φ) = ∀x σφ

if σ {x}-admissible for φ

σ(αφ) = σασφ

if σ BV(σα)-admissible for φ

σ(a) = σa σ(x :=θ) = x :=σθ σ(x′ = θ &q) = x′ = σθ &σq

if σ {x,x′}-admissible for θ,q

σ(α ∪β) = σα ∪σβ σ(α;β) = σα;σβ

if σ BV(σα)-admissible for β

σ(α∗) = (σα)∗

if σ BV(σα)-admissible for α

σ(αd) = (σα)d

Idea Check side conditions at each operator again where soundness demands it.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 14 / 23

slide-31
SLIDE 31

Uniform Substitution Application: One-pass with Taboo U

σ U(f(θ)) = (σ Uf)(σ Uθ)

def

= {· → σ Uθ}/

0σf(·)

if F V(σf(·))∩ U = /

σ U(θ +η) = σ Uθ +σ Uη σ U((θ)′) = (σVθ)′ σ U(p(θ)) = (σ Up)(σ Uθ)

if F V(σp(·))∩ U = /

σ U(φ ∧ψ) = σ Uφ ∧σ Uψ σ U(∀x φ) = ∀x σ U∪{x}φ σ U(αφ) = σ U

V ασ Vφ

σ U

U∪B V(σa)(a) = σa

σ U

U∪{x}(x :=θ) = x :=σ Uθ

σ U

U∪{x,x′}(x′ = θ &q) = (x′ = σ U∪{x,x′}θ &σ U∪{x,x′}q)

σ U

V∪W(α ∪β) = σ U V α ∪σ U Wβ

σ U

W(α;β) = σ U V α;σ V Wβ

σ U

V (α∗) = (σ V V α)∗

where σ U

V α defined

σ U

V (αd) = (σ U V α)d

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 15 / 23

slide-32
SLIDE 32

Uniform Substitution Application: One-pass with Taboo U

σ U(f(θ)) = (σ Uf)(σ Uθ)

def

= {· → σ Uθ}/

0σf(·)

if F V(σf(·))∩ U = /

σ U(θ +η) = σ Uθ +σ Uη σ U((θ)′) = (σVθ)′ σ U(p(θ)) = (σ Up)(σ Uθ)

if F V(σp(·))∩ U = /

σ U(φ ∧ψ) = σ Uφ ∧σ Uψ σ U(∀x φ) = ∀x σ U∪{x}φ σ U(αφ) = σ U

V ασ Vφ

σ U

U∪B V(σa)(a) = σa

σ U

U∪{x}(x :=θ) = x :=σ Uθ

σ U

U∪{x,x′}(x′ = θ &q) = (x′ = σ U∪{x,x′}θ &σ U∪{x,x′}q)

σ U

V∪W(α ∪β) = σ U V α ∪σ U Wβ

σ U

W(α;β) = σ U V α;σ V Wβ

σ U

V (α∗) = (σ V V α)∗

where σ U

V α defined

σ U

V (αd) = (σ U V α)d

  • utput

input

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 15 / 23

slide-33
SLIDE 33

Uniform Substitution Application: One-pass with Taboo U

σ U(f(θ)) = (σ Uf)(σ Uθ)

def

= {· → σ Uθ}/

0σf(·)

if F V(σf(·))∩ U = /

σ U(θ +η) = σ Uθ +σ Uη σ U((θ)′) = (σVθ)′ σ U(p(θ)) = (σ Up)(σ Uθ)

if F V(σp(·))∩ U = /

σ U(φ ∧ψ) = σ Uφ ∧σ Uψ σ U(∀x φ) = ∀x σ U∪{x}φ σ U(αφ) = σ U

V ασ Vφ

σ U

U∪B V(σa)(a) = σa

σ U

U∪{x}(x :=θ) = x :=σ Uθ

σ U

U∪{x,x′}(x′ = θ &q) = (x′ = σ U∪{x,x′}θ &σ U∪{x,x′}q)

σ U

V∪W(α ∪β) = σ U V α ∪σ U Wβ

σ U

W(α;β) = σ U V α;σ V Wβ

σ U

V (α∗) = (σ V V α)∗

where σ U

V α defined

σ U

V (αd) = (σ U V α)d

Idea Linear homomorphic pass postponing admissibility. Recover with taboos at replacements.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 15 / 23

slide-34
SLIDE 34

Uniform Substitution

Theorem (Soundness) replace all occurrences of p(·)

US

φ σ /

0φ

provided σ /

0φ is defined

If you bind a free variable, you go to logic jail! Such a clash can only happen with taboos U arising while forming σ /

0φ

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 16 / 23

slide-35
SLIDE 35

Soundness of Uniform Substitutions

“Syntactic uniform substitution = semantic replacement”

Lemma (Uniform substitution lemma)

Uniform substitution σ and adjoint σ∗

ωI to σ for I,ω have the same semantics

for all ν such that ν = ω except on U: Iν[

[σ Uθ] ] = σ∗

ωIν[

[θ] ] ν ∈ I[ [σ Uφ] ] iff ν ∈ σ∗

ωI[

[φ] ] ν ∈ I[ [σ U

V α]

]

  • X
  • iff ν ∈ σ∗

ωI[

[α] ]

  • X
  • Induction lexicographically on σ and φ +α simultaneously,

with nested induction over closure ordinal, simultaneously for all ν,ω,U,X

θ σθ

Iν[

[σθ] ] σ∗

ωIν[

[θ] ] σ σ∗

ωI

I

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 17 / 23

slide-36
SLIDE 36

Uniform Substitution of Rules

Theorem (Soundness) φ1 ... φn ψ

locally sound implies σVφ1

... σVφn σVψ

locally sound Locally sound The conclusion is valid in any interpretation in which the premises are.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 18 / 23

slide-37
SLIDE 37

Static Semantics

Lemma (Coincidence for formulas) (Only F V(φ) determine truth)

If ω= ˜

ω on F

V(φ) then: ω ∈ [

[φ] ] iff ˜ ω ∈ [ [φ] ] Lemma (Coincidence for games) (Only F V(α) determine victory)

If ω= ˜

ω on V⊇F

V(α) then:

ω ∈ [ [α] ]

  • X↑V
  • iff ˜

ω ∈ [ [α] ]

  • X↑V
  • X↑V

X

[ [α] ]

  • X
  • ω

˜ ω

  • n V ⊇ F

V(α)

α α

Lemma (Bound effect) (Only B V(α) change value) ω ∈ [ [α] ]

  • X
  • iff ω ∈ [

[α] ]

  • X↓ω(B

V(α)∁)

  • X

X↓ω

[ [α] ]

  • X↓ω(B

V(α)∁)

  • ω

α α

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 20 / 23

slide-38
SLIDE 38

Differential Game Logic: Axiomatization

Axiom = one formula Infinite axiom schema

[a]p(¯

x) ↔ ¬a¬p(¯ x)

x := fp(x) ↔ p(f) x′ = fp(x) ↔ ∃t≥0x := x + ftp(x) ?qp ↔ (q ∧ p) a∪ bp(¯

x) ↔ ap(¯ x)∨bp(¯ x)

a;bp(¯

x) ↔ abp(¯ x)

a∗p(¯

x) ↔ p(¯ x)∨aa∗p(¯ x)

adp(¯

x) ↔ ¬a¬p(¯ x)

[·] [α]φ ↔ ¬α¬φ := x :=θφ ↔ φ θ

x

′ x′ = θφ ↔ ∃t≥0x := y(t)φ ? ?ψφ ↔ (ψ ∧φ) ∪ α ∪βφ ↔ αφ ∨βφ ; α;βφ ↔ αβφ ∗ α∗φ ↔ φ ∨αα∗φ d αdφ ↔ ¬α¬φ

IJCAR’18 TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 21 / 23

slide-39
SLIDE 39

Differential Game Logic: Axiomatization

Axiom = one formula Infinite axiom schema

[a]c⊤ ↔ ¬a¬c⊤ x := fc⊤ ↔ ∃x (x = f ∧c⊤) x′ = fp(x) ↔ ∃t≥0x := x + ftp(x) ?qp ↔ (q ∧ p) a∪ bc⊤ ↔ ac⊤∨bc⊤ a;bc⊤ ↔ abc⊤ a∗c⊤ ↔ c⊤∨aa∗c⊤ adc⊤ ↔ ¬a¬c⊤ [·] [α]φ ↔ ¬α¬φ := x :=θφ ↔ φ θ

x

′ x′ = θφ ↔ ∃t≥0x := y(t)φ ? ?ψφ ↔ (ψ ∧φ) ∪ α ∪βφ ↔ αφ ∨βφ ; α;βφ ↔ αβφ ∗ α∗φ ↔ φ ∨αα∗φ d αdφ ↔ ¬α¬φ

CADE’19 TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 21 / 23

slide-40
SLIDE 40

Differential Game Logic: Axiomatization

c⊤ uniformly substitutes to ?φ⊤ alias φ [a]c⊤ ↔ ¬a¬c⊤ x := fc⊤ ↔ ∃x (x = f ∧c⊤) x′ = fp(x) ↔ ∃t≥0x := x + ftp(x) ?qp ↔ (q ∧ p) a∪ bc⊤ ↔ ac⊤∨bc⊤ a;bc⊤ ↔ abc⊤ a∗c⊤ ↔ c⊤∨aa∗c⊤ adc⊤ ↔ ¬a¬c⊤ [·] [α]φ ↔ ¬α¬φ := x :=θφ ↔ φ θ

x

′ x′ = θφ ↔ ∃t≥0x := y(t)φ ? ?ψφ ↔ (ψ ∧φ) ∪ α ∪βφ ↔ αφ ∨βφ ; α;βφ ↔ αβφ ∗ α∗φ ↔ φ ∨αα∗φ d αdφ ↔ ¬α¬φ

CADE’19 TOCL ’15

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 21 / 23

slide-41
SLIDE 41

Uniform Substitution for Differential Hybrid Games

avoid obstacles changing wind local turbulence x′ = f(x,y,z) TOCL ’17

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 22 / 23

slide-42
SLIDE 42

Uniform Substitution for Differential Hybrid Games

avoid obstacles changing wind local turbulence x′ = f(x,y,z) TOCL ’17

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 22 / 23

slide-43
SLIDE 43

Outline

1

Motivation Parsimonious Hybrid Game Proofs Foundation for Verification

2

Differential Game Logic Syntax Example: Push-around Cart Denotational Semantics

3

Uniform Substitution Application Uniform Substitution Lemma Uniform Substitution of Rules Static Semantics Axioms Differential Hybrid Games

4

Summary

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 22 / 23

slide-44
SLIDE 44

Uniform Substitution At One Fell Swoop

differential game logic

dGL = GL+ HG = dL+ d αϕ ϕ Faster sound uniform substitution Replace all at once, check all at once Modular: Logic Prover Isabelle/HOL formalization 3,500 lines Sound & rel. complete axiomatization Sound for differential hybrid games Future: Benefit from USubst elsewhere

d i s c r e t e c

  • n

t i n u

  • u

s nondet stochastic a d v e r s a r i a l

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 23 / 23

slide-45
SLIDE 45
  • A. Platzer. Logical Foundations of Cyber-Physical Systems. Springer 2018

I Part: Elementary Cyber-Physical Systems

  • 2. Differential Equations & Domains
  • 3. Choice & Control
  • 4. Safety & Contracts
  • 5. Dynamical Systems & Dynamic Axioms
  • 6. Truth & Proof
  • 7. Control Loops & Invariants
  • 8. Events & Responses
  • 9. Reactions & Delays

II Part: Differential Equations Analysis

  • 10. Differential Equations & Differential Invariants
  • 11. Differential Equations & Proofs
  • 12. Ghosts & Differential Ghosts
  • 13. Differential Invariants & Proof Theory

III Part: Adversarial Cyber-Physical Systems 14-17. Hybrid Systems & Hybrid Games IV Part: Comprehensive CPS Correctness

Logical Foundations of Cyber-Physical Systems

André Platzer

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 24 / 23

slide-46
SLIDE 46

Foundation for Verification

− − − − − − − − − →

Foundation for

− − − − − − − − − →

FOL Functional Language Imperative Language Formula Functional program Imperative program/game Predicate calculus Function calculus Program calculus Subst + rename

α,β,η-conversion

USubst + rename

Functional α-conversion

for bound variables

β-reduction

capture-avoiding subst.

η-conversion

versus free variables

Imperative

Uniform substitution replaces predicate/function/program sym. mindful of free/bound variables Substitution is fundamental but subtle. Henkin wants it banished! Now: Make USubst even more subtle, but faster, and still sound. Beware: Imperative free and bound variables may overlap!

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 25 / 23

slide-47
SLIDE 47

André Platzer. Uniform substitution at one fell swoop. In Pascal Fontaine, editor, CADE, volume 11716 of LNCS, pages 425–441. Springer, 2019.

doi:10.1007/978-3-030-29436-6_25.

André Platzer. Uniform substitution for differential game logic. In Didier Galmiche, Stephan Schulz, and Roberto Sebastiani, editors, IJCAR, volume 10900 of LNCS, pages 211–227. Springer, 2018.

doi:10.1007/978-3-319-94205-6_15.

André Platzer. Differential game logic. ACM Trans. Comput. Log., 17(1):1:1–1:51, 2015.

doi:10.1145/2817824.

André Platzer. Differential hybrid games. ACM Trans. Comput. Log., 18(3):19:1–19:44, 2017.

doi:10.1145/3091123.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 25 / 23

slide-48
SLIDE 48

André Platzer. Logical Foundations of Cyber-Physical Systems. Springer, Cham, 2018. URL: http://www.springer.com/978-3-319-63587-3,

doi:10.1007/978-3-319-63588-0.

André Platzer. A complete uniform substitution calculus for differential dynamic logic.

  • J. Autom. Reas., 59(2):219–265, 2017.

doi:10.1007/s10817-016-9385-1.

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 25 / 23

slide-49
SLIDE 49

Outline

5

Appendix ODE Schema Static Semantics Operational Semantics Completeness

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 25 / 23

slide-50
SLIDE 50

Axiom Schemata Need Side Conditions: Solving ODEs

′ x′ = θφ ↔ ∃t≥0x := y(t)φ

Axiom schema with side conditions:

1

Occurs check: t fresh

2

Solution check: y(·) solves the ODE y′(t) = θ with x(·) plugged in for x in term θ

3

Initial value check: y(·) solves the symbolic IVP y(0) = x

4

x(·) covers all solutions parametrically

5

x′ cannot occur free in φ Quite nontrivial soundness-critical algorithms . . .

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 26 / 23

slide-51
SLIDE 51

Static Semantics

F V(θ) =

  • x ∈ V : ∃

,ω, ˜ ω such that ω = ˜ ω on {x}∁ and ω[ [θ] ] = ˜ ω[ [θ] ]

  • F

V(φ) =

  • x ∈ V : ∃

,ω, ˜ ω such that ω = ˜ ω on {x}∁ and ω ∈ [ [φ] ] ∋ ˜ ω

  • F

V(α) =

  • x ∈ V : ∃

,ω, ˜ ω,X with ω = ˜ ω on {x}∁, ω ∈ [ [α] ]

  • X↑{x}∁

∋ ˜ ω

  • B

V(α) =

  • x ∈ V : ∃

,ω,X such that [ [α] ]

  • X
  • ∋ ω ∈ [

[α] ]

  • X↓ω({x})
  • André Platzer (CMU)

Uniform Substitution At One Fell Swoop CADE’19 27 / 23

slide-52
SLIDE 52

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω

x :=θ

ωω[

[θ] ]

x

x :=θ

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-53
SLIDE 53

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω

x′ = θ &q

ϕ(r)

r

ϕ(t)

t

ϕ(0)

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-54
SLIDE 54

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω ?q ω ?q ω ∈ [ [q] ]

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-55
SLIDE 55

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω α ∪β ω

tκ

β

tj

β

t1

β

r i g h t

ω

sλ

α

si

α

s1

α

l e f t

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-56
SLIDE 56

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω α;β

tλ rλ1

λ

β

r j

λ

β

r 1

λ

β α

ti rλi

i

β

r 1

i

β α

t1 rλ1

1

β

r j

1

β

r 1

1

β α

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-57
SLIDE 57

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω α∗ ω α α

r e p e a t stop

α α α

r e p e a t stop

α

repeat stop

α α α

r e p e a t stop

α α α

r e p e a t stop

α

repeat stop

α

repeat

ω

s t

  • p

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-58
SLIDE 58

Differential Game Logic: Operational Semantics

Definition (Hybrid game α: operational semantics) ω α

t0 tκ tj t1 s0 sλ si s1

ω αd

t0 tκ tj t1 s0 sλ si s1

d

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 28 / 23

slide-59
SLIDE 59

Soundness & Completeness

Theorem (Completeness)

dGL calculus is a sound & complete axiomatization relative to any (differentially) expressive1logic L.

ϕ

iff TautL ⊢ ϕ TOCL ’15

1∀

ϕ ∈ dGL ∃ ϕ♭ ∈ L ϕ ↔ ϕ♭ x′ = θG ↔ (x′ = θG)♭ provable for G ∈ L

André Platzer (CMU) Uniform Substitution At One Fell Swoop CADE’19 29 / 23