[PPT] - Differential Dynamic Logic and Differential Invariants for Hybrid PowerPoint Presentation

SLIDE 1

Differential Dynamic Logic and Differential Invariants for Hybrid Systems

Andr´ e Platzer

aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA

http://symbolaris.com/

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 1 / 42

SLIDE 2

How can we design computers that are guaranteed to interact correctly with the physical world?

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 2 / 42

SLIDE 3

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 2 / 42

SLIDE 4

Hybrid Systems Analysis: Car Control

Challenge (Hybrid Systems)

Fixed rule describing state evolution with both Continuous dynamics (differential equations) Discrete dynamics (control decisions)

1 2 3 4 t 2 1 1 2 a 1 2 3 4 t 0.5 1.0 1.5 2.0 2.5 3.0 v 1 2 3 4 t 1 2 3 4 5 6 z

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 3 / 42

SLIDE 5

Hybrid Systems Analysis is Important for . . .

. 2 . 4 . 6 . 8 1 .

0.1 0.2 0.3 0.4 0.5

x1 x2 y1 y2 d ω e ¯ ϑ ̟

c

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 4 / 42

SLIDE 6

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 4 / 42

SLIDE 7

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 4 / 42

SLIDE 8

Differential Dynamic Logic for Hybrid Systems

differential dynamic logic

dL = FOLR z v MA v2 ≤ 2b(MA − z)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 5 / 42

SLIDE 9

Differential Dynamic Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

hybrid program

] v2 ≤ 2b

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 5 / 42

SLIDE 10

Differential Dynamic Logic for Hybrid Systems

differential dynamic logic

dL = FOLR + DL + HP v2 ≤ 2b v2 ≤ 2b v2 ≤ 2b C → [ if(z > SB) a := −b; z′′ = a

hybrid program

] v2 ≤ 2b Initial condition System dynamics Post condition

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 5 / 42

SLIDE 11

Differential Dynamic Logic dL: Syntax

Definition (Hybrid program α)

x := θ | ?H | x′ = f (x) & H | α ∪ β | α; β | α∗

Definition (dL Formula φ)

θ1 ≥ θ2 | ¬φ | φ ∧ ψ | ∀x φ | ∃x φ | [α]φ | αφ

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 6 / 42

SLIDE 12

Differential Dynamic Logic dL: Syntax

Definition (Hybrid program α)

x := θ | ?H | x′ = f (x) & H | α ∪ β | α; β | α∗

Definition (dL Formula φ)

θ1 ≥ θ2 | ¬φ | φ ∧ ψ | ∀x φ | ∃x φ | [α]φ | αφ Discrete Assign Test Condition Differential Equation Nondet. Choice Seq. Compose Nondet. Repeat All Reals Some Reals All Runs Some Runs

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 6 / 42

SLIDE 13

Differential Dynamic Logic dL: Semantics

Definition (Hybrid program α)

ρ(x := θ) = {(v, w) : w = v except [ [x] ]w = [ [θ] ]v} ρ(?H) = {(v, v) : v | = H} ρ(x′ = f (x)) = {(ϕ(0), ϕ(r)) : ϕ | = x′ = f (x) for some duration r} ρ(α ∪ β) = ρ(α) ∪ ρ(β) ρ(α; β) = ρ(β) ◦ ρ(α) ρ(α∗) =

n∈N

ρ(αn)

Definition (dL Formula φ)

v | = θ1 ≥ θ2 iff [ [θ1] ]v ≥ [ [θ2] ]v v | = [α]φ iff w | = φ for all w with (v, w) ∈ ρ(α) v | = αφ iff w | = φ for some w with (v, w) ∈ ρ(α) v | = ∀x φ iff w | = φ for all w that agree with v except for x v | = ∃x φ iff w | = φ for some w that agrees with v except for x v | = φ ∧ ψ iff v | = φ and v | = ψ v | = ¬φ iff v | = φ does not hold

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 7 / 42

SLIDE 14

Differential Dynamic Logic dL: Axiomatization

([:=]) [x := θ][(x)]φx ↔ [(x)]φθ ([?]) [?H]φ ↔ (H → φ) ([′]) [x′ = f (x)]φ ↔ ∀t≥0 [x := y(t)]φ (y′(t) = f (y)) ([∪]) [α ∪ β]φ ↔ [α]φ ∧ [β]φ ([;]) [α; β]φ ↔ [α][β]φ ([∗]) [α∗]φ ↔ φ ∧ [α][α∗]φ (K) [α](φ → ψ) → ([α]φ → [α]ψ) (I) [α∗](φ → [α]φ) → (φ → [α∗]φ) (C) [α∗]∀v>0 (ϕ(v) → αϕ(v − 1)) → ∀v (ϕ(v) → α∗∃v≤0 ϕ(v))

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 8 / 42

SLIDE 15

Differential Dynamic Logic dL: Axiomatization

(G) φ [α]φ (MP) φ → ψ φ ψ (∀) φ ∀x φ

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 8 / 42

SLIDE 16

Differential Dynamic Logic dL: Axiomatization

(G) φ [α]φ (MP) φ → ψ φ ψ (∀) φ ∀x φ (B) ∀x [α]φ → [α]∀x φ (x ∈ α) (V) φ → [α]φ (FV (φ) ∩ BV (α) = ∅)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 8 / 42

SLIDE 17

Soundness

Theorem (Soundness)

dL calculus is sound, i.e., all provable dL formulas are valid: ⊢ φ implies φ What about the converse?

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 9 / 42

SLIDE 18

Complete Proof Theory of Hybrid Systems

Theorem (Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15p Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 10 / 42

SLIDE 19

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15p

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10p Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 10 / 42

SLIDE 20

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15p

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10p

System Continuous Discrete Hybrid

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 10 / 42

SLIDE 21

Complete Proof Theory of Hybrid Systems

Theorem (Continuous Relative Completeness) (J.Autom.Reas. 2008)

dL calculus is a sound & complete axiomatization of hybrid systems relative to differential equations.

Proof 15p

Theorem (Discrete Relative Completeness) (LICS’12)

dL calculus is a sound & complete axiomatization of hybrid systems relative to discrete dynamics.

Proof +10p

System Continuous Discrete Hybrid Hybrid Theory Discrete Theory Contin. Theory

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 10 / 42

SLIDE 22

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 10 / 42

SLIDE 23

Air Traffic Control

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 24

Air Traffic Control

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 25

Air Traffic Control

Verification?

looks correct

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 26

Air Traffic Control

Verification?

looks correct NO!

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 27

Air Traffic Control

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̟ − ω   

Verification?

looks correct NO!

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 28

Air Traffic Control

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̟ − ω   

Example (“Solving” differential equations)

x1(t) = 1 ω̟

x1ω̟ cos tω − v2ω cos tω sin ϑ + v2ω cos tω cos t̟ sin ϑ − v1̟ sin tω

+ x2ω̟ sin tω − v2ω cos ϑ cos t̟ sin tω − v2ω

1 − sin ϑ2 sin tω

+ v2ω cos ϑ cos tω sin t̟ + v2ω sin ϑ sin tω sin t̟

. . .

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 29

Air Traffic Control

x1 x2 y1 y2 d ω e ς ̺

   x′

1 = −v1+v2 cos ϑ + ωx2

x′

2 =

v2 sin ϑ − ωx1 ϑ′ = ̟ − ω   

Example (“Solving” differential equations)

∀t≥0 1 ω̟

x1ω̟ cos tω − v2ω cos tω sin ϑ + v2ω cos tω cos t̟ sin ϑ − v1̟ sin tω

+ x2ω̟ sin tω − v2ω cos ϑ cos t̟ sin tω − v2ω

1 − sin ϑ2 sin tω

+ v2ω cos ϑ cos tω sin t̟ + v2ω sin ϑ sin tω sin t̟

. . .

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 11 / 42

SLIDE 30

\forall R ts2. ( 0 <= ts2 & ts2 <= t2_0

>

( (om_1)^-1 * (omb_1)^-1 * (

m_1 * omb_1 * x1 * Cos(om_1 * ts2)

+ om_1 * v2 * Cos(om_1 * ts2) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * ts2) + om_1 * omb_1 * x2 * Sin(om_1 * ts2) + om_1 * v2 * Cos(u) * Sin(om_1 * ts2) + -1 * om_1 * v2 * Cos(omb_1 * ts2) * Cos(u) * Sin(om_1 * ts2) + om_1 * v2 * Cos(om_1 * ts2) * Cos(u) * Sin(omb_1 * ts2) + om_1 * v2 * Cos(om_1 * ts2) * Cos(omb_1 * ts2) * Sin(u) + om_1 * v2 * Sin(om_1 * ts2) * Sin(omb_1 * ts2) * Sin(u))) ^2 + ( (om_1)^-1 * (omb_1)^-1 * (

1 * omb_1 * v1 * Cos(om_1 * ts2)

+ om_1 * omb_1 * x2 * Cos(om_1 * ts2) + omb_1 * v1 * (Cos(om_1 * ts2))^2 + om_1 * v2 * Cos(om_1 * ts2) * Cos(u) + -1 * om_1 * v2 * Cos(om_1 * ts2) * Cos(omb_1 * ts2) * Cos(u) + -1 * om_1 * omb_1 * x1 * Sin(om_1 * ts2) +

1

* om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * ts2) + omb_1 * v1 * (Sin(om_1 * ts2))^2 + -1 * om_1 * v2 * Cos(u) * Sin(om_1 * ts2) * Sin(omb_1 * ts2) + -1 * om_1 * v2 * Cos(omb_1 * ts2) * Sin(om_1 * ts2) * Sin(u) + om_1 * v2 * Cos(om_1 * ts2) * Sin(omb_1 * ts2) * Sin(u))) ^2 >= (p)^2), t2_0 >= 0, x1^2 + x2^2 >= (p)^2 ==> Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 31

\forall R t7. ( t7 >= 0

>

( (om_3)^-1 * (

m_3

* ( (om_1)^-1 * (omb_1)^-1 * (

m_1 * omb_1 * x1 * Cos(om_1 * t2_0)

+

m_1

* v2 * Cos(om_1 * t2_0) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * t2_0) + om_1 * omb_1 * x2 * Sin(om_1 * t2_0) + om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) +

1

* om_1 * v2 * Cos(omb_1 * t2_0) * Cos(u) * Sin(om_1 * t2_0) +

m_1

* v2 * Cos(om_1 * t2_0) * Cos(u) * Sin(omb_1 * t2_0) +

m_1

* v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Sin(u) +

m_1

* v2 * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 32

* Cos(om_3 * t5) + v2 * Cos(om_3 * t5) * ( 1 +

1

* (Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))^2) ^(1 / 2) + -1 * v1 * Sin(om_3 * t5) +

m_3

* ( (om_1)^-1 * (omb_1)^-1 * (

1 * omb_1 * v1 * Cos(om_1 * t2_0)

+ om_1 * omb_1 * x2 * Cos(om_1 * t2_0) + omb_1 * v1 * (Cos(om_1 * t2_0))^2 + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) +

1

* om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Cos(u) + -1 * om_1 * omb_1 * x1 * Sin(om_1 * t2_0) +

1

* om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * t2_0) + omb_1 * v1 * (Sin(om_1 * t2_0))^2 +

1

* om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 33

+

1

* om_1 * v2 * Cos(omb_1 * t2_0) * Sin(om_1 * t2_0) * Sin(u) +

m_1

* v2 * Cos(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Sin(om_3 * t5) + v2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) * Sin(om_3 * t5) + v2 * (Cos(om_3 * t5))^2 * Sin(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) + v2 * (Sin(om_3 * t5))^2 * Sin(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))) ^2 + ( (om_3)^-1 * (

1 * v1 * Cos(om_3 * t5)

+

m_3

* ( (om_1)^-1 * (omb_1)^-1 * (

1 * omb_1 * v1 * Cos(om_1 * t2_0)

+ om_1 * omb_1 * x2 * Cos(om_1 * t2_0) + omb_1 * v1 * (Cos(om_1 * t2_0))^2 + om_1 * v2 * Cos(om_1 * t2_0) * Cos(u) +

1

* om_1 * v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Cos(u) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 34

+ -1 * om_1 * omb_1 * x1 * Sin(om_1 * t2_0) +

1

* om_1 * v2 * (1 + -1 * (Cos(u))^2)^(1 / 2) * Sin(om_1 * t2_0) + omb_1 * v1 * (Sin(om_1 * t2_0))^2 +

1

* om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) +

1

* om_1 * v2 * Cos(omb_1 * t2_0) * Sin(om_1 * t2_0) * Sin(u) +

m_1

* v2 * Cos(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Cos(om_3 * t5) + v1 * (Cos(om_3 * t5))^2 + v2 * Cos(om_3 * t5) * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) +

1

* v2 * (Cos(om_3 * t5))^2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 35

+

1

* om_3 * ( (om_1)^-1 * (omb_1)^-1 * (

m_1 * omb_1 * x1 * Cos(om_1 * t2_0)

+

m_1

* v2 * Cos(om_1 * t2_0) * (1 + -1 * (Cos(u))^2)^(1 / 2) + -1 * omb_1 * v1 * Sin(om_1 * t2_0) + om_1 * omb_1 * x2 * Sin(om_1 * t2_0) + om_1 * v2 * Cos(u) * Sin(om_1 * t2_0) +

1

* om_1 * v2 * Cos(omb_1 * t2_0) * Cos(u) * Sin(om_1 * t2_0) +

m_1

* v2 * Cos(om_1 * t2_0) * Cos(u) * Sin(omb_1 * t2_0) +

m_1

* v2 * Cos(om_1 * t2_0) * Cos(omb_1 * t2_0) * Sin(u) +

m_1

* v2 * Sin(om_1 * t2_0) * Sin(omb_1 * t2_0) * Sin(u))) * Sin(om_3 * t5) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 36

+

1

* v2 * ( 1 +

1

* (Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4))^2) ^(1 / 2) * Sin(om_3 * t5) + v1 * (Sin(om_3 * t5))^2 +

1

* v2 * Cos(-1 * om_1 * t2_0 + omb_1 * t2_0 + u + Pi / 4) * (Sin(om_3 * t5))^2)) ^2 >= (p)^2)

This is just one branch to prove

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 12 / 42

SLIDE 37

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

SLIDE 38

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

SLIDE 39

Differential Invariants for Differential Equations

“Definition” (Differential Invariant)

“Formula that remains true in the direction of the dynamics”

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 13 / 42

SLIDE 40

Differential Induction: Local Dynamics w/o Solutions

Definition (Differential Invariant) (J.Log.Comput. 2010)

F closed under total differentiation with respect to differential constraints

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

SLIDE 41

Differential Induction: Local Dynamics w/o Solutions

Definition (Differential Invariant) (J.Log.Comput. 2010)

F closed under total differentiation with respect to differential constraints

¬ ¬F

F F

(χ → F ′) χ → F→[x′ = θ & χ]F F → [α]F F → [α∗]F

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

SLIDE 42

Differential Induction: Local Dynamics w/o Solutions

Definition (Differential Invariant) (J.Log.Comput. 2010)

F closed under total differentiation with respect to differential constraints

¬ ¬F

F F χ

F

(χ → F ′) χ → F→[x′ = θ & χ]F

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

SLIDE 43

Differential Induction: Local Dynamics w/o Solutions

Definition (Differential Invariant) (J.Log.Comput. 2010)

F closed under total differentiation with respect to differential constraints

¬ ¬F

F F χ

F

(χ → F ′) χ → F→[x′ = θ & χ]F (¬F ∧ χ → F ′

≫)

[x′ = θ & ¬F]χ→x′ = θ & χF

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

SLIDE 44

Differential Induction: Local Dynamics w/o Solutions

Definition (Differential Invariant) (J.Log.Comput. 2010)

F closed under total differentiation with respect to differential constraints

¬ ¬F

F F χ

F

(χ → F ′) χ → F→[x′ = θ & χ]F (¬F ∧ χ → F ′

≫)

[x′ = θ & ¬F]χ→x′ = θ & χF Total differential F ′ of formulas?

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 14 / 42

SLIDE 45

Equational Differential Invariants

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 46

Equational Differential Invariants

→[x′ = θ & H]p = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 47

Equational Differential Invariants

F

¬F

(H → p = 0)→[x′ = θ & H]p = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 48

Equational Differential Invariants

F

¬F

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 49

Equational Differential Invariants

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 50

Equational Differential Invariants

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 p = c → [x′ = f (x) & H]p = c

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 51

Equational Differential Invariants

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 p = c → [x′ = f (x) & H]p = c

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 52

Equational Differential Invariants

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 53

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 54

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 15 / 42

SLIDE 55

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 56

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 57

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = 4, a1 = −1, a0 = 5 3 prove ∀x (H→p′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 58

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = 4, a1 = −1, a0 = 6 3 prove ∀x (H→p′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 59

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = 4, a1 = −1, a0 = 7 3 prove ∀x (H→p′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 60

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = 4, a1 = −2, a0 = 5 3 prove ∀x (H→p′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 61

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = −4, a1 = 2, a0 = 8 3 prove ∀x (H→p′ = 0) 3 Problem: enumerating all polynomials takes a while . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 62

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = −4, a1 = 2, a0 = 8 3 prove ∀x (H→p′ = 0) 3 Instead: ∃a ∀x (H→p′ = 0) Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 63

Lie Generates Invariants

Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Corollary (Invariant polynomials with R ∩ Q coefficients r.e.)

Invariant polynomial function p ∈ (R ∩ Q)[x] of x′ = f (x) on open H r.e.

Proof (Direct Method).

1 for

p def = a2x2 + a1x + a0

2 with a2 = −4, a1 = 2, a0 = 8 3 prove ∀x (H→p′ = 0) 3 Instead: ∃a ∀x (H→p′ = 0) 4 Still enumerate polynomial degrees . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 16 / 42

SLIDE 64

Ex: Deconstructed Aircraft (I) Directly

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 65

Ex: Deconstructed Aircraft (I) Directly

−y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 66

Ex: Deconstructed Aircraft (I) Directly

(−y)2x + e2y = 0 ∧ −y = −y −y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 67

Ex: Deconstructed Aircraft (I) Directly

−2xy + 2ey = 0 (−y)2x + e2y = 0 ∧ −y = −y −y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 68

Ex: Deconstructed Aircraft (I) Directly

not valid −2xy + 2ey = 0 (−y)2x + e2y = 0 ∧ −y = −y −y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 69

Ex: Deconstructed Aircraft (I) Directly

not valid −2xy + 2ey = 0 (−y)2x + e2y = 0 ∧ −y = −y −y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x) Not Provable? Wait! It’s true. Why not proved?

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 70

Ex: Deconstructed Aircraft (I) Directly

not valid −2xy + 2ey = 0 (−y)2x + e2y = 0 ∧ −y = −y −y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x) Not Provable? Wait! It’s true. Why not proved? not single equation

c x y d e x − y e d − e

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 17 / 42

SLIDE 71

The Structure of Differential Invariants

Theorem (Closure properties of differential invariants) (LMCS 2012)

Closed under conjunction, differentiation, and propositional equivalences.

Theorem (Differential Invariance Chart) (LMCS 2012)

DI= DI=,∧,∨ DI> DI>,∧,∨ DI≥ DI≥,∧,∨ DI DI≥,=,∧,∨ DI>,=,∧,∨

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 18 / 42

SLIDE 72

Ex: Deconstructed Aircraft (II) Atomic

. . . →[x′ = −y, y′ = e, e′ = −y](x2 + y2 − 1)2 + (e − x)2 = 0 Reduce to single equation, try again

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

SLIDE 73

Ex: Deconstructed Aircraft (II) Atomic

not valid 2(x2 + y2 − 1)(−2yx + 2ey) = 0 2(x2 + y2 − 1)(−y2x + e2y) + 2(e − x)(−y − (−y)) = 0 (−y ∂

∂x + e ∂ ∂y − y ∂ ∂e )

(x2 + y2 − 1)2 + (e − x)2

= 0 . . . →[x′ = −y, y′ = e, e′ = −y](x2 + y2 − 1)2 + (e − x)2 = 0 Reduce to single equation, try again

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

SLIDE 74

Ex: Deconstructed Aircraft (II) Atomic

not valid 2(x2 + y2 − 1)(−2yx + 2ey) = 0 2(x2 + y2 − 1)(−y2x + e2y) + 2(e − x)(−y − (−y)) = 0 (−y ∂

∂x + e ∂ ∂y − y ∂ ∂e )

(x2 + y2 − 1)2 + (e − x)2

= 0 . . . →[x′ = −y, y′ = e, e′ = −y](x2 + y2 − 1)2 + (e − x)2 = 0 Reduce to single equation, try again Not Provable? Wait! It’s true. Why not proved?

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

SLIDE 75

Ex: Deconstructed Aircraft (II) Atomic

not valid 2(x2 + y2 − 1)(−2yx + 2ey) = 0 2(x2 + y2 − 1)(−y2x + e2y) + 2(e − x)(−y − (−y)) = 0 (−y ∂

∂x + e ∂ ∂y − y ∂ ∂e )

(x2 + y2 − 1)2 + (e − x)2

= 0 . . . →[x′ = −y, y′ = e, e′ = −y](x2 + y2 − 1)2 + (e − x)2 = 0 Reduce to single equation, try again Could Prove? If only we could assume invariant F during its proof . . .

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 19 / 42

SLIDE 76

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 77

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 78

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions)

x2 − 6x + 9 = 0 →[x′ = y, y′ = −x]x2 − 6x + 9 = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 79

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions)

x2 − 6x + 9 = 0 →y ∂(x2−6x+9)

∂x

− x ∂(x2−6x+9)

∂y

= 0 x2 − 6x + 9 = 0 →[x′ = y, y′ = −x]x2 − 6x + 9 = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 80

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions)

x2 − 6x + 9 = 0 →y2x − 6y = 0 x2 − 6x + 9 = 0 →y ∂(x2−6x+9)

∂x

− x ∂(x2−6x+9)

∂y

= 0 x2 − 6x + 9 = 0 →[x′ = y, y′ = −x]x2 − 6x + 9 = 0 y x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 81

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions are unsound!)

x2 − 6x + 9 = 0 →y2x − 6y = 0 x2 − 6x + 9 = 0 →y ∂(x2−6x+9)

∂x

− x ∂(x2−6x+9)

∂y

= 0 x2 − 6x + 9 = 0 →[x′ = y, y′ = −x]x2 − 6x + 9 = 0 y x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 82

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions)

(x2 ≤ 0 → 2x · 1 ≤ 0) x2 ≤ 0 →[x′ = 1]x2 ≤ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 83

Assuming Differential Invariance ¬ ¬F

F F

¬ ¬F

F F

(H → F ′) (H → F)→[x′ = θ & H]F (F ∧ H → F ′) (H → F)→[x′ = θ & H]F

Example (Restrictions are unsound!)

(x2 ≤ 0 → 2x · 1 ≤ 0) x2 ≤ 0 →[x′ = 1]x2 ≤ 0 t x x0 + t x′ = 1

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 20 / 42

SLIDE 84

Ex: Deconstructed Aircraft (III) Differential Cut

x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 85

Ex: Deconstructed Aircraft (III) Differential Cut

. . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 86

Ex: Deconstructed Aircraft (III) Differential Cut

. . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 87

Ex: Deconstructed Aircraft (III) Differential Cut

. . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 88

Ex: Deconstructed Aircraft (III) Differential Cut

. . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 89

Ex: Deconstructed Aircraft (III) Differential Cut

e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 90

Ex: Deconstructed Aircraft (III) Differential Cut

e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 91

Ex: Deconstructed Aircraft (III) Differential Cut

e = x → − 2yx + 2xy = 0 e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 92

Ex: Deconstructed Aircraft (III) Differential Cut

∗ e = x → − 2yx + 2xy = 0 e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 93

Ex: Deconstructed Aircraft (III) Differential Cut

∗ e = x → − 2yx + 2xy = 0 e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x) Successful Proof Lie & differential cuts separate aircraft

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 21 / 42

SLIDE 94

Ex: Deconstructed Aircraft (IV) Smart

e2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](e2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

SLIDE 95

Ex: Deconstructed Aircraft (IV) Smart

−y ∂(e2+y2)

∂e

+ e ∂(e2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

e2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](e2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

SLIDE 96

Ex: Deconstructed Aircraft (IV) Smart

−y2e + e2y = 0 ∧ −y = −y −y ∂(e2+y2)

∂e

+ e ∂(e2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

e2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](e2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

SLIDE 97

Ex: Deconstructed Aircraft (IV) Smart

∗ −y2e + e2y = 0 ∧ −y = −y −y ∂(e2+y2)

∂e

+ e ∂(e2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

e2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](e2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

SLIDE 98

Ex: Deconstructed Aircraft (IV) Smart

∗ −y2e + e2y = 0 ∧ −y = −y −y ∂(e2+y2)

∂e

+ e ∂(e2+y2)

∂y

= 0 ∧ −y ∂e

∂e = −y ∂x ∂x

e2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](e2 + y2 = 1 ∧ e = x) Direct Proof Smart invariant also separates aircraft?!

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 22 / 42

SLIDE 99

Differential Cuts

φ→[x′ = θ & H]C φ→[x′ = θ & (H ∧ C)]φ φ→[x′ = θ & H]φ

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 23 / 42

SLIDE 100

Ex: Differential Cuts

x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 101

Ex: Differential Cuts

x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 102

Ex: Differential Cuts

x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 103

Ex: Differential Cuts

x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 104

Ex: Differential Cuts

x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 ∗ 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 105

Ex: Differential Cuts

x3 ≥ −1 →[x′ = (x − 3)4 + y5, y′ = y2 & y5 ≥ 0]x3 ≥ −1 ⊲ x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 ∗ 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 106

Ex: Differential Cuts

y5 ≥ 0 →2x2x′ ≥ 0 x3 ≥ −1 →[x′ = (x − 3)4 + y5, y′ = y2 & y5 ≥ 0]x3 ≥ −1 ⊲ x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 ∗ 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 107

Ex: Differential Cuts

y5 ≥ 0 →2x2((x − 3)4 + y5) ≥ 0 y5 ≥ 0 →2x2x′ ≥ 0 x3 ≥ −1 →[x′ = (x − 3)4 + y5, y′ = y2 & y5 ≥ 0]x3 ≥ −1 ⊲ x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 ∗ 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 108

Ex: Differential Cuts

∗ y5 ≥ 0 →2x2((x − 3)4 + y5) ≥ 0 y5 ≥ 0 →2x2x′ ≥ 0 x3 ≥ −1 →[x′ = (x − 3)4 + y5, y′ = y2 & y5 ≥ 0]x3 ≥ −1 ⊲ x3 ≥ −1 ∧ y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]x3 ≥ −1 ∗ 5y4y2 ≥ 0 5y4y′ ≥ 0 y5 ≥ 0 →[x′ = (x − 3)4 + y5, y′ = y2]y5 ≥ 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 24 / 42

SLIDE 109

Differential Cuts

φ→[x′ = θ & H]C φ→[x′ = θ & (H ∧ C)]φ φ→[x′ = θ & H]φ

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 25 / 42

SLIDE 110

Differential Cuts

φ→[x′ = θ & H]C φ→[x′ = θ & (H ∧ C)]φ φ→[x′ = θ & H]φ

Theorem (Gentzen’s Cut Elimination)

A→B ∨ C A ∧ C→B A→B cut can be eliminated

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 25 / 42

SLIDE 111

Differential Cuts

φ→[x′ = θ & H]C φ→[x′ = θ & (H ∧ C)]φ φ→[x′ = θ & H]φ

Theorem (Gentzen’s Cut Elimination)

A→B ∨ C A ∧ C→B A→B cut can be eliminated

Theorem (No Differential Cut Elimination) (LMCS 2012)

Deductive power with differential cut exceeds deductive power without. DCI > DI

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 25 / 42

SLIDE 112

Ex: Exponentials

Counterexample ()

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 26 / 42

SLIDE 113

Ex: Exponentials

Counterexample ()

x′ > 0 x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 26 / 42

SLIDE 114

Ex: Exponentials

Counterexample ()

−x > 0 x′ > 0 x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 26 / 42

SLIDE 115

Ex: Exponentials

Counterexample (Cannot prove)

not valid −x > 0 x′ > 0 x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 26 / 42

SLIDE 116

Differential Auxiliaries

Example (Successful proof)

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 117

Differential Auxiliaries

Example (Successful proof)

x > 0 ↔ ∃y xy2 = 1 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 118

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 119

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 x′y2 + x2yy′ = 0 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 120

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 −xy2 + 2xy y

2 = 0

x′y2 + x2yy′ = 0 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 121

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 ∗ −xy2 + 2xy y

2 = 0

x′y2 + x2yy′ = 0 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 122

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 ∗ −xy2 + 2xy y

2 = 0

x′y2 + x2yy′ = 0 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x y′ = y

2

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 123

Differential Auxiliaries

Example (Successful proof)

∗ x > 0 ↔ ∃y xy2 = 1 ∗ −xy2 + 2xy y

2 = 0

x′y2 + x2yy′ = 0 xy2 = 1 →[x′ = −x, y′ = y

2]xy2 = 1

x > 0 →[x′ = −x]x > 0 t x x0 x0e−t x′ = −x y′ = y

2

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 27 / 42

SLIDE 124

Differential Auxiliaries

φ ↔ ∃y ψ ψ→[x′ = θ, y′ = ϑ & H]ψ φ→[x′ = θ & H]φ if y′ = ϑ has solution y : [0, ∞) → Rn

Theorem (Auxiliary Differential Variables) (LMCS 2012)

Deductive power with differential auxiliaries exceeds deductive power without. DCI + DA > DCI

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 28 / 42

SLIDE 125

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 28 / 42

SLIDE 126

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 29 / 42

SLIDE 127

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

invariant equation

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 29 / 42

SLIDE 128

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

invariant equation

3 2 1

invariant function H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 29 / 42

SLIDE 129

Structure of Invariant Functions

Lemma (Structure of invariant functions)

Invariant functions of x′ = θ & H form an R-algebra.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 30 / 42

SLIDE 130

Structure of Invariant Functions

Lemma (Structure of invariant functions)

Invariant functions of x′ = θ & H form an R-algebra.

Corollary

Only need generating system of algebra.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 30 / 42

SLIDE 131

Structure of Invariant Functions

Lemma (Structure of invariant functions)

Invariant functions of x′ = θ & H form an R-algebra.

Corollary

Only need generating system of algebra. p invariant, F function ⇒ F(p) invariant

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 30 / 42

SLIDE 132

Structure of Invariant Equations

I=(Γ) := {p ∈ R[ x] : Γ → [x′ = θ & H]p = 0} DCI=(Γ) := {p ∈ R[ x] : ⊢DI=+DC Γ → [x′ = θ & H]p = 0}

Lemma (Structure of invariant equations)

DCI=(Γ) ⊆ I=(Γ) chain of differential ideals ((θ · ∇)p ∈ DCI=(Γ) for all p ∈ DCI=(Γ)). The varieties are generated by a single polynomial.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 31 / 42

SLIDE 133

Structure of Invariant Equations

I=(Γ) := {p ∈ R[ x] : Γ → [x′ = θ & H]p = 0} DCI=(Γ) := {p ∈ R[ x] : ⊢DI=+DC Γ → [x′ = θ & H]p = 0}

Lemma (Structure of invariant equations)

DCI=(Γ) ⊆ I=(Γ) chain of differential ideals ((θ · ∇)p ∈ DCI=(Γ) for all p ∈ DCI=(Γ)). The varieties are generated by a single polynomial.

Proof.

4 p ∈ DCI=(Γ) and r ∈ R[

x] implies rp ∈ DCI=(Γ), because (θ · ∇)(rp) = p(θ · ∇)r + r (θ · ∇)p

=

p

(θ · ∇)r = 0

and Γ → p = 0 implies Γ → rp = 0

5 p = 0 ∧ q = 0 iff p2 + q2 = 0, differential, Hilbert basis theorem . . . Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 31 / 42

SLIDE 134

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 31 / 42

SLIDE 135

Full Rank Assumptions

Theorem (Lie — necessary)

(← − DI p)

n

i=1

pi = 0 → [x′ = f (x) & H]

n

i=1

pi = 0 H ∧

n

i=1

pi = 0→

n

i=1

(θ · ∇)pi = 0 Premises, conclusions equivalent if rank ∂pi

∂xj = n on H ∧ n i=1 pi = 0.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 32 / 42

SLIDE 136

Full Rank Assumptions

Theorem (. . . — sufficient)

(− → DI p) H→

n

i=1

(θ · ∇)pi =

j

Qi,jpj

n

i=1

pi = 0 → [x′ = f (x) & H]

n

i=1

pi = 0

Theorem (Lie — necessary)

(← − DI p)

n

i=1

pi = 0 → [x′ = f (x) & H]

n

i=1

pi = 0 H ∧

n

i=1

pi = 0→

n

i=1

(θ · ∇)pi = 0 Premises, conclusions equivalent if rank ∂pi

∂xj = n on H ∧ n i=1 pi = 0.

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 32 / 42

SLIDE 137

Ex: Deconstructed Aircraft (III) Differential Cut

∗ e = x → − 2yx + 2xy = 0 e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 33 / 42

SLIDE 138

Ex: Deconstructed Aircraft (III) Differential Cut

∗ e = x → − 2yx + 2xy = 0 e = x →(−y)2x + e2y = 0 e = x → − y ∂(x2+y2)

∂x

+ e ∂(x2+y2)

∂y

= 0 . . . →[x′ = −y, y′ = e, e′ = −y & e = x](x2 + y2 = 1 ∧ e = x) ∗ −y = −y −y ∂e

∂e = −y ∂x ∂x

e = x →[x′ = −y, y′ = e, e′ = −y]e = x ⊲ x2 + y2 = 1 ∧ e = x →[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1 ∧ e = x) Successful Proof Lie & differential cuts separate aircraft

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 33 / 42

SLIDE 139

Ex: Deconstructed Aircraft (III) Differential Cut

∂(x2+y2−1)

∂x ∂(x2+y2−1) ∂y ∂(x2+y2−1) ∂e ∂(e−x) ∂x ∂(e−x) ∂y ∂(e−x) ∂e

=

2x 2y −1 1

Full rank 2 at invariant x2 + y2 = 1

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 34 / 42

SLIDE 140

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 34 / 42

SLIDE 141

Equational Differential Invariants

Theorem (Lie)

H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
equivalence if H open

F

¬F

3 2 1

H → p′ = 0 (H → p = 0)→[x′ = θ & H]p = 0 H→p′ = 0 ∀c

p = c → [x′ = f (x) & H]p = c
Corollary (Decidable invariant polynomials)

Decidable whether polynomial p invariant function of x′ = f (x) on open H

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 35 / 42

SLIDE 142

Inverse Characteristic Method

Theorem (Inverse characteristic method)

(Sufficiently smooth) f is invariant function of x′ = f (x) on H iff f solves (θ · ∇)f = 0

n H

Proof.

⇐ Lie

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 36 / 42

SLIDE 143

Inverse Characteristic Method

Theorem (Inverse characteristic method)

(Sufficiently smooth) f is invariant function of x′ = f (x) on H iff f solves (θ · ∇)f = 0

n H

Proof.

⇐ Lie If ODE too complicated, consider PDE instead???

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 36 / 42

SLIDE 144

Inverse Characteristic Method

Theorem (Inverse characteristic method)

(Sufficiently smooth) f is invariant function of x′ = f (x) on H iff f solves (θ · ∇)f = 0

n H

Proof.

⇐ Lie If ODE too complicated, consider PDE instead??? Yes, but inverse characteristic PDE is simple (first-order, linear, homogeneous) Makes rich PDE theory available for differential invariants Oracle PDE solver sufficient

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 36 / 42

SLIDE 145

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 146

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

Example (Inverse Characteristic PDE)

− y ∂f

∂x + e ∂f ∂y − y ∂f ∂e = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 147

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

Example (Inverse Characteristic PDE)

− y ∂f

∂x + e ∂f ∂y − y ∂f ∂e = 0

f (x, y, e) = g
x − e

(1)

, 1 2(x2 − 2ex − y2

(2)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 148

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

(1)

− e + x

(2)

− y2 − 2ex + x2

Example (Inverse Characteristic PDE)

− y ∂f

∂x + e ∂f ∂y − y ∂f ∂e = 0

f (x, y, e) = g
x − e

(1)

, 1 2(x2 − 2ex − y2

(2)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 149

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

(1)

− e + x

(4)

(2)

− y2 − 2ex + x2

(3)

−2ex + 2x2 − 1

(4)

−2e2 + 2e2 − 1 = − 1

Example (Inverse Characteristic PDE)

− y ∂f

∂x + e ∂f ∂y − y ∂f ∂e = 0

f (x, y, e) = g
x − e

(1)

, 1 2(x2 − 2ex − y2

(2)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 150

Ex: Deconstructed Aircraft (IV)

Example (Generate Differential Invariants)

x2 + y2 = 1 ∧ e = x→[x′ = −y, y′ = e, e′ = −y](x2 + y2 = 1

(3)

∧ e = x

(4)

)

(1)

− e + x

(4)

(2)

− y2 − 2ex + x2

(3)

−2ex + 2x2 − 1

(4)

−2e2 + 2e2 − 1 = − 1 Differential invariants: − e + x = 0, − y2 − 2ex + x2 = −1

Example (Inverse Characteristic PDE)

− y ∂f

∂x + e ∂f ∂y − y ∂f ∂e = 0

f (x, y, e) = g
x − e

(1)

, 1 2(x2 − 2ex − y2

(2)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 37 / 42

SLIDE 151

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2

∧ d1 = −ωx2 ∧ d2 = ωx1

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 152

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2

∧ d1 = −ωx2 ∧ d2 = ωx1

Example (Inverse Characteristic PDE)

d1

∂f ∂x1 + d2 ∂f ∂x2 − ωd2 ∂f ∂d1 + ωd1 ∂f ∂d2 = 0

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 153

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2

∧ d1 = −ωx2 ∧ d2 = ωx1

Example (Inverse Characteristic PDE)

d1

∂f ∂x1 + d2 ∂f ∂x2 − ωd2 ∂f ∂d1 + ωd1 ∂f ∂d2 = 0

f (x1, x2, d1, d2) = g
d2 − ωx1
(1)

, d1 + ωx2 ω

(2)

, 1 2(d2

1 + 2ωd2x1 − ω2x2 1

(3)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 154

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2

∧ d1 = −ωx2 ∧ d2 = ωx1 d2 − ωx1 d1 + ωx2 d2

1 + 2ωx1d2 − ω2x2 1

Example (Inverse Characteristic PDE)

d1

∂f ∂x1 + d2 ∂f ∂x2 − ωd2 ∂f ∂d1 + ωd1 ∂f ∂d2 = 0

f (x1, x2, d1, d2) = g
d2 − ωx1
(1)

, d1 + ωx2 ω

(2)

, 1 2(d2

1 + 2ωd2x1 − ω2x2 1

(3)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 155

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2 (4) ∧ d1 = −ωx2 (5) ∧ d2 = ωx1 (6)

d2 − ωx1

(5)

d1 + ωx2

(6)

d2

1 + 2ωx1d2 − ω2x2 1 (6)

d2

1 + 2d2 2 − ω2x2 1 (5)

d2

1 + 2d2 2 − d2 2 (4)

ω2p2

Example (Inverse Characteristic PDE)

d1

∂f ∂x1 + d2 ∂f ∂x2 − ωd2 ∂f ∂d1 + ωd1 ∂f ∂d2 = 0

f (x1, x2, d1, d2) = g
d2 − ωx1
(1)

, d1 + ωx2 ω

(2)

, 1 2(d2

1 + 2ωd2x1 − ω2x2 1

(3)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 156

Ex: Aircraft

Example (Generate Differential Invariants)

F ∧ ω = 0→[x′

1 = d1, x′ 2 = d2, d′ 1 = −ωd2, d′ 2 = ωd1]F

F ≡ d2

1 + d2 2 = ω2p2 (4) ∧ d1 = −ωx2 (5) ∧ d2 = ωx1 (6)

d2 − ωx1

(5)

d1 + ωx2

(6)

d2

1 + 2ωx1d2 − ω2x2 1 (6)

d2

1 + 2d2 2 − ω2x2 1 (5)

d2

1 + 2d2 2 − d2 2 (4)

ω2p2

Example (Inverse Characteristic PDE)

d1

∂f ∂x1 + d2 ∂f ∂x2 − ωd2 ∂f ∂d1 + ωd1 ∂f ∂d2 = 0

f (x1, x2, d1, d2) = g
d2 − ωx1
(1)

, d1 + ωx2 ω

(2)

, 1 2(d2

1 + 2ωd2x1 − ω2x2 1

(3)

)

Andr´

e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 157

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 38 / 42

SLIDE 158

F

¬F

F

[α]φ

φ α αPφ P(φ)

ψ → [α]φ ψ → [α]φ ψ → [α]φ ψ → [α]φ ψ → [α]φ

Strategy Rule Engine Proof Input File Rule base Mathematica QEPCAD Orbital KeYmaera Prover Solvers

1 2 2 4 4 8 8 16 16 16 ∗ ∗

16 8 4 2 1

c

∪

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 39 / 42

SLIDE 159

Successful Hybrid Systems Proofs

far neg cor rec fsa

* 1 [SB := ((amax / b + 1) * ep * v + (v ^ 2 - d ^ 2) / (2 * b) + ((amax / b + 1) * amax * ep ^ 2) / 2)] 7 17 6 [?d >= 0 & do ^ 2 - d ^ 2 <= 2 * b * (m - mo) & vdes >= 0] 5 [vdes := *] 4 [d := *] 3 [m := *] 2 [mo := m] [do := d] 8 [state := brake] 10 [?v <= vdes] 13 [?v >= vdes] 22 31 21 [{z‘ = v, v‘ = a, t‘ = 1, v >= 0 & t <= ep}] 18 28 17 [a := -b] 12 24 11 [?a >= 0 & a <= amax] [a := *] 15 14 [?a <= 0 & a >= -b] [a := *] 19 [t := 0] * [?m - z <= SB | state = brake] [?m - z >= SB & state != brake]

x y c

 

c

x

e n t r y e x i t

y

c

x1

x2 y1 y2 d ω e ¯ ϑ ̟

c

x
y
z

x Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 40 / 42

SLIDE 160

Successful Hybrid Systems Proofs

ey fy xb (lx, ly) ex fx (rx, ry) (vx, vy)

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 40 / 42

SLIDE 161

Outline

1

Motivation

2

Differential Dynamic Logic dL Syntax Semantics Axiomatization Soundness and Completeness

3

Differential Invariants Air Traffic Control Equational Differential Invariants Structure of Differential Invariants Differential Cuts Differential Auxiliaries

4

Structure of Invariant Functions / Equations

5

Differential Invariants and Assumptions

6

Inverse Characteristic Method

7

Survey

8

Summary

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 40 / 42

SLIDE 162

Differential Dynamic Logic and Differential Invariants

d i s c r e t e c

n

t i n u

u

s s t

c

h a s t i c differential dynamic logic

dL = DL + HP [α]φ φ α Logic for hybrid systems++ Sound & complete / ODE Differential invariants No differential cut elimination Differential auxiliaries Algebra / differential ideal Inverse characteristic PDE KeYmaera

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 41 / 42

SLIDE 163

Logical Foundations

f

Cyber-Physical Systems

Logic

Model Checking Theorem Proving Proof Theory

Algebra

Computer Algebra Algebraic Geometry Differential Algebra

Analysis

Differential Equations Dynamical Systems Differen- tiation

Stochastics

Stochastic Differential Equations Dynkin Generator Super- martingales

Numerics

Numerical Integration Polynomial Interpo- lation Weierstraß Approx- imation

Algorithms

Decision Procedures Proof Search Fixedpoint Loops

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 42 / 42

SLIDE 164

Logical Foundations

f

Cyber-Physical Systems

Logic

Model Checking Theorem Proving Proof Theory

Algebra

Computer Algebra Algebraic Geometry Differential Algebra

Analysis

Differential Equations Dynamical Systems Differen- tiation

Stochastics

Stochastic Differential Equations Dynkin Generator Super- martingales

Numerics

Numerical Integration Polynomial Interpo- lation Weierstraß Approx- imation

Algorithms

Decision Procedures Proof Search Fixedpoint Loops

Andr´ e Platzer (CMU) Differential Dynamic Logic and Differential Invariants ITP’12 42 / 42