Differential Dynamic Logic for Hybrid Systems

Abstract

Hybrid systems are models for complex physical systems and are defined as dynamical systems with interacting discrete transitions and continuous evolutions along differential equations. With the goal of developing a theoretical and practical foundation for deductive verification of hybrid systems, we introduce a dynamic logic for hybrid programs, which is a program notation for hybrid systems. As a verification technique that is suitable for automation, we introduce a free variable proof calculus with a novel combination of real-valued free variables and Skolemisation for lifting quantifier elimination for real arithmetic to dynamic logic. The calculus is compositional, i.e., it reduces properties of hybrid programs to properties of their parts. Our main result proves that this calculus axiomatises the transition behaviour of hybrid systems completely relative to differential equations. In a case study with cooperating traffic agents of the European Train Control System, we further show that our calculus is well-suited for verifying realistic hybrid systems with parametric system dynamics.

European Train Control System: A Case Study in Formal Verification

“…In this section, we survey differential dynamic logic dL [10] which is tailored for specifying and verifying rich correctness properties of parametric hybrid systems.…”

“…We only develop the theory as far as necessary and refer to [10] for more background on dL and the sequent proof calculus for dL which is implemented in KeYmaera [11].…”

“…Instead, we use our techniques based on symbolic decompositions [10] for systematically exploring the design space of a hybrid system and for discovering correctness constraints on free parameters. For a complex physical system, we show step by step how a control system can be developed that meets its control design goals and desired correctness properties.…”

“…2 we summarize differential dynamic logic [10] which we use for modelling ETCS. We introduce a formal model for parametric ETCS in Sect.…”

“…3. Using symbolic decomposition analysis [10], we systematically derive parametric correctness constraints for ETCS and verify several correctness properties of parametric ETCS using these constraints in Sect. 4.…”