Formally verified differential dynamic logic

Abstract

We formalize the soundness theorem for differential dynamic logic, a logic for verifying hybrid systems. To increase confidence in the formalization, we present two versions: one in Isabelle/HOL and one in Coq. We extend the metatheory to include features used in practice, such as systems of differential equations and functions of multiple arguments. We demonstrate the viability of constructing a verified kernel for the hybrid systems theorem prover KeYmaera X by embedding proof checkers for differential dynamic logic in Coq and Isabelle. We discuss how different provers and libraries influence the design of the formalization.

Differential Equation Invariance Axiomatization

“…e study of the Noetherian functions is a major new contribution of this extended version, among others: (5) e Noetherian functions are shown to meet the extended term conditions. Any such extension automatically inherits all of the aforementioned completeness results.…”

“…Crucially, this obviates the need to unfold the mathematical semantics of di erential equations each time for proving their invariance properties. is separation of syntax and axiomatics from semantics enables their sound implementation e.g., in KeYmaera X [9] with dL's uniform substitution calculus [33], and their veri cation in foundational theorem provers [5].…”

“…Constants c are 0-ary function symbols always denoting their respective (real) values. 5 Autonomous ODEs x = f (x ) do not depend explicitly on time on the RHS. A standard transformation is to add a clock variable t to the system with x = f (x, t ), t = 1 if time dependency on the RHS is desired.…”

“…w.r.t. their respective normal forms(5), this axiom derives in dL with RI&,Dadj,Cont,Uniq:SAI& ∀x (P → [x = f (x) & Q]P) ↔ ∀x P ∧ Q ∧ .right conjunct on the RHS of SAI& are abbreviated a and b respectively. e "←" direction derives by sAI&.…”

Uniform Substitution at One Fell Swoop

“…For example, applying a uniform substitution σ checks at every sequential composition α; β again that the entire substitution σ is admissible for the remainder β compared to the bound variables of the result of having applied σ to α: σ(α; β) = (σ(α); σ(β)) if σ is BV(σ(α))-admissible for β (1) where σ is U-admissible for β iff the free variables of the replacements for the part of σ having function/predicate symbols that occur in β do not intersect U, which, here, are the bound variables BV(σ(α)) computed from the result of applying the substitution σ to α [18]. This mechanism is sound [16,18], even verified sound for hybrid systems in Isabelle/HOL and Coq [2], but computationally redundant due to its repeated substitution application and admissibility computations.…”