KeYmaera X: An Axiomatic Tactical Theorem Prover for Hybrid Systems

Abstract

Abstract. KeYmaera X is a theorem prover for differential dynamic logic (dL), a logic for specifying and verifying properties of hybrid systems. Reasoning about complicated hybrid systems models requires support for sophisticated proof techniques, efficient computation, and a user interface that crystallizes salient properties of the system. KeYmaera X allows users to specify custom proof search techniques as tactics, execute these tactics in parallel, and interface with partial proofs via an extensible user interface. Advanced proof search features-and user-defined tactics in particular-are difficult to check for soundness. To admit extension and experimentation in proof search without reducing trust in the prover, KeYmaera X is built up from a small trusted kernel. The prover kernel contains a list of sound dL axioms that are instantiated using a uniform substitution proof rule. Isolating all soundness-critical reasoning to this prover kernel obviates the intractable task of ensuring that each new proof search algorithm is implemented correctly. Preliminary experiments suggest that a single layer of tactics on top of the prover kernel provides a rich language for implementing novel and sophisticated proof search techniques.

ModelPlex: verified runtime validation of verified cyber-physical system models

“…Differential dynamic logic comes with a verification technique to prove correctness properties of hybrid programs (cf. [33] for an overview of dL and KeYmaera, and [14] for an overview of KeYmaera X).…”

“…Furthermore, ν| A denotes the state ν projected to just the variables in A, whereas ν y x denotes the state ν in which x is interpreted as y. In the proofs throughout this article, we will use the following lemmas specialized from [35,Lemmas 12,14,and 15]. Hybrid programs only change their bound variables:…”

“…We assume to be given a verified model of a CPS, i. e. formula (2) is proved valid, 3 for example using the differential dynamic logic proof calculus [29,33] implemented in KeYmaera [37] and KeYmaera X [14]:…”

“…This proof tactic is formulated in the tactic language of our theorem prover KeYmaera X [14]. KeYmaera X features a small soundnesscritical core for axiomatic reasoning.…”

“…2 Extension In addition to providing proofs for the results, this article extends the short version [24] with support for a correct-by-construction approach to synthesize ModelPlex monitors by a systematic transformation in the differential dynamic logic axiomatization [33]. We leverage an implementation of this axiomatization in our entirely new theorem prover KeYmaera X [14] by performing the ModelPlex monitor proof construction in place, as opposed to splitting it over the branches of its classical sequent calculus [29]. Sequent calculi are usually preferred for proving properties, because they induce a sequent normal form that simplifies proof construction by narrowing proof search to proof rules for top-level operators and splitting the proof over independent branches as needed.…”