Pegasus: A Framework for Sound Continuous Invariant Generation

Abstract

Continuous invariants are an important component in deductive verification of hybrid and continuous systems. Just like discrete invariants are used to reason about correctness in discrete systems without unrolling their loops forever, continuous invariants are used to reason about differential equations without having to solve them. Automatic generation of continuous invariants remains one of the biggest practical challenges to the automation of formal proofs of safety for hybrid systems. There are at present many disparate methods available for generating continuous invariants; however, this wealth of diverse techniques presents a number of challenges, with different methods having different strengths and weaknesses. To address some of these challenges, we develop Pegasus: an automatic continuous invariant generator which allows for combinations of various methods, and integrate it with the KeYmaera X theorem prover for hybrid systems. We describe some of the architectural aspects of this integration, comment on its methods and challenges, and present an experimental evaluation on a suite of benchmarks.1 An etymological note on naming conventions. The KeY [3] prover provided the foundation for developing KeYmaera [58], an interactive theorem prover for hybrid systems. The name KeYmaera was a pun on the Chimera, a hybrid monster from Classical Greek mythology. The tactic language of the new (aXiomatic) KeYmaera X prover [24] is called Bellerophon [23], after the hero who defeats the Chimera in the myth. In keeping with an established tradition, the invariant generation framework is called Pegasus because the aid of this winged horse was crucial to the hero Bellerophon in his feat.

Logical Foundations of Cyber-Physical Systems

“…At the same time, KeYmaera X provides a language for custom tactics [Fulton et al, 2017], sophisticated proof automation, including invariant generation [Sogokon et al, 2019], and a versatile user interface [Mitsch and Platzer, 2016a], but those are markedly outside the soundness-critical part of KeYmaera X even if still just as important for practical verification in KeYmaera X.…”

“…Combining reinforcement learning with ModelPlex safety monitors enables provably safe reinforcement learning in CPS [Fulton and Platzer, 2018]. Reinforcement learning repeatedly chooses actions and observes outcomes in the (simulated or real) environment and makes those actions more likely if the outcome was favorable and less likely if it was not [Sutton and Barto, 1998]. The most obvious way of benefiting from a provably safe ModelPlex monitor in a learning CPS is to leave learning alone while training and then, during deployment, simply safeguard all actions performed by the trained CPS using the ModelPlex monitors.…”

“…Fortunately, differential dynamic logic is not just for pen-and-paper proofs but is implemented 1 in the theorem prover KeYmaera X [Fulton et al, 2015] that makes it possible to conduct rigorous formal proofs with tool support and substantial levels of proof automation including invariant generation [Sogokon et al, 2019]. The tool KeYmaera X was instrumental for verifying challenging applications, including ground robot obstacle avoidance [Mitsch et al, 2017b], railway systems [Mitsch et al, 2017a], and the Next-generation Airborne Collision Avoidance System ACAS X [Jeannin et al, 2017].…”

Implicit Semi-Algebraic Abstraction for Polynomial Dynamical Systems

“…All these techniques are orthogonal to semialgebraic abstraction, and can be used to find invariant polynomials to restrict the abstract state space. Pegasus [33] implements all the above techniques, the LazyReach, and DWCL algorithms. Our algorithm can be integrated in Pegasus.…”

A Formally Verified Plasma Vertical Position Control Algorithm

“…Automated analysis of both linear and nonlinear systems is also possible within KeYmaera X. The Pegasus tool introduced a set of nonlinear control benchmark problems, some of which exhibit dynamics similar to those studied in this paper [40].…”