Relational differential dynamic logic

Abstract

In the field of quality assurance of hybrid systems (that combine continuous physical dynamics and discrete digital control), Platzer's differential dynamic logic (dL) is widely recognized as a deductive verification method with solid mathematical foundations and sophisticated tool support. Motivated by benchmarks provided by our industry partner, we study a relational extension of dL, aiming to formally prove statements such as "an earlier deployment of the emergency brake decreases the collision speed." A main technical challenge here is to relate two states of two dynamics at different time points. Our main contribution is a theory of suitable simulations (a relational extension of differential invariants that are central proof methods in dL), and a derived technique of time stretching. The latter features particularly high applicability, since the user does not have to synthesize a simulation out of the air. We derive new inference rules for dL from these notions, and demonstrate their use over a couple of automotive case studies.

Relational Analysis of Sensor Attacks on Cyber-Physical Systems

“…For instance, our example shown in Figure 8 is not directly expressible in their setting. We believe that the work by Kolčák et al [54] is orthogonal to ours, and the two can be combined to express and prove more complicated relational properties.…”

“…Closely related to our work is that of Kolčák et al [54] which introduces a relational extension of dL. A key contribution of their work is a new proof rule to combine two dynamics, allowing existing inference rules of dL to be applied in a relational setting.…”

Formal Certification Methods for Automated Vehicle Safety Assessment

“…4) Building New Logic For Safety Description: Although the majority of primary studies use linear temporal logic implicitly or explicitly for arguing safety guarantees, there exist developments of new forms of logic, such as Differential Dynamic Logic 7 [156](based on concept in [157]), allows statements and related proofs such as "an earlier engagement of the emergency brake yields a smaller collision speed". It would be therefore interesting to see developments of new logic constructs for proving more complicated safety-related statements, as they could potentially help resolve liability issues generated by AVs.…”