Tactical contract composition for hybrid system component verification

Abstract

We present an approach for hybrid systems that combines the advantages of component-based modeling (e.g., reduced model complexity) with the advantages of formal verification (e.g., guaranteed contract compliance). Component-based modeling can be used to split large models into multiple component models with local responsibilities to reduce modeling complexity. Yet, this only helps the analysis if verification proceeds one component at a time. In order to benefit from the decomposition of a system into components for both modeling and verification purposes, we prove that the safety of compatible components implies safety of the composed system. We implement our composition theorem as a tactic in the KeYmaera X theorem prover, allowing automatic generation of a KeYmaera X proof for the composite system from proofs for the components without soundness-critical changes to KeYmaera X. Our approach supports component contracts (i.e., input assumptions and output guarantees for each component) that characterize the magnitude and rate of change of values exchanged between components. These contracts can take into account what has changed between two components in a given amount of time since the last exchange of information.

Skill-Based Verification of Cyber-Physical Systems

“…We further extend this concept with skill graphs by modularizing the verification of complex driving tasks, such that the verification of the entire behavior is reduced to simpler sub-tasks and compatibility checks. Finally, there exists a seamless connection to the work conducted by Müller et al [24], who present a compositional component-based approach for the verification of hybrid systems based on hybrid programs. Skill graphs provide an abstract and organized view of the system and are applied (1) in the verification and validation phase of the requirements analysis and (2) the early stages of the design phase.…”

A Mechanically Verified Theory of Contracts

“…While the verification process supports decomposition, it does not support parallelism hence modularity. Multiple approaches have therefore been investigated to define contracts in dL [13,15]. Their goal is to define a composition theorem allowing to connect multiple components.…”

A Formally Verified Plasma Vertical Position Control Algorithm

“…Second, our plan for future work includes modeling more complex aspects of the fusion reactor's control systems and synthesizing safety interlocks that enable the use of reinforcement learning for these systems. KeYmaera X provides a method for composing verification results [29]. Because data-driven methodologies can play an important role in plasma design [37,38], KeYmaera X's support for incorporating safety interlocks into learning systems [14] -especially in cases where some aspects of the control system are not captured by a first-principles model [15] or represented in explicitly modeled quantities [19] -provides another motivation for its use as a platform for this work.…”