CoasterX: A Case Study in Component-Driven Hybrid Systems Proof Automation

Transcription

1 CoasterX: A Case Study in Component-Driven Hybrid Systems Proof Automation Brandon Bohrer (joint work with Adriel Luo, Xuean Chuang, André Platzer) Logical Systems Lab Computer Science Department Carnegie Mellon University ADHS, Jul / 32

2 Roller Coasters are Safety-Critical Systems Top Thrill Steel Phantom Mindbender [BLCP18] Joker s Jinx Phantom s Revenge Fujin Raijin II Rollback Head Injury Derailment 2 / 32

3 Formal Proofs in dl Ensure Safe Designs Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment Pre [phys]post [BLCP18] Identify: Notion of safety Post (acc < acc hi ) 3 / 32

4 Formal Proofs in dl Ensure Safe Designs Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment Pre [phys]post [BLCP18] Identify: Notion of safety Post (acc < acc hi ) Safe conditions Pre (v = v 0 ) 3 / 32

5 Formal Proofs in dl Ensure Safe Designs Top Thrill Steel Phantom Mindbender Rollback Head Injury Derailment Pre [phys]post [BLCP18] Identify: Notion of safety Post (acc < acc hi ) Safe conditions Pre (v = v 0 ) Verify physical plant ({x =..., y =...}) 3 / 32

6 Design Verification Supplements Simulation Simulations typically used today [XXLY12, Wei15] Approach Pro Con Simulate Rich dynamics, easy Low rigor+precision Verify High rigor+precision Simple dynamics, hard 4 / 32

7 Verifying Physical Designs is a Challenge How do we verify models at scale? How do we make verification accessible to non-experts? 5 / 32

8 Verifying Plant Designs is Important 6 / 32

9 Component-Driven Proof Automation Enables Design Verification GUI Builder Component model CoasterX Backend dl fml. dl pf. KeYmaera X Prover Core (1700 Lines) [FMQ + 15] Goal Accessible Rigorous Scalable Solution High-level graphical modeling Formal proof checked by small prover core Proof scales by exploiting component structure 7 / 32

10 Track Sections are Components for Coasters Generic Component 8 / 32

11 Track Sections are Components for Coasters Generic Component Automatic Composition 8 / 32

12 Track Sections are Components for Coasters Generic Component Automatic Composition 8 / 32

13 Track Sections are Components for Coasters Generic Component Automatic Composition 8 / 32

14 Track Sections are Components for Coasters Generic Component Automatic Composition 8 / 32

15 Background: dl Formulas P, Q ::= P Q P xp θ 1 θ 2 [α]p Example: Pre [plant]post Construct P Q, P, xp θ 1 θ 2 [α]p Meaning First-order Logic Real arithmetic comparisons Safety: After α runs, P always holds 9 / 32

16 Background: Hybrid Programs α, β ::= {x = θ & P} α β α Construct Meaning {x = θ & P} Evolve x at continuous rate θ Evolution domain constraint P asserted continuously α β Choose either α or β nondeterministically α Loop α nondeterministically n 0 times 10 / 32

17 Velocity and Acceleration Bounds are Fundamental Rollback Head Injury Derailment 0 < v lo v a a hi a a hi [AST17] 11 / 32

18 Tracks are 2D 2D modeling greatly simplifies GUI Vertical and horizontal bounds only (no lateral bound) Ignores banking, wind, roll resistance (1-2%) 12 / 32

19 Conservative Bound Suffices for Phantom Top Thrill Steel Phantom Mindbender Joker s Jinx Phantom s Revenge Fujin Raijin II Rollback Head Injury Derailment (>) (<) (<) 13 / 32

20 Example plant {{x = 2/2 v, y = 2/2 v, v = 2/2 g & 0 x 100} {x = dx v, y = dy, v = dy g, dx = dy v/100 2, dy = dx v/100 2 & 100 x 200} {x = 2/2 v, y = 2/2 v, v = 2/2 g & 200 x 300}} 14 / 32

21 Example plant {{Line(...) & 0 x 100} {Arc(...) & 100 x 200} {Line(...) & 200 x 300}} 14 / 32

22 Example plant {{Line(...) & 0 x 100} {Arc(...) & 100 x 200} {Line(...) & 200 x 300}} 14 / 32

23 Example plant {{Line(...) & 0 x 100} {Arc(...) & 100 x 200} {Line(...) & 200 x 300}} 14 / 32

24 Individual Components are Modeled as ODEs Arc Segment: Arc def {x = v dx, y = v dy, v = dy g, dx = dy v/r, dy = dx v/r & InBounds(x 1, x 2, y 1, y 2 )} 15 / 32

25 Concrete Parameters are Plugged in From GUI Line Segment: Line def {x = v dx, y = v dy, v = dy g & InBounds(x 1, x 2, y 1, y 2 )} Subst Line(1, 0,...) def {x = v 1, y = v 0, v = 0 g & InBounds(0, 100, 200, 200)} 16 / 32

26 Composition is Modeled with Discrete Programs Let track sections sec i be component instances: sec i def Line(args i ) or Arc(args i ) and system model α: plant def (sec 1 sec n ) 17 / 32

27 Components Verified with Invariants and Solving Straight line is solvable, thus decidable. Arc needs invariant (energy conservation), proved manually: E = E 0 OnTrack [Arc] (E = E 0 OnTrack) 18 / 32

28 Instantiation is Verified by Substitution Conceptually simple step Greatly improves performance (20x in some cases) Line def {x = v dx, y = v dy, v = dy g & InBounds(x 1, x 2, y 1, y 2 )} Subst Line(1, 0,...) def {x = v 1, y = v 0, v = 0 g & InBounds(0, 100, 200, 200)} 19 / 32

29 Composition is Verified by Contract-Checking At boundary, invariants for both sections hold Checked with arithmetic solving + custom automation Example: J 1 (x = y) J 2 ( y 2 + (x 200) 2 = 100 2) 20 / 32

30 Analysis Distinguished 6 Safe/Unsafe Real Coasters Top Thrill Steel Phantom (6.5g) Backyard El Toro Phantom s Revenge (3.5g) Lil Phantom 21 / 32

31 This is the Largest dl Model Ever Stats: CoasterX Max Previous Max (Est.) Components 56 > 3 Fml size 52KB > 6.5KB Proof Steps 20M (29K w/ reuse) > 100K 22 / 32

32 Scalability is Quadratic Runtime vs. Problem Size 1500 time(s) # vars 192 (on a recent workstation) / 32

33 Component Verification Cost Sometimes Matters Component Time # Steps Line 140s 900K Arc 4.5s 12.5K Automatic proof (Line) vastly slower than manual proof (Arcs) 24 / 32

34 Future Work 25 / 32

35 Advanced Dynamical Models Answer Deeper Questions Acceleration a a hi Rollback 0 < v lo v Stuck 0 < v lo v Friction Wind 26 / 32

36 Advanced 3D Design 2D Build Detect Simulate 3D 3D Modeling support enables lateral bounds and banking support 27 / 32

37 Rich Contracts Enable High-Impact Domains Transit networks: Contracts at intersections/switches Flight plans: Contracts at crossing points Rail Road UAV 28 / 32

38 Coasters Support Pedagogical Mission CPS Foundations: Fun applications motivate students Course feeds into undergraduate research Initial stages were Adriel + Xuean s course project GPWS Chute Pong Coaster Chess Baseball 29 / 32

39 Questions? Top Thrill Steel Phantom Backyard El Toro Phantom s Revenge Lil Phantom 30 / 32

40 References I ASTM, Standard Practice for Design of Amusement Rides and Devices, Standard, ASTM Intl., Sep Brandon Bohrer, Adriel Luo, Xuean Chuang, and André Platzer, CoasterX: A case study in component-driven hybrid systems proof automation, IFAC, Nathan Fulton, Stefan Mitsch, Jan-David Quesel, Marcus Völp, and André Platzer, KeYmaera X: An axiomatic tactical theorem prover for hybrid systems, CADE (Berlin) (Amy Felty and Aart Middeldorp, eds.), LNCS, vol. 9195, Springer, 2015, pp Nick Weisenberger, Coasters 101: An engineer s guide to roller coaster design, / 32

41 References II Gening Xu, Hujun Xin, Fengyi Lu, and Mingliang Yang, Kinematics and dynamics simulation research for roller coaster multi-body system, Advanced Materials Research, vol. 421, Trans Tech Publications, 2012, pp / 32