How to model and prove hybrid systems with KeYmaera: a tutorial on safety

TLDR

Hybrid systems model safety‑critical controllers for physical plants, and formal methods aid in designing correct systems. The tutorial demonstrates how to model, validate, and verify hybrid systems in KeYmaera, highlighting how modeling choices affect verification suitability. The tutorial presents example hybrid programs and shows how KeYmaera’s interactive prover can model, validate, and verify them, illustrating real‑world challenges. The tutorial shows that KeYmaera’s interactive features help designers understand system behavior and prove complex properties, serving as a useful resource for embedded and cyber‑physical system designers.

Abstract

Abstract This paper is a tutorial on how to model hybrid systems as hybrid programs in differential dynamic logic and how to prove complex properties about these complex hybrid systems in KeYmaera, an automatic and interactive formal verification tool for hybrid systems. Hybrid systems can model highly nontrivial controllers of physical plants, whose behaviors are often safety critical such as trains, cars, airplanes, or medical devices. Formal methods can help design systems that work correctly. This paper illustrates how KeYmaera can be used to systematically model, validate, and verify hybrid systems. We develop tutorial examples that illustrate challenges arising in many real-world systems. In the context of this tutorial, we identify the impact that modeling decisions have on the suitability of the model for verification purposes. We show how the interactive features of KeYmaera can help users understand their system designs better and prove complex properties for which the automatic prover of KeYmaera still takes an impractical amount of time. We hope this paper is a helpful resource for designers of embedded and cyber–physical systems and that it illustrates how to master common practical challenges in hybrid systems verification.