Verification of Autonomous Neural Car Control with KeYmaera X

2025-04-04

AI Summary

This work formally verifies the collision-avoidance safety of neural controllers for single-lane highway autonomous driving over infinite time horizons. It presents the first full-time-domain safety proof—within the differential dynamic logic (dL) framework—for neural control policies under time-varying reaction delays and bounded braking forces. Methodologically, it integrates the KeYmaera X theorem prover, formal modeling, runtime monitoring, and neural network verification techniques. Key contributions are threefold: (1) rigorous formal proof of infinite-horizon collision avoidance; (2) identification and correction of a critical specification-environment inconsistency between the ABZ’25 benchmark and the highway-env simulator; and (3) discovery of multiple environmental counterexamples exposing fundamental design flaws in reinforcement learning simulation platforms—particularly concerning vehicle dynamics modeling and safety semantics—thereby establishing a novel paradigm and reusable toolchain for trustworthy autonomous driving verification.

Technology Category

• Multiagent Systems: Adversarial Agents
• Natural Language Processing: Safety and Robustness
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving

Application Category

• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

This article presents a formal model and formal safety proofs for the ABZ'25 case study in differential dynamic logic (dL). The case study considers an autonomous car driving on a highway avoiding collisions with neighbouring cars. Using KeYmaera X's dL implementation, we prove absence of collision on an infinite time horizon which ensures that safety is preserved independently of trip length. The safety guarantees hold for time-varying reaction time and brake force. Our dL model considers the single lane scenario with cars ahead or behind. We demonstrate that dL with its tools is a rigorous foundation for runtime monitoring, shielding, and neural network verification. Doing so sheds light on inconsistencies between the provided specification and simulation environment highway-env of the ABZ'25 study. We attempt to fix these inconsistencies and uncover numerous counterexamples which also indicate issues in the provided reinforcement learning environment.

Problem

• Formal safety verification for autonomous car control
• Collision avoidance in infinite time horizon scenarios
• Addressing inconsistencies in ABZ'25 specification and simulation

Innovation

• Formal safety proofs using differential dynamic logic
• KeYmaera X ensures collision-free autonomous driving
• Runtime monitoring and neural network verification