Differential Dynamic Logic (dL)

• Differential Dynamic Logic (dL) is a first-order modal logic that defines hybrid programs and formulas to reason about system safety and reachability.
• It models complex systems by integrating discrete assignments, tests, and continuous evolution via differential equations, enabling proofs of invariance and safety.
• Extensions of dL incorporate temporal, stochastic, and distributed dynamics, providing versatile tools for verifying safety-critical cyber-physical systems.

Differential Dynamic Logic ($\mathrm{dL}$) is a first-order modal logic for specifying and verifying hybrid systems, i.e. systems that combine discrete control steps, continuous evolution by differential equations, nondeterministic choice, and repetition. Its characteristic modalities $[\alpha]\phi$ and $\langle \alpha \rangle \phi$ express, respectively, that $\phi$ holds after all terminating runs of a hybrid program $\alpha$ or after some terminating run of $\alpha$. In its standard form, dL reasons about reachability and end-state properties of hybrid programs; later logics preserve dL as their non-temporal core while extending it with temporal, distributed, communicating, relational, refinement, stochastic, or differential-algebraic features (Platzer, 2012, Platzer, 2016).

1. Language of hybrid programs and formulas

The underlying program model of dL is the hybrid program. Standard presentations use constructors such as deterministic assignment $x:=e$, nondeterministic assignment $x:=*$, test $?Q$, continuous evolution $x'=f(x)\,{data}\,Q$, nondeterministic choice $[\alpha]\phi$0, sequential composition $[\alpha]\phi$1, and repetition $[\alpha]\phi$2 (Teuber et al., 2024). These constructs are the program side of dL; formulas then state properties of the states reachable by such programs.

The formula language combines first-order real arithmetic with the modal operators indexed by hybrid programs. The central formulas are $[\alpha]\phi$3 and $[\alpha]\phi$4. The box modality expresses universal postconditions after all runs, while the diamond modality expresses existential reachability after some run. This gives dL the usual dynamic-logic reading for discrete programs, but with continuous dynamics internalized as first-class program steps (Platzer, 2012).

Modern differential-form presentations extend the term language with differentials. In that form, terms include

$[\alpha]\phi$5

They also use differential symbols $[\alpha]\phi$6 as variables distinct from $[\alpha]\phi$7, so that derivatives become syntactic objects inside the logic rather than external proof annotations (Platzer, 2016).

A representative dL formula used in the literature is

$[\alpha]\phi$8

which expresses that a car never moves backward (Platzer, 2016). This illustrates the typical dL pattern: a closed-loop hybrid program is placed under a box modality, and the postcondition is an invariance or safety property.

2. Semantics of states, runs, and differential equations

Standard dL semantics interprets a hybrid program as a transition relation on states. States are valuations of variables by real numbers, and a formula $[\alpha]\phi$9 is true in a state iff every state reachable by $\langle \alpha \rangle \phi$0 satisfies $\langle \alpha \rangle \phi$1; dually, $\langle \alpha \rangle \phi$2 is true iff some reachable state satisfies $\langle \alpha \rangle \phi$3 (Selvaraj et al., 2022). This is the semantic basis for viewing dL as a program logic for hybrid systems.

The semantics of the program constructors follows their operational reading. Assignment updates a variable to the value of an expression, nondeterministic assignment chooses an arbitrary real value, choice is union of transition relations, sequential composition is relational composition, and repetition is the reflexive transitive closure induced by finite iteration (Teuber et al., 2024). Tests are semantically significant because they abort when their condition is false; failed test executions disappear from the reachable-state relation, which is one reason assumptions encoded as tests must be modeled carefully (Selvaraj et al., 2022).

For continuous evolution, the construct $\langle \alpha \rangle \phi$4 follows the differential equation for an arbitrary duration while remaining in the evolution domain $\langle \alpha \rangle \phi$5. In the denotational presentations used in later work, the continuous semantics requires that the solution satisfies the differential equation throughout the interval, that only the ODE variables change, and that derivative variables match the time derivative along the evolution (Brieger et al., 2024). This provides the bridge between modal reasoning and continuous mathematics.

Differential-form dL strengthens this semantics by interpreting differential terms internally. A differential term $\langle \alpha \rangle \phi$6 denotes the total differential of $\langle \alpha \rangle \phi$7 evaluated on the current values of the differential symbols. Along actual solutions of an ODE, this coincides with analytic time differentiation, which is the key semantic fact behind differential invariants and related proof rules (Platzer, 2015).

3. Proof calculi, differential invariants, and uniform substitution

The proof theory of dL decomposes hybrid-system proofs along program structure and along the algebra of differential equations. Standard axiomatizations include modal principles for assignment, test, choice, composition, and iteration, together with first-order reasoning and specialized differential principles such as differential weakening, differential effect, differential induction, differential cut, and differential ghosts (Platzer, 2012). These are the core mechanisms by which dL proves safety and invariance of hybrid programs without exploring executions explicitly.

A central theoretical result is relative completeness. The survey literature states that dL is sound and complete relative to the first-order logic of differential equations, so hybrid-system reasoning can be reduced proof-theoretically to reasoning about differential equations (Platzer, 2012). This is a relative, not absolute, completeness claim; it localizes the remaining proof burden in the continuous fragment.

Differential-form calculi internalize ODE reasoning into the object language. By admitting differential terms $\langle \alpha \rangle \phi$8 and differential symbols $\langle \alpha \rangle \phi$9, they turn derivations, differential substitutions, and differential invariants into ordinary dL formulas and axioms rather than external meta-rules (Platzer, 2015). This makes ODE reasoning more modular and aligns it with the rest of the logic.

A major proof-theoretic refactoring of dL is the uniform-substitution calculus. The key idea is to replace axiom schemata and soundness-critical schema side conditions by a finite set of ordinary dL formulas as axioms plus a single instantiation mechanism, uniform substitution. The calculus in “A Complete Uniform Substitution Calculus for Differential Dynamic Logic” is entirely based on uniform substitution, captures the static semantics of dL exclusively in uniform substitutions and variable renamings, internalizes differential invariants, differential substitutions, and derivatives as first-class axioms, and is proved sound and relatively complete (Platzer, 2016). This substantially simplifies theorem-prover implementations because soundness-critical admissibility checks are concentrated in the substitution kernel rather than distributed across many proof rules.

4. Extensions built on top of dL

Several later logics treat dL as the base logic and extend it to richer classes of systems. Quantified Differential Dynamic Logic ($\phi$0) generalizes dL from fixed-dimensional hybrid systems to distributed hybrid systems with quantified assignments, quantified differential equations, and dynamic appearance of agents. Its states are first-order structures rather than finite variable valuations, and its proof calculus is sound and complete relative to quantified differential equations (Platzer, 2012).

Quantified Differential Temporal Dynamic Logic ($\phi$1) extends QdL with temporal operators over traces, so formulas such as $\phi$2 and $\phi$3 speak about what holds throughout or somewhere along executions rather than only at their endpoints. Its trace semantics is a conservative extension of non-temporal QdL (Hou, 2012). Signal Temporal Dynamic Logic (STdL) takes a different temporal direction by combining dL with bounded-time operators from Signal Temporal Logic, yielding a conservative extension of dL for time-bounded temporal properties over hybrid-program traces (Ahmad et al., 2021).

The dynamic logic of communicating hybrid programs, $\phi$4, extends dL with communication and parallel composition. Its communicating hybrid programs add send, receive, and true simultaneous parallel composition, because interleaving alone is not enough to represent the shared-time evolution of parallel hybrid dynamics. The resulting completeness results show that reasoning about parallel hybrid systems is exactly as hard as reasoning about hybrid systems, continuous systems, or discrete systems (Brieger et al., 2024).

Other extensions change the kind of property being reasoned about. Differential Refinement Logic ($\phi$5) adds a formula constructor $\phi$6 so that one can reason about relations between hybrid systems as well as properties of individual systems; its uniform-substitution calculus preserves ordinary dL reasoning while making refinement first-class (Prebet et al., 2024). Relational Differential Dynamic Logic develops comparative proofs between two hybrid-system executions, using synchronization and time stretching to compare runs at corresponding progress values rather than equal times (Kolčák et al., 2019).

Differential-algebraic and stochastic variants extend the continuous core itself. Real-analytic differential-algebraic dynamic logic ($\phi$7) extends differential-form dL with differential-algebraic programs, algebraic refinements, index reduction, and ghost switching for decomposing multimodal analytic DAE behavior into hybrid programs (Hellwig et al., 25 May 2025). Stochastic Differential Dynamic Logic ($\phi$8) adapts the dL methodology to stochastic hybrid systems by replacing boolean reachability semantics with stochastic-process semantics and by using stochastic differential invariants based on infinitesimal generators (Platzer, 2012).

5. Applications, theorem proving, and mechanization

dL and its extensions have been used to verify safety-critical applications in automotive, aviation, railway, robotics, and analogue electrical circuits (Platzer, 2012). In these applications, the usual proof goal has the shape $\phi$9, where the hybrid program $\alpha$0 models a closed-loop controller-and-plant system and the postcondition $\alpha$1 expresses safety or another correctness property.

A recent application area is neural-network-controlled cyber-physical systems. The VerSAILLE approach uses a dL proof of a safe nondeterministic control envelope, extracts a controller monitor specification, and then proves by neural-network verification that the concrete network refines that envelope on the relevant reachable states. If the network satisfies the monitor, the original dL theorem transfers to the concrete neural-network-controlled hybrid system, including infinite-time safety over arbitrary loop repetitions (Teuber et al., 2024). This use of dL is notable because the neural network is not proved safe directly inside the dL calculus; instead, dL supplies the closed-loop proof layer and the reachable-state contract.

The prover ecosystem around dL has likewise broadened. KeYmaera and KeYmaera X implement dL-style deductive verification, and later work explicitly uses KeYmaera X for proving theorems about modeling discipline and controller correctness (Selvaraj et al., 2022). Uniform-substitution calculi are especially important here because they support small prover microkernels by replacing axiom schemata with finite axiom bases (Platzer, 2016).

Formal embeddings of dL into general theorem provers have also appeared. The Plaidypvs embedding formalizes the semantics of hybrid programs and the dL proof calculus inside PVS, yielding a version of dL whose proof calculus is formally verified and available for hybrid-program verification within PVS itself. It supports standard dL-style proofs while also allowing reasoning about entire classes of hybrid programs and reuse of existing PVS mathematical libraries (Slagel et al., 2024). This suggests a broader role for dL as both a standalone verification logic and a mechanized layer inside general-purpose proof assistants.

6. Modeling discipline, misconceptions, and proof-theoretic limitations

A recurring misconception is that a valid dL proof automatically establishes correctness of the intended controller. The modeling literature is more precise: a dL proof establishes correctness of the model, and modeling errors can still make a faulty controller appear provably safe (Selvaraj et al., 2022). This is especially acute because tests $\alpha$2 remove failing executions entirely, so over-strong assumptions can eliminate exactly the behaviors that would reveal the fault.

Two concrete failure modes have been isolated. In an “exploiting controller” pattern, a controller appears safe only because the environment assumptions later prune the bad continuations; in an “unchallenged controller” pattern, assumptions are so strong that the controller is never actually needed to preserve the invariant (Selvaraj et al., 2022). Both are dL-specific manifestations of the gap between proof soundness and modeling adequacy.

Proof-based debugging work makes this issue systematic. The usage-aware sequent calculus UAPC tracks which atomic constraints in a dL proof are actually used and computes whether they must remain unchanged, may be generalized, or may be removed while preserving validity. It is proved sound and complete with respect to dL, and it applies not only to antecedent assumptions but also to tests, choice branches, loop structure, and evolution domain constraints inside ODEs (Dotzel et al., 2023). This suggests that dL proofs can serve not only as certificates of validity but also as diagnostics for vacuity and over-specification.

On the metatheoretic side, dL’s completeness results are relative, not effective. The survey literature explicitly states that the discrete fragment and the continuous fragment are not effectively axiomatizable, and analogous incompleteness phenomena reappear in richer logics such as QdL and QdTL (Platzer, 2012). A plausible implication is that dL’s proof-theoretic strength lies less in algorithmic decision procedures than in its ability to factor hybrid-system verification into compositional program reasoning plus mathematically focused obligations about differential equations and invariants.