Heterogeneous Dynamic Logic (HDL)

• Heterogeneous Dynamic Logic (HDL) is a modular framework that integrates distinct dynamic logics to prove properties in cyber-physical systems.
• It employs lifting and combination techniques to reuse mature proof calculi, enabling cross-language verification across languages like Java and dL.
• HDL ensures soundness and relative completeness through standardized modal rules and reduction strategies, demonstrated in its automotive case study.

Searching arXiv for the specified HDL paper and contextual dynamic-logic survey. Heterogeneous Dynamic Logic (HDL) is a framework for combining reasoning principles from distinct dynamic program logics in a modular and compositional way, so that dynamic properties can be proved “modulo program theories” rather than by re-encoding one language into another (Teuber et al., 11 Jul 2025). It is motivated by heterogeneous software-cyber-physical systems in which, for example, a discrete-control component is implemented in a general-purpose language such as Java while the physical plant is modeled by hybrid dynamics such as differential equations. HDL imports the modular architecture of satisfiability modulo theories (SMT) into dynamic logic: each constituent program logic is packaged as a dynamic theory with its own program syntax, semantics, and proof calculus, and these dynamic theories are then lifted and combined to support cross-language reasoning in a single modality (Teuber et al., 11 Jul 2025).

1. Motivation and general architecture

Modern software-cyber-physical systems are intrinsically heterogeneous: a discrete-control component is implemented in a general-purpose language, while the physical plant is modeled by hybrid dynamics. Strong verification frameworks exist for each “world,” including Java Dynamic Logic and differential dynamic logic, but the central difficulty is that there had been no principled way to specify and verify system-level properties that span both worlds (Teuber et al., 11 Jul 2025).

HDL addresses this difficulty by treating individual dynamic logics, along with their calculi, as dynamic theories. This yields compositional verification: one reasons about heterogeneous systems without re-encoding one world into another and while reusing mature, logic-specific tools (Teuber et al., 11 Jul 2025). The framework has two key operations. Lifting extends a single dynamic theory with standardized program constructs such as nondeterministic assignment or regular programs, automatically augmenting its calculus with sound rules. Combination builds a heterogeneous dynamic theory from multiple constituents, enabling cross-language reasoning in a single modality and reusing existing proof infrastructure (Teuber et al., 11 Jul 2025).

A useful contextual comparison is the broader dynamic-logic tradition surveyed in “Dynamic Logics of Dynamical Systems” (Platzer, 2012). That survey develops a heterogeneous family of logics—dL, QdL, and SdL—for hybrid, distributed hybrid, and stochastic hybrid dynamics, all sharing a common dynamic-logic core (Platzer, 2012). HDL differs in emphasis: rather than presenting a family of separate logics for distinct dynamical phenomena, it provides a principled framework for combining distinct dynamic theories so that heterogeneous programs drawn from multiple languages can occur within one modality (Teuber et al., 11 Jul 2025).

2. Dynamic theories, syntax, and semantics

A dynamic theory formalizes the minimal structure needed for a dynamic logic over an arbitrary programming language and a first-order data theory. It is presented as a tuple

$T = (\Sigma, \Delta, Calc),$

where $\Sigma$ is a dynamic signature, $\Delta$ is a domain of computation, and $Calc$ is a sound proof calculus (Teuber et al., 11 Jul 2025).

The dynamic signature is

$$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$

with disjoint sets of variables, first-order atoms, and programs. Given $\Sigma$, formulas are generated by

$$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$

for atoms $a \in \mathit{Atoms}$, variables $v \in \mathit{Vars}$, and programs $p \in \mathit{Prog}$. Diamonds are defined as usual:

$\Sigma$0

This places HDL squarely within the standard first-order modal perspective of dynamic logic, where $\Sigma$1 expresses universal postcondition validity and $\Sigma$2 existential reachability (Teuber et al., 11 Jul 2025, Platzer, 2012).

The domain of computation is

$\Sigma$3

where $\Sigma$4 is a nonempty universe of values, $\Sigma$5 a nonempty set of states, $\Sigma$6 a variable evaluation function, $\Sigma$7 the atom semantics, $\Sigma$8 a finite overapproximation of atom free variables, $\Sigma$9 the program transition relation, and $\Delta$0 a finite overapproximation of program free variables (Teuber et al., 11 Jul 2025).

These components satisfy interpolation, atom coincidence, program overapproximation, and extensionality. Interpolation states that for any $\Delta$1 and finite $\Delta$2, there exists $\Delta$3 that agrees with $\Delta$4 on $\Delta$5 and with $\Delta$6 on $\Delta$7. Atom coincidence requires that if two states agree on $\Delta$8, then either both satisfy $\Delta$9 or neither does. Program overapproximation requires that agreement on a superset of $Calc$0 can be transported across program transitions. Extensionality identifies transitions for states that agree on all variables (Teuber et al., 11 Jul 2025).

Formula semantics is given by the standard clauses:

$Calc$1

$Calc$2

$Calc$3

Validity and satisfiability are then defined in the usual way (Teuber et al., 11 Jul 2025).

HDL assumes a shared first-order data theory $Calc$4 providing atoms and their semantics. Each constituent dynamic theory shares the same first-order fragment, or a compatible conservative extension, which enables reduction of dynamic proofs to first-order proofs in $Calc$5 (Teuber et al., 11 Jul 2025). This shared data-theoretic substrate is one of the framework’s central structural assumptions.

3. Lifting: standardized program constructs over an existing dynamic theory

Lifting extends a dynamic theory with standardized constructs while preserving semantics and enabling reuse of the original calculus (Teuber et al., 11 Jul 2025). The paper presents two principal liftings: havoc lifting and regular program lifting.

Lifting	Extension	Characteristic rule
Havoc lifting	Adds nondeterministic assignment $Calc$6	$Calc$7
Regular program lifting	Closes programs under $Calc$8, $Calc$9, $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$0, $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$1	seq, choice, test, star, invariant

For havoc lifting, given $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$2, the theory $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$3 adds programs $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$4 for all $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$5. Its semantics is

$$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$6

The read-set overapproximation is empty, while the bound set includes $$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$7 (Teuber et al., 11 Jul 2025). The sound havoc axiom is

$$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$8

The associated reduction rule states that formulas over the original program fragment remain provable in the extended calculus (Teuber et al., 11 Jul 2025).

For regular program lifting, programs are closed under

$$\Sigma = (\mathit{Vars}, \mathit{Atoms}, \mathit{Prog}),$$9

where $\Sigma$0 and $\Sigma$1 is any first-order formula over the data theory (Teuber et al., 11 Jul 2025). The relational semantics is standard:

$\Sigma$2

$\Sigma$3

$\Sigma$4

$\Sigma$5

The sound regular axioms are

$\Sigma$6

$\Sigma$7

$\Sigma$8

$\Sigma$9

together with the invariant rule

$$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$0

These are the familiar regular-program principles of dynamic logic, but in HDL they are obtained as a generic lifting over arbitrary constituent dynamic theories (Teuber et al., 11 Jul 2025). A plausible implication is that proof reuse is not tied to any single object language, because the regular-program layer is factored out of the constituent logic.

The framework also includes a loop convergence axiom schema $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$1 under inductive expressivity. When a dynamic theory has integer-expressive variables and admits first-order reasoning about natural numbers, HDL provides a loop-progress axiom ensuring reachability (Teuber et al., 11 Jul 2025). The paper’s stated intuition is that if one $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$2-iteration decreases a variant to $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$3 and $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$4 implies the goal, then eventually the loop reaches $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$5.

4. Combination and heterogeneous modalities

Given two dynamic theories

$$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$6

HDL first constructs a simple heterogeneous dynamic theory $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$7 and then lifts it to a fully heterogeneous theory $$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$8 (Teuber et al., 11 Jul 2025).

The simple heterogeneous theory uses the product state space

$$\phi ::= a \mid \neg \phi \mid \phi \land \psi \mid \forall v\, \phi \mid [p]\phi,$$9

the disjoint union of variables

$a \in \mathit{Atoms}$0

atoms

$a \in \mathit{Atoms}$1

and programs

$a \in \mathit{Atoms}$2

Atoms from the first or second language are evaluated componentwise, while heterogeneous atoms are evaluated directly over the product state space. The paper gives equalities between views, rounding relations, int2real, and round as representative cross-world constraints (Teuber et al., 11 Jul 2025).

Program semantics is owner-sensitive. If $a \in \mathit{Atoms}$3, then $a \in \mathit{Atoms}$4 acts only on $a \in \mathit{Atoms}$5 and is extensional on $a \in \mathit{Atoms}$6; symmetrically for programs in $a \in \mathit{Atoms}$7 (Teuber et al., 11 Jul 2025). The heterogeneous interpretation thereby evaluates modalities over a product state space in which atomic programs from language 1 act on $a \in \mathit{Atoms}$8, atomic programs from language 2 act on $a \in \mathit{Atoms}$9, and regular program operators compose these actions freely in a single modality $v \in \mathit{Vars}$0 (Teuber et al., 11 Jul 2025).

After applying havoc lifting and regular-program lifting, the resulting heterogeneous theory supports cross-language reasoning inside one modality. The core heterogeneous composition rules are the same regular rules:

$v \in \mathit{Vars}$1

$v \in \mathit{Vars}$2

$v \in \mathit{Vars}$3

$v \in \mathit{Vars}$4

but now $v \in \mathit{Vars}$5 and $v \in \mathit{Vars}$6 may be drawn from either constituent language and composed heterogeneously (Teuber et al., 11 Jul 2025).

The framework is explicitly designed so that constituent proof rules coexist. The paper’s examples are a JavaDL assignment axiom,

$v \in \mathit{Vars}$7

when $v \in \mathit{Vars}$8 does not bind $v \in \mathit{Vars}$9, and a dL differential-invariant principle for

$p \in \mathit{Prog}$0

with proof obligations handled in the second constituent calculus, such as by differential induction, while appearing as a subgoal within a single HDL proof tree (Teuber et al., 11 Jul 2025). This cross-calculus coexistence is the central technical content of heterogeneous modalities.

Reduction rules formalize proof reuse. If $p \in \mathit{Prog}$1 is pure over $p \in \mathit{Prog}$2, then

$p \in \mathit{Prog}$3

and similarly for $p \in \mathit{Prog}$4:

$p \in \mathit{Prog}$5

Thus homogeneous subgoals are discharged by their original proof systems, while the heterogeneous proof remains single-modality at the top level (Teuber et al., 11 Jul 2025).

5. Metatheory: soundness, relative completeness, and mechanization

The soundness theorem for the elementary HDL calculus states that for any dynamic theory $p \in \mathit{Prog}$6, the axioms $p \in \mathit{Prog}$7, $p \in \mathit{Prog}$8, $p \in \mathit{Prog}$9, $\Sigma$00, and the composition rules for regular programs—seq, choice, star, test, and invariant—are sound (Teuber et al., 11 Jul 2025). The proof sketch given in the paper proceeds from relational semantics together with extensionality and coincidence lemmas; the axioms $\Sigma$01 and $\Sigma$02 rely on constant-domain and frame conditions guaranteed by interpolation on $\Sigma$03 and the overapproximation of free and bound variables (Teuber et al., 11 Jul 2025).

The paper states relative completeness results for both lifting and combination. If $\Sigma$04 denotes relative completeness of a theory’s calculus with respect to its first-order fragment, and $\Sigma$05, $\Sigma$06, and $\Sigma$07 denote first-order expressiveness, Gödel expressiveness, and finite support, then the lifting theorem is:

$\Sigma$08

$\Sigma$09

The proof idea is that havoc reduces to first-order quantification, while regular programs reduce through the composition axioms, the invariant rule, and a first-order rendition of programs; Gödel expressiveness supports strongest postconditions for loops by encoding finite execution traces as single first-order values over counting variables (Teuber et al., 11 Jul 2025).

For combination, if $\Sigma$10 and $\Sigma$11 are relatively complete, first-order expressive, Gödel expressive dynamic theories with finite support, and if the simple heterogeneous combination $\Sigma$12 has communicating atoms ensuring aligned integer expressivity, then the fully heterogeneous theory

$\Sigma$13

is relatively complete:

$\Sigma$14

The proof sketch reduces box and diamond fragments over $\Sigma$15 to first-order logic via rendition and frame/ghost rules, then uses $\Sigma$16 and $\Sigma$17 to discharge pure subgoals to the constituent calculi (Teuber et al., 11 Jul 2025). Communication atoms align the counting or integer indices used in Gödel encodings across languages, which the paper identifies as the mechanism needed for lockstep loop reasoning (Teuber et al., 11 Jul 2025).

The entire HDL framework is formalized in Isabelle/HOL with modular locales. The listed locales are folCore, dynLogCore, dynLog, HavocDynLog, KATDynLog, NatKATDynLog, and HeterogeneousDynLog (Teuber et al., 11 Jul 2025). The mechanized development proves soundness of all rules and preservation of relative completeness under lifting and combination, while reusing existing proof infrastructure for constituent logics such as KeY for JavaDL and KeYmaera X for dL (Teuber et al., 11 Jul 2025).

6. Automotive case study, relations to prior work, and scope conditions

The worked case study combines a Java controller and a dL plant in an automotive stopping scenario (Teuber et al., 11 Jul 2025). The Java controller computes acceleration commands for a car approaching a stop sign, while the plant models position and velocity evolution under the commanded acceleration. The hybrid program for the plant is $\Sigma$35 and the paper states that the differential invariant

$\Sigma$18

is preserved under the evolution when $\Sigma$19 and appropriate domain assumptions hold (Teuber et al., 11 Jul 2025).

The heterogeneous program is defined as

$\Sigma$20

This couples Java’s integer variables $\Sigma$21 to dL’s real variables $\Sigma$22 through the heterogeneous atoms int2real and round (Teuber et al., 11 Jul 2025). The safety property is

$\Sigma$23

under a coupled precondition ensuring bounds $\Sigma$24, $\Sigma$25, $\Sigma$26, heap well-formedness, and the initial invariant $\Sigma$27 (Teuber et al., 11 Jul 2025).

The proof outline is explicitly heterogeneous. The sequence rule decomposes the program, the frame rule separates Java and dL parts, Java subgoals are reduced via $\Sigma$28 to KeY, dL subgoals via $\Sigma$29 to KeYmaera X, coupling constraints are preserved by tests using

$\Sigma$30

and the invariant rule proves that the loop preserves $\Sigma$31 (Teuber et al., 11 Jul 2025). The loop convergence axiom $\Sigma$32 can additionally be used for reachability properties when needed (Teuber et al., 11 Jul 2025).

In relation to prior work, HDL is compared with SMT, fibring, and UTP. Like SMT, it is modular, but SMT combines first-order theories for satisfiability, whereas HDL combines program theories for modal reasoning about transitions (Teuber et al., 11 Jul 2025). Prior dynamic logics such as PDL, JavaDL, and dL are described as single-language, while fibring merges truth-bearing modalities but not program primitives, and UTP often requires re-encoding language semantics into a relational framework (Teuber et al., 11 Jul 2025). For broader context, the survey of dynamic logics of dynamical systems emphasizes that dL, QdL, and SdL share a common program algebra and modal core, including sequence, choice, star, test, and modal $\Sigma$33, while supplying specialized proof rules for ODEs, quantified dynamics, or stochastic dynamics (Platzer, 2012). This suggests that HDL can be read as a further modularization step: not merely a family of related logics, but a framework for proof-theoretic and semantic combination across them.

The paper is explicit about assumptions and limitations. HDL assumes a shared data theory $\Sigma$34 and first-order calculus, sound constituent dynamic theories, communication atoms ensuring aligned integer expressivity, disjoint program-state components, product-state semantics, and extensionality and interpolation properties (Teuber et al., 11 Jul 2025). Concurrency and interleaving semantics are out of scope; HDL currently reasons about sequential composition in a single thread of control. Automation depends on constituent tools, heterogeneous reasoning may require user guidance for cross-language obligations, and HDL does not improve decidability, though it preserves relative completeness (Teuber et al., 11 Jul 2025). Future work identified in the paper includes concurrency, probabilistic programs and stochastic hybrid systems, separation logic integration for heap-rich software components, and further exploitation of refinement calculi and hyperproperties in heterogeneous settings (Teuber et al., 11 Jul 2025).