KeYmaera X: Theorem Prover for Hybrid Systems

• KeYmaera X is an interactive theorem prover for hybrid systems that integrates discrete control and continuous dynamics through differential dynamic logic.
• It employs a small trusted kernel with sequent calculus and tactical automation to verify models from traffic networks to chemical reactors.
• The tool bridges model verification with implementation assurance using techniques like runtime monitors, verified compilation, and robust invariant generation.

KeYmaera X is an interactive theorem prover for hybrid systems and cyber-physical systems that implements differential dynamic logic ($\mathrm{dL}$), a logic whose formulas refer to hybrid programs combining discrete control and continuous dynamics. In the literature it is described as an “interactive theorem tester” whose input is a $\mathrm{dL}$ formula that combines both the system description and the properties under consideration, and it is used to prove safety, liveness, reachability, stability, and refinement properties for models ranging from traffic networks and switched systems to chemical reactors, railway control, airborne collision avoidance, PLC-controlled industrial systems, and self-driving car safety models (Velasquez et al., 2021, Platzer, 2019, Strauss et al., 2023).

1. Differential dynamic logic and hybrid programs

The logical foundation of KeYmaera X is differential dynamic logic, a first-order modal logic for hybrid systems. Its program notation, the hybrid program language, combines assignments, tests, differential equations with evolution domain constraints, nondeterministic choice, sequential composition, and iteration. In the standard presentation used across the cited work, hybrid programs have the form

$$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$

and $\mathrm{dL}$ formulas add the modal operators $[\alpha]\phi$ and $\langle \alpha \rangle \phi$, where $[\alpha]\phi$ states that $\phi$ holds after all runs of $\alpha$, while $\langle \alpha \rangle \phi$ states that there exists some run of $\mathrm{dL}$0 after which $\mathrm{dL}$1 holds (Platzer, 2019, Velasquez et al., 2021, Tan et al., 2021).

The semantics is relational: a hybrid program denotes a transition relation on states, and continuous evolution $\mathrm{dL}$2 follows the ODE for any nondeterministic duration while the evolution domain constraint $\mathrm{dL}$3 remains true. This makes $\mathrm{dL}$4 especially suitable for control envelopes, adversarial environments, and abstractions of implementation choices, because nondeterminism can represent both uncertainty and underspecification (Platzer, 2019, Tan et al., 2021).

A central bridge exploited by KeYmaera X is the embedding of hybrid automata and related formalisms into $\mathrm{dL}$5. One traffic-verification case study states that there is an effective mapping from safety properties of a hybrid automaton to $\mathrm{dL}$6 formulas such that safety of the automaton is equivalent to validity of the corresponding $\mathrm{dL}$7 formula (Velasquez et al., 2021). This equivalence is what lets KeYmaera X turn automata-theoretic and ODE-based models into proof obligations in a single logic.

2. Proof calculus, automation, and the trusted kernel

KeYmaera X implements a sound proof calculus for $\mathrm{dL}$8, presented to users as a sequent calculus and, internally, via a uniform-substitution microkernel. The architecture is intentionally small in its soundness-critical core: one overview reports a kernel “under 2000 lines of code,” while a later reactor case study describes “a small trusted kernel (~1700 lines of code)” (Platzer, 2019, Feyzishendi et al., 1 Sep 2025). Around this kernel sits a tactical layer for proof automation, arithmetic procedures, and user interaction.

The core proof principles decompose hybrid programs structurally. Standard axioms and rules handle assignments, tests, choice, composition, and loops; continuous dynamics are treated by differential invariants, differential cuts, differential ghosts, and related ODE rules rather than by explicit solution formulas alone (Platzer, 2019, Mitsch et al., 2017). In case studies, KeYmaera X constructs proof trees whose leaves are axiom sequents of the form $\mathrm{dL}$9; reaching such leaves closes the proof (Velasquez et al., 2021).

Automation is substantial but not unrestricted. The Proof IDE paper emphasizes that hybrid-systems verification is undecidable in general and that verification engineers must be able to intervene with invariants and proof guidance (Mitsch et al., 2017). The tactical layer includes composite tactics such as the “master tactic,” described in a traffic case study as a meta-tactic used “to verify all the content of the program and arrive at the axiom,” and the Bellerophon tactic language supports scripted proof strategies (Velasquez et al., 2021, Mitsch et al., 2017). Arithmetic closing steps can use quantifier elimination and decision procedures for real arithmetic, but several papers stress that scalability is often determined less by the logic than by invariant discovery and arithmetic complexity (Feyzishendi et al., 1 Sep 2025, Sogokon et al., 2020).

3. Modeling patterns in KeYmaera X

KeYmaera X is used with a recurring family of modeling patterns. The most common is the sampled-data control loop, encoded as a repetition of discrete control and continuous plant evolution. In PLC-oriented verification, this appears in scan-cycle normal form as a loop over input sampling, controller execution, timer reset, and plant ODE evolution with an evolution domain constraint (Garcia et al., 2019). In self-driving car verification, the same pattern appears as a repeated controller-motion cycle $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$0 (Strauss et al., 2023).

The language is expressive enough to encode several classes of switched systems. For arbitrary switching among modes $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$1, one paper gives the hybrid program

$$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$2

and analogous schemas are developed for state-dependent switching, slow switching with dwell-time constraints, and controlled switching with discrete controller logic (Tan et al., 2021). The adequacy results in that work show that reachable states of these hybrid programs coincide with finite-time reachable states of the corresponding switched systems.

Domain-specific case studies illustrate how these generic constructs are instantiated. In macroscopic traffic verification, hybrid programs such as $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$3 combine density-based control, flow assignments, traffic-light or bus-stop mode choices, and ODEs for link densities (Velasquez et al., 2021). In chemical verification, continuous-only hybrid programs encode ODEs for batch reactors, Michaelis–Menten kinetics, and CSTRs, with properties like $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$4 or $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$5 proved symbolically (Feyzishendi et al., 1 Sep 2025). In object-oriented CPS modeling, Hybrid Active Objects are translated compositionally into formulas of the form

$$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$6

which are then discharged in KeYmaera X (Kamburjan et al., 2019).

4. ODE reasoning and invariant technology

Continuous reasoning in KeYmaera X is centered on invariants. A differential invariant is a state formula $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$7 such that

$$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$8

and it is proved by reasoning about derivatives and evolution domains instead of solving the ODE explicitly (Feyzishendi et al., 1 Sep 2025). This is why KeYmaera X can prove properties for nonlinear systems without closed-form solutions, as demonstrated for Michaelis–Menten kinetics and other reactor models (Feyzishendi et al., 1 Sep 2025, Bohrer, 2022).

Many successful proofs use physical conservation laws as invariants. In chemical reactors, conservation of mass yields invariants such as $$\alpha,\beta ::= x := \theta \mid ?\chi \mid x' = f(x)\;{data}\;\chi \mid \alpha \cup \beta \mid \alpha;\beta \mid \alpha^*,$$9 or $\mathrm{dL}$0, which are then used via differential cuts to derive concentration bounds (Feyzishendi et al., 1 Sep 2025). When direct positivity or monotonicity arguments are awkward, differential ghosts introduce auxiliary ODE variables to make the invariant inductive; one reactor proof adds $\mathrm{dL}$1 so that $\mathrm{dL}$2 becomes a differential invariant implying $\mathrm{dL}$3 (Feyzishendi et al., 1 Sep 2025).

The invariant technology extends well beyond simple differential induction. KeYmaera X case studies and extensions use Darboux polynomials, barrier certificates, semianalytic invariants, and forward invariant cuts (Bohrer, 2022, Arechiga et al., 2015). The Pegasus integration adds automatic continuous invariant generation by combining first integrals, Darboux polynomials, barrier certificates, qualitative analysis, subsystem splitting, differential saturation, and differential divide-and-conquer, while retaining soundness because all candidate invariants are rechecked in KeYmaera X’s $\mathrm{dL}$4 core (Sogokon et al., 2020).

A more recent development targets high-dimensional control envelopes. In the zonotope-to-certificate pipeline, numerically computed robust control invariant sets and zonotope witnesses are turned into $\mathrm{dL}$5 proof certificates; KeYmaera X validates Taylor-model premises and zonotope-containment witnesses instead of attempting intractable quantifier elimination over the full set representation (Hellwig et al., 24 Sep 2025). This suggests a specialization strategy: when generic arithmetic is overwhelmed, domain-specific derived proof rules can preserve rigor while avoiding the worst-case cost of general elimination.

5. Interfaces, language extensions, and verification pipelines

KeYmaera X includes a browser-based Proof IDE designed to combine proof search, point-and-click sequent interaction, and tactic programming. The interface exposes a sequent view, branch tabs, tactic suggestions, and tactic extraction, and it is explicitly motivated by the need to balance automation with human guidance in an undecidable domain (Mitsch et al., 2017). A later structured-proof layer, Kaisar, adds declarative proof blocks, structured symbolic execution, and nominal terms $\mathrm{dL}$6 for referring to the value of $\mathrm{dL}$7 in a previously named state, simplifying historical references that would otherwise require ghost variables (Bohrer et al., 2019).

The language itself has been extended. An implicit-definition package for KeYmaera X adds interpreted function symbols whose graphs are characterized by $\mathrm{dL}$8 formulas derived from ODEs, allowing direct use of functions such as $\mathrm{dL}$9, $[\alpha]\phi$0, $[\alpha]\phi$1, and $[\alpha]\phi$2 in hybrid proofs (Gallicchio et al., 2022). Soundness is obtained by minimally extending the kernel with a single function-interpretation axiom scheme, while the higher-level tactics automatically prove existence side conditions, initial-value lemmas, and derivative axioms such as $[\alpha]\phi$3 (Gallicchio et al., 2022).

KeYmaera X also participates in end-to-end assurance pipelines. ModelPlex synthesizes runtime monitors from $[\alpha]\phi$4 safety proofs to check whether observed executions remain model-compliant, and VeriPhy refines these logical monitors to executable code with verified compilation (Platzer, 2019). HyPLC translates between hybrid programs and PLC Structured Text, so that proofs of formulas like

$[\alpha]\phi$5

can be connected to PLC implementations while preserving safety by compilation (Garcia et al., 2019). In the RSS self-driving case study, deterministic controllers are proved to refine nondeterministic safety envelopes and are then compiled to Python, with compilation and refinement both shown to preserve the safety proof (Strauss et al., 2023).

6. Applications, scope, and limitations

The application record described in the cited literature is broad. KeYmaera X has been used for ground robot obstacle avoidance, railway control, train control, adaptive cruise control, airborne collision avoidance in ACAS X, surgical robots, switched-system stability, vehicular traffic flow, chemical reactors, self-driving car safety envelopes, PLC-controlled water treatment, and control-envelope certification for sampled-data systems (Platzer, 2019, Feyzishendi et al., 1 Sep 2025, Tan et al., 2021, Velasquez et al., 2021, Strauss et al., 2023, Garcia et al., 2019, Hellwig et al., 24 Sep 2025). The same logical core also supports purely continuous models; reactor verification papers explicitly emphasize that KeYmaera X can reason about ODE systems that have no discrete transitions at all, even though the underlying logic is designed for hybrid systems (Feyzishendi et al., 1 Sep 2025).

Several recurring misconceptions are addressed by the case studies. One is that theorem proving in KeYmaera X always requires explicit ODE solutions. The reactor and chemical case studies show the opposite: proofs can proceed via differential invariants, cuts, and ghosts even for nonlinear systems without closed-form solutions (Feyzishendi et al., 1 Sep 2025, Bohrer, 2022). Another is that safety proofs alone suffice to transfer guarantees to deployed artifacts. The overview chapter, HyPLC, and the RSS study all distinguish model-level verification from implementation-level assurance and use monitors, refinement proofs, and verified compilation to bridge that gap (Platzer, 2019, Garcia et al., 2019, Strauss et al., 2023).

The limitations are equally explicit. Invariant discovery remains a practical bottleneck; several papers state that automation often succeeds only once suitable invariants are identified, and that this is “often the hard part” of using KeYmaera X effectively (Feyzishendi et al., 1 Sep 2025, Sogokon et al., 2020). Some workflows are restricted to polynomial ODEs or require global-existence proofs for user-defined functions (Bohrer, 2022, Gallicchio et al., 2022). Certain features were absent in specific tool generations or case studies, such as the staging-set liveness rule in the station-keeping verification and support for distributed hybrid logic $[\alpha]\phi$6 in the HAO translation work (Martin et al., 2017, Kamburjan et al., 2019). High-dimensional arithmetic can overwhelm quantifier elimination, which is precisely why the zonotope-certificate pipeline introduces specialized witness validation inside KeYmaera X (Hellwig et al., 24 Sep 2025). More generally, symbolic guarantees may be broad compared with tight numerical reachability bounds, especially for open systems such as CSTRs where simple conservation invariants do not hold (Feyzishendi et al., 1 Sep 2025).

Taken together, these works portray KeYmaera X as a logic-centered verification environment rather than a single proof engine: a small trusted $[\alpha]\phi$7 kernel, layered automation, increasingly rich invariant technology, proof-oriented interfaces, and certified connections to monitors, PLCs, Python code, and numerical reachability. The common theme is not replacement of simulation or numerical analysis, but their incorporation into proof-producing workflows in which the final safety claim is a checked theorem rather than an empirical regularity (Platzer, 2019, Sogokon et al., 2020, Hellwig et al., 24 Sep 2025).