Modelling and Proving Safety in Autonomous Cars Scenarios in HOL-CSP

We present an approach to model scenarios of autonomous cars in HOL-CSP [10] and prove particular safety properties via interactive proofs in the Isabelle/HOL system (https: //en.wikipedia.org/wiki/Isabelle_(proof_assistant)). The basis of this work is an ontology for Autonomous Car Scenarios given in MOSAR (https://www.mosar.io) that describes a collection of actors (e.g. cars, trucks, bicycles), equipments (e.g. signals, vehicle lights, etc.), infrastructures (e.g. expressways, intersec- tions, etc.) and their dynamic interactions throughout driving scenarios. We represent the behaviour of actors and (rudimentarily) equipments as processes, i.e. infinite sets of traces denoting classes of scenarios. In particular, actors were represented as HOL-CSP processes. Due to the non-determinism and event-polymorphism of HOL-CSP, actor descriptions can be partially defined wrt. to data and arbitrarily ”chaotic” in their behaviour. A translation scheme of MOSAR-ontologies into actor processes in HOL-CSP is sketched. For a particular scenario described in [9] (two cars in a linear line, no backwards driving) we specialize our framework and demonstrate a machine-checked safety proof: If all the actors apply a particular driving strategy taking into account position, speed and acceleration as well as distance to the car in front, there will be no situation with a collision. This strategy — called Responsibility-Sensitive Safety — is formulated as a function and the resulting invariant formally proven in Isabelle/HOL, while overcoming a number of short-comings in both the original modeling and the original paper-and-pencil proof.