A Reliable Translation Method for Synchronous Data Stream Languages ​​Based on the 8114 Criterion

Abstract

This invention relates to a reliable translation method for synchronous dataflow languages ​​based on the 8114 criterion, belonging to the field of code generation. The invention obtains the abstract syntax tree of the Ctemp intermediate language through lexical and syntactic analysis and translation of Lustre source code; it traverses the Ctemp abstract syntax tree and designs translation methods for control flow statements and assignment statements within the tree structure; it traverses expressions within statements and designs translation methods that add type casting to ensure that statements are semantically correct while avoiding implicit type conversions; it extends the theorem on type relations in Cltype for verifying type operations; and it extends the theorem on type casting and binary operations in Ctemp semantics to achieve semantic formal verification. This invention significantly improves the compliance of C code generated by code generation tools with the GJB 8114 specification.

Description

Technical Field

[0001] This invention belongs to the field of code generation, specifically relating to a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 criterion. Background Technology

[0002] Generating highly reliable code is a core technical challenge in model-based software development. Code generation technology is an advanced programming technique that can automatically generate code from models. The core advantage of this type of technology lies in its ability to effectively improve development efficiency and reduce human programming errors.

[0003] Currently, synchronous dataflow languages ​​play a crucial role in model-based software development. In safety-critical fields such as aerospace and nuclear power, model-based software development has become an important research direction. In these fields, even a minor software error can lead to significant loss of life or property. Therefore, achieving reliable translation of synchronous dataflow languages ​​has gradually become a key research focus in this field.

[0004] Traditional methods for ensuring compiler correctness mostly involve extensive testing of the generated code or strict process management during production. However, as software scales up, these methods become increasingly inefficient, and their ability to guarantee code security is approaching its limits. Another means of ensuring code security—formal verification—is gradually becoming a research hotspot. Regarding model development and verification, the U.S. Radio Technical Committee on Aeronautics (RTA) supplemented the DO-178C series of airworthiness standards in 2011 with the DO-331 standard (based on model development and verification) and the DO-333 standard (formal method).

[0005] In domestic research on trusted compilation of modeling languages, the L2C trusted compiler is a prominent achievement. The L2C compiler's source language is Lustre*, an extension of the synchronous dataflow language Lustre V6. The target language is Clight, an intermediate language of the CompCert compiler, a subset of C language conforming to the C99 standard. The CompCert compiler is a fully formally verified C language compiler developed based on the interactive theorem proving tool Coq. Its security reaches the highest level currently available for C language compilers. The L2C compiler is also developed based on the interactive theorem proving tool Coq, where the core translation steps undergo rigorous formal verification to ensure the semantic equivalence of the translation process. By interfacing with the CompCert compiler at the Clight step, the L2C compiler can complete the formally verified compilation entirely, and can also directly output C code based on the Clight abstract syntax tree for code debugging and portability.

[0006] To further enhance the maintainability and portability of C code, defining and implementing secure C code and secure programming standards is crucial. To improve the security of military software, my country has proposed the GJB 8114-2103 standard for the C / C++ language used in military software. This standard imposes strict restrictions on many aspects of C / C++ language usage, constructing a secure subset of C code, which significantly improves the security, maintainability, and portability of C code conforming to this standard.

[0007] However, current model-based C code generation tools do not adequately comply with the GJB 8114-2103 standard and undergo complete formal verification, thus affecting their applicability in high-risk fields, particularly aerospace and military. Taking L2C as an example, its violation rate of the 8114 standard is extremely high. In a test of 50,000 lines of code, a total of 19,660 rules were violated. Among these, 17,192 violations (87.4%) were of the R-1-10-4 rule, which prohibits implicit type conversion. Summary of the Invention

[0008] (a) Technical problems to be solved

[0009] The technical problem this invention aims to solve is how to provide a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 standard, in order to address the issue of implicit type conversions in code generated by current code generators, which leads to a high violation rate of the GJB 8114 standard.

[0010] (II) Technical Solution

[0011] To address the aforementioned technical problems, this invention proposes a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 criterion. This method includes the following steps:

[0012] S1. Use the synchronous data stream language translation tool L2C to generate the intermediate language Ctemp abstract syntax tree from the Lustre source code;

[0013] S2. Translate the expression layer in the Ctemp abstract syntax tree: detect and eliminate implicit type conversions in the expression layer;

[0014] S3. Traverse the statement layer, function layer, and program layer in the abstract syntax tree to complete the full translation; at the statement layer, detect and eliminate implicit type conversions at the connection between statements and expressions;

[0015] S4. Traverse the translated Ctemp abstract syntax tree and output the abstract syntax tree as C code;

[0016] S5. Perform formal verification on the translation process to prove that the program before and after translation is analogously equivalent, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0017] (III) Beneficial Effects

[0018] This invention proposes a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 criterion. This method has at least the following beneficial effects:

[0019] (1) The abstract syntax tree of the Ctemp intermediate language code has been modified to ensure that the generated code does not contain implicit type conversions, thus improving the security of the code generated by the OnModel modeling platform. Currently, implicit type conversions account for over 87% of the violations of the 8114 code safety guidelines in the C code generated by the tool. Eliminating implicit type conversions can significantly reduce the violation rate of the generated code against the 8114 safe code guidelines.

[0020] (2) Code optimization and formal verification on Ctemp were implemented, ensuring the integrity of the formal verification chain of the new code generation method.

[0021] (3) While performing formal verification, several practical lemmas were proved for the syntax and operational semantics in Cltypes and Ctemp, which can be applied to the formal verification of other code optimization processes. Attached Figure Description

[0022] Figure 1 This is a diagram of an abstract syntax tree;

[0023] Figure 2 This is a flowchart illustrating the core translation steps of this invention.

[0024] Figure 3 This is a flowchart illustrating the complete code translation process of the present invention;

[0025] Figure 4 This is a flowchart of the formal verification process for this invention;

[0026] Figure 5 The example program is shown in the OnModel model diagram. Detailed Implementation

[0027] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0028] The technical problem this invention aims to solve is how to provide a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 standard, in order to address the issue of implicit type conversions in code generated by current code generators, which leads to a high violation rate of the GJB 8114 standard.

[0029] To address the aforementioned technical problems, this invention proposes a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 criterion. Before describing this method, it is necessary to introduce the concepts and technical terms that will appear in the following text:

[0030] The main work of this invention is carried out in Coq, one of the most popular theorem-proving tools. Its core theory is inductive constructive calculus. Within this theoretical framework, Coq combines functional programming language and higher-order logic, possessing a strong mathematical foundation. Coq's strength also lies in the fact that terms and functions defined within it can be directly extracted into the OCaml language. This means that it is possible to construct programs that can be directly verified through formal analysis.

[0031] This invention is based on the abstract syntax tree of Ctemp, an intermediate language in the Lustre compilation process. The Ctemp abstract syntax tree is formally defined in Coq and is divided into four layers from top to bottom: program layer, function layer, statement layer, and expression layer.

[0032] In Coq, an inductive construct can contain several construct parameters, and the construct parameters can also be inductive constructs. This allows for tree representation. The statements and expressions mentioned below refer to those in the Ctemp abstract syntax tree.

[0033] Taking type casting expressions as an example, within Coq, it is defined as a constructor `Ecast` of the expression inductive type `expr`. It accepts an expression and a data type (such as `int`, `float`, etc.) as constructor parameters. `Ecast e ty` means: applying a type cast of data type `ty` to the expression `e`. `Ecast e ty` can also be used as an expression in the construction of other expressions or statements. For example, `Ecast(Ecast e ty) ty2` is also a valid expression constructor.

[0034] Expressions can be evaluated on the right. The data type of the final calculated value is referred to as the data type of the expression in this invention.

[0035] Expressions in an abstract syntax tree exist within a specific context: they either serve as constructor parameters for statements (subtrees of statements) or as constructor parameters for higher-level expressions (subtrees of expressions). If there exists a data type ty, when the data type of an expression is equal to ty, no direct implicit type conversion is performed in its context according to the operational semantics. In this invention, ty is referred to as the context type of the expression.

[0036] As an intermediate language serving formal verification, Ctemp not only defines an abstract syntax tree in Coq, but also defines formal operational semantics on top of it. Operational semantics reflect the program execution process at a highly abstract level. The formal definition of operational semantics allows us to verify whether the translation process guarantees semantic invariance.

[0037] This invention relates to a reliable translation method for synchronous data stream languages ​​based on the 8114 criterion, belonging to the field of code generation. This invention can convert Lustre source code into C language code without any implicit type conversions. This method obtains the abstract syntax tree (AST) of the Ctemp intermediate language through lexical analysis, syntax analysis, and translation of the Lustre source code. It then traverses the Ctemp AST and designs translation methods for control flow statements and assignment statements within the tree structure. Furthermore, it traverses expressions within statements and designs translation methods that incorporate type casting to ensure semantic correctness while preventing implicit type conversions. The method extends the theorems regarding type relationships in Cltype for verifying type operations. It also extends theorems regarding type casting and binary operations in Ctemp semantics to achieve formal semantic verification. Addressing the issue that over 87% of violations of the GJB 8114 specification by current code generation tools are implicit type conversions, this method reconstructs the generated code by refactoring the AST and proves its correctness through formal verification. This improves the security of the C code generated by the self-developed OnModel tool and significantly enhances the compliance of the generated C code with the GJB 8114 specification.

[0038] This invention provides a reliable translation method for synchronous data stream languages ​​based on the 8114 criterion, the method comprising the following steps:

[0039] S1. Use the existing synchronous data stream language translation tool L2C to generate the intermediate language Ctemp abstract syntax tree from the Lustre source code.

[0040] S2. Translate the expression layer in the Ctemp abstract syntax tree: detect and eliminate implicit type conversions in the expression layer.

[0041] S3. Traverse the statement layer, function layer, and program layer in the abstract syntax tree to complete the full translation; at the statement layer, detect and eliminate implicit type conversions in the connection between statements and expressions.

[0042] S4. Traverse the translated Ctemp abstract syntax tree and output the abstract syntax tree as C code.

[0043] S5. Perform formal verification on the translation process to prove that the program before and after translation is analogously equivalent, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0044] Further, step S2 specifically includes:

[0045] S21. Create a recursive function safe_type_of(e) = ty to solve for the data type of the expression. e is the expression to be solved, and ty is the data type of the solved e.

[0046] For variables and constant expressions, their types can be obtained directly from their type labels.

[0047] For other types of expressions, inference needs to be made based on the semantics of the operation.

[0048] S22. A recursive function `trans_expr(e,ty) = e'` is created to translate implicit type conversion expressions into explicit type conversion expressions, eliminating implicit type conversions at the expression level. `e` is the expression, `ty` is its context type, and `e'` is the modified expression.

[0049] For an expression e, its subexpressions are defined as expressions that serve as arguments (subtrees) to the constructor of e. If the expression input to trans_expr has subexpressions, then those subexpressions are also translated via trans_expr. The context type of the subexpression is inferred from the semantics of the expression operation.

[0050] Furthermore, step S3 specifically includes:

[0051] S31. Create a recursive function trans_stmt(s) = s' to translate the function body. s is the statement, and s' is the translated statement.

[0052] For control flow statements, recursively traverse their sub-statements and apply trans_stmt to complete the translation.

[0053] For an assignment statement, let its left-hand expression be e1 and its right-hand expression be e2. Translate e2 into: trans_expr(e2, safe_type_of(e1)).

[0054] S32. Traverse the program layer and function layer, apply trans_stmt to the function body statements of each function in the function layer, and complete the translation of the entire program.

[0055] Further, step S5 specifically includes:

[0056] S51. The theorem on semantic equivalence before and after translation: If program p1 is translated into p2 by S3, for any numerical sequence v1 and v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2.

[0057] If the theorem is proven in the theorem-proving tool Coq, it can be shown that the translation process of the program through step S3 ensures that the program's behavior remains consistent at the input and output levels, and that the translation process does not lead to semantic changes.

[0058] S52. Decompose the proof of the theorem into the proof of several important lemmas.

[0059] Furthermore, the key lemmas described in S52 mainly include: 1. Initial environment matching; 2. Function execution matching; 3. Expression evaluation matching. Based on operational semantics, the above proof is completed, fully demonstrating the correctness of the translation process.

[0060] Example 1:

[0061] To address the aforementioned technical problems, this invention proposes a code translation method incorporating the 8114 standard. The specific implementation method includes:

[0062] Operation S1 calls L2C to generate the Ctemp abstract syntax tree from the Lustre source code. In this embodiment, the Lustre source code is generated by the OnModel tool based on a model, which is as follows: Figure 5 As shown, the generated Lustre code is presented in Table 1. Since the Ctemp abstract syntax tree representation is relatively difficult, the C source code constructed from it is used here to demonstrate this process (the input structure and context structure are omitted in the example code). The C code generated from the Ctemp abstract syntax tree is shown in Table 2:

[0063] Table 1 Lustre source code

[0064]

[0065]

[0066] Table 2 C code before conversion

[0067]

[0068] Operation S2: Implement expression-level translation within Coq. Specific implementation includes:

[0069] S21: Create a recursive function `safe_type_of` to evaluate the data type of the expression. Classify and discuss each different expression based on its operational semantics.

[0070] For variables and constant expressions, their data type can be obtained directly from their type label.

[0071] For other expressions, their data type needs to be inferred from the operation semantics.

[0072] For example, for a binary operation expression, it is necessary to first obtain the type of its subexpressions, and then determine the data type of the binary operation expression according to the definition of binary operation semantics.

[0073] Establishing this function requires defining a type equality check function: `type_eq(ty1,ty2) = b`, which accepts two data types and returns a boolean value. Furthermore, this is demonstrated by proving the proposition:

[0074] forall ty1 ty2,ty1=ty2<=>type_eqty1 ty2=true.

[0075] We prove that type_eq is indeed the function for determining whether data types in Ctemp are equal, and we also prove that data types in Ctemp are determinate, which is crucial for the subsequent definition and proof.

[0076] S22: Within the expression layer, let the current expression be e, the context type of e be t1, and the data type of e be t2. Implement the recursive function trans_expr(e, t1):

[0077] If t1 = t2, continue executing step S2 for all its subexpressions.

[0078] If t1≠t2, and if e is: Econst, Evar, Etempvar, Etempret, Ederef, then e will be translated as: Ecast e t1, which means applying a type cast of data type t1 to the expression e.

[0079] Operation S3: Implement translation of statement layer, function layer, and program layer in Coq.

[0080] Furthermore, step S3 specifically includes:

[0081] S31: Create a recursive function trans_stmt(s) = s' to translate the function body. s is the statement (function body), and s' is the translated statement.

[0082] The `trans_stmt` classifies and discusses statements. For sub-statements of control flow statements, `trans_stmt` is recursively applied for translation. For assignment statements, if the lvalue expression is `e1` and the rvalue expression is `e2`, then `e2` is translated as: `trans_expr(e2, safe_type_of(e1))`.

[0083] S32: Traverse the program layer and function layer, apply trans_stmt to the function body of each function in the function layer, and complete the translation of the entire program.

[0084] The algorithm in S3 is written as a programmatic translation function, encapsulated as the AddCast translation step, and interfaced with the synchronous data stream language translation tool L2C. The complete translation process is as follows: Figure 3 As shown.

[0085] Operation S4: Traverse the transformed Ctemp abstract syntax tree and output the abstract syntax tree as C code, as shown in Table 3:

[0086] Table 3. Converted C Code

[0087]

[0088]

[0089] As can be seen, implicit type conversion has disappeared.

[0090] Operation S5: Perform formal verification on the translation process to prove that the program before and after translation has analog equivalence, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0091] Further, step S5 specifically includes:

[0092] S51: Determine the theorem to be proved: Assume that program p1 is translated into p2 via AddCast. For any numerical sequence v1 v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2. Formalize the theorem in the theorem proving tool Coq.

[0093] S52: In Coq, break down the proof of the theorem into proofs of several important lemmas.

[0094] Furthermore, the important lemmas described in S52 mainly include:

[0095] 1. Initial environment matching: After initializing p1 and p2, the initial environment is matched.

[0096] 2. Function execution matching: For any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, and memory state m1, if statement a is executed in global environment e1, local variable environment le1, local return value environment te1, and memory state m1, and the memory state changes to m2 after execution, and e2 matches e1, le2 matches le1, and te2 matches te1, then the translated statement a' is executed in global environment e2, local variable environment le2, local return value environment te2, and memory state m1, and the memory state also changes to m2 after execution.

[0097] 3. Expression evaluation matching: If a1 is translated to a2 when the specified context type is ty, then for any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, and numerical value v1, v2, if the statement a1 is evaluated to v1 when it is in the global environment e1, the local variable environment le1, and the local return value environment te1, and e2 matches e1, le2 matches le1, and te2 matches te1, then the expression a2 is evaluated when it is in the global environment e2, the local variable environment le2, and the local return value environment te2, and the result is castv1 ty.

[0098] Based on the semantics of Ctemp operations and context semantics, the above theorem is proved inductively. Finally, a formal proof of the translation correctness theorem is completed. The framework of the proof is as follows: Figure 4 As shown.

[0099] This invention proposes a reliable translation method for synchronous data stream languages ​​that incorporates the 8114 criterion. This method has at least the following beneficial effects:

[0100] (1) The abstract syntax tree of the Ctemp intermediate language code has been modified to ensure that the generated code does not contain implicit type conversions, thus improving the security of the code generated by the OnModel modeling platform. Currently, implicit type conversions account for over 87% of the violations of the 8114 code safety guidelines in the C code generated by the tool. Eliminating implicit type conversions can significantly reduce the violation rate of the generated code against the 8114 safe code guidelines.

[0101] (2) Code optimization and formal verification on Ctemp were implemented, ensuring the integrity of the formal verification chain of the new code generation method.

[0102] (3) While performing formal verification, several practical lemmas were proved for the syntax and operational semantics in Cltypes and Ctemp, which can be applied to the formal verification of other code optimization processes.

[0103] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for trusted translation of a synchronous dataflow language adhering to the 8114 guideline, characterized in that, The method comprises the following steps: S1, generating an intermediate language Ctemp abstract syntax tree from the Lustre source code by using a synchronous data flow language translation tool L2C; S2, translating the expression layer in the Ctemp abstract syntax tree: detecting and eliminating implicit type conversion in the expression layer; S3, traversing the statement layer, the function layer and the program layer in the abstract syntax tree to complete the complete translation; In the statement layer, detecting and eliminating implicit type conversion in the joint part of the statement and the expression; S4, traversing the translated Ctemp abstract syntax tree, and outputting the abstract syntax tree as C code; S5, performing formal verification on the translation process, proving that the programs before and after the translation are equivalent, so as to ensure that the translation process does not affect the correctness of the generated code; Wherein, The S2 specifically comprises: S21, creating a recursive function safe_type_of(e)=ty to solve the data type of an expression, e is an expression to be solved, and ty is the data type of e obtained by solving; S22, creating a recursive function trans_expr(e, ty)=e' to translate an implicit type conversion expression into an explicit type conversion expression, and eliminate the implicit type conversion in the expression layer, e is an expression, ty is the context type thereof, and e' is the modified expression.

2. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 1, wherein, In the S21, for variable and constant expressions, the types thereof are directly obtained from the type tags thereof; for other types of expressions, the types thereof need to be inferred according to the operation semantics.

3. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 1, wherein, In the S22, for an expression e, the sub-expressions of e are defined as: the expressions that are the construction parameters of e; if the sub-expressions of the expression input by trans_expr exist, the sub-expressions are also translated via trans_expr; the context types of the sub-expressions are inferred by the expression operation semantics.

4. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 3, wherein, The S22 specifically comprises: In the expression layer, the current expression is e, the context type of e is t1, and the data type of e is t2, a recursive function trans_expr(e, t1) is implemented: If t1=t2, all the sub-expressions of e continue to execute step S2; If t1≠t2, if e is: Econst, Evar, Etempvar, Etempret or Ederef, e is translated into: Ecast et1, indicating that the expression e is applied with the forced conversion of the data type t1.

5. The method for trusted translation of synchronous dataflow language according to the 8114 criterion of any one of claims 1-4, wherein, The S3 comprises: S31, creating a recursive function trans_stmt(s)=s' to translate the function body; s is a statement, and s' is the translated statement; S32, traversing the program layer and the function layer, and applying trans_stmt to the function body statement of each function in the function layer to complete the translation of the entire program.

6. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 5, wherein, The S31 specifically comprises: For a control flow statement, the sub-statements thereof are recursively traversed and trans_stmt is applied to complete the translation; For an assignment statement, the left value expression thereof is e1, and the right value expression thereof is e2, e2 is translated into: trans_expr(e2, safe_type_of(e1)).

7. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 5, wherein, The algorithm in S3 is written as a program translation function, encapsulated as an AddCast translation step, and connected to the synchronous data flow language translation tool L2C.

8. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 5, wherein, The S5 includes: S51, determining a semantic equivalence theorem before and after translation: if program p1 is translated into p2 by S3, for any numerical sequence v1, v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2; the theorem is proved in the theorem proving tool Coq; S52, the proof of the theorem is decomposed into the proof of a number of lemmas.

9. The method for trusted translation of synchronous dataflow language bound to 8114 criteria as claimed in claim 8, wherein, The lemma in S52 includes: Initial environment matching: after the initialization of p1 and p2, the initial environment is matched; Function execution matching: for any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, memory state m1, m2, if the statement a is in the global environment e1, local variable environment le1, local return value environment te1, and the memory state m1, the memory state changes to m2 after execution, and e2 matches e1, le2 matches le1, and te2 matches te1, then a' obtained after translation of a is in the global environment e2, local variable environment le2, local return value environment te2, and memory state m1, and the memory state changes to m2 after execution; Expression evaluation matching: if a1 is translated into a2 in the specified context type ty, then for any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, and numerical value v1, v2, if the statement a1 is in the global environment e1, local variable environment le1, and local return value environment te1, the evaluation result is v1, and e2 matches e1, le2 matches le1, and te2 matches te1, then the expression a2 is evaluated in the global environment e2, local variable environment le2, and local return value environment te2, and the result is cast v1 ty; According to the Ctemp operation semantics and environment semantics, the above theorem is inductively proved, and finally the formal proof of the translation correctness theorem is completed.

Images