A method for automatically generating verification properties of AADL model combinations based on natural language requirements

Abstract

The present invention discloses a method for automatically generating combined verification properties of an AADL model based on natural language requirements. In the verification phase of a software model established with AADL as a modeling language, the method automatically generates an input natural language requirement text into a formalized contract, which is inserted into the original model, thereby facilitating combined verification of the AADL model based on a verification tool AGREE.

Description

Technical Field

[0001] The present invention belongs to the technical field of safety-critical software, and in particular relates to a method for automatically generating verification properties of AADL model combinations based on natural language requirements. Background Art

[0002] Safety-critical software is a type of software used in safety-critical systems in the fields of aviation, aerospace, transportation, energy, etc. If it does not perform well, it will cause the safety-critical system to be in a dangerous state, thereby causing property loss, environmental damage or personal injury. Therefore, there are extremely high requirements for the functional correctness, real-time performance, security and other properties of safety-critical software.

[0003] The increasing complexity of safety-critical software has increased the difficulty of software development, and the development cost and insecurity factor have also increased accordingly. In recent years, model-driven, especially formal model-driven safety-critical software design and development methods have gradually gained attention and are considered by the industry to be an important and feasible means. The model-driven development method regards the model as the core element of the entire software development process, establishes the software model in the design phase, and verifies and analyzes it as early as possible. At the same time, the reuse of models and automatic code generation based on models can help reduce software development time and costs.

[0004] Traditional system model verification methods generally convert the entire flattened model and directly verify it. Due to the large number of software components and complex states in safety-critical systems, this type of verification method will lead to the problem of system state space explosion. In recent years, contract-based compositional verification has become an international frontier hotspot in the field of safety-critical software to solve the problem of verification state space explosion.

[0005] The core idea of ​​the contract-based combination verification method is to use the combination structure of the software system to decompose the verification problem, first verify the properties of each sub-component, and then comprehensively derive the properties of the entire system, solving the state space explosion problem by divide and conquer. These properties are formalized by contracts. Contracts are abstract specifications for component inputs, internal behaviors, and outputs, generally expressed as two tuples.<Assume,Guarantee> Assume specifies the environmental constraints of the component, because the behavior of each component in the system is often affected by the components associated with it. The so-called environment refers to other components and connections that interact with the component. The components in the environment can be software, hardware, or physical devices, etc. Guarantee specifies the behavior that the component should guarantee when Assume is met.

[0006] In the field of safety-critical systems, commonly used modeling languages ​​include Modelica, SysML, UML Marte, AADL, EAST-ADL, SCADE, Simulink, Ptolemy II, etc. Among them, AADL expresses the hardware and software architecture of the system in a hierarchical way, expresses the normal functional behavior of components based on the Behavior Annex, and expresses the fault behavior of components under failure conditions based on the Error Model Annex. It fully supports MBSD and MBSA in an integrated way. The rich expression methods make AADL an important choice for safety-critical software design and verification methods.

[0007] The Assumption Assurance Reasoning Environment (AGREE) is a combinatorial, assumption-assurance model checker for AADL models. The AGREE annex subcomponent can be embedded into AADL systems, processes, and threads, supports inserting formal contracts into existing AADL models, uses k-induction as the underlying algorithm for model checking, and implements AADL model requirement verification, architecture design, and architecture verification.

[0008] Contract definition is the premise for the use of combined verification methods. How to achieve the automatic generation of formal contracts from natural language requirements has become the key to the effective use of combined verification methods in the field of safety-critical systems. The current method of obtaining formal contracts is to manually convert natural language into contracts, which has some disadvantages:

[0009] First, manual conversion increases the possibility of introducing errors into the system;

[0010] Second, for most complex safety-critical systems, the workload and complexity of manual conversion requirements are unbearable.

[0011] In addition, existing research on combinatorial verification tools is mainly based on synchronous data flow, that is, it only supports synchronous subsets, and does not support asynchronous subsets, event data ports, delayed communication and other AADL model subsets. In practical applications, safety-critical systems have characteristics such as distribution and heterogeneity, so most of the communication methods adopted are heterogeneous communication modes. Therefore, the model subsets supported by AGREE should be expanded to meet the model verification requirements. Summary of the invention

[0012] Purpose of the invention: In order to reduce the errors and workload caused by manual contract input and expand the AADL model subset supported by the AGREE verification tool, the present invention proposes a method and tool for automatically generating verification properties of AADL model combinations based on natural language requirements. By providing contract patterns, the limited natural language requirements are converted into component contracts, and the development of the CPL contract generation tool is completed.

[0013] Technical solution: A method for automatically generating verification properties of AADL model combinations based on natural language requirements, comprising the following steps:

[0014] S100: Expand the component subset supported by AGREE, an AADL model verification tool, to enable it to complete the combination verification of asynchronous communication. The expanded components include asynchronous communication components.

[0015] S200: Adding AGREE statements to the AADL model as needed, and specifying the corresponding natural language requirement document in the safety-critical software system through the contract pattern definition language CPL as shown in formula (1), so as to realize the conversion of the natural language requirement into the requirement document expressed based on the contract pattern definition language;

[0016] CPL::=<Component,Pattern,Type,Structure> (1)

[0017] In the formula, Component is a set of AADL components, which indicates the components of the AADL model to which AGREE statements need to be added; Pattern is a set of requirement patterns; Type indicates the statement type in AGREE ANNEX; Structure indicates the common sentence patterns in each requirement pattern;

[0018] S300: Convert the requirement document expressed in the contract model definition language into an AGREE ANNEX contract;

[0019] S400: Insert the AGREE ANNEX contract into the existing AADL model;

[0020] S500: By inserting the AADL model with the AGREE ANNEX contract, the requirement verification, architecture design and architecture verification of the AADL model are completed.

[0021] The present invention also discloses an automatic generation tool for AADL model combination verification properties based on natural language requirements, which is used to convert the input requirements into LUSTRE language supported by AGREE to facilitate the subsequent combination verification process, including:

[0022] File processing module, used to perform file IO processing;

[0023] Statement generation module, used to generate AGREE ANNEX statements;

[0024] Expression conversion module, used to convert real-time mode statements;

[0025] Asynchronous communication processing module, used to establish asynchronous communication threads;

[0026] In the file processing module, the AADL model of the contract is added according to the user's needs, and the System type component and its communication port in the AADL model are obtained; and the user's synchronous or asynchronous communication processing selection is obtained. If it is synchronous communication processing, the statement generation module is called, and if it is asynchronous communication processing, the asynchronous communication processing module is called; when the demand mode selected by the user is the real-time mode, the expression conversion module is called;

[0027] In the statement generation module, if it is synchronous communication processing, an AGREE ANNEX statement is generated according to the demand mode, statement type and common sentence pattern selected by the user, and the generated AGREE ANNEX statement is inserted into the relevant component description; if it is asynchronous communication processing, an AGREE ANNEX statement is generated according to the demand mode, statement type and common sentence pattern selected by the user, and the generated AGREE ANNEX statement is inserted into the end of the file;

[0028] In the expression conversion module, if it is a when-occurs sentence pattern, a clock variable is newly created in the AGREE ANNEX statement to represent the current time, and it is determined whether there is an Assume condition. If so, it is added, otherwise the task assumes that the Assume condition is true; if it is one of the when-hold sentence pattern, when-imply sentence pattern, and condition sentence pattern, E1, E2 and time range contained in the sentence structure are obtained, and a corresponding property Property statement is generated; if it is a condition sentence pattern, a node is generated, and a corresponding statement is generated according to the period input in the sentence structure;

[0029] In the asynchronous communication processing module, an asynchronous communication thread is generated according to the sending component, sending port, receiving component, receiving port and input queue size selected by the user, and then the statement generation module is called.

[0030] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0031] (1) This invention takes the combinatorial verification problem of complex systems as the background and explores the solution of extracting formal contracts from requirements. This invention limits the input of natural language requirements in the form of templates, provides the conversion rules from template language to AGREEANNEX, and completes the development of related tools to achieve the automatic conversion of limited natural language requirements to formal contracts, thus reducing the failures and workload caused by manual input;

[0032] (2) The present invention explores the field of combinatorial verification methods for AADL asynchronous communication models and expands the model subset supported by AGREE, so that the AGREE verification tool can support combinatorial verification of asynchronous communication models and meet model verification requirements. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 For tool framework;

[0034] Figure 2 A flowchart for the tool to implement the transformation from natural language to formal contracts;

[0035] Figure 3 is the BNF grammar of CPL;

[0036] Figure 4 is the BNF grammar for real-time mode;

[0037] Figure 5 UML class diagram for pattern and structure;

[0038] Figure 6 is the CPL2AGREEANNEX instance;

[0039] Figure 7 This is a diagram of real-time mode statement conversion. DETAILED DESCRIPTION

[0040] By referring to the exemplary embodiments, the objects and functions of the present invention and the methods for achieving these objects and functions will be explained. However, the present invention is not limited to the exemplary embodiments disclosed below; it can be implemented in different forms. The essence of the description is only to help those skilled in the relevant art to comprehensively understand the specific details of the present invention.

[0041] The present invention aims at the contract acquisition problem of safety-critical software combination verification, and focuses on how to obtain a formalized contract that can be used in combination verification tools from a natural language requirement text. Due to the advantages of AADL such as rich expressive methods, the present invention considers using AADL as a modeling language and AGREE ANNEX supported by AADL verification tools to express formalized contracts.

[0042] Currently, most requirement specifications are documents written in natural language. However, natural language requirements are incomplete, imprecise, informal, and ambiguous, so it is difficult to verify the system model based on such requirement specifications. Formal languages ​​use precise mathematical symbols to express design requirements, which can solve this problem. However, formal languages ​​are difficult to learn and have a high threshold for use. Therefore, by defining an intermediate language and realizing the automatic conversion of natural language requirements to formal languages, the threshold for engineers to use formal verification is lowered.

[0043] In order to solve the problem of transforming natural language requirements into formal language, a Contract Pattern Language (CPL) based on natural language requirements is proposed. The Contract Pattern Language (CPL) builds a bridge between semi-formal natural language requirements and precise formal definitions. Through the Contract Pattern Language (CPL), a general architecture that can be ported to different fields can be created, and semantics can be incorporated into the generation of formal models. The basic work of the Contract Pattern Language (CPL) can be summarized as follows: establish a requirements framework, combine the advantages of semi-formal natural language and precise formal symbols, and provide a method for extracting relevant information from patterned natural language requirements and creating formal models with this information, that is, transforming natural language requirements into requirements expressed based on the Contract Pattern Language. Among them, the patterned natural language has a certain degree of precision and consistency in expression. Generally, the transformation from the requirement text based on the pattern definition language to the formal contract can be completed semi-automatically.

[0044] Therefore, the present invention provides a method for automatically generating verification properties of AADL model combinations based on natural language requirements. In the verification phase of a software model established with AADL as the modeling language, the input requirement text is automatically generated into a formal contract through the method. The formal contract can be used for the AADL verification tool AGREE, and the formal contract is inserted into the original model. The specific steps are described as follows:

[0045] Step 1: Define the contract model definition language CPL. The contract model definition language CPL can be expressed as a four-tuple, namely CPL::=<Component,Pattern,Type,Structure> , where Component is a set of AADL components, representing the components of the AADL model that need to add AGREE statements; Pattern is a set of requirement patterns, representing system requirement patterns with certain characteristics; Type represents the statement type in AGREE ANNEX; Structure represents the common sentence patterns in each requirement pattern; For the specific BNF description of CPL, see Figure 3 .

[0046] Among them, components are component type declarations (Type) and component implementations (Implementation) of all components in the AADL model, including software, hardware and system components. Each time you select a component, you are selecting the component to which AGREE ANNEX needs to be added. A component can be implemented in multiple modes.

[0047] The AADL component set Component includes:

[0048] Software architecture, including threads, thread groups, subroutines, data, and processes;

[0049] Hardware architecture, including processor, memory, bus, and peripherals;

[0050] System-level architecture, which represents the combined set of software and execution platform.

[0051] Among them, according to the requirements of safety-critical systems, the requirement pattern Pattern is divided into functional pattern, real-time pattern, security pattern, resource pattern, and pattern transformation pattern. Each pattern corresponds to a variety of statement types, and the commonly used statement types are nodes, assumptions, guarantees, assertions, lemmas, structures, constants, characteristics, and equations. Each pattern contains a variety of statement structures. The statement structure is a common statement expression method summarized according to the characteristics of each pattern. The main framework of the statement structure is a limited natural language template, and the content is implemented by manual addition. Therefore, the pattern can be expressed as a triple Pattern::=<Pattern_name,Type,Structure> ,The following is a detailed description of the five modes, as well as the statement types and statement structures contained in each mode.

[0052] Functional patterns are used to express the specific functional behaviors of the system. Common statement types under this pattern category include assumptions, guarantees, assertions, nodes, etc. Common structural types include trigger conditions, inequality relationships, etc. It can also be expanded to complex situations such as multiple event sequences and multiple condition sequences.

[0053] Real-time mode is used to describe the real-time behavior of the system and specifies that the system completes certain specific operations within a certain period of time. This mode category includes when-occur sentence patterns, when-hold sentence patterns, when-imply sentence patterns, and condition sentence patterns. To use real-time mode, you must first define a variable representing system time in AGREE. In the AGREE ANNEX of the top-level system of the AADL model, a variable representing time, eq T:int=0->pre(v)+1, is defined. We use T to represent the system clock, where pre is a special operation of the synchronous language, which is to obtain the value of the variable at the previous moment. First, initialize T to 0 to represent the system start time, and then each clock executes one step, and T counts up by 1. For a specific BNF description of the real-time mode syntax, see Figure 4 . Among them, whenever E1 occurs E2 occurs during[a,b] means that no matter when E1 occurs, E2 will occur at some point in the closed interval [a,b]; whenever E1 occurs E2 holds during[a,b] means that no matter when E1 occurs, E2 will always occur in the closed interval [a,b]; whenever E occurs E1 implies E2during[a,b] means that no matter when E occurs, E1=>E2 will always occur in the closed interval [a,b]; condition C1,E1occurs each T means that under the premise that condition C1 is met, E1 occurs once in each T period.

[0054] Safety patterns are used to express possible failure behaviors of the system. They are usually system-level requirements. Therefore, it is necessary to predefine some common failure or failure concepts in the field of safety-critical systems. For example, equipment failure, power failure, communication failure, etc. Among them, equipment failure mainly refers to system control failure, instruction control failure, etc.; communication failure mainly refers to thread communication timeout, thread periodic time property failure, etc. Safety requirements are closely related to AGREE's assumptions Assume and Guarantee, indicating the properties that the system must meet. There are equipment failure sentence patterns and communication failure sentence patterns under this pattern category;

[0055] Resource mode is used to express the system's constraints on power consumption, storage, bus, CPU, network bandwidth and other resource consumption. In safety-critical systems, it is usually a fixed constant value. It is converted to Const in AGREE. There are resource allocation sentences under this mode category;

[0056] Mode conversion mode, mode conversion is a common functional organization method in the aerospace field. This mode is used to express the switching between modes, which corresponds to complex conversion conditions and related operations. The statements related to mode switching are extracted to form a mode conversion mode, that is, under certain conditions, mode switching is performed to change the functional configuration of the system. There are mode conversion sentence patterns under this mode category;

[0057] Among them, the commonly used sentence structures in each demand pattern include:

[0058] The trigger condition sentence pattern is used to judge the truth or falsehood before the system is ready to perform certain operations; the trigger is similar to the judgment condition of the IF-ELSE statement in C language, so the trigger condition is often used together with the IF-ELSE structure;

[0059] Inequality relationship sentence pattern refers to the inequality relationship between more complex variables in the system, which is used to judge the trigger conditions or assign the values ​​of variables;

[0060] The when-occur sentence pattern is used to describe the situation whenever E1 occurs E2 occurs during [a,b];

[0061] The when-hold sentence pattern is used to describe the situation whenever E1 occurs E2 holds during [a, b];

[0062] The when-imply sentence pattern is used to describe the situation that whenever E occurs E1 implies E2 during [a, b];

[0063] The condition sentence pattern is used to describe the situation where condition C1, E1 occurs each T;

[0064] Faulty equipment sentence pattern, used to express system control faults and command control faults;

[0065] Communication failure sentence pattern, used to express communication timeout and other failures;

[0066] Resource allocation sentences are used to express the definition of system resources. They are fixed constant values, and their verification is usually combined with other patterns to verify whether the system can operate normally under the current resource allocation.

[0067] The mode change sentence pattern is used to express the operation of switching modes and changing the functional configuration of the system under certain conditions.

[0068] To clearly explain the relationship between patterns and sentence structures, see Table 1. Table 1 introduces the relationship between patterns and sentence structures. Each pattern contains several specific sentence structures, and each sentence structure expresses specific system requirements. The following will introduce the sentence structure templates contained in each pattern in detail. For the specific relationship between patterns and sentence patterns, see Figure 5 .

[0069] Table 1 CPL mode and sentence table

[0070]

[0071] The statement types in AGREE ANNEX include: Assume, Guarantee, Equation, Property, Constant, Node, Record, and Real-time Patterns. The descriptions are as follows:

[0072]

[0073] The subtypes of Real-time Patterns include: WheneverStatement, WhenStatement, RealTimeStatement, WhenStatement. The description of Real-time Patterns subtype statements is as follows:

[0074]

[0075]

[0076] Step 2: Use this rule to regulate the natural language requirement document in the safety-critical software system and convert the natural language requirement into a requirement document expressed in the language based on the contract model definition;

[0077] Step 3: Expand the model subset supported by the AADL model verification tool AGREE to support AADL model subsets such as asynchronous communication subset and event data port, so that it can complete the combined verification of asynchronous communication model; wherein, the step of expanding the asynchronous communication subset includes:

[0078] Select the sending component Sender and establish the Sender contract; the Sender contract includes:<ASender,GSender> , indicating that the component can produce output that conforms to GSender under the assumption that ASender is satisfied; msg, used to store the data to be sent; send action, indicating that Sender sends the message (msg) to the queue.

[0079] Select the receiving component Receiver and establish the Receiver contract; the Receiver contract includes:<AReceiver,GReceiver> , indicating that the Receiver can always receive the message if the AReceiver conditions are met.

[0080] Establish a communication queue Queue and establish a Queue contract; the Queue contract includes: a tuple<AQueue,GQueue> AQueue indicates that a queue of size n allows two operations: enqueue and dequeue. GQueue indicates that the queue can guarantee correct enqueue and dequeue operations.

[0081] The contract of the entire model is (ASystem, GSystem), that is, a communication queue is established between two or more components that communicate, which is regarded as a new component and related contracts are added to it. If the component can pass the verification, it means that the communication is fault-free.

[0082] Step 4: Based on the CPL2AGREE ANNEX conversion algorithm, the requirement document expressed in the contract pattern definition language is converted into an AGREE ANNEX contract document. The workflow of the CPL2AGREE ANNEX conversion algorithm is as follows: first, select the component to which the contract needs to be added in CPL, then select the appropriate pattern according to the requirements, and then return the corresponding set of selectable statement types and statement structures according to the type of the selected pattern, then select the appropriate statement type and statement structure, and fill in the template of the statement structure to generate the corresponding AGREE statement.

[0083] The CPL2AGREE ANNEX conversion algorithm includes an overall conversion algorithm Algorithm1 and a real-time mode statement conversion algorithm Algorithm2;

[0084] Among them, the overall conversion algorithm Algorithm1:

[0085]

[0086] Among them, the real-time mode statement conversion algorithm Algorithm2 takes the two statement structures 1 and 4 of the real-time mode as examples. Its input is the statement structure of the real-time mode, and the output is AGREE ANNEX. First, it determines which statement structure the real-time statement belongs to. If it is a when-occurs statement structure, then AGREE ANNEX creates a new clock variable to represent the current moment. Then it determines whether there is an assume condition. If it exists, it is added, otherwise the task assume is true. Next, E1, E2 and time range contained in the statement structure are obtained according to the requirements, and the corresponding property statement is generated. If the statement structure is a condition statement, a node is generated, and the corresponding statement is generated according to the cycle of the statement structure input.

[0087]

[0088]

[0089] Based on the above method, the present invention also discloses an automatic generation tool for AADL model combination verification properties based on natural language requirements, including the CPL tool of the OSATE platform. The CPL tool needs to abstract the requirement template according to the four basic modes (functional mode, real-time mode, security mode, and resource mode) required by the AGREE verification tool. The near-natural language requirements can be input in a patterned statement under the specified component. The tool converts the input requirements into the LUSTRE language supported by AGREE to facilitate the subsequent combination verification process. Tool block diagram reference Figure 1 .

[0090] Operating environment:

[0091] Operating system: Windows 10OS;

[0092] Development language and tools: Java / Eclipse;

[0093] Middleware: OSATE / AGREE.

[0094] The CPL tool needs to be able to cover as many types of requirements as possible, reduce manual input statements, and be able to insert the Lustre statements generated by the tool into the accurate location of the AADL model. The input condition is an existing textual AADL model.

[0095] like Figure 1The tool framework shown in the figure implements the tool of the present invention. It is developed by using Eclipse plug-in technology with OSATE as the underlying support software, and mainly includes: a file processing module, a statement generation module, an expression conversion module, and an asynchronous communication processing module, which respectively execute the functions of file IO processing, AGREE ANNEX statement generation, real-time mode statement conversion, and asynchronous communication thread establishment.

[0096] The system workflow is as follows Figure 2 As shown. When the user right-clicks the file in *.aadl format, the "Contract Generation" label can be seen. After entering the tool, first select the model category. If the user selects a synchronous model, the System type component and its communication port in the AADL model are obtained. The user can select the corresponding mode, and then select the type under the mode and the corresponding sentence pattern to enter the specific statement generation page. After the statement is established, click "Generate Code" to generate the AGREE ANNEX statement, and then insert the user-generated related statements under the description of the relevant component; if the user selects an asynchronous model, an asynchronous communication thread is generated according to the sending component, sending port and receiving component, receiving port and the input queue size selected by the user, and then the synchronous communication statement generation function is called to generate the constraint contract of the thread and insert it before the end statement at the end of the file.

[0097] The file processing module needs to complete the following tasks: the user right-clicks the file in *.aadl format to display the "Contract Generation" tab. After entering the tool, first select the model category. If it is a synchronous model, obtain the System type component and its communication port in the AADL model, and finally insert the user-generated related statements under the relevant component description; if it is an asynchronous model, obtain the System type component and its communication port in the AADL model, generate the communication thread and the constraint contract of the thread according to the user's selection, and insert it before the end statement at the end of the file.

[0098] The statement generation model needs to complete the following work: If the user selects the asynchronous model, an asynchronous communication thread is generated according to the sending component, sending port and receiving component, receiving port and the queue size selected by the user, and then the statement generation function of synchronous communication is called. In the synchronous communication mode, the user can select the corresponding mode, then select the type under the mode and select the corresponding sentence pattern, enter the specific statement generation page, and click "Generate Code" after completing the statement establishment to generate the AGREE ANNEX statement.

[0099] The expression conversion module is mainly for statements that meet real-time requirements. The clock-related statements in real-time requirements need to be converted into Lustre expressions, the synchronous language required by AGREE. Time observers and invariants are defined in the form of Lustre nodes to reflect "timing". For example, operations like T:=(0->pre(T)+1) are used to express time T. Pre takes the value of T at the previous moment. Initially, T is 0 and increases with the number of executions. This converts the verification of complex real-time behaviors into judgments on invariants. For details, see Figure 7 The process shown.

[0100] Table 2 is an example of some real-time mode statement conversion. In addition, some examples of conversion can be found in Figure 6 .

[0101] Table 2 Real-time requirement statements are converted into LUSTRE statements

[0102]

[0103] The asynchronous communication processing module needs to complete the following tasks: the user selects asynchronous communication processing, and with the support of the file processing module, the sending and receiving components and ports can be selected. The user determines the maximum length of the communication queue, and then the tool can automatically generate the queue communication thread. The original asynchronous communication constraints can be converted into assumptions and guarantees for the queue communication thread. This step can call the contract generation of the synchronous model.

Claims

1. A method for automatically generating verification properties of AADL model combinations based on natural language requirements, characterized by: The following steps are involved: S100: Expand the component subset supported by AGREE, an AADL model verification tool, to enable it to complete the combination verification of asynchronous communication. The expanded components include asynchronous communication components. S200: Adding AGREE statements to the AADL model as needed, and specifying the corresponding natural language requirement document in the safety-critical software system through the contract pattern definition language CPL as shown in formula (1), so as to realize the conversion of the natural language requirement into the requirement document expressed based on the contract pattern definition language; CPL::=<Component,Pattern,Type,Structure> (1) In the formula, Component is a set of AADL components, which indicates the components of the AADL model to which AGREE statements need to be added; Pattern is a set of requirement patterns; Type indicates the statement type in AGREE ANNEX; Structure indicates the common sentence patterns in each requirement pattern; S300: Convert the requirement document expressed in the contract model definition language into an AGREE ANNEX contract; S400: Insert the AGREE ANNEX contract into the existing AADL model; S500: by inserting the AADL model with the AGREE ANNEX contract, completing the requirements verification, architecture design and architecture verification of the AADL model; Wherein, S300 includes the following steps: Add the AADL model of the contract according to the user's needs, and obtain the System type component and its communication port in the AADL model; Get the user's synchronous or asynchronous communication processing selection. If it is synchronous communication processing, generate AGREE ANNEX statements according to the demand mode, statement type and common sentence patterns selected by the user, and insert the generated AGREE ANNEX statements into the relevant component description; if it is asynchronous communication processing, generate an asynchronous communication thread according to the sending component, sending port, receiving component, receiving port and input queue size selected by the user, and then enter synchronous communication processing, generate AGREE ANNEX statements according to the demand mode, statement type and common sentence patterns selected by the user, and insert the generated AGREE ANNEX statements into the end of the file.

2. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 1, characterized in that: A component can choose multiple demand patterns to implement, and the demand pattern is expressed as: Pattern::=<Pattern_name,Type,Structure> , where Pattern_name is the name of the demand pattern, including: functional mode, real-time mode, security mode, resource mode and pattern transformation mode; each pattern includes multiple common sentence patterns, and the common sentence patterns include: trigger condition sentence pattern, inequality relationship sentence pattern, when-occur sentence pattern, when-hold sentence pattern, when-imply sentence pattern, condition sentence pattern, faulty device sentence pattern, communication fault sentence pattern, resource allocation sentence pattern and pattern transformation sentence pattern.

3. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 2, characterized in that: The functional mode is used to express the specific functional behavior of the system. Common sentence patterns under this mode category include trigger condition sentence patterns and inequality relationship sentence patterns; The real-time mode is used to describe the real-time behavior of the system and specifies that the system completes certain specific operations within a certain period of time. Common sentence patterns under this mode category include when-occur sentence pattern, when-hold sentence pattern, when-imply sentence pattern and condition sentence pattern; The safety mode is used to express possible fault behaviors of the system. Common sentence patterns under this mode category include equipment fault sentence patterns and communication fault sentence patterns. The resource mode is used to express the system's constraints on resource consumption. Common sentence patterns under this mode category include resource allocation sentence patterns; The mode conversion mode is used to change the operation of the functional configuration of the system under certain conditions; the common sentence patterns under this mode category include mode conversion sentence patterns.

4. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 3, characterized in that: The trigger condition sentence pattern is used to judge whether something is true or false before the system is ready to perform certain operations; The inequality relation sentence pattern is used for judging trigger conditions or assigning values ​​to variables; The when-occur sentence pattern is used to describe the situation whenever E1 occurs E2 occurs during [a, b], which means that no matter when E1 occurs, E2 will occur at a certain time in the closed interval [a, b]; The when-hold sentence pattern is used to describe the situation whenever E1 occurs E2 holds during [a, b], which means that no matter when E1 occurs, E2 will always occur in the closed interval [a, b]; The when-imply sentence pattern is used to describe the situation that whenever E occurs E1 implies E2 during [a, b], which means that no matter when E occurs, E1=>E2 will always occur within the closed interval [a, b]; The condition sentence pattern is used to describe the situation of condition C1, E1 occurs every T, which means that under the premise that condition C1 is met, E1 occurs once in each T period; The faulty equipment sentence pattern is used to express system control faults and command control faults; The communication failure sentence pattern is used to express communication failure; The resource allocation sentence pattern is used to express the definition of system resources; The mode change sentence pattern is used to express the operation of switching modes and changing the functional configuration of the system under certain conditions.

5. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 1, characterized in that: The statement types in the AGREE ANNEX include: Assume, Guarantee, Equation, Property, Constant, Node, Record, and Real-time Patterns; wherein the subtypes of Real-time Patterns include: WheneverStatement, WhenStatement, RealTimeStatement, and WhenStatement.

6. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 1, characterized in that: In S100, the asynchronous communication component extension includes the following steps: Establish a communication queue between two or more components that communicate, treat the communication queue as a new component, and add relevant contracts to each component; If the component can pass the verification, it means that the asynchronous communication component expansion is successful, otherwise it fails; For the sending component Sender, add the following form of Sender contract:<ASender,GSender> , indicating that the component can produce output that conforms to GSender under the assumptions of ASender; For the receiving component Receiver, add the following form of Receiver contract:<AReceiver,GReceiver> , indicating that Receiver can always receive messages when AReceiver is satisfied; For the communication queue, establish a Queue contract of the following form<AQueue,GQueue> , where AQueue means that a queue of size n allows both enqueue and dequeue operations, and GQueue means that the queue can guarantee correct dequeue and enqueue operations.

7. The method for automatically generating verification properties of AADL model combinations based on natural language requirements according to claim 1, characterized in that: When the demand mode selected by the user is the real-time mode, the commonly used sentence patterns under this mode category include when-occur sentence pattern, when-hold sentence pattern, when-imply sentence pattern and condition sentence pattern; If it is a when-occurs sentence pattern, a new clock variable is created in the AGREE ANNEX statement to represent the current time, and it is determined whether there is an Assume condition. If so, it is added. Otherwise, the task assumes that the Assume condition is true. If it is one of the when-hold sentence pattern, when-imply sentence pattern, and condition sentence pattern, then obtain E1, E2, and time range contained in the sentence structure, and generate the corresponding property Property statement; If it is a condition sentence pattern, a node is generated, and the corresponding statement is generated according to the cycle of the sentence structure input.

8. A tool for automatically generating a method for combining verification properties of an AADL model based on natural language requirements according to any one of claims 1 to 7, used for converting input requirements into the LUSTRE language supported by AGREE to facilitate the subsequent combination verification process, characterized in that: include: File processing module, used to perform file IO processing; Statement generation module, used to generate AGREE ANNEX statements; Expression conversion module, used to convert real-time mode statements; Asynchronous communication processing module, used to establish asynchronous communication thread; In the file processing module, the AADL model of the contract is added according to the user's needs, and the System type component and its communication port in the AADL model are obtained; and the user's synchronous or asynchronous communication processing selection is obtained. If it is synchronous communication processing, the statement generation module is called, and if it is asynchronous communication processing, the asynchronous communication processing module is called; When the demand mode selected by the user is the real-time mode, the expression conversion module is called; In the statement generation module, if it is synchronous communication processing, an AGREE ANNEX statement is generated according to the demand mode and sentence pattern selected by the user, and the generated AGREE ANNEX statement is inserted under the relevant component description; If it is asynchronous communication processing, then according to the demand mode, statement type and common sentence pattern selected by the user, an AGREE ANNEX statement is generated, and the generated AGREE ANNEX statement is inserted at the end of the file; In the expression conversion module, if it is a when-occurs sentence pattern, a clock variable is newly created in the AGREE ANNEX statement to represent the current time, and it is determined whether there is an Assume condition. If so, it is added, otherwise the task assumes that the Assume condition is true; if it is one of the when-hold sentence pattern, when-imply sentence pattern, and condition sentence pattern, E1, E2 and time range contained in the sentence structure are obtained, and a corresponding property Property statement is generated; if it is a condition sentence pattern, a node is generated, and a corresponding statement is generated according to the period input in the sentence structure; In the asynchronous communication processing module, an asynchronous communication thread is generated according to the sending component, sending port, receiving component, receiving port and input queue size selected by the user, and then the statement generation module is called.

9. The tool according to claim 8, characterized in that: The demand modes include: functional mode, real-time mode, security mode, resource mode and mode transformation mode; each mode includes a plurality of commonly used sentence patterns, and the commonly used sentence patterns include: trigger condition sentence pattern, inequality relationship sentence pattern, when-occur sentence pattern, when-hold sentence pattern, when-imply sentence pattern, condition sentence pattern, faulty equipment sentence pattern, communication fault sentence pattern, resource allocation sentence pattern and mode transformation sentence pattern; The functional mode is used to express the specific functional behavior of the system. Common sentence patterns under this mode category include trigger condition sentence patterns and inequality relationship sentence patterns; The real-time mode is used to describe the real-time behavior of the system and specifies that the system completes certain specific operations within a certain period of time. Common sentence patterns under this mode category include when-occur sentence pattern, when-hold sentence pattern, when-imply sentence pattern and condition sentence pattern; The safety mode is used to express possible fault behaviors of the system. Common sentence patterns under this mode category include equipment fault sentence patterns and communication fault sentence patterns. The resource mode is used to express the system's constraints on resource consumption. Common sentence patterns under this mode category include resource allocation sentence patterns; The mode conversion mode is used to change the function configuration of the system under certain conditions; the common sentence patterns under this mode category include mode conversion sentence patterns; The trigger condition sentence pattern is used to judge whether something is true or false before the system is ready to perform certain operations; The inequality relation sentence pattern is used for judging trigger conditions or assigning values ​​to variables; The when-occur sentence pattern is used to describe the situation whenever E1 occurs E2 occurs during [a, b], which means that no matter when E1 occurs, E2 will occur at a certain time in the closed interval [a, b]; The when-hold sentence pattern is used to describe the situation whenever E1 occurs E2 holds during [a, b], which means that no matter when E1 occurs, E2 will always occur in the closed interval [a, b]; The when-imply sentence pattern is used to describe the situation that whenever E occurs E1 implies E2 during [a, b], which means that no matter when E occurs, E1=>E2 will always occur within the closed interval [a, b]; The condition sentence pattern is used to describe the situation of condition C1, E1 occurs every T, which means that under the premise that condition C1 is met, E1 occurs once in each T period; The faulty equipment sentence pattern is used to express system control faults and command control faults; The communication failure sentence pattern is used to express communication failure; The resource allocation sentence pattern is used to express the definition of system resources; The mode change sentence pattern is used to express the operation of switching modes and changing the functional configuration of the system under certain conditions.

Images