Formal automatic translation method, device and computing equipment of state machine model

Abstract

A formal automatic translation method of a state machine model comprises: adding a state model analysis structure corresponding to state transition data of a state machine model layer on the basis of a synchronous data flow layer to form an intermediate translation layer. The state transition data comprises current input values, a current state, a next state, current output values, state transition relationships and clock data. The state transition data and state machine structure data of the state machine model layer semantics are translated into state machine model data of the synchronous data flow layer semantics. The state machine model data of the synchronous data flow layer semantics is translated into state machine model data of C language semantics. The state machine translation method adopted by the present application keeps the semantics of each layer, simplifies the translation process from the state machine to the synchronous data flow language, makes the state machine be translated into a conditional block first, and then be translated into the synchronous data flow language, and further reduces the verification time of the state machine and improves the verification efficiency and accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of state machine, in particular to a formal automatic translation system of state machine. BACKGROUND

[0002] The state machine model is widely used as a control model of industrial control software in the safety-critical field, and is widely used in the aerospace and nuclear power industries. How to credibly generate C code from the state machine model is a core problem of the code generator in the safety-critical field.

[0003] The traditional software development method mainly guarantees safety through process control and testing, and it is difficult to guarantee completeness and credibility through this method. The formal verification method is a popular credible software development method in the world. The verification process is checked by the program through defining the semantic model. Once the verification work is completed, the main thing to be reviewed is the semantics of the source language and the semantics of the target language.

[0004] In the field of formal verification of industrial software, Velus has translated a simplified synchronous data flow language Lustre into C code through formal verification, but the operators contained in the source language Lustre are less, and the state machine model is not included, and the current method cannot meet the needs of practical application.

[0005] Therefore, a state machine translation method and device with semantic preservation are needed to solve the above problems, and the system can be compatible with the existing verification environment to ensure the complete verification of the state machine core code generator, thereby overcoming the above-mentioned defects of the prior art. SUMMARY

[0006] The purpose of the present application is to provide a formal automatic translation method of state machine model, which adopts a state machine translation method with semantic preservation at each layer, simplifies the translation process from state machine to synchronous data flow language, so that the state machine can be translated into conditional block first, and then translated into synchronous data flow language, thereby reducing the verification time of the state machine and improving the verification efficiency and accuracy.

[0007] To achieve the above purpose, the present application provides a formal automatic translation method of state machine model, comprising: adding a state model analysis structure corresponding to state transition data of a state machine model layer on the basis of a synchronous data flow layer to form an intermediate translation layer. The state transition data includes current input value, current state, next state, current output value, state transition relationship and clock data. The state transition data and state machine structure data of the state machine model layer semantics are translated into state machine model data of the synchronous data flow layer semantics. The state machine model data of the synchronous data flow layer semantics is translated into state machine model data of C language semantics.

[0008] As a preferred mode, the state model analysis structure comprises a conditional block analysis structure. The conditional block analysis structure parses the trigger condition statement of the state transition of the state machine model layer, so as to translate the state transition data of the state machine model layer semantics into the state transition data of the synchronous data flow layer semantics.

[0009] As a preferred mode, parsing the trigger condition statement of the state transition of the state machine model layer comprises: judging the condition type of the trigger condition statement when parsing the trigger condition statement, and calling the corresponding state transition analysis reference table according to the condition type. The conditional block model semantics is updated according to the state transition relationship of the state transition analysis reference table, so as to translate the state transition data of the state machine model layer semantics into the state transition data of the synchronous data flow layer semantics.

[0010] As a preferred mode, parsing the trigger condition statement of the state transition of the state machine model layer further comprises: parsing the state machine model layer to generate the state machine model semantics. The equation list of the corresponding state machine type and the equation list of the corresponding condition type are parsed according to the state machine model semantics and the conditional block model semantics. The mapping relationship between the trigger condition and the state is generated according to the equation list of the state machine type and the equation list of the corresponding condition type, so as to translate the state transition data and the state machine structure data of the state machine model layer semantics into the state machine model data of the synchronous data flow layer semantics.

[0011] As a preferred mode, judging the condition type of the trigger condition statement and calling the corresponding state transition analysis reference table according to the condition type comprises: judging whether the trigger condition statement is an enumeration type condition or a Boolean type condition, and calling the corresponding state transition analysis reference table according to the condition type.

[0012] As a preferred mode, parsing the equation list of the corresponding state machine type and the equation list of the corresponding condition type according to the state machine model semantics and the conditional block model semantics specifically comprises: if the trigger condition statement is an enumeration type condition, a corresponding condition branch matching list is called. It is judged whether the condition branch defined by the condition branch matching list is a null condition branch or a non-null condition branch according to the condition branch matching list, and the equation list of the non-null condition branch is obtained according to the condition branch matching list. If the trigger condition statement is a Boolean type condition, a true branch equation list and a false branch equation list are called, and the equation list of the condition type is obtained.

[0013] As a preferred mode, the formal automatic translation method of the state machine model further comprises: generating an empty equation list, an equation list of the original synchronous data flow statement and an equation list of the trigger condition statement respectively according to the corresponding equation list definitions in the equation list. The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer by the equation list of the original synchronous data flow statement. The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer by the equation list of the trigger condition statement.

[0014] As a preferred mode, the formal automatic translation method of the state machine model further comprises: generating an empty equation list, an equation list of the original synchronous data flow statement and an equation list of the trigger condition statement respectively according to the corresponding equation list definitions in the equation list. The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer by the equation list of the original synchronous data flow statement. The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer by the equation list of the trigger condition statement.

[0015] As a preferred mode, the formal automatic translation method of the state machine model further comprises: generating an empty equation list, an equation list of the original synchronous data flow statement and an equation list of the trigger condition statement respectively according to the corresponding equation list definitions in the equation list. The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer by the equation list of the original synchronous data flow statement. The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer by the equation list of the trigger condition statement.

[0016] As a preferred mode, the formal automatic translation method of the state machine model further comprises: generating an empty equation list, an equation list of the original synchronous data flow statement and an equation list of the trigger condition statement respectively according to the corresponding equation list definitions in the equation list. The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer by the equation list of the original synchronous data flow statement. The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer by the equation list of the trigger condition statement.

[0017] Compared with the prior art, the improvement of the present application lies in defining the formal semantic model layer of the state machine and the condition block. The present application links the syntax semantics and translation proof of the state machine and the condition block on the basis of the code generation tool L2C, forms a complete trusted compiler with a semantic preservation proof from the synchronous data flow language with the state machine and the condition block to C. The present application adopts the state machine translation method of each layer semantic preservation, simplifies the translation process from the state machine to the synchronous data flow language, makes the state machine be translated into the condition block first, and then be translated from the condition block to the synchronous data flow language, thereby reducing the verification time of the state machine and improving the verification efficiency and accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 Fig. 1 is a schematic diagram of a state machine translation semantic proof layering principle verification flow for the present application.

[0019] Figure 2 Fig. 2 is a schematic diagram of a state machine translation flow for the present application.

[0020] Figure 3 Fig. 3 is a schematic diagram of a state machine model layer syntax structure flow for the present application.

[0021] Figure 4 Fig. 4 is a schematic diagram of a synchronous data flow layer statement syntax definition restructuring flow for the present application.

[0022] Figure 5 Fig. 5 is a hierarchical framework diagram of a state machine model layer semantic definition for the present application.

[0023] Figure 6 Fig. 6 is a schematic diagram of a conditional block model formalized syntax definition structure flow for the present application.

[0024] Figure 7 Fig. 7 is a hierarchical framework structure schematic diagram of a conditional block semantic definition for the present application.

[0025] Figure 8 Fig. 8 is a schematic diagram of a formalized logical system classification for the present application. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of a formalized automatic translation method, apparatus, computing device, and storage medium of a state machine model of the present application will be described with reference to the accompanying drawings.

[0027] The embodiments described herein are specific embodiments of the present application, used to illustrate the concept of the present application, and are explanatory and exemplary in nature, and should not be construed as limiting the embodiments of the present application and the scope of the present application. In addition to the embodiments described herein, those skilled in the art can employ other technical solutions that are obvious based on the content disclosed in the claims and the specification of the present application, which include technical solutions that make any obvious substitutions and modifications to the embodiments described herein.

[0028] In the field of computers, the introduction of state machines is to complete some specific sequential logic through different state transitions. The four elements of a state machine are: current input, current state, next state, and current output value. The transformation of the state machine state is obviously driven by two external inputs (clock, current input), and according to the different external inputs, the following two classifications can be made:

[0029] Moore type state machine: the output only depends on the current state, in another word, it is a "synchronous" output state machine.

[0030] Mealy type state machine: the output not only depends on the current state, but also is directly controlled by the input, and can be independent of the state, in another word, it is an "asynchronous" output state machine. Compared with the Moore type state machine, the Mealy type state machine needs less states, and due to its asynchronous characteristic, the output does not need to wait for a clock cycle, but also because of the asynchronous characteristic, the output can produce glitches, so the output of the Mealy type is usually connected with a register to achieve the effect of synchronization.

[0031] As shown in Figure 1 In the prior art, the state machine of syntax analysis generally includes a front end and a back end. The lexical analysis, syntax analysis and semantic analysis part is also called the front end of the compiler, and the intermediate code generation after this until the target generation, optimization and the like belong to the back end of the compiler. Usually, a high-level algorithm description language such as a synchronous data flow language is translated into a conventional serial imperative language (usually C language).

[0032] Figure 8 A classification of formalized logic systems of state machines is shown, wherein the meta-logic can be divided into first-order logic, higher-order logic and hybrid logic. The state machine is a complete logic system realized by state changes. The state nodes of the state machine determine the logic function of the state machine.

[0033] Many requirements are described in the form of state machines, and the test of the state machine mainly focuses on whether the state transition is correct. For a finite state machine, it is verified by testing whether it can produce the required state change under the given conditions, whether there is an unreachable state and illegal state, and whether it is possible to produce illegal state transition. The state transition between states is tested by constructing events that can cause state transition, which is mainly used for protocol testing. Using this method, reverse test cases can be designed, such as illegal combinations of states and events.

[0034] Embodiment one

[0035] In the field of industrial control, the commonly used industrial software is SCADE Suite of ANSYS company, which verifies the state machine condition block model by testing and model checking method. The present application verifies the state machine condition block model by using the semantic preservation method, and guarantees the whole process verification of the core code generator.

[0036] The traditional development mode can directly generate C code for the state machine, but this mode cannot define semantics and perform verification in a formalized manner. Although the formalized method of developing trusted software through semantic preservation can greatly improve the security of software, due to the difficulty of semantic definition and proof process in the formal verification process, the semantic definability and the feasibility of formal proof must be considered in the code generation process. That is, hierarchical verification is required, and a suitable intermediate layer syntax semantics needs to be defined to decompose the complex proof for verification.

[0037] Figure 1 A state machine translation semantic preservation proof hierarchical principle structure verification flowchart of the application is shown in the drawings, which shows the translation verification flow between different layers of the state machine of the application. The original L2C has realized trusted translation from synchronous data flow language to C. As shown in the drawings, for this purpose, the application defines a state machine semantic model and an intermediate layer conditional block model, and translates the composite model of the state machine and the synchronous data flow language into an intermediate layer conditional block and a composite model of the synchronous data flow language, and then translates it into the synchronous data flow language and then into C code. Figure 1

[0038] In the prior art, the model checking method checks the properties of the state machine model system itself, and an abstract model is constructed for the finite state program, and the system characteristics are verified by traversing the model. The code generation process is not verified, and it cannot completely guarantee that no error will be introduced in the code generation process. This is because the state machine conditional block and the synchronous data flow language are two different description languages, and it is difficult to apply the traditional synchronous data flow language to express the state machine. If there is no such semantic definition means and structure of the application, the synchronous data flow and the state machine conditional block need to use two code generators to verify the correctness of their generation process respectively, and do not support the nested use of the two models. This obviously has a narrow application range and low accuracy. The application adopts SCADE and an improved verification state machine conditional block model to verify the model checking method, and superimposes the synchronous data flow and the state machine, which is more in line with the modeling needs of industrial applications. Therefore, with this semantic definition method, the synchronous data flow and the state machine model can be generated into C code through semantic preservation proof, and the nested use of the two models can also be supported, which is more in line with the application needs.

[0039] In order to make up for this deficiency, the application adopts a more rigorous theorem proving technique to verify the code generation process, without enumerating all the states of the model. Instead, the equivalence of the code before and after translation is verified in the respective semantics through the semantic preservation property. The semantic definition of the state machine model and the semantic definition of the conditional block model are the key steps to complete the trusted verification of the state machine model, and are also the key technical problems to be solved by the application. ​

[0040] In the formal verification process of semantic preservation, semantic definition is extremely crucial. The semantic definition is the key to the completion of the verification process and the basis of the verification credibility. By defining the syntax and semantics of each layer in the translation process and completing the translation and proof between each layer, the translation process and the proof process can be checked by a theorem prover, thereby converting the credibility of the translation process into the credibility of the semantic definition.

[0041] The improvement of the present application lies in defining the formal semantic model layer of the state machine and the conditional block. Based on the code generation tool L2C, the present application links the syntax semantics and translation proof of the state machine and the conditional block, forming a complete and semantically preserved proof of the reliable compiler from the synchronous data flow language with state machine and conditional block to C. The present application adopts the state machine translation method of semantic preservation of each layer, simplifies the translation process from the state machine to the synchronous data flow language, makes the state machine be translated into the conditional block first, and then translated from the conditional block to the synchronous data flow language, thereby reducing the verification time of the state machine and improving the verification efficiency and accuracy.

[0042] As shown in Figure 1 The state machine model semantics defines the syntax and semantic behavior of the state machine language, and describes the semantic behavior of the state machine through mathematical logic in a formalized manner. In the semantic model of the state machine, the state transition process in the state machine and the execution process of the statements in the state are defined.

[0043] The conditional block model syntax layer defines the conditional control statement layer. The conditional block model semantics defines the syntax and semantic behavior of the conditional control statement. In the semantic model of the conditional block, the selection process of the condition and the execution process of the statements in the conditional block are defined.

[0044] The translation step from the state machine to the conditional block is to translate the state machine language into the conditional control statement. The proof step from the state machine to the conditional block is to prove the accuracy of translating the state machine language into the conditional control statement by a prover (such as the Coq theorem prover).

[0045] The synchronous data flow model layer defines the synchronous data flow language layer. The synchronous data flow semantics defines the syntax and semantic behavior of the synchronous data flow language.

[0046] The translation step from the conditional block to the synchronous data flow is to translate the conditional control statement into the synchronous data language. The proof step from the conditional block to the synchronous data flow is to prove the accuracy of translating the conditional control statement into the synchronous data language by a prover (such as the Coq theorem prover). The translation from the synchronous data flow to C is to translate the synchronous data language into the C language. The proof from the synchronous data flow to C is to prove the accuracy of translating the synchronous data language into the C language by a prover (such as the Coq theorem prover).

[0047] The C language syntax layer defines the C language layer. The C language semantics defines the syntax analysis of the C language.

[0048] A verification tool such as the Coq theorem prover: Coq is a theorem proving assistant tool and a general system for implementing logical formalization. The Coq system provides a logic with strong expression capability, which is commonly referred to as higher-order logic. Under the logic framework, axioms can be provided for new logics, and proofs can be developed based on these logics. The platform can now run in three operating system environments: Linux, Windows and IOS.

[0049] The application provides a formal automatic translation method of a state machine model, comprising: adding a state model analysis structure corresponding to state transition data of a state machine model layer on the basis of a synchronous data flow layer to form an intermediate translation layer. The state transition data comprises a current input value, a current state, a next state, a current output value, a state transition relationship and clock data. The state transition data and state machine structure data of the state machine model layer semantics are translated into state machine model data of the synchronous data flow layer semantics. The state machine model data of the synchronous data flow layer semantics is translated into state machine model data of C language semantics.

[0050] Specifically, the formal semantic definition of the conditional block model layer of the application is simplified compared with the state machine model layer, which is equivalent to a subset of the semantic definition of the state machine model layer and is simplified and adjusted in details. Figure 7 A conditional block semantic definition hierarchical framework structure diagram is provided, which shows the hierarchical framework of the formal semantic definition of the conditional block model.

[0051] As Figure 3 A state machine model layer syntax structure flow diagram of the application is provided, which shows the syntax definition of the state machine model layer. Figure 5 A state machine model layer semantic definition hierarchical framework diagram of the application is provided. As Figure 3 And Figure 5As shown, the state machine model layer defines the control block statement (the introduction of the state machine is to complete some specific sequential logic by different state transitions. The four elements of the state machine are: current input, current state, next state, and current output value. That is, the model layer defines the current input, current state, next state, and current output value of the state machine, that is, the state machine model layer defines all the states and state transition relationships of the state machine, and the control block parses the current state, next state, current input, and next input of the state machine), and the state machine model layer realizes the function of the control block by executing the control block statement. The control block statement is divided into state machines and conditional blocks. The state machine supports two switching modes of restart and reset, and supports strong and weak transitions. The conditional block is used to parse the conditional judgment statement, which is divided into enumerated type block and Boolean type conditional block. The state of the state machine and the condition branch of the conditional block can be nested state machines or two conditional blocks, and can also contain ordinary synchronous data flow statements.

[0052] Figure 4 The term explanation of the reconstruction structure flow diagram of the synchronous data flow layer statement syntax is as follows:

[0053] In the reconstruction of the synchronous data statement, the first cycle flag variable represents the first cycle flag. Because the first cycle expression is different from other cycle expressions, a flag is set to distinguish the processing, and a first cycle flag is added in the statement to record the cycle. The first cycle expression means the expression of the action executed by the state machine in the first cycle. The subsequent cycle expression means the expression of the action executed by the state machine in the cycle other than the first cycle.

[0054] The left value (lvalue) is a kind of expression in computer languages such as synchronous data flow language / C language / C++ language. The original meaning of “left” is that it can be placed on the left side of the assignment symbol “=”. The self-defined variable is an implicit variable contained in the semantic behavior of the temporal operation in the synchronous data flow language. These implicit variables are used to pass the values required by the temporal operation between different cycles. The expression is the basic calculation evaluation unit in the synchronous data flow language. The temporal operation post assignment equation means the assignment statement for saving the value of the current cycle of the temporal operation to the self-defined variable. Because the saved value is used for the next cycle calculation, it needs to be run after the value of the current cycle is calculated, so it is called the temporal operation post assignment equation. Conditional assignment statement: the conditional assignment statement decides whether to execute the assignment equation according to the value of the self-defined condition variable. When the self-defined condition variable is true, the assignment equation is executed, and when the self-defined condition variable is false, no operation is performed. The assignment equation is the equation for assigning a specific variable. The node call reset statement is the statement for initializing the node call.

[0055] Nested support indicates that two different types of object nesting can be identified: for example, parent / child nesting and owning / owned nesting. Parent / child nesting occurs when one object is contained in another object (for example: a button contained on a form). Owning / owned nesting occurs when the owned object has its own top-level window, such as a top-level window owning a dialog box.

[0056] Serial statement nesting support allows both statements of a serial statement to be other statements in the synchronous dataflow language, as well as allowing both statements of a serial statement to be themselves a serial statement.

[0057] Conditional statement nesting support allows both branch statements of a conditional statement to be other statements in the synchronous dataflow language, as well as allowing both branch statements of a conditional statement to be themselves a conditional statement.

[0058] Case nesting support allows statements in the case branch list of a case statement to be other statements in the synchronous dataflow language, as well as allowing statements in the case branch list of a case statement to be themselves a case statement.

[0059] Figure 3 The terms of the state machine model layer syntax definition hierarchy framework diagram of the present application are explained as follows:

[0060] Control block definition: both state machines and conditional blocks are called models of control layer logic, so the syntax definitions of the two are combined and collectively referred to as control block definitions. Among them, the state machine type control block refers to the control block defined as a state machine, and the conditional block type control block refers to the control block defined as a conditional block. The reason for combining state machines and conditional blocks into control blocks is that the internal statements of state machines and conditional blocks can be nested to define state machines and conditional blocks.

[0061] The state machine self-defined variable structure is an important structure in the state machine layer syntax definition, and the structure contains the definition of important intermediate variables required for the semantic definition of the state machine. The following table shows the definition of the members of the state machine self-defined variable structure and their functions.

[0062]

[0063]

[0064]

[0065] Migration definition is also an important definition in the state machine definition, and the migration switching type is divided into restart switching and reset switching. Among them, the restart switching needs to reset the target state to the first period state; the reset switching continues to execute the target state. The syntax definition of the migration is shown in the following table.

[0066]

[0067] In this way, by adding a condition block model layer that has the related functional structure of the state machine model layer not possessed by the original intermediate layer as the intermediate layer, the difficulty of state machine model layer to synchronous data flow translation and proof can be smoothed.

[0068] Figure 2 The state machine translation process of the present application is shown in the schematic diagram. The present application further optimizes the translation process. First, the state migration process of the state model is decomposed and translated into a condition block model; then, according to the type of the condition block model, the enumerated type condition block is translated into a case statement in the synchronous data flow language, and the Boolean type condition block is translated into an if statement in the synchronous data flow language.

[0069] The terms of the present application are explained as follows:

[0070] State refers to the state of the state machine. The state list contains a list of all states of the state machine, including an empty state list and a non-empty state list. The empty state list refers to the empty state, i.e. the state machine does not contain any state. The non-empty state list refers to a list containing at least one state.

[0071] The state-related flags or storage structures of the present application include: initial state flag, state name, first period flag in state, node call list in state, strong migration, weak migration, and equality list.

[0072] The initial state flag is the flag of the starting state of the state machine. The state name is the name of the state of the state machine. The first period flag in the state is used to mark whether it is the first period (different from other periods). The node call list in the state is a list recording all the call relationships between corresponding states. The strong migration is a type of state machine migration, which indicates that when the migration condition is true, the statements in the target state of the migration are executed immediately. The strong migration list is used to store multiple strong migrations. The weak migration refers to when the migration condition is true, the statements in the target state of the migration are executed in the next period. The weak migration list is used to store multiple weak migrations.

[0073] The condition block of the present application is a condition control model modeled according to the condition type, and the condition block-related terms include:

[0074] An equation list is a combination of statements defined within a node, within a state machine state, and within a conditional block conditional branch. In an equation list, an empty equation list is an empty list. In an equation list, a non-empty equation list with a head of a synchronous data flow statement and a non-empty equation list with a head of a control block are both non-empty lists. An equation list semantics is a semantics of defining an equation list function, including: a non-empty equation list semantics, an execution semantics of an equation list with a length of zero, and an empty equation list semantics, an execution semantics of an equation list with a length of zero. A node is equivalent to a function, and a node semantics defines a semantics of a function in a program. A normal equation semantics is a semantics of defining a normal equation function.

[0075] An enumerated type conditional block is a conditional block with an enumerated type condition. A condition variable defines a range of changes of the condition. A conditional branch match list defines all conditional branches. A Boolean type conditional block is a conditional block with a Boolean type condition. A true branch equation list refers to an equation list executed when a Boolean type conditional expression is evaluated as true. A false branch equation list refers to an equation list executed when a Boolean type conditional expression is evaluated as false. A conditional branch match list refers to a resolution reference table of all conditional branches in an enumerated type conditional block. An empty conditional branch match list defines a resolution reference table of all empty conditional branches. A non-empty conditional branch match list defines a resolution reference table of all non-empty conditional branches. A condition match value is used to compare which conditional branch is entered.

[0076] The present application restructures the syntax semantics of the original L2c synchronous data flow:

[0077] The execution mode of the temporal operation post equation is restructured. The execution semantics of the first period flag variable of the temporal operation is restructured. The definitions of serial statements, conditional statement nesting, and case statement nesting are added in the synchronous data flow syntax. A self-defined variable conditional assignment statement is added in the synchronous data flow syntax. A node call reset statement is added in the synchronous data flow syntax. Thus, the semantics of the state machine, the conditional block, and the synchronous data flow can be integrated, thereby finally accommodating the translation verification of the state machine, and finally greatly simplifying the formal verification process of the code generator. The reason is that the state machine conditional block and the synchronous data flow language are two different description languages, and it is difficult to apply the traditional synchronous data flow language to express the state machine. If there is no such semantic definition method, the synchronous data flow and the state machine conditional block need to use two code generators to verify the correctness of the generation process, but the premise is that the two models are not nested, which is obviously not desirable. The reason why SCADE can be better applied in the industrial control field is that the synchronous data flow and the state machine are superimposed and used, which can better meet the modeling needs of industrial applications. Therefore, with this semantic definition method, the synchronous data flow and the state machine model can generate C code through semantic preservation proof, and the nested use of the two models can also be supported, which is more in line with application requirements.

[0078] In summary, the formal automatic translation method of state machine model provided by the application adopts the state machine translation method with each layer semantic preservation, which can effectively simplify the verification process of the state machine, and further reduce the verification time of the state machine and improve the verification efficiency and accuracy.

[0079] The abstract model in the prior art is easy to be inconsistent with the actual translation process of the code, thereby causing the verification failure. Moreover, the abstract model cannot verify all possible semantic states, and can only verify whether the related properties concerned in the model meet the requirements, thereby being easy to cause errors in the code generation stage. The formal verification object of the application is the actual process of code generation, rather than verifying the abstract model. The semantic preservation verification method can verify all cases of semantic execution. The intermediate layer conditional block model is used as the transition layer syntax, which makes the code generation process more secure and reliable in the case of simplifying the verification process. The application adopts the interactive theorem proving method to convert the syntax semantics of the conditional block into the syntax semantics of the synchronous data flow, and combines with L2C (a code generation tool from synchronous data flow to C) to translate into C code.

[0080] The application has the following advantages:

[0081] 1. The original synchronous data flow semantics is modified, and the state machine model semantic definition of the fusion of the state machine, the conditional block and the synchronous data flow is defined.

[0082] 2. The difference between the state machine and the synchronous data flow language is balanced, the intermediate layer conditional block model syntax semantics is defined, and the intermediate layer conditional block can undertake the translation of the state machine.

[0083] 3. The translation of the state machine model to the intermediate layer conditional block model is proved to be semantic preservation.

[0084] 4. The translation of the intermediate layer conditional block model to the synchronous data flow language is proved to be semantic preservation.

[0085] 5. The code generation process of the synchronous data flow and the mixed model with the state machine and the conditional block is verified.

[0086] Embodiment two

[0087] Figure 6 The structural flow diagram of the formal syntax definition of the conditional block model is defined. See Figure 6Compared with the first embodiment, the difference of the second embodiment is that the parsing of the trigger condition statement of the state transition of the state machine model layer further comprises: parsing the state machine model layer to generate state machine model semantics. According to the state machine model semantics and the conditional block model semantics, an equation list of a corresponding state machine type and an equation list of a corresponding condition type are parsed. According to the equation list of the state machine type and the equation list of the corresponding condition type, a mapping relationship of the trigger condition and the state is generated, so as to translate the state transition data and the state machine structure data of the state machine model layer semantics into the state machine model data of the synchronous data flow layer semantics.

[0088] The embodiment is further preferably that the condition type of the trigger condition statement is judged, and according to the condition type, a corresponding state transition parsing reference table is called, which comprises: judging whether the trigger condition statement is an enumeration type condition or a Boolean type condition, and according to the condition type, a corresponding state transition parsing reference table is called.

[0089] The embodiment is further preferably that the equation list of the corresponding state machine type and the equation list of the corresponding condition type are parsed according to the state machine model semantics and the conditional block model semantics, which specifically comprises: if the trigger condition statement is an enumeration type condition, a corresponding condition branch matching list is called. According to the condition branch definition of the condition branch matching list, it is judged whether it is a null condition branch or a non-null condition branch, and an equation list of the non-null condition branch is obtained according to the condition branch matching list. If the trigger condition statement is a Boolean type condition, a true branch equation list and a false branch equation list are called, and an equation list of the condition type is obtained.

[0090] The embodiment is further preferably that the formalization automatic translation method of the state machine model further comprises: according to the corresponding equation list definition in the equation list, an empty equation list, an equation list of the original synchronous data flow statement and an equation list of the trigger condition statement are respectively generated. The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer through the equation list of the original synchronous data flow statement. The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer through the equation list of the trigger condition statement.

[0091] Specifically, the semantic definition of the state machine model layer contains the semantic definition of the state machine, the semantic definition of the conditional block and the semantic definition of the synchronous data flow. How to integrate the semantic definitions of the three is the difficulty of the formal semantic definition of the state machine model. In order to be compatible with the synchronous data flow semantics and the control flow semantics of the state machine, the following modifications of the semantics of the synchronous data flow are made in the application.

[0092] (1) Modification of the semantic execution of the temporal operation post equation

[0093] The temporal operation post equation of the original synchronization data flow semantics in L2c is executed after the normal equation in the node is executed, and the self-defined temporal variable that needs to be saved is assigned. The new synchronization data flow semantics integrates the temporal operation post equation into the normal equation, and executes the temporal operation post equation in the state after the equation in the state, and executes the temporal operation post equation in the condition block after the equation in the condition branch.

[0094] (2) Modification of the execution semantics of the first cycle flag variable of temporal operation:

[0095] The first cycle flag variable of temporal operation in the original synchronization data flow semantics in L2c is generated according to the clock of temporal operation. The new synchronization data flow semantics embeds the first cycle flag variable of temporal operation in the syntax definition of the synchronization data flow.

[0096] (3) Adding the definitions of serial statements, conditional statement nesting and case statement nesting in the synchronization data flow syntax:

[0097] The original synchronization data flow semantics in L2c does not support serial statements, conditional statement nesting and case statement nesting, making it difficult to integrate the semantics of state machines and condition blocks with the semantics of synchronization data flow. The new synchronization data flow semantics adds the definition of serial statements, enabling the support of statement lists in the state and the condition branch through serial statements. It also adds the support of conditional statement nesting, enabling the nested definition of the condition block semantics of the Boolean type. It also adds the nested definition of the case statement, enabling the nested definition of the state machine and the condition block semantics of the enumeration type.

[0098] (4) Adding the conditional assignment statement of self-defined variables in the synchronization data flow syntax:

[0099] The conditional assignment statement of self-defined variables does not exist in the original synchronization data flow semantics in L2c. However, it is needed in the process of translating state machines into condition blocks.

[0100] (5) Adding the node call reset statement in the synchronization data flow syntax:

[0101] The node call reset statement does not exist in the original synchronization data flow semantics in L2c. However, it is needed in the process of state restart switching of state machines, so it is necessary to add the node call reset statement in the synchronization data flow semantics.

[0102] Figure 4The reformed structure flow diagram of the synchronous data stream layer statement syntax definition shows the reformed flow of the synchronous data stream layer statement syntax definition, wherein the syntax definition of the dotted part is the modification and new definition based on the original synchronous data stream syntax definition.

[0103] Compared with the prior art, the state machine translation method with semantic preservation of each layer is adopted, the verification process of the state machine is effectively simplified, and the verification time of the state machine is reduced, and the verification efficiency and accuracy are improved.

[0104] Compared with the prior art, the state machine translation method with semantic preservation of each layer is adopted, the verification process of the state machine is effectively simplified, and the verification time of the state machine is reduced, and the verification efficiency and accuracy are improved.

[0105] 1. The original synchronous data stream semantics is reformed, and the state machine, the condition block and the state machine model semantics definition of the fusion of the synchronous data stream are defined.

[0106] 2. The difference between the state machine and the synchronous data stream language is balanced, the intermediate layer condition block model syntax semantics is defined, and the intermediate layer condition block can undertake the translation of the state machine.

[0107] 3. The translation of the state machine model to the intermediate layer condition block model is proved to be semantically preserved.

[0108] 4. The translation of the intermediate layer condition block model to the synchronous data stream language is proved to be semantically preserved.

[0109] 5. The code generation process of the synchronous data stream and the mixed model with the state machine and the condition block is verified.

[0110] Embodiment three

[0111] The application provides a formal automatic translation device of a state machine model, which comprises: an intermediate translation layer generation module, which is used for adding a state model analysis structure corresponding to state transition data of a state machine model layer on the basis of a synchronous data stream layer to form an intermediate translation layer, wherein the state transition data comprises a current input value, a current state, a next state, a current output value, a state transition relationship and clock data; a state machine model layer translation module, which is used for translating state transition data and state machine structure data of a state machine model layer semantics into state machine model data of a synchronous data stream layer semantics; and an intermediate translation layer translation module, which is used for translating the state machine model data of the synchronous data stream layer semantics into state machine model data of a C language semantics.

[0112] The state model analysis structure comprises a condition block analysis structure.

[0113] The embodiment further preferably comprises: judging the condition type of the trigger condition statement when parsing the trigger condition statement, and calling a corresponding state transition parsing reference table according to the condition type; and updating the condition block model semantics according to the state transition relationship of the state transition parsing reference table, so as to translate the state transition data of the state machine model layer semantics into the state transition data of the synchronous data flow layer semantics.

[0114] The embodiment further preferably comprises: parsing the state machine model layer to generate state machine model semantics; and parsing an equation list of a corresponding state machine type and an equation list of a corresponding condition type according to the state machine model semantics and the condition block model semantics; and generating a mapping relationship between a trigger condition and a state according to the equation list of the state machine type and the equation list of the corresponding condition type, so as to translate the state transition data and the state machine structure data of the state machine model layer semantics into the state machine model data of the synchronous data flow layer semantics.

[0115] The embodiment further preferably comprises: judging whether the trigger condition statement is an enumeration type condition or a Boolean type condition, and calling a corresponding state transition parsing reference table according to the condition type.

[0116] Specifically, Figure 6 A structural flow diagram is defined for the formal syntax of the condition block model, which shows the syntax definition of the condition block model layer. As shown in Figure 6 The condition block is divided into an enumeration type condition block and a Boolean type condition block, and both the two types of condition blocks can be nested in the corresponding condition branch, or the condition branch can contain an ordinary statement list.

[0117] The embodiment further preferably comprises: if the trigger condition statement is an enumeration type condition, calling a corresponding condition branch matching list; judging whether the condition branch defined by the condition branch matching list is a null condition branch or a non-null condition branch according to the condition branch definition of the condition branch matching list, and obtaining an equation list of the non-null condition branch according to the condition branch matching list; and if the trigger condition statement is a Boolean type condition, calling a true branch equation list and a false branch equation list of a corresponding condition type, and obtaining the equation list of the condition type.

[0118] Figure 2 A state machine translation flow diagram is defined for the state machine translation of the present application, which shows the state machine translation technical route. As shown in Figure 2The state machine model is translated into the case statement, and the multi-layer nested state machine semantics definition can be better supported.

[0119] The state machine model is translated into the case statement, and the multi-layer nested state machine semantics definition can be better supported.

[0120] The state machine model is translated into the case statement, and the multi-layer nested state machine semantics definition can be better supported.

[0121] The state machine model is translated into the case statement, and the multi-layer nested state machine semantics definition can be better supported.

[0122] 1. The original synchronous data stream semantics is modified, and the state machine, condition block and synchronous data stream integrated state machine model semantics definition is defined.

[0123] 2. The difference between the state machine and the synchronous data stream language is balanced, and the intermediate layer condition block model syntax semantics is defined, so that the intermediate layer condition block can undertake the translation of the state machine.

[0124] 3. The translation of the state machine model to the intermediate layer condition block model is proved to have semantic preservation.

[0125] 4. The translation of the intermediate layer condition block model to the synchronous data stream language is proved to have semantic preservation.

[0126] 5. The code generation process of the synchronous data stream and the mixed model with state machine and condition block is verified.

[0127] Embodiment Four

[0128] The present application provides a kind of formal automatic translation computing device of state machine model.This computing device includes: one or more processors;Memory;And one or more programs, wherein one or more programs are stored in memory and are configured to be executed by one or more processors, one or more programs include the instructions for executing the formal automatic translation method of state machine model according to the present application.

[0129] Further, the present application provides a kind of computer readable storage medium storing one or more programs, one or more programs include instructions, which when executed by computing device, make computing device execute the method in the formal automatic translation method of state machine model according to the present application.

[0130] Compared with prior art, the improvement of the present application is to define the formal semantic model layer of state machine and condition block.The present application links the syntax semantics and translation proof of state machine and condition block based on code generation tool L2C, forms the complete trusted compiler of semantic preservation proof from synchronous data stream language with state machine and condition block to C.The present application adopts the state machine translation method of each layer semantic preservation, simplifies the translation process from state machine to synchronous data stream language, so that state machine can be translated into condition block first, and then translated into synchronous data stream language, thereby reducing the verification time of state machine and improving verification efficiency and accuracy.

[0131] The present application restructures the syntax semantics of original L2c synchronous data stream:

[0132] The execution mode of tense operation post equation is restructured.The execution semantics of the first period flag variable of tense operation is restructured.In synchronous data stream syntax, the definition of serial statement, condition statement nesting and case statement nesting is added.In synchronous data stream syntax, self-defined variable condition assignment statement is added.In synchronous data stream syntax, node call reset statement is added.So that state machine, condition block and synchronous data stream semantics can be integrated, so as to finally undertake the translation verification of state machine, finally greatly simplify the formal verification process of code generator.

[0133] The abstract model in the prior art is easy to be inconsistent with the actual translation process of the code, thereby causing the verification to fail. Moreover, the abstract model cannot verify all possible semantic states, and can only verify whether the relevant properties concerned in the model meet the requirements, thereby being easy to cause errors in the code generation stage. The formal verification object of the present application is the actual process of code generation, rather than verifying the abstract model. By using the semantic-preserving verification mode, all cases of semantic execution can be verified. By using the intermediate layer conditional block model as the transition layer syntax, the code generation process is made more secure and reliable while the verification process is simplified. The present application uses the interactive theorem proving mode to convert the conditional block syntax semantics into the synchronous data flow syntax semantics, and combines with L2C (a code generation tool from synchronous data flow to C) to translate into C code.

[0134] Compared with the prior art, the present application has the following advantages:

[0135] 1. The original synchronous data flow semantics is modified, and the state machine, conditional block and synchronous data flow fusion state machine model semantics definition is defined.

[0136] 2. The difference between the state machine and the synchronous data flow language is balanced, and the intermediate layer conditional block model syntax semantics is defined, so that the intermediate layer conditional block can undertake the translation of the state machine.

[0137] 3. The translation of the state machine model to the intermediate layer conditional block model is proved to be semantically preserved.

[0138] 4. The translation of the intermediate layer conditional block model to the synchronous data flow language is proved to be semantically preserved.

[0139] 5. The code generation process of the synchronous data flow and the mixed model with state machine and conditional block is verified.

[0140] The above describes the embodiments of the formal automatic translation method, device and computing equipment of the state machine model of the present application, and the purpose is to explain the spirit of the present application. Please note that the skilled in the art can modify and combine the features of the above-mentioned embodiments without departing from the spirit of the present application, therefore, the present application is not limited to the above-mentioned embodiments. The specific features of the formal automatic translation device and computing equipment of the state machine model of the present application, such as shape, size and position, can be designed according to the role of the above-mentioned features, and these designs can be realized by the skilled in the art. Moreover, the above-mentioned technical features are not limited to the disclosed combinations with other features, and the skilled in the art can also make other combinations between technical features according to the purpose of the present application, and the purpose of the present application is achieved.

Claims

1. A method for formal automatic translation of state machine models, characterized in that, The method comprises: adding a state model analysis structure corresponding to state transition data of a state machine model layer on the basis of a synchronous data flow layer to form an intermediate translation layer; the state transition data comprises a current input value, a current state, a next state, a current output value, a state transition relationship and clock data; wherein the clock data comprises a first period flag variable embedded in an fby / arrow / pre statement to control timing within the synchronous data flow; a synchronous data flow semantics integrates a temporal transport post equation into a normal equation, and places a temporal operation post equation within a state after a state equation for execution, and places a temporal operation post equation within a conditional block after an equation within a conditional branch for execution; the synchronous data flow semantics embeds a temporal operation first period flag variable within a syntax definition of the synchronous data flow; the synchronous data flow syntax is increased to include serial statements, conditional statement nesting and case statement nesting: the synchronous data flow semantics is increased to include serial statements, so that a state within and a conditional branch within can support a statement list through the serial statements; the conditional statement is nested to support a nested definition of a Boolean type conditional block semantics; the case statement is nested to support a state machine and an enumeration type conditional block semantics; the synchronous data flow syntax is increased to include a custom variable conditional assignment statement, and the custom variable conditional assignment statement is generated in a process of translating into a conditional block; the synchronous data flow syntax is increased to include a node call reset statement; translating state transition data and state machine structure data of a state machine model layer semantics into state machine model data of a synchronous data flow layer semantics; translating the state machine model data of the synchronous data flow layer semantics into state machine model data of a C language semantics.

2. The formalized automatic translation method of the state machine model according to claim 1, characterized in that, the state model analysis structure comprises a conditional block analysis structure; the conditional block analysis structure analyzes a trigger condition statement of state transition of the state machine model layer, so as to translate the state transition data of the state machine model layer semantics into the state transition data of the synchronous data flow layer semantics.

3. The method of claim 2, wherein, analyzing the trigger condition statement of the state transition of the state machine model layer comprises: when analyzing the trigger condition statement, judging a condition type of the trigger condition statement, and calling a corresponding state transition analysis table according to the condition type; updating a conditional block model semantics according to a state transition relationship of the state transition analysis table, so as to translate the state transition data of the state machine model layer semantics into the state transition data of the synchronous data flow layer semantics.

4. The method of claim 3, wherein, analyzing the trigger condition statement of the state transition of the state machine model layer further comprises: analyzing the state machine model layer to generate a state machine model semantics; analyzing an equation list of a corresponding state machine type and an equation list of a corresponding condition type according to the state machine model semantics and the conditional block model semantics; generating a mapping relationship of a trigger condition and a state according to the equation list of the state machine type and the equation list of the corresponding condition type, so as to translate the state transition data and the state machine structure data of the state machine model layer semantics into the state machine model data of the synchronous data flow layer semantics.

5. The method of claim 4, wherein, The condition type of the trigger condition statement is determined, and a corresponding state transition analysis table is called according to the condition type, comprising: The condition type of the trigger condition statement is determined, and a corresponding state transition analysis table is called according to the condition type.

6. The method of claim 5, wherein, The equation list of the corresponding state machine type and the equation list of the corresponding condition type are parsed according to the state machine model semantics and the condition block model semantics, specifically comprising: If the trigger condition statement is an enumeration type condition, a corresponding condition branch matching list is called, and whether the condition branch matching list is a null condition branch or a non-null condition branch is determined according to the condition branch definition of the condition branch matching list, and the equation list of the non-null condition branch is obtained according to the condition branch matching list; If the trigger condition statement is a Boolean type condition, a corresponding true branch equation list and a false branch equation list are called, and the equation list of the condition type is obtained.

7. The method of claim 6, wherein, Further comprising: The null equation list, the equation list of the original synchronous data flow statement and the equation list of the trigger condition statement are respectively generated according to the corresponding equation list definition in the equation list; The state machine structure data of the state machine model layer semantics is translated into the state machine structure data in the state machine model data of the synchronous data flow layer through the equation list of the original synchronous data flow statement; The state transition data of the state machine model layer semantics is translated into the state transition data in the state machine model data of the synchronous data flow layer through the equation list of the trigger condition statement.

8. An apparatus for formal automatic translation of state machine models, characterized in that, The device comprises: An intermediate translation layer generation module is configured to add a state model analysis structure corresponding to state transition data of the state machine model layer on the basis of the synchronous data flow layer to form an intermediate translation layer, wherein the state transition data comprises a current input value, a current state, a next state, a current output value, a state transition relationship and clock data; the clock data comprises a first period flag variable embedded in an fby / arrow / pre statement to control the timing within the synchronous data flow; the synchronous data flow semantics integrates a temporal transport post equation into a normal equation, and places a temporal operation post equation within a state after a state equation for execution, and places a temporal operation post equation within a condition block after an equation within a condition branch for execution; the synchronous data flow semantics embeds a temporal operation first period flag variable in the syntax definition of the synchronous data flow; the synchronous data flow syntax is increased to include serial statements, condition statement nesting and case statement nesting: the synchronous data flow semantics is increased to include serial statements, so that a state and a condition branch within the state can support a statement list through the serial statements; the condition statement is nested to support the nested definition of the Boolean type condition block semantics; the case statement is nested to support the nested state machine and the enumeration type condition block semantics; the synchronous data flow syntax is increased to include a custom variable condition assignment statement, which is generated in the translation of the condition block; the synchronous data flow syntax is increased to include a node call reset statement; A state machine model layer translation module is configured to translate the state transition data and the state machine structure data of the state machine model layer semantics into the state machine model data of the synchronous data flow layer semantics. an intermediate translation layer translation module that translates state machine model data of the synchronization data flow layer semantics to state machine model data of C language semantics.

9. A computing device comprising: one or more processors; memory; and one or more means for causing the device to perform any of the methods of claims 1-7.

10. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions, which when executed by a computing device, cause the computing device to perform any of the methods of claims 1-7. ​

Images