A formal checking method of a process control model

Abstract

The application relates to a formal checking method of a flow control model, and belongs to the technical field of development and checking of flow control software. The application proposes a checking method for the flow control model under a real-time operating system. The checking method is used for the demand of one-time flow control, performs formal analysis on the execution process of each flow action, checks the environmental conditions of the communication operation in each action in the flow execution process, judges whether the communication operation is safe, and further improves the safety of the whole system.

Description

Technical Field

[0001] This invention belongs to the field of process control software development and inspection technology, and specifically relates to a formal inspection method for process control models. Background Technology

[0002] Using software for process control is a very common requirement. Under the control of software, hardware sends and receives signals through communication interfaces to control the process. In many process control requirements, the process is a process that is executed only once after the device is powered on. Although it includes loops and monitoring, the main process is executed once, and this kind of process is called a one-time execution process. Summary of the Invention

[0003] (a) Technical problems to be solved

[0004] The technical problem to be solved by this invention is to propose a checking method for the process control model under a real-time operating system. In response to the requirements of an execution process, the method checks the preconditions of communication operations in each step of the process execution to improve the security of process control.

[0005] (II) Technical Solution

[0006] To address the aforementioned technical problems, this invention provides a formal inspection method for process control models. This method, targeting process control models under a real-time operating system, uses formal software inspection techniques to examine the environmental conditions of communication operations in each step of the process execution, in response to the requirements of a single execution process.

[0007] Preferably, the process control model under the real-time operating system is a three-level process abstraction model that decomposes the process into process state machines, process steps, and process actions. The actual process can be decomposed into several process state machines, each process state machine can be decomposed into several process steps, each process step can be decomposed into several process actions, and the execution process is included in the process actions.

[0008] Preferably, the process state machine runs periodically, and at any given time, only one process action in one process step is being executed in each process state machine.

[0009] Preferably, in the process control model, all process state machines share the same running context, which is the execution state upon which the process action execution depends.

[0010] Preferably, in the process control model, all process state machines are concentrated in a task of a real-time operating system and executed sequentially. First, the reception of communication I / O is completed uniformly. Then, the current process action of each process state machine is executed sequentially, and the process is transferred to the next process step and process action according to the process configuration.

[0011] Preferably, in the process control model, the execution process of each process action is as follows: First, the process action determines whether the preceding transition condition is met. This transition condition consists of zero or several condition pairs. Each condition pair has a condition expression based on the running context on one side and the process step and action of the target transition in the current process state machine on the other side. If the condition is met, the corresponding process state machine transitions to the target process step and action corresponding to the met condition. If the condition is not met, a preceding non-communication I / O data operation is performed. This non-communication I / O data operation refers to performing simple operations on some data in the running context without reading or writing the message queue related to the communication task, preparing data for subsequent communication operations. Then, a communication operation is performed, which involves writing to the message queue related to the communication task. If the operation is successful, a subsequent non-communication I / O data operation is performed. If the operation fails, the system continues to determine whether the failure subsequent transition condition is met. After the subsequent non-communication I / O data operation, the system determines whether the success subsequent transition condition is met. If it is, a success subsequent process transition is performed, and the process ends; otherwise, it ends directly. If the failure subsequent transition condition is met, a failure subsequent process transition is performed; otherwise, the process ends.

[0012] Preferably, in this inspection method, in the three-level process abstraction model of process state machine, process step, and process action, the process step is omitted, that is, each process state machine consists only of a number of process actions, expressed as follows:

[0013] Machine = {OP1, OP2, ..., OP} s}

[0014] Among them, Machine is a process state machine containing s process actions, i.e., OP;

[0015] Make each process action OP i Represented by a six-tuple, as shown in the following expression:

[0016] OP i = <ENV i PRE i OkPOST i ErrPOST i ,DO i ID i >

[0017] Among them, ENV iThis refers to the transition from the process state machine (Machine) to the process action (OP). i Environmental conditions at the time, PRE i This refers to the process action (OP). i Pre-transfer information, OkPOST i This refers to the process action (OP). i The information related to the subsequent transfer after successful execution, ErrPOST i This refers to the process action (OP). i Information related to subsequent transfers after execution failure, DO i This refers to the process action (OP). i The communication operations performed can be summarized into logical expressions, ID. i For OP i A unique identifier within the Machine;

[0018] Process Action OP i Transfer to process action OP based on Machine i Environmental conditions at that time ENV i If a certain preceding transition condition is met, the communication operation is not executed; instead, the process state machine is transferred to another process action.

[0019] This inspection method determines that if none of the preceding conditions are met, and the environmental condition ENV is also not met. i Is it safe to perform communication operations under the condition that the condition is true?

[0020] Preferably, in this inspection method, for PRE (preceding transfer related information) i This can be summarized into a set of two tuples, as shown in the following expression:

[0021]

[0022] Among them, process action OP i It contains m preorder transition groups, each preorder transition group consisting of a tuple. It means that, among them, The logical expression representing the condition for executing the current preceding transfer group, when When true, the process state machine (Machine) does not execute the process action (OP). i Instead of the communication operation, it is transferred to ID equal to The process of actions;

[0023] For OkPOST i This can be summarized into a set of two tuples, as shown in the following expression:

[0024]

[0025] Among them, process action OP i It contains n successful postorder transition groups, each postorder transition group consisting of a tuple. It means that, among them The logical expression representing the condition for executing the current preceding transfer group, if the process action OP... i The communication operation was executed successfully, i.e., DO i True, and when When the value is true, the state machine transitions to ID equal to... The process of actions;

[0026] For ErrPOST i This can be summarized into a set of two tuples, as shown in the following expression:

[0027]

[0028] Among them, process action OP i It contains o failed post-transfer groups, each post-transfer group consisting of a tuple. It means that, among them The logical expression representing the condition for executing the current preceding transfer group, if the process action OP... i The communication operation was executed successfully, i.e., DO i True, and when When the value is true, the state machine transitions to ID equal to... The process of actions;

[0029] For preceding transfers, for each preceding transfer group, the process action OP will be... i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression:

[0030]

[0031] For each successful subsequent transfer group, the process action OP will be executed. i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression:

[0032]

[0033] For each failed subsequent transfer group, the process action OP will be transferred. i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression.

[0034]

[0035] So, for each process action oP i By traversing all the process actions of the process state machine in which it resides, the following set of binary tuples is obtained:

[0036]

[0037] There are p cases in total This allows the process state machine to transition to process action oP. i For each pair of tuples Based on its different transfer scenarios—preceding transfer, successful subsequent transfer, and failed subsequent transfer—the formulas for the three different transfer scenarios can be used to handle them separately.

[0038] So, what about the process action OP? i Environmental conditions ENV i Suppose there are p possible states that allow the process state machine to transition to process action OP. i This can be summarized into the following formula:

[0039]

[0040] For each process action OP i Its environmental conditions ENV i It can be transferred to the process action OP. i Other process actions determine the outcome, according to ENV. i Starting with the constant true process action, derive the ENV of other process actions. i ;

[0041] Thus, for each process action OP i The environmental conditions of the ENV were completed. i Solve by comparing the operation parameters (OPs) of each process. i Environmental conditions ENV i and process action OP i The communication operations performed can be summarized as the logical expression DO. i This allows for the checking of the environmental conditions of communication operations at each step of the process execution.

[0042] Preferably, at the starting point of the process state machine, the ENV of the process action... i It is considered to be true.

[0043] The present invention also provides an application of the method in the field of process control software development and inspection technology.

[0044] (III) Beneficial Effects

[0045] This invention proposes a checking method for process control models under real-time operating systems. Faced with the requirements of a single execution process, it performs formal analysis on the execution process of each process action, checks the environmental conditions of communication operations in each action during process execution, and determines whether it is safe to perform communication operations, thereby improving the security of the entire system. Attached Figure Description

[0046] Figure 1 The main process task flowchart provided for embodiments of the present invention;

[0047] Figure 2 The flowchart for the execution of actions provided in the embodiments of the present invention. Detailed Implementation

[0048] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.

[0049] This invention proposes a checking method for process control models under real-time operating systems. Using formal software checking techniques, it checks the environmental conditions of communication operations in each step of the process execution to improve the security of process control.

[0050] In the modeling method of the process control model under the real-time operating system, the process is decomposed into a three-level process abstraction model: process state machine, process step, and process action. The actual process can be decomposed into several process state machines, each process state machine can be decomposed into several process steps, and each process step can be decomposed into several process actions. Process state machines and process steps are organizational forms; the actual execution process is contained within the process actions. All process state machines share the same runtime context, which is the execution state upon which the execution of process actions depends. The process state machines run periodically; at any given time, each process state machine is executing only one process action from one process step.

[0051] All process state machines are centralized in a task of a real-time operating system, executed sequentially, as follows: Figure 1 As shown. First, the communication I / O is received uniformly. Then, the current process action of each process state machine is executed sequentially, and the process transitions to the next process step and action according to the process configuration. The most crucial part is the process action, which is the specific process control content and actually communicates with the external interface. The execution process of each process action is as follows: Figure 2As shown. The process action first checks whether the preceding transition conditions are met. These transition conditions are zero or several condition pairs. Each condition pair consists of a conditional expression based on the runtime context on one side and the process steps and actions of the target transition in the current process state machine on the other side. If the conditions are met, the corresponding process state machine transitions to the target process steps and actions corresponding to the met conditions. If the conditions are not met, a preceding non-communication I / O data operation is performed. This non-communication I / O data operation refers to performing simple operations on some data in the runtime context without reading or writing the message queue related to the communication task, preparing data for subsequent communication operations. Then, a communication operation is performed, which involves writing to the message queue related to the communication task. If the operation succeeds, a subsequent non-communication I / O data operation is performed. If the operation fails, the process continues to check whether the subsequent transition conditions are met. Here, a communication operation failure does not necessarily mean that the read / write operation of the message queue itself has failed, but rather that the required reply message from the communication task has not been received. The current process action ends in failure and is executed again in the next main process task cycle. This allows the main process task to asynchronously wait for the execution of the communication task while ensuring real-time performance. The subsequent non-communication I / O data operations, failure follow-up transfer conditions, and success follow-up transfer conditions are similar to the preceding operations and will not be repeated here. After the subsequent non-communication I / O data operation, it is determined whether the success follow-up transfer condition is met. If so, the success follow-up process transfer is performed, and then the process ends; otherwise, it ends directly. If the failure follow-up transfer condition is met, the failure follow-up process transfer is performed; otherwise, the process ends.

[0052] Based on this process modeling method, this invention proposes a set of inspection methods to perform formal analysis on the execution process of each process action, check the environmental conditions of each process action before communication operation, and determine whether it is safe to perform communication operation, thereby improving the security of the entire system.

[0053] In the three-level process abstraction model of process state machine, process step, and process action, the process step only demonstrates the process execution process to the software user and does not affect the process execution itself. Therefore, in the inspection method of this invention, the process step is omitted, that is, each process state machine consists only of several process actions, represented by the following expression:

[0054] Machine = {OP1, OP2, ..., OP} s}

[0055] Here, Machine is a process state machine containing s process actions, i.e., OP.

[0056] according to Figure 2 Each process action OP i It can be represented by a six-tuple, as shown in the following expression:

[0057] OP i = <ENV i PRE i OkPOST i ErrPOST i ,DO i ID i >

[0058] Among them, ENV i This refers to the transition from the process state machine (Machine) to the process action (OP). i Environmental conditions at the time, PRE i This refers to the process action (OP). i Pre-transfer information, OkPOST i This refers to the process action (OP). i The information related to the subsequent transfer after successful execution, ErrPOST i This refers to the process action (OP). i Information related to subsequent transfers after execution failure, DO i This refers to the process action (OP). i The communication operations performed can be summarized into logical expressions, ID. i For OP i A unique identifier within the Machine.

[0059] The following is a detailed explanation of this six-tuple.

[0060] like Figure 2 As shown, the process action OP i Transfer to process action OP based on Machine i Environmental conditions at that time ENV i The process involves determining whether a precondition is met. If so, the communication operation is not performed; instead, the process state machine is transferred to another process action. The core of this invention is to design a checking method to determine whether a communication operation is performed if the preconditions are not met and the environmental condition is ENV. i Given that the condition is true, is it safe to perform the communication operation? The following description will solve for each process action (OP) step by step. i ENV i .

[0061] For information related to prior transfers PRE i This can be summarized into a set of binary tuples, as shown in the following expression:

[0062]

[0063] Among them, process action OP iIt contains m preorder transition groups, each preorder transition group consisting of a tuple. It means that, among them, The logical expression representing the condition for executing the current preceding transfer group, when When true, the process state machine (Machine) does not execute the process action (OP). i Instead of the communication operation, it is transferred to ID equal to The process and actions.

[0064] For OkPOST i OP process action i The subsequent transfer information after a successful communication operation can also be summarized into a set of binary tuples, as shown in the following expression:

[0065]

[0066]

[0067] Among them, process action OP i It contains n successful postorder transition groups, each postorder transition group consisting of a tuple. It means that, among them The logical expression representing the condition for executing the current preceding transfer group, if the process action OP... i The communication operation was executed successfully, i.e., DO i True, and when When the value is true, the state machine transitions to ID equal to... The process and actions.

[0068] For ErrPOST i OP process action i The information related to the subsequent transfer after a communication operation fails can also be summarized into a set of binary tuples, as shown in the following expression:

[0069]

[0070] Among them, process action OP i It contains o failed post-transfer groups, each post-transfer group consisting of a tuple. It means that, among them The logical expression representing the condition for executing the current preceding transfer group, if the process action OP... i The communication operation was executed successfully, i.e., DO i True, and when When the value is true, the state machine transitions to ID equal to... The process and actions.

[0071] Next, we will summarize the three types of transfer scenarios mentioned above: preceding transfer, successful subsequent transfer, and failed subsequent transfer.

[0072] For preceding transfers, for each preceding transfer group, the process action OP will be... i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression:

[0073]

[0074] For each successful subsequent transfer group, the process action OP can be transferred. i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression:

[0075]

[0076] For each failed subsequent transfer group, the process action OP will be transferred. i Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression.

[0077]

[0078] So, for each process action OP i By traversing all the process actions of the process state machine in which it resides, the following set of binary tuples is obtained:

[0079]

[0080] The above set represents all processes that can be transferred from other process actions to process action OP. i There are p possible scenarios. This allows the process state machine to transition to the process action (OP). i For each pair of tuples Based on its different transfer scenarios—preceding transfer, successful subsequent transfer, and failed subsequent transfer—the formulas for the three different transfer scenarios can be used to handle the three cases respectively.

[0081] So, what about the process action OP? i Environmental conditions ENV i Suppose there are p possible states that allow the process state machine to transition to process action OP. i This can be summarized into the following formula:

[0082]

[0083] This allows us to discover that for each process action OP i Its environmental conditions ENV i It can be transferred to the process action OP. i The process state machine is determined by other process actions. We know that a process state machine must have one or more starting points, that is, places where it starts unconditionally; these are the ENVs of those process actions. i It can be considered that it is always true. Thus, these ENVs... i Starting with the constant true process action, derive the ENV of other process actions. i .

[0084] This invention addresses a single-execution process with minimal recurring loops. The aforementioned derivation method is highly mechanical, requiring manual intervention only in handling recurring loops. An inductive approach is used to address the ENV (Envelope) issues within these loops. i The problem to be solved is to iterate several times and derive an ENV that does not change with the number of iterations. i expression.

[0085] Thus, for each process action OP i The environmental conditions of the ENV were completed. i Solve this problem by comparing the operation parameters (OPs) of each process. i Environmental conditions ENV i and process action OP i The communication operations performed can be summarized as the logical expression DO. i This allows for the checking of the environmental conditions of communication operations in each step of the process execution, thus achieving the design objective of this invention.

[0086] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for formal checking of a process control model, characterized by, The method is a process control model under a real-time operating system, using formal software checking means to face the demand of one-time process, checking the environmental conditions of communication operations in each step of the process execution process; The process control model under the real-time operating system is a three-level process abstraction model of process state machine, process step and process action, the actual process can be decomposed into a plurality of process state machines, each process state machine can be decomposed into a plurality of process steps, and each process step can be decomposed into a plurality of process actions, and the execution process is contained in the process action; The process state machine runs periodically, and at a time, only one process action in a process step of each process state machine is executed; In the process control model, all process state machines share the same running context, and the running context is the execution state on which the process action execution process depends; In the process control model, all process state machines are concentrated in a real-time operating system task, and are executed in turn, first unified to complete the receiving of communication IO, then execute the current process action of each process state machine in turn, and transfer to the next process step and process action according to the configuration of the process; In the process control model, the execution process of each process action is as follows: the process action first judges the environmental conditions of the process action, the environmental conditions of the process action are determined by other process actions that can be transferred to the process action, judges whether the pre-sequenced transfer condition is met, the transfer condition is 0 or a plurality of condition pairs, one side of each condition pair is a condition expression based on the running context, and the other side is the target process step and process action of the target transfer in the current process state machine; if it is met, the corresponding process state machine is transferred to the target process step and process action corresponding to the met condition; if it is not met, the pre-sequenced non-communication IO data operation is performed, the non-communication IO data operation refers to not reading and writing the message queue related to the communication task, and simply operating some data of the running context to prepare for the data of the subsequent communication operation; then the communication operation is performed, which is writing the message queue related to the communication task, if the operation is successful, the post-sequenced non-communication IO data operation is performed, if the operation fails, it is judged whether the post-sequenced transfer condition is met; after the post-sequenced non-communication IO data operation, it is judged whether the post-sequenced transfer condition is met, if yes, the post-sequenced process transfer is performed, and then the process is ended, otherwise the process is directly ended; when it is judged that the post-sequenced transfer condition is met, the post-sequenced process transfer is performed, otherwise the process is ended.

2. The method of claim 1, wherein, In the checking method, the process step is omitted in the three-level process abstraction model of process state machine, process step and process action, that is, each process state machine is composed of a plurality of process actions, which is expressed as follows: ​ Let each process action is represented by a six tuple, as expressed in the following table: wherein, refers to the pre-sequenced transition related information of the flow action refers to the environmental condition when the flow state machine Machine transfers to the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the pre-sequenced transition related information of the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the post-sequenced transition related information after the execution of the flow action refers to the logical expression which can be summarized from the communication operation performed by the flow action is the unique identifier in the Machine; Flow action According to Machine to flow action The environmental conditions at the time A determination is made as to whether a certain pre-sequenced transition condition is met, and if so, rather than performing the communication operation, the flow state machine is transitioned to another flow action. The checking method determines whether the communication operation is safe under the condition that none of the preconditions is satisfied and the environmental condition is true. is true.

3. The method of claim 2, wherein, In the checking method, for the pre-sequenced transfer related information , is summarized as a binary tuple set, as expressed in the following expression: wherein the flow action comprises m pre-sequenced transition groups, each pre-sequenced transition group being represented by a two-tuple wherein represents a logical expression of a condition for executing the current pre-sequenced transition group, and when is true, the flow state machine Machine does not execute the communication operation of the flow action but instead transitions to the flow action with ID equal to ; For , a set of binary tuples is induced, as expressed in the following expression: wherein the flow action comprises n successful post-sequenced transition groups, each post-sequenced transition group being represented by a two-tuple wherein represents a logical expression of a condition for executing the current pre-sequenced transition group, and wherein the flow action is true if the communication operation of the flow action is executed successfully, and wherein the state machine Machine is transferred to the flow action with ID equal to when the flow action is true. For , a set of binary tuples is induced, as expressed in the following expression: wherein the flow action comprises o failure post-sequencer groups, each post-sequencer group being a pair of a binary expression , wherein represents a logical expression of a condition for executing the current pre-sequencer group, and wherein the flow action is true if the communication operation of the flow action is executed successfully, and wherein the state machine Machine is transferred to the flow action with ID equal to when the binary expression is true. For preceding transfers, for each preceding transfer group, the process action will be... Transfer to process action At that time, process actions Environmental conditions It can be summarized into the following expression: For each successful post-sequencing group, the environmental conditions of the process action to which the process action is transferred from the flow action are summarized in the following table: ​ For each post-failure transition group, the environmental conditions under which the flow action is to be transitioned from the flow action are summarized in the following table: ​ So, for each flow action , traverse all flow actions of the flow state machine it belongs to, resulting in the following set of pairs: There are p cases in common The flow state machine can be caused to move to a flow action For each pair of According to different transition cases of the pre-sequenced transition, the success post-sequenced transition and the failure post-sequenced transition, three different transition case formulas are used for processing respectively. So for the environmental condition of the flow action , suppose there are p cases that can make the flow state machine transfer to the flow action Induction into the following formula: For each process action Its environmental conditions It can be transferred to process actions Determined by other process actions, Starting with the process action that is always true, other process actions are derived. ; Thus, for each flow action , the environmental conditions for its execution are solved by comparing the environmental conditions of each flow action with the communication operations performed by the flow action and the logical expression that can be summarized from the communication operations performed by the flow action , i.e. the check of the environmental conditions for the communication operations in each step of the execution of the flow.

4. The method of claim 3, wherein, At the start of the flow state machine, the flow action's is considered to be true constantly.

Images