A synchronous language program multi-attribute incremental model detection method
By using program slicing and parallel execution engine threads, the parallel verification of synchronous language programs is simplified, solving the problem of low verification efficiency of synchronous language program model detectors in existing technologies, and realizing efficient security attribute verification of large and complex software systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-30
- Publication Date
- 2026-04-07
AI Technical Summary
Existing synchronous language program model detectors are insufficient in terms of verification capabilities and performance, and cannot effectively support the automatic verification of security attributes of large and complex software systems. In particular, they are inefficient in processing language structures such as linear operations of integers and real numbers, uninterpreted function symbols, and arrays.
By removing data streams and equations irrelevant to the attributes to be verified using a program slicing algorithm, the program is simplified and then executed in parallel using bounded model detection, induction, and program abstraction engine threads. Parallel verification is performed using the SMT solver, combined with incremental model detection technology to improve verification efficiency.
It accelerates the verification speed of synchronous language programs, enables the handling of more complex programs, and improves the performance and verification capabilities of model detectors.
Smart Images
Figure CN116089264B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a method for detecting synchronous language program models, and more particularly to a method for detecting multi-attribute incremental models of synchronous language programs. Background Technology
[0002] With the development of technology, reactive systems are increasingly widely used in critical fields such as aerospace, transportation, and nuclear industry. They can continuously respond to their environment at a given time, exhibiting time constraints, predictability, and interactivity with the external environment. To facilitate the design and implementation of reactive systems, academia and industry have jointly proposed synchronous languages, a new programming language paradigm for real-time embedded system programming. Common synchronous languages include Esterel, Lustre, SIGNAL, and SCADE. SCADE, in particular, originated from Esterel and Lustre, adding many syntactic structures to simplify program development. A SCADE program consists of multiple nodes, which are analogous to functions in imperative programming languages. A node consists of input data streams, local data streams, and output data streams, which are analogous to variables in imperative programming languages. SCADE only supports integer, Boolean, and real number data streams. In a SCADE program, any variable and expression represents a data stream consisting of values across multiple clock cycles. For example, variable x represents the data stream (x0, x1, x2, x3, ...), where x... i (0≤i) is the value of variable x at the i-th clock cycle. Commonly used operators in SCADE include: arithmetic operators (+, -, *, / , div, mod), Boolean operators (and, or, not), relational operators (>, >=, <, <=), conditional operators (if-then-else), and timing operators (pre, when).
[0003] Synchronous languages such as SCADE have become de facto standard development languages in aerospace, transportation, and nuclear industries, and are widely used to implement real-time embedded systems. Because these fields have extremely high requirements for system security and reliability, programs developed using synchronous languages such as SCADE must undergo rigorous formal verification (i.e., correctness verification). To this end, academia and industry have proposed many model checking techniques for verifying synchronous language programs, and developed various synchronous language model detectors based on different technologies.
[0004] Early synchronous language model detectors primarily relied on program translation techniques. These techniques translated synchronous language (source language) programs into a formal specification language specific to general model detectors (the target language, such as the input language of NuSMV or SPIN). Model detection was then performed on the translated formal specifications. The drawback of this technique is its poor validation capability and usability: because it cannot directly handle synchronous language programs, and because the semantics and expressive power of the source and target languages differ, some structures in the source language cannot be accurately translated into structures in the target language. This results in the model detector not supporting certain language structures in the source language, thus limiting the tool's validation capability and usability.
[0005] The current trend is to design proprietary model detectors for synchronous languages, enabling optimization of verification algorithms for specific language structures, thereby improving the verification capability and usability of the tools. A representative technique is the model detector based on propositional logic satisfiability (SAT) solvers. The drawback of this technique is its poor performance: because SAT solvers can only determine whether propositional logic formulas are satisfiable, they cannot support important language structures in the program, such as linear operations on integers and real numbers, uninterpreted function symbols, arrays, etc. Algorithms designed to accommodate these language structures generally have poor performance, resulting in poor overall verification performance and making it impossible to automatically verify large, complex software systems.
[0006] Most existing synchronous language program model detectors are based on Satisfiability Modular Theory (SMT) solvers. SMT solvers can determine the satisfiability of first-order logic formulas under combinatorial background theory, such as linear operations on integers and real numbers, uninterpreted function symbols, and arrays. The basic process of a synchronous language program model detector based on an SMT solver is as follows: First, the synchronous language program with a complex syntax is simplified to a synchronous language program containing only a simple syntax. Then, bounded model detection algorithms and inductive algorithms are used to transform the synchronous language program into a first-order logic formula solvable by the SMT solver. Finally, the SMT solver is called to perform satisfiability calculations on the formula, thereby achieving model detection of the synchronous language program.
[0007] Compared to the SAT solver, the SMT solver has stronger expressive power, can better describe various language structures in real-world programs, and has a relatively more efficient satisfiability determination algorithm. However, the performance of existing model detectors based on SMT solvers is still unsatisfactory, and they cannot automatically verify the security attributes of large and complex software systems. Therefore, it is necessary to combine techniques such as program analysis and parallel computing to improve the performance of model detectors. Summary of the Invention
[0008] Purpose of the invention: The purpose of this invention is to provide a method for detecting multi-attribute incremental models of synchronous language programs that can accelerate the verification process.
[0009] Technical solution: The method for detecting multi-attribute incremental models of synchronous language programs according to the present invention includes the following steps:
[0010] S1 performs lexical and syntactic analysis on the synchronous language program to obtain an abstract syntax tree, and then transforms the program from a complex program with multiple data types, multiple nodes, and multiple timing operators into a simple program containing only a single node and a memory depth of 1.
[0011] S2, using a program slicing algorithm, removes data streams and equations irrelevant to the attribute to be verified, resulting in a simplified program; then, based on the simplified program, extracts two first-order logic formulas I and T without quantifiers. i Where I represents the initial state of the simplified program, which is the variable value at clock 0; T i Describe the state transitions of the simplified program as the relationship between the variable values at clock i and clock i-1, where i ≥ 1; and extract a first-order logic formula P for each attribute P to be verified. i , used to describe the instance of the attribute to be verified at the i-th clock;
[0012] S3 is the basic formula for the bounded model detection engine thread, used to represent "attribute P holds true within the first k clock cycles", and its expression is as follows:
[0013] φ k :=I∧T1∧…∧T k →P0∧…∧P k
[0014] Among them, I and T x and P x It is the formula obtained by subscript substitution of the first-order logic formula extracted in step S2, where 0≤x≤k;
[0015] Construct an inductive formula for the inductive engine thread to represent "if property P is true from the nth to the (n+kth)th clock cycle, then P is also true at the (n+k+1th)th clock cycle", as shown in the following expression:
[0016] ψ k :=T n ∧…∧T n+k+1 ∧P n ∧…∧P n+k →P n+k+1
[0017] Where n is the symbol representing any natural number; T y and Py It is the formula obtained by subscript substitution of the first-order logic formula extracted in step S2, n≤y≤n+k+1;
[0018] S4 executes the bounded model detection engine thread, the induction engine thread, and the program abstraction engine thread in parallel, and controls the synchronization between these threads through a message passing mechanism.
[0019] A critical value k_opt is set. When k ≤ k_opt, the bounded model detection engine and the inductive engine work in parallel. When k > k_opt, the program abstraction engine and the inductive engine work in parallel.
[0020] Furthermore, in step S2, the program slicing includes the following steps:
[0021] S21, Calculate variable dependencies: Analyze all equations in the program to be verified. The variables on the left side of each equation directly depend on all variables on the right side. Store these dependencies as a variable dependency relationship.
[0022] S22, push all variables of the attribute to be verified onto stack S, and initialize set U to empty;
[0023] S23, determine if stack S is empty;
[0024] S24. If stack S is not empty, pop the top element of the stack, add it to set U, and search for all variables that the popped variable directly depends on in the above variable dependency relationship; if the variable is neither in U nor in stack S, push it onto stack S and go to step S23.
[0025] S25. If the stack is empty, it means that all variables that the attribute to be verified directly or indirectly depends on in the program have been traversed. The set U is all the variables that the attribute to be verified directly or indirectly depends on. Proceed to step S26.
[0026] Step S26: Traverse all equations in the set of program equations to be verified. If the variable on the left side of the equation is not in set U, then delete the equation from the set of program equations. After the traversal is completed, a simplified program with equations unrelated to the attribute to be verified deleted is obtained.
[0027] Furthermore, in step S4, the execution steps of the bounded model detection engine thread are as follows:
[0028] S411, set variable k = 0, representing the 0th clock cycle;
[0029] S412, Call the SMT solver to verify the basic formula φ k Is it valid?
[0030] If φ kIf the condition is not met, the SMT solver will return a counterexample, output the property violated by the counterexample and the counterexample, and pass the thread termination message M1=Abort to the induction engine thread, and then terminate the current thread.
[0031] If φ k If true, the value of k that has passed the check will be passed to the induction engine thread via the message M1=k, indicating that no counterexamples were found within k clock cycles.
[0032] S413, if a thread termination message M2=Abort is received from the induction engine thread, then terminate this thread; otherwise, increment the value of k by 1, and then proceed to step S412.
[0033] Furthermore, in step S4, the execution steps of the inductive engine thread are as follows:
[0034] S421, the thread sleeps until it receives message M1 from the bounded model detection engine thread or the program abstraction engine thread;
[0035] S422, If M1 = Abort is a thread termination message, and the bounded model detection engine thread or the program abstraction engine thread has proven that the property is false, then terminate this thread.
[0036] S423, if M1 = k is a natural number, and the bounded model detection engine thread or the program abstraction engine thread finds that the attribute is true within the k-th clock cycle, then for all natural numbers z ≤ k, call the SMT solver to verify the inductive formula ψ. z Is it valid?
[0037] If for a certain z, the inductive formula ψ z If this holds true, then for all clocks c > z, the fundamental formula φ... c If all conditions are met, the attribute is proven to be valid. At this point, the valid attribute is output, and the thread termination message M2=Abort is passed to the bounded model detection engine thread and the program abstraction engine thread. Then, the current thread is terminated.
[0038] If for all z, the inductive formula ψ z If this does not work, proceed to step S421.
[0039] Furthermore, in step S4, the execution steps of the program abstraction engine thread are as follows:
[0040] S431, When the variable k ≤ k_opt in the bounded model detection engine thread, this thread sleeps; when k > k_opt, the target program is initially abstracted.
[0041] S432, perform bounded model detection on the abstract program. If a counterexample is reported, proceed to step S434. If no counterexample is reported, it means that the abstract program satisfies the attribute to be verified within k clock cycles. Then, the value of k that has passed the check is passed to the induction engine thread through message M1=k, indicating that no counterexample was found within k clock cycles.
[0042] S433, if a thread termination message M2=Abort is received from the induction engine thread, then terminate this thread; otherwise, increment the value of k by 1, and then proceed to step S432.
[0043] S434, based on the first-order logic formulas I and T extracted in step S2 i The formula τ was tested using an SMT solver. k :=I∧T1∧…∧T k ∧V0∧…∧V k Satisfactionability is used to determine whether the variable value at each step in the counterexample is a reachable program state, V. i Let i be the variable value for each step, and 0 ≤ i ≤ k;
[0044] S435, if the solver returns "satisfiable", it proves that the counterexample is a real counterexample, and the conclusion that the property is invalid is drawn. Then, the property violated by the counterexample and the counterexample are output, and the thread termination message M1=Abort is passed to the induction engine thread, and then the current thread is terminated.
[0045] S436. If the solver returns "unsatisfiable", it proves that the counterexample is a false counterexample. The current abstraction of the program needs to be refined. The equation definitions of the key variables in the target program are added to the equation set of the abstract program to obtain a new abstract program. Then, proceed to step S432.
[0046] Furthermore, the verification engine thread in step S4 can also employ the parallel operation of the incremental bounded model detection engine thread and the incremental induction engine thread.
[0047] Furthermore, the execution steps of the incremental bounded model detection engine thread are as follows:
[0048] S511, set variable k = 0 to represent the 0th clock cycle;
[0049] S512, if the set of attributes to be verified is empty, then the thread termination message M1 = Abort is passed to the induction engine thread, and then the current thread is terminated;
[0050] S513, if the set of attributes to be verified is not empty, then connect all attributes in the set of attributes to be verified using the conjunction operator to obtain attribute P, and then call the SMT solver to verify the basic formula φ. k Is it valid?
[0051] S514, if φ k If the condition is not met, the SMT solver will return a counterexample. The set of properties violated by the counterexample will be extracted, removed from the set of properties to be verified, and the set of properties violated by the counterexample and the counterexample will be output. At the same time, these invalid properties will be passed to the induction engine thread through message M1, and the process will proceed to step S513.
[0052] S515, if φ k If true, the value of k that passed the check will be passed to the induction engine thread via message M1=k, indicating that no counterexamples of the attributes in the set of attributes to be verified were found within k clock cycles.
[0053] S516, if a thread termination message M2=Abort is received from the induction engine thread, then terminate this thread; otherwise, increment the value of k by 1, and then proceed to step S512.
[0054] Furthermore, the execution steps of the incremental induction engine thread include:
[0055] S521, construct a potentially valid attribute set PV and initialize it as the attribute set to be verified;
[0056] S522, the thread sleeps until it receives message M1 from the bounded model detection engine thread;
[0057] S523, if M1 = Abort is a thread termination message, and the bounded model detection engine thread has proven that all properties are false, then the current thread is terminated.
[0058] S524, If message M1 is an invalid attribute set, then remove these attributes from the potentially valid attribute set PV, and then proceed to step S522.
[0059] S525, if M1 = k is a natural number, and the bounded model detection engine thread finds that all attributes in the potentially valid attribute set PV are true within the k-th clock cycle, then all attributes in the potentially valid attribute set PV are concatenated using the conjunction operator to obtain attribute P. Then, for all natural numbers i ≤ k, the SMT solver is called to verify the induction formula ψ. i Is it valid?
[0060] If for some i, the inductive formula ψ i If this holds true, then for all clocks c, c > i, the fundamental formula φ... c If all are true, it proves that all attributes in the potentially valid attribute set PV are true. At this point, the valid attributes are output, and the thread termination message M2=Abort is passed to the bounded model detection engine thread, and finally the current thread is terminated.
[0061] If for all i, the inductive formula ψ i If this does not work, proceed to step S522.
[0062] Compared with the prior art, the significant advantages of this invention are as follows:
[0063] This invention simplifies the program to be verified by slicing the program to remove data streams and equations that are irrelevant to attributes, accelerates the parallel execution of program verification by executing three verification engine threads in parallel, and reuses the intermediate verification results through multi-attribute incremental verification, which can speed up the verification process and enable the same hardware configuration to verify more complex synchronous language programs, thereby alleviating the problem of slow verification speed of existing model detection technologies. Attached Figure Description
[0064] Figure 1 This is a structural diagram of the invention;
[0065] Figure 2 This is a flowchart of a program abstraction verification method. Detailed Implementation
[0066] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.
[0067] In this embodiment, a synchronous language program is used as an example for illustration. Here, SCADE language is used as an example, and the program is as follows:
[0068]
[0069] In the Ctr node, the speed threshold margin is set to 10.5, and the initial value of the speed target is 60.0. The speed target in this node can be adjusted by pressing the up and down buttons: if the down button is pressed, the speed target decreases by 1.0; if the up button is pressed, the speed target increases by 1.0; otherwise, the speed target remains unchanged. Then, the Adj node is called to calculate the output data streams decelerate and accelerate, representing deceleration and acceleration control commands. The final current value is used to calculate the current actual speed in km / h. In the Adj node, the actual speed is compared with the speed target. If the difference is greater than the threshold margin, deceleration is performed (decelerate is true); if it is less than the threshold minus the margin, acceleration is performed (accelerate is true). In this embodiment, there are two properties to be verified: Property 1 to be verified is "this speed regulator will always issue deceleration control commands", that is, Q1: (dr=true)∧(ar=false) is true on all clocks; Property 2 to be verified is "this speed regulator will always issue acceleration control commands", that is, Q2: (dr=false)∧(ar=true) is true on all clocks.
[0070] like Figure 1 , Figure 2 As shown, the present invention includes the following steps:
[0071] Step S1: Perform lexical and syntactic analysis on the synchronous language program to obtain an abstract syntax tree. Then, transform the program from a complex program with multiple data types, multiple nodes, and multiple timing operators into a simple program containing only a single node and a memory depth of 1.
[0072] Step S2: Use the program slicing algorithm to remove data streams and equations unrelated to the attribute to be verified, resulting in a simplified program. Then, extract two first-order logic formulas I and T without quantifiers from the simplified program. i Where I represents the initial state of the simplified program (i.e., the variable value at clock 0), and T... i Describe the state transitions of the simplified program (i.e., the relationship between the variable values at clock i and clock i-1, where i ≥ 1), and extract a first-order logic formula P for each attribute P to be verified. i , used to describe the instance of the attribute to be verified at the i-th clock.
[0073] In this embodiment, the data stream unrelated to the attributes Q1 and Q2 to be verified is 'current', therefore all equations related to the 'current' data stream are deleted. Then, based on the simplified program, two first-order logic formulas without quantifiers are extracted as follows:
[0074] I∶=(m0=10.5)∧(t0=60.0) (1)
[0075]
[0076] Where m, t, d, u, dr, ar, a, adr, aar, aa, at, and am represent the margin, target, down, up, decelerate, accelerate, and actual data streams in Ctr and the decelerate, accelerate, actual, target, and margin data streams in Adj, respectively; the subscript i indicates the value of the data stream on the i-th clock cycle, for example, m i This represents the value of data stream m on the i-th clock cycle, ite represents the if-then-else function, and ∧ represents the logical AND operation.
[0077] Extract two first-order logic formulas based on the attributes Q1 and Q2 to be verified:
[0078] Q1 i :=(dr i =true)∧(ar i =false) (3)
[0079] Q2 i :=(dr i =false)∧(ar i =true) (4)
[0080] Program slicing includes the following steps:
[0081] Step S21, Calculate variable dependencies: Analyze all equations in the program to be verified. The variables on the left side of each equation directly depend on all variables on the right side. Store these dependencies as a variable dependency relationship.
[0082] Step S22: Push all variables of the attributes to be verified onto stack S, and initialize set U to empty.
[0083] Step S23: Determine if stack S is empty;
[0084] Step S24: If stack S is not empty, pop the top element of the stack and add it to set U. Then, in the variable dependency relationship obtained in step S21, find all the variables that the popped variable directly depends on. If some of these variables are not in U or stack S, push them onto stack S and go to step S23.
[0085] Step S25: If stack S is empty, it means that all variables that the attribute to be verified directly or indirectly depends on in the program to be verified have been traversed. Set U is all the variables that the attribute to be verified directly or indirectly depends on. Proceed to step S26.
[0086] Step S26: Iterate through all equations in the set of equations to be verified. If the variable on the left side of an equation is not in the set U, remove the equation from the set of equations. After the iteration is complete, a simplified program is obtained, in which equations unrelated to the attribute to be verified have been removed. The simplified program is more concise than the original program, but retains all equations related to the attribute to be verified in the original program.
[0087] Step S3: Construct a basic formula for the bounded model detection engine thread to represent "attribute P holds true within the first k clock cycles", the expression is as follows:
[0088] φ k :=I∧T1∧…∧T k →P0∧…∧P k (5)
[0089] Among them, I and T x and P x (0≤x≤k) is the formula obtained by subscript substitution of the first-order logic formula extracted in step S2.
[0090] Construct an inductive formula for the inductive engine thread to represent "if property P is true from the nth to the (n+kth)th clock cycle, then P is also true at the (n+k+1th)th clock cycle", as shown in the following expression:
[0091] ψ k :=T n ∧…∧T n+k+1 ∧P n ∧…∧P n+k →P n+k+1 (6)
[0092] Where n is the symbol representing any natural number, T y and P y (n≤y≤n+k+1) is the formula obtained by subscript substitution of the first-order logic formula extracted in step S2.
[0093] Step S4: Three verification engine threads (including the bounded model detection engine thread, the inductive engine thread, and the program abstraction engine thread) are executed in parallel, and the synchronization between these threads is controlled through a message passing mechanism to improve verification performance. A critical value k_opt is set. When k ≤ k_opt, the bounded model detection engine and the inductive engine cooperate in parallel. Otherwise, the program abstraction engine and the inductive engine cooperate in parallel to achieve the optimization of verification performance.
[0094] In this embodiment, k_opt is set to 23, which means that when k≤23, the bounded model detection engine and the inductive engine work together in parallel, and otherwise the program abstraction engine and the inductive engine work together in parallel.
[0095] The parallel collaborative threads include the following three parallel-running verification engine threads: the bounded model detection engine thread, the inductive method engine thread, and the program abstraction engine thread; the specific implementation steps of each verification engine thread are as follows:
[0096] S41, the specific execution steps of the bounded model detection engine thread include:
[0097] Step S411: Set variable k = 0 (representing the 0th clock cycle).
[0098] Step S412: Call the SMT solver to verify the basic formula φ k Is it true (is it a tautology)? If φ k This is not true; the SMT solver will return a counterexample (containing a value that makes the basic formula φ...). k If the set of variable values is invalid, then the property violated by the counterexample (i.e., the invalid property) and the counterexample are output, and the thread termination message M1 = Abort is passed to the induction engine thread, and then the current thread is terminated. If φ k If true, the value of k that has passed the check will be passed to the induction engine thread via the message M1=k (indicating that no counterexample was found within k clock cycles).
[0099] In step S413, if a thread termination message M2 = Abort is received from the induction engine thread, then the current thread is terminated. Otherwise, the value of k is incremented by 1, and then the process proceeds to step S412.
[0100] S42, the specific execution steps of the inductive engine thread include:
[0101] Step S421: The thread sleeps until it receives a message M1 from the bounded model detection engine thread or the program abstraction engine thread. The content of message M1 can be a thread termination message (Abort), a natural number, or an attribute.
[0102] Step S422: If M1 = Abort is a thread termination message, that is, the bounded model detection engine thread or the program abstraction engine thread has proven that the property is not true, then the current thread is terminated.
[0103] Step S423: If M1 = k is a natural number, that is, if the bounded model detection engine thread or the program abstraction engine thread finds that the attribute is true within the k-th clock cycle, then for all natural numbers z ≤ k, call the SMT solver to verify the inductive formula ψ. z Does it hold true? If for some z, the inductive formula ψ z If this holds true, then for all clocks c (c>z), the fundamental formula φ... c If all conditions are met, the attribute is proven to be valid. At this point, the valid attribute is output, and the thread termination message M2 = Abort is passed to the bounded model detection engine thread and the program abstraction engine thread, then the current thread is terminated. If the inductive formula is not valid, proceed to step S421.
[0104] S43, the specific execution steps of the program abstraction engine thread include:
[0105] Step S431: When the variable k ≤ k_opt in the bounded model detection engine thread, the thread sleeps; when k > k_opt, the target program is initially abstracted. That is, according to the variable dependency relationship obtained in step S21, the variables in the attribute to be verified and their directly dependent variables are taken as local variables of the abstract program, and the equation definitions of these variables in the target program are added to the equation set of the abstract program to obtain an abstract program (i.e., a program that contains some equations in the target program).
[0106] Step S432: Perform bounded model testing on the abstract program. If a counterexample is reported, proceed to step S434. If no counterexample is reported, it means that the abstract program satisfies the attribute to be verified within k clock cycles. In this case, the value of k that has passed the check is passed to the induction engine thread via message M1=k (indicating that no counterexample was found within k clock cycles).
[0107] In step S433, if a thread termination message M2 = Abort is received from the induction engine thread, then the current thread is terminated. Otherwise, the value of k is incremented by 1, and then the process proceeds to step S432.
[0108] Step S434: Confirm the counterexamples. Specifically, since the counterexamples returned by the SMT solver consist of the step number k and the variable value V at each step... i (0≤i≤k) constitutes the first-order logic formulas I and T extracted in step S2. i The formula τ can be tested using an SMT solver. k :=I∧T1∧…∧Tk ∧V0∧…∧V k Satisfactionability is used to determine whether the variable value at each step in the counterexample is a reachable program state.
[0109] In step S435, if the solver returns "satisfiable", it proves that the counterexample is a true counterexample and the conclusion that the property is invalid can be drawn. Then, the property violated by the counterexample (i.e. invalid property) and the counterexample are output, and the thread termination message M1 = Abort is passed to the induction engine thread, and then the current thread is terminated.
[0110] Step S436: If the solver returns "unsatisfiable", it proves that the counterexample is a false counterexample. Then, the current abstraction of the program needs to be refined. Specifically, since the SMT solver will return a set of unsatisfiable variables, including key variables that make the attribute to be verified not satisfied, the equation definitions of these key variables in the target program can be added to the equation set of the abstract program to obtain a new abstract program. Then, proceed to step S432.
[0111] To further improve verification performance, the aforementioned parallel collaboration also supports multi-attribute incremental verification. The main idea is to verify the conjunction of all attributes to be verified, and check the validity of each attribute at each clock k (k≥0), updating the conjunction of the attributes to be verified accordingly. In other words, the verification engine thread in step S4 can be replaced by two parallel multi-attribute incremental verification engine threads: an incremental bounded model detection engine thread and an incremental induction engine thread. The specific implementation steps of the two incremental verification engine threads are as follows:
[0112] S51, the execution steps of the incremental bounded model detection engine thread include:
[0113] Step S511: Set variable k = 0 (representing the 0th clock cycle).
[0114] In step S512, if the set of attributes to be verified is empty (i.e., all attributes have been proven to be invalid), then the thread termination message M1 = Abort is passed to the induction engine thread, and then the current thread is terminated.
[0115] Step S513: If the set of attributes to be verified is not empty, then connect all attributes in the set of attributes to be verified using the conjunction operator to obtain attribute P, and then call the SMT solver to verify the basic formula φ. k Is it true (is it a tautology)?
[0116] Step S514, if φ k This is not true; the SMT solver will return a counterexample (containing a value that makes the basic formula φ...). kIf the set of variable values that are not valid is obtained, then the set of attributes violated by the counterexample is extracted, and it is removed from the set of attributes to be verified. Then the set of attributes violated by the counterexample (i.e. the set of invalid attributes) and the counterexample are output. At the same time, these invalid attributes are passed to the induction engine thread through message M1, and the process proceeds to step S513.
[0117] Step S515, if φ k If true, the value of k that has passed the check will be passed to the induction engine thread via the message M1=k (indicating that no counterexamples of the attribute in the set of attributes to be verified were found within k clock cycles).
[0118] Step S516: If a thread termination message M2 = Abort is received from the induction engine thread, then terminate this thread. Otherwise, increment the value of k by 1, and then proceed to step S512.
[0119] S52, the execution steps of the incremental induction engine thread include:
[0120] Step S521: Construct a potentially valid attribute set PV and initialize it as the attribute set to be verified.
[0121] Step S522: The thread sleeps until it receives message M1 from the bounded model detection engine thread.
[0122] Step S523: If M1 = Abort is a thread termination message, that is, the bounded model detection engine thread has proven that all properties are false, then the current thread is terminated.
[0123] In step S524, if message M1 is an invalid attribute set, these attributes are removed from the potentially valid attribute set PV, and then proceed to step S522.
[0124] Step S525: If M1 = k is a natural number, meaning the bounded model detection engine thread finds that all attributes in the potentially valid attribute set PV are true within the k-th clock cycle, then all attributes in the potentially valid attribute set PV are concatenated using the conjunction operator to obtain attribute P. Then, for all natural numbers i ≤ k, the SMT solver is called to verify the induction formula ψ. i Does it hold true? If for some i, the inductive formula ψ i If this holds true, then for all clocks c (c>i), the fundamental formula φ... c If all attributes are true, it proves that all attributes in the potentially valid attribute set PV are true. At this point, output the valid attributes, pass the thread termination message M2 = Abort to the bounded model detection engine thread, and finally terminate this thread. If the inductive formula is false, proceed to step S522.
[0125] In this embodiment, the initial set of attributes to be verified is {Q1, Q2}, thus yielding the conjunction P1:=Q1∧Q2. When k=0, the basic formula φ... k This is not true. Specifically, if the actual speed a0 = 70.0 at the 0th clock, then according to the equation dr0 = adr0 = ((aa0 - at0) > am0) = ((a0 - t0) > m0), we get dr0 = ((70.0 - 60.0) > 10.5), which means dr0 = false. Therefore, Q10 = false and P10 = false, meaning that this property Q1 is not an invariant, and this speed regulator will not continuously issue deceleration control commands.
[0126] After removing Q1 from the set of attributes to be verified, the new set is {Q2}, thus obtaining the conjunction P2:=Q2. When k=0, the basic formula φ... k This is not true. Specifically, if the actual speed a0 = 50.0 at clock 0, then according to the equation ar0 = ((a0-t0) < -m0) = ((50.0-60.0) < -10.5), i.e., ar0 = false, so Q20 = false and P20 = false. That is, this property Q2 is not an invariant, and this speed regulator will not continuously issue speed-up control commands.
[0127] After removing Q2 from the set of attributes to be verified, the new set is empty. Therefore, the incremental bounded model detection engine thread passes the termination message M1=Abort to the induction engine thread, and then terminates the thread. The induction engine thread then terminates, and the verification ends.
Claims
1. A method for detecting synchronous language program models, characterized in that, Includes the following steps: S1 performs lexical and syntactic analysis on the synchronous language program to obtain an abstract syntax tree, and then transforms the program from a complex program with multiple data types, multiple nodes, and multiple timing operators into a simple program containing only a single node and a memory depth of 1. S2, using a program slicing algorithm, removes data streams and equations irrelevant to the attribute to be verified, resulting in a simplified program; then, based on the simplified program, extracts two first-order logic formulas without quantifiers. and ,in, This represents the initial state of the simplified program, which is the variable value at clock 0. Describe the state transitions of the simplified program, representing the relationship between the variable values at clock i and clock i-1. And extract a first-order logic formula for each attribute P to be verified. , used to describe the instance of the attribute to be verified at the i-th clock; S3 is the basic formula for the bounded model detection engine thread, used to represent "attribute P holds true within the first k clock cycles", and its expression is as follows: in, , and The formula is obtained by subscript substitution of the first-order logic formula extracted in step S2. ; Construct an inductive formula for the inductive engine thread to represent "if property P is true from the nth to the (n+kth)th clock cycle, then P is also true at the (n+k+1th)th clock cycle", the expression is as follows: Where n is a symbol representing any natural number; and The formula is obtained by subscript substitution of the first-order logic formula extracted in step S2. ; S4 executes three verification engine threads in parallel: the bounded model detection engine thread, the inductive engine thread, and the program abstraction engine thread, and controls the synchronization between these threads through a message passing mechanism. A critical value k_opt is set. When k ≤ k_opt, the bounded model detection engine and the inductive engine work in parallel. When k > k_opt, the program abstraction engine and the inductive engine work in parallel.
2. The synchronous language program model detection method according to claim 1, characterized in that, In step S2, the program slicing includes the following steps: S21, Calculate variable dependencies: Analyze all equations in the program to be verified. The variables on the left side of each equation directly depend on all variables on the right side. Store these dependencies as a variable dependency relationship. S22, push all variables of the attribute to be verified onto stack S, and initialize set U to empty; S23, determine if stack S is empty; S24. If stack S is not empty, pop the top element of the stack, add it to set U, and search for all variables that the popped variable directly depends on in the above variable dependency relationship; if the variable is neither in U nor in stack S, push it onto stack S and go to step S23. S25. If the stack is empty, it means that all variables that the attribute to be verified directly or indirectly depends on in the program have been traversed. The set U is all the variables that the attribute to be verified directly or indirectly depends on. Proceed to step S26. Step S26: Traverse all equations in the set of program equations to be verified. If the variable on the left side of the equation is not in set U, then delete the equation from the set of program equations. After the traversal is completed, a simplified program with equations unrelated to the attribute to be verified deleted is obtained.
3. The synchronous language program model detection method according to claim 1, characterized in that, In step S4, the execution steps of the bounded model detection engine thread are as follows: S411, set variable k=0 to represent the 0th clock cycle; S412, Call the SMT solver to verify the basic formulas. Is it valid? if If the condition is not met, the SMT solver will return a counterexample, outputting the property violated by the counterexample and the counterexample itself, and will also terminate the thread message. Pass it to the induction engine thread, then terminate the current thread; if If established, it will be done via message. The k value that passes the check is passed to the induction engine thread, indicating that no counterexamples were found within k clock cycles. S413, if a thread termination message is received from the induction engine thread. If the condition is met, the current thread is terminated; otherwise, the value of k is incremented by 1, and then the process proceeds to step S412.
4. The synchronous language program model detection method according to claim 1, characterized in that, In step S4, the execution steps of the inductive engine thread are as follows: S421, the thread sleeps until it receives a message from the bounded model detection engine thread or the program abstraction engine thread. ; S422, if This is a thread termination message. If the bounded model detection engine thread or the program abstraction engine thread has proven that the property is false, then the current thread will be terminated. S423, if If a natural number is a bounded model, and the bounded model detection engine thread or program abstraction engine thread finds that the attribute is true within the k-th clock cycle, then for all natural numbers... The SMT solver was called to verify the induction formula. Is it valid? If for a certain z-induction formula If this holds true, then for all clocks c, Basic formula If all conditions are met, the attribute is proven to be valid. At this point, the valid attribute is output, and a thread termination message is sent. It is passed to the bounded model detection engine thread and the program abstraction engine thread, and then the current thread is terminated. If for all z-induction formulas If this does not work, proceed to step S421.
5. The synchronous language program model detection method according to claim 1, characterized in that, In step S4, the execution steps of the program abstraction engine thread are as follows: S431, When the variable k ≤ k_opt in the bounded model detection engine thread, this thread sleeps; when k > k_opt, the target program is initially abstracted. S432, perform bounded model testing on the abstract program. If a counterexample is reported, proceed to step S434. If no counterexamples are reported, indicating that the abstract program satisfies the attribute to be verified within k clock cycles, then the message is passed. The k value that passes the check is passed to the induction engine thread, indicating that no counterexamples were found within k clock cycles. S433, if a thread termination message is received from the induction engine thread. If the condition is met, the current thread is terminated; otherwise, the value of k is incremented by 1, and then the process proceeds to step S432. S434, based on the first-order logic formula extracted in step S2 and The formula was tested using an SMT solver. Satisfactionability is used to determine whether the variable value at each step in the counterexample is a reachable program state. For the variable value at each step, ; S435, if the solver returns "satisfiable", then the counterexample is proven to be a true counterexample, leading to the conclusion that the property is invalid. The property violated by the counterexample and the counterexample itself are then output, and a thread termination message is sent. Pass it to the induction engine thread, then terminate the current thread; S436. If the solver returns "unsatisfiable", it proves that the counterexample is a false counterexample. The current abstraction of the program needs to be refined. The equation definitions of the key variables in the target program are added to the equation set of the abstract program to obtain a new abstract program. Then, proceed to step S432.
6. The synchronous language program model detection method according to claim 1, characterized in that, The parallel execution of the three verification engine threads in step S4 is replaced by the following two parallel multi-attribute incremental verification engine threads: the incremental bounded model detection engine thread and the incremental induction engine thread.
7. The synchronous language program model detection method according to claim 6, characterized in that, The execution steps of the incremental bounded model detection engine thread are as follows: S511, set variable k=0 to represent the 0th clock cycle; S512, if the set of attributes to be verified is empty, the thread will be terminated. Pass it to the induction engine thread, then terminate the current thread; S513, if the set of attributes to be verified is not empty, then connect all attributes in the set of attributes to be verified using the conjunction operator to obtain attribute P, and then call the SMT solver to verify the basic formula. Is it valid? S514, if If the condition is not met, the SMT solver will return a counterexample. The set of properties violated by the counterexample will be extracted, removed from the set of properties to be verified, and then the set of properties violated by the counterexample and the counterexample itself will be output. This will be done simultaneously via a message. Pass these invalid properties to the induction engine thread and proceed to step S513; S515, if If established, it will be done via message. The k value that passes the check is passed to the induction engine thread, indicating that no counterexamples of the properties in the set of properties to be verified were found within k clock cycles. S516, if a thread termination message is received from the induction engine thread. If the condition is met, the current thread is terminated; otherwise, the value of k is incremented by 1, and then the process proceeds to step S512.
8. The synchronous language program model detection method according to claim 6, characterized in that, The execution steps of the incremental induction engine thread include: S521, construct a potentially valid attribute set PV and initialize it as the attribute set to be verified; S522, the thread sleeps until it receives a message from the bounded model detection engine thread. ; S523, if This is a thread termination message. The bounded model detection engine thread has proven that all properties are false, so it terminates this thread. S524, if message If the set of attributes is invalid, then these attributes are removed from the set of potentially valid attributes PV, and then proceed to step S522; S525, if If the value is a natural number, the bounded model detection engine thread finds that all attributes in the potentially valid attribute set PV are true within the k-th clock cycle. It then concatenates all attributes in the potentially valid attribute set PV to obtain attribute P. Finally, for all natural numbers... The SMT solver was called to verify the induction formula. Is it valid? If for a certain i, the inductive formula If this holds true, then for all clocks c, Basic formula If all attributes are true, it proves that all attributes in the potentially valid attribute set PV are true. At this point, output the valid attributes and send a thread termination message. Passed to the bounded model detection engine thread, and finally terminated in this thread; If the induction formula applies to all i... If this does not work, proceed to step S522.