An IC3 accelerated verification method and system based on unsatisfiable core

Abstract

The present invention discloses an IC3 accelerated verification method and system based on unsatisfiable cores. The present invention includes inputting a program model to be verified into an IC3 algorithm model using an SMT solver for solving to obtain a verification result of whether the program model to be verified meets a specified security attribute or specification, and includes initializing an unsatisfiable core library, checking the unsatisfiable core library before each call to the SMT solver, and skipping the solution process if an unsatisfiable core matching the current formula is found, otherwise the solution is executed and the returned unsatisfiable core is updated to the unsatisfiable core library after the solution. The present invention aims to utilize the similarity between a large number of constraint solutions in the IC3 algorithm, construct an unsatisfiable core library according to the previous constraint solution, and quickly implement the solution of the following part of the problem based on the existing unsatisfiable core, which can reduce the number of SMT solutions and thus reduce the running time of the IC3 algorithm, and accelerate the verification speed of the IC3 algorithm.

Description

Technical Field

[0001] The present invention relates to the field of software engineering, and in particular to an IC3 acceleration verification method and system based on unsatisfiable cores. Background Art

[0002] Model checking is an automated technology used to verify whether a system design meets specific specifications. It is mainly used in the fields of hardware circuits, software programs, and protocol verification. It systematically checks all possible states of the model to ensure that its behavior meets expectations. As the scale and complexity of the system increase, traditional model checking methods face the problem of state space explosion, which significantly reduces the efficiency and feasibility of the verification process.

[0003] As an incremental state space search method, IC3 (Incremental Construction of Inductive Clauses for IndubitableCorrectness) has made important progress in this field. IC3 is an incremental state space search algorithm for incremental verification, mainly used in the verification of hardware and software systems. IC3 was proposed by Aaron Bradley in 2011. With its efficiency and flexibility, it quickly became one of the key technologies in the field of symbolic model checking. The core idea of ​​IC3 is to gradually build a series of inductive clauses that can prove the security of the system. The algorithm iteratively enhances these clause sets until all reachable states are covered, ensuring that all states of the system meet the given security properties. IC3 uses a recursive and incremental method to verify invariants. Through recursive solution, the algorithm gradually generates and verifies new clauses, and only necessary clauses are added in each iteration, avoiding large-scale computational overhead. This incremental construction method enables the algorithm to efficiently handle large-scale state spaces. There are two main processes in IC3, namely the blocking phase and the propagation phase. The main purpose of the blocking phase is to ensure that inductive clauses hold in the system through conflict analysis and counterexample blocking. The main purpose of the propagation phase is to gradually propagate reachable states through forward state expansion, verifying and strengthening the inductive clauses of the system.

[0004] The IC3 algorithm is based on the SMT (Satisfiability Modulo Theories) solver. The SMT solver is used to determine whether a logical formula is satisfiable under a specific theory. In the IC3 algorithm, the SMT solver is used in several key steps, including state verification, clause generation, and conflict analysis. A clause is a disjunction of several literals, such as A cube is a conjunction of literals, such as A literal is a propositional variable or its negation. For example, if x is a propositional variable, then x or ¬x is a literal, " " indicates logical AND, " " indicates logical negation. However, the SMT solver is called too many times in the whole process. As the complexity of the test case increases, the number of solutions and the solution time also increase. The SMT solution time accounts for too much of the whole process. Unsatisfiable Core (Unsatisfiable Core), usually referred to as UNSAT Core, is an important information that appears when solving Boolean formulas. When using the SMT (Satisfiability Modulo Theories) solver to try to verify a logical formula, if it is found that the formula is unsatisfiable, the SMT solver will return the unsatisfiable core, which is the smallest subset that causes the formula to be unsatisfiable. Summary of the invention

[0005] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, an IC3 accelerated verification method and system based on unsatisfiable cores are provided. The present invention aims to utilize the similarities between a large number of constraint solutions in the IC3 algorithm, construct an unsatisfiable core library according to the previous constraint solutions, and quickly implement the solution of the subsequent part of the problem based on the existing unsatisfiable cores, which can reduce the number of SAT solutions and thus reduce the running time of the IC3 algorithm, thereby accelerating the verification speed of the IC3 algorithm.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0007] An IC3 accelerated verification method based on unsatisfiable cores is used to verify a software program model modeled using the Lustre language. The IC3 accelerated verification method includes inputting the Lustre file of the program model to be verified into an IC3 algorithm model using an SMT solver to solve the program model to obtain a verification result of whether the program model to be verified meets a specified security attribute or specification, and the IC3 algorithm model using the SMT solver to solve the problem includes: initializing an unsatisfiable core library, the unsatisfiable core library is used to store unsatisfiable cores obtained from the solver in the previous solving process, and each time the IC3 algorithm model calls the SMT solver to perform a formula Before solving, check the unsatisfiable core library. If an unsatisfiable core matching the current formula is found in the unsatisfiable core library, directly obtain the unsatisfiable core and skip the solution process of calling the SMT solver this time. Otherwise, call the SMT solver to solve the formula. After calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is unsatisfiable, update the unsatisfiable core returned by the SMT solver to the unsatisfiable core library. If the SMT solver determines that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula. The unsatisfiable core library includes an unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the following formula:

[0008] ,

[0009] In the above formula, Security attributes are used for security conditions or constraints that the software system should meet; is the forward state set, which is the set of states that can be reached from the initial state set I through k-step migration relations T. The forward state set is in conjunction normal form, and its format is ,in ~ For clauses, is logical AND; To transfer the relationship in one step; For clause, clause ,in ~ For text, is logical OR; For Clause After a step of migration, the negative state is logically negated; the unsatisfiable core library also includes an unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the following formula:

[0010] ,

[0011] In the above formula, is the initial state set, For clause, clause ,in ~ For text, is a logical OR, For logical AND, It is logical NOT.

[0012] Optionally, the checking of the unsatisfiable core library before each call of the SMT solver to solve the formula in the IC3 algorithm model includes: arranging the clauses and texts of the formula to be solved in an orderly manner into a formula information list; traversing the unsatisfiable core library to determine whether there are unsatisfiable cores included in the formula information list in the unsatisfiable core library, if there are unsatisfiable cores included in the formula information list, then determining to find an unsatisfiable core matching the current formula in the unsatisfiable core library, otherwise determining to not find an unsatisfiable core matching the current formula in the unsatisfiable core library.

[0013] Optionally, the unsatisfiable core library is a list of variable length composed of units, each unit being a list for storing an unsatisfiable core matching a specified formula.

[0014] Optionally, after calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is not satisfiable, the unsatisfiable core returned by the SMT solver is updated to the unsatisfiable core library, including: obtaining the result of calling the SMT solver to solve the formula, if the result of the formula solving is that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula; if the result of the formula solving is that the current formula is not satisfiable, obtaining the unsatisfiable core of the current formula through the SMT solver, and converting the unsatisfiable core information returned by the SMT solver into a format suitable for storage in the unsatisfiable core library, and storing it in the unsatisfiable core library.

[0015] Optionally, the execution steps of the IC3 algorithm model include:

[0016] Initialize loop variable k;

[0017] Forward process: Execute the forward solution of IC3 algorithm and call SMT solver to solve the formula. If the fixed point is reached after the solution, the property is judged to be established, and the program model to be verified meets the specified security property or the verification result of the specification, and then the process ends and exits. If the fixed point is not reached after the solution, the block process is entered;

[0018] Block process: Execute the block process of the IC3 algorithm and call the SMT solver to solve the formula. If a real counterexample is found after the solution, the property is judged to be invalid, and the program model to be verified does not meet the specified security properties or the specified verification results. The process ends and exits. If no real counterexample is found, the loop variable k is increased by 1 and the forward process is entered.

[0019] In addition, the present invention also provides an IC3 accelerated verification system based on an unsatisfiable core, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the IC3 accelerated verification method based on an unsatisfiable core.

[0020] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the IC3 acceleration verification method based on unsatisfiable cores through a processor.

[0021] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the IC3 acceleration verification method based on unsatisfiable cores through a processor.

[0022] Compared with the prior art, the present invention mainly has the following advantages:

[0023] 1. The present invention constructs and utilizes an unsatisfiable core library, and quickly solves the following problems based on the existing unsatisfiable cores. Reusing the previous SMT solution results can avoid repeated calculations of already solved problems, thereby reducing calculation time and accelerating verification speed;

[0024] 2. Since the present invention does not need to use the SMT solver to re-solve some of the problems, the algorithm can reduce the number of calls to the SMT solver, thereby reducing overall resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.

[0026] Figure 2 Schematic diagram of the execution framework of the IC3 algorithm in an embodiment of the present invention.

[0027] Figure 3 It is a data structure that cannot satisfy the core library in the embodiment of the present invention.

[0028] Figure 4 The flowchart of using an unsatisfiable core library to judge reuse in an embodiment of the present invention.

[0029] Figure 5The flowchart of updating the unsatisfiable core library in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] The present invention is further described below in conjunction with the accompanying drawings and specific preferred embodiments of the specification, but the scope of protection of the present invention is not limited thereby. The present invention aims to solve the following technical problems: the IC3 algorithm can be used in software program verification to check whether the software program meets functional requirements, security and other specifications. When using the IC3 algorithm for software program verification, two major challenges are faced: due to the complexity of the software program, the IC3 algorithm needs to frequently call the SMT solver to solve the constraints during the verification process, resulting in a long solution time, affecting the verification efficiency; during the operation of the IC3 algorithm, a large number of constraint solutions have similarities, but the existing IC3 algorithm fails to effectively reuse the existing solution information, resulting in repeated calculations, further exacerbating the problem of long solution time. To this end, the present invention proposes an IC3 accelerated verification method and system based on unsatisfiable cores, which aims to construct an unsatisfiable core library and use the existing unsatisfiable cores to quickly solve the following part of the problem, thereby effectively reducing the number and time of solutions and improving the speed and efficiency of software program verification.

[0031] like Figure 1 and Figure 2 As shown, the IC3 accelerated verification method based on unsatisfiable cores in this embodiment is used to verify the software program model modeled using the Lustre language. The IC3 accelerated verification method includes inputting the Lustre file of the program model to be verified into the IC3 algorithm model of the SMT solver for solving to obtain a verification result of whether the program model to be verified satisfies the specified security attributes or specifications, and the IC3 algorithm model of the SMT solver is used for solving, including: initializing an unsatisfiable core library, the unsatisfiable core library is used to store the unsatisfiable cores obtained from the solver in the previous solving process, and in the IC 3 The algorithm model checks the unsatisfiable core library each time before calling the SMT solver to solve the formula. If an unsatisfiable core matching the current formula is found in the unsatisfiable core library, the unsatisfiable core is directly obtained and the solution process of calling the SMT solver this time is skipped. Otherwise, the SMT solver is called to solve the formula. After calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is unsatisfiable, the unsatisfiable core returned by the SMT solver is updated to the unsatisfiable core library. If the SMT solver determines that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula.

[0032] like Figure 2 As shown, the execution steps of the IC3 algorithm model in this embodiment include:

[0033] Initialize loop variable k;

[0034] Forward process: Execute the forward solution of IC3 algorithm and call SMT solver to solve the formula. If the fixed point is reached after the solution, the property is judged to be established, and the program model to be verified meets the specified security property or the verification result of the specification, and then the process ends and exits. If the fixed point is not reached after the solution, the block process is entered;

[0035] Block process: Execute the block process of IC3 algorithm to solve and call SMT solver to solve the formula. If a real counterexample is found after solving, the property is judged to be invalid, and the program model to be verified does not meet the specified security property or the specified verification result, and the process ends and exits; if no real counterexample is found, the loop variable k is increased by 1 and the forward process is entered. In the process of executing IC3 algorithm, there are mainly two processes: forward phase and block phase. In the block phase, conflict analysis and counterexample blocking are used to ensure that the invariant clause is valid in the system. If the security property is found to be invalid, the algorithm will return a counterexample, indicating that there is a defect in the system. In the forward phase, the reachable state is gradually propagated through forward state expansion to verify and enhance the invariant clause of the system. If the fixed point is reached, the algorithm returns to safety, proving that the system meets the given security property. In these two processes, a large number of constraint solutions will be performed, and some formulas will be solved repeatedly. Therefore, by building an unsatisfiable core library, the existing unsatisfiable cores can be used to quickly solve the following problems, thereby effectively reducing the number and time of solutions and improving the speed and efficiency of software program verification.

[0036] In this embodiment, the IC3 algorithm is improved in the open source symbolic model checking tool Kind2. The symbolic model checking tool Kind2 is mainly used to verify whether the program model written in Lustre language meets specific security attributes or specifications. Therefore, the program model to be verified is a lustre file, and the final output is whether the model meets specific security attributes or specifications, that is, "valid" (meets the attribute) or "invalid" (does not meet the attribute). In addition, the symbolic model checking tool Kind2 will also output key statistical information such as the running time, constraint solving time, and number of solving times of the IC3 algorithm.

[0037] The unsatisfiable core library in this embodiment is a list of variable length composed of units, each unit is a list for storing an unsatisfiable core matching a specified formula, wherein the specified formula of each unit can be matched as needed. As an optional implementation, the unsatisfiable core library in this embodiment includes an unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the following formula:

[0038] , (1)

[0039] In the above formula, Security attributes are used for security conditions or constraints that the software system should meet; is the forward state set, which is the set of states that can be reached from the initial state set I through k-step migration relations T. The forward state set is in conjunction normal form, and its format is ,in ~ For clauses, is logical AND; To transfer the relationship in one step; For clause, clause ,in ~ For text, is logical OR; For Clause After a step of migration, the negative state In this embodiment, the unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the above formula is named "unsat_core_F", and its structure is as follows: Figure 3 As shown, taking the first unit as an example, ~ Represents the forward state set The unsatisfiable core of express The unsatisfiable core Is the forward state set A subset of ~ Representation Clause C The unsatisfiable core of Expression Clause C The unsatisfiable core Is Clause C A subset of .

[0040] As an optional implementation manner, in this embodiment, the unsatisfiable core library further includes an unsatisfiable core library for storing unsatisfiable cores matched by the formula shown in the following formula:

[0041] , (2)

[0042] In the above formula, is the initial state set, For clause, clause ,in ~ For text, is a logical OR, For logical AND, is logical negation. In this embodiment, the unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the above formula is named "unsat_core_I". The storage format of the "unsat_core_I" library is the same as that of the "unsat_core_F" library.

[0043] In the execution process of IC3 algorithm, a large number of constraint solving is an essential step, among which the number of solving times of formula (1) and formula (2) accounts for more than 50%, and there are similarities in the solving process of these two formulas. In view of the above problems, the concept of unsatisfiable core is introduced in this embodiment, and unsatisfiable core library is constructed: "unsat_core_F" library and "unsat_core_I" library. "unsat_core_F" library and "unsat_core_I" library are lists of variable length, and each unit is also a list, which is used to store the unsatisfiable core information of a specific formula. On the basis of constructing the unsatisfiable core library, the unsatisfiable core library can be used as a cache of unsatisfiable cores to accelerate the IC3 algorithm: before solving the formula, first check the unsatisfiable core library to determine whether the previously stored unsatisfiable core information can be reused. If the unsatisfiable core information matching the current formula can be found, the current solving process can be skipped directly, thereby saving computing time. If no reusable information is found in the unsatisfiable core library, the SMT solver needs to be called for a new solution; after the SMT solution, when the SMT solver determines that the current logic formula is unsatisfiable, the unsatisfiable core returned by the SMT solver is stored in the unsatisfiable core library, thereby updating the library. These unsatisfiable core information records the minimum subset that causes the formula to be unsatisfiable. When solving similar logic formulas in the future, the information in the unsatisfiable core library can be reused, thereby skipping unnecessary solution processes and speeding up verification.

[0044] like Figure 4As shown, in this embodiment, before the IC3 algorithm model calls the SMT solver each time to solve the formula, checking the unsatisfiable core library includes: organizing the clauses and texts of the formula to be solved in an orderly manner into a formula information list; connecting and organizing the relevant information of the formula to be solved to form a formula information list for subsequent processing. This formula information list contains important information to be solved in the current logic formula. Through this step, the clauses and texts in the formula are orderly organized into a data structure, which is convenient for subsequent query and processing. Traverse the unsatisfiable core library to determine whether there is an unsatisfiable core a included in the formula information list in the unsatisfiable core library. If there is an unsatisfiable core a included in the formula information list, it is determined that an unsatisfiable core matching the current formula is found in the unsatisfiable core library and the unsatisfiable core a can be reused to skip this solution, otherwise it is determined that no unsatisfiable core matching the current formula is found in the unsatisfiable core library. Before solving a new logic formula, first check whether there is unsatisfiable core information related to the current formula in the unsatisfiable core library. Traverse the unsatisfiable core library and check whether there is an unsatisfiable core in the unsatisfiable core library included in the formula information list (named formulaInfo in this embodiment). If there is relevant information in the unsatisfiable core library, that is, there is an unsatisfiable core in the unsatisfiable core library included in the formula information list, then the information can be reused to skip the current solution and avoid calling the SMT solver again; if there is no relevant information, call the SMT solver for a new solution.

[0045] For example, for the formula (1) to be checked, suppose The form is , yes , then first The clause in , , , )and The text in ( , , , ) to form a formula information list. Traverse "unsat_core_F" and check whether there is an unsat core in "unsat_core_F", whose elements are all included in the formula information list formulaInfo list. If such an unsat core exists, return the unsat core and the Boolean value "true"; if not, return an empty list and the Boolean value "false". If , so that ,but is unsatisfiable. Assume that there is an unsatisfiable core in "unsat_core_F" ,but is unsatisfiable, then:

[0046] It is also unsatisfactory.

[0047] When solving formula (1), that is:

[0048] When, because ,Right now:

[0049] .

[0050] Therefore, formula (1) is also unsatisfiable. In this case, the unsatisfiable core can be reused and this solution can be skipped.

[0051] Similarly for formula (2), if yes , then first I and The text in ( , , , ) to form a formula information list. Traverse "unsat_core_I" and check whether there is an unsat core in "unsat_core_I" whose elements are contained in the formula information list formulaInfo list. If such a core exists, return the unsat core and the Boolean value "true"; if not, return an empty list and the Boolean value "false". If , so that ,but is unsatisfiable. Assume that there is an unsatisfiable core in "unsat_core_I" ,but is unsatisfactory. When solving formula (2), that is, When, because ,Right now Therefore, formula (2) is also unsatisfiable. In this case, the unsatisfiable core can be reused and this solution can be skipped.

[0052] In addition, if the returned Boolean value is "true", it means that the previous unsatisfiable core can be reused, so there is no need to solve it again and it can be skipped directly. If the returned Boolean value is "false", it means that the previous unsatisfiable core cannot be reused and the SMT solver needs to be called for a new solution.

[0053] like Figure 5As shown, in this embodiment, after calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is unsatisfiable, the unsatisfiable core returned by the SMT solver is updated to the unsatisfiable core library, including: obtaining the result of calling the SMT solver to solve the formula, if the result of the formula solving is that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula; if the result of the formula solving is that the current formula is unsatisfiable, obtaining the unsatisfiable core of the current formula through the SMT solver, and converting the unsatisfiable core information returned by the SMT solver into a format suitable for storage in the unsatisfiable core library, and storing it in the unsatisfiable core library. The uniqueness and simplicity of the unsatisfiable core library must be guaranteed during storage.

[0054] When solving formula (1), the unsatisfiable core returned by the SMT solver is and A subset of , namely: , Through format conversion, we get the unsatisfiable core The corresponding unsatisfiable core Based on the unsatisfiable core , So that:

[0055] It is also unsatisfactory.

[0056] Therefore, the core cannot be satisfied and The connection is a list join_unsat_core and is ready to be stored in "unsat_core_F". For formula (1), assume The form is , yes , the SMT solver solves formula (1), that is, solves:

[0057] .

[0058] Assuming that the formula is unsatisfiable, the SMT solver will return the unsatisfiable core of the formula, assuming that , , , , you need to , Convert to Then , and The connection is a list join_unsat_core ready to be stored in "unsat_core_F".

[0059] When solving formula (2), the unsatisfiable kernel returned is and A subset of By conversion, we get Corresponding form. Make is also unsatisfactory. and The connection is a list join_unsat_core and is ready to be stored in "unsat_core_I". For formula (2), assuming yes , the SMT solver solves formula (2), that is, 。 Assuming that the formula is unsatisfiable, the SMT solver will return the unsatisfiable core of the formula, assuming that I , , , you need to , Convert to Then I and The connection is a list join_unsat_core ready to be stored in "unsat_core_I".

[0060] In this embodiment, in order to ensure that there is no inclusion relationship between the data in the two unsatisfiable core libraries "unsat_core_F" and "unsat_core_I", the unsatisfiable cores obtained after solving a certain formula are first connected into a list join_unsat_core, and then the list is added to the unsatisfiable core library according to the rules. Here, "unsat_core_F" is taken as an example for explanation:

[0061] Condition (1): If , , then the Replace with ;

[0062] Condition (2): If unsat_core_F , , then the "unsat_core_F" is not added;

[0063] Condition (3): If , so that:

[0064] and join_ , then the join_ Added to "unsat_core_F".

[0065] When solving formula (1), if the formula is unsatisfiable, the unsatisfiable core returned is , , , , then the list join_unsat_core is If there is an unsat_core_F with an unsatisfiable core , , that is, it satisfies the above condition (1), then replace the unsatisfiable core with the list join_unsat_core; if there is an unsatisfiable core in unsat_core_F , that is, if the above condition (2) is met, the list join_unsat_core is not added to "unsat_core_F".

[0066] In order to verify the IC3 accelerated verification method based on the unsatisfiable core of this embodiment, the IC3 accelerated verification method based on the unsatisfiable core of this embodiment is compared with the original IC3 algorithm. The comparison shows that the IC3 accelerated verification method based on the unsatisfiable core of this embodiment and the original IC3 algorithm can reduce the number of constraint solving times by about 50%, thereby effectively shortening the solving time and improving the verification efficiency.

[0067] In summary, the IC3 accelerated verification method based on unsatisfiable cores in this embodiment includes first initializing an unsatisfiable core library. Before solving a specific formula, first check the unsatisfiable core library to determine whether the previously stored unsatisfiable core information can be reused. If the unsatisfiable core information that matches the current formula can be found, the current solution process can be skipped directly, thereby saving computing time. If no reusable information is found in the unsatisfiable core library, it is necessary to call the SMT solver for a new solution. After performing the SMT solution, when the SMT solver determines that the current logic formula is unsatisfiable, the unsatisfiable core returned by the SMT solver is stored in the unsatisfiable core library, thereby updating the unsatisfiable core library. These unsatisfiable core information records the minimum subset that causes the formula to be unsatisfiable. When solving similar logic formulas in the subsequent solution, the information in the unsatisfiable core library can be reused, thereby skipping unnecessary solution processes. When verifying complex program models, compared to the original IC3 algorithm, the IC3 accelerated verification method based on the unsatisfiable core of this embodiment effectively reduces the number of solutions, thereby shortening the solution time. This optimization ultimately leads to a reduction in the overall verification time of the IC3 algorithm, thereby achieving an increase in verification speed. The IC3 accelerated verification method based on the unsatisfiable core of this embodiment shows significant advantages over the original IC3 algorithm. Its core advantage is that it significantly reduces the number of constraint solutions. Compared with the original algorithm, the IC3 accelerated verification method based on the unsatisfiable core of this embodiment can reduce the number of constraint solutions by about 50%, thereby effectively shortening the solution time and improving verification efficiency.

[0068] In addition, the present embodiment also provides an IC3 accelerated verification system based on an unsatisfiable core, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the IC3 accelerated verification method based on an unsatisfiable core.

[0069] In addition, this embodiment also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the IC3 acceleration verification method based on unsatisfiable cores through a processor.

[0070] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the IC3 acceleration verification method based on unsatisfiable cores through a processor.

[0071] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0072] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. An IC3 accelerated verification method based on unsatisfiable cores, used to verify a software program model modeled using the Lustre language, characterized in that: The IC3 accelerated verification method includes inputting the Lustre file of the program model to be verified into the IC3 algorithm model of the SMT solver for solving to obtain a verification result of whether the program model to be verified meets the specified security attributes or specifications, and the IC3 algorithm model of the SMT solver is used for solving, including: initializing an unsatisfiable core library, the unsatisfiable core library is used to store unsatisfiable cores obtained from the solver in the previous solving process, checking the unsatisfiable core library before the IC3 algorithm model calls the SMT solver each time to solve the formula, and if a core is found in the unsatisfiable core library, The unsatisfiable core that matches the current formula is directly obtained and the solution process of calling the SMT solver this time is skipped. Otherwise, the SMT solver is called to solve the formula; after calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is unsatisfiable, the unsatisfiable core returned by the SMT solver is updated to the unsatisfiable core library; if the SMT solver determines that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula; the unsatisfiable core library includes an unsatisfiable core library for storing unsatisfiable cores that match the formula shown in the following formula: ， In the above formula, Security attributes are used for security conditions or constraints that the software system should meet; is the forward state set, which is the set of states that can be reached from the initial state set I through k-step migration relations T. The forward state set is in conjunction normal form, and its format is ,in ~ For clauses, is logical AND; To transfer the relationship in one step; For clause, clause ,in ~ For text, is logical OR; For Clause After a step of migration, the negative state is logically negated; the unsatisfiable core library also includes an unsatisfiable core library for storing unsatisfiable cores matching the formula shown in the following formula: ， In the above formula, is the initial state set, For clause, clause ,in ~ For text, is a logical OR, For logical AND, It is logical negation; The execution steps of the IC3 algorithm model include: Initialize loop variable k; Forward process: Execute the forward solution of IC3 algorithm and call SMT solver to solve the formula. If the fixed point is reached after the solution, the property is judged to be established, and the program model to be verified meets the specified security property or the verification result of the specification, and then the process ends and exits. If the fixed point is not reached after the solution, the block process is entered; Block process: Execute the block process of the IC3 algorithm and call the SMT solver to solve the formula. If a real counterexample is found after the solution, the property is judged to be invalid, and the program model to be verified does not meet the specified security properties or the specified verification results. The process ends and exits. If no real counterexample is found, the loop variable k is increased by 1 and the forward process is entered.

2. The IC3 accelerated verification method based on unsatisfiable core according to claim 1, characterized in that: The unsatisfiable core library is a list of variable length composed of units, and each unit is a list for storing an unsatisfiable core matching a specified formula.

3. The IC3 accelerated verification method based on unsatisfiable core according to claim 1, characterized in that: The checking of the unsatisfiable core library before each call of the SMT solver to solve the formula in the IC3 algorithm model includes: orderly arranging the clauses and texts of the formula to be solved into a formula information list; traversing the unsatisfiable core library to determine whether there are unsatisfiable cores included in the formula information list in the unsatisfiable core library, if there are unsatisfiable cores included in the formula information list, then determining to find an unsatisfiable core matching the current formula in the unsatisfiable core library, otherwise determining to not find an unsatisfiable core matching the current formula in the unsatisfiable core library.

4. The IC3 accelerated verification method based on unsatisfiable core according to claim 1, characterized in that: After calling the SMT solver to solve the formula, if the SMT solver determines that the current formula is not satisfiable, the unsatisfiable core returned by the SMT solver is updated to the unsatisfiable core library, including: obtaining the result of calling the SMT solver to solve the formula, if the result of the formula solving is that the current formula is satisfiable, the SMT solver returns a set of assignments that satisfy the current formula; if the result of the formula solving is that the current formula is not satisfiable, obtaining the unsatisfiable core of the current formula through the SMT solver, and converting the unsatisfiable core information returned by the SMT solver into a format suitable for storage in the unsatisfiable core library, and storing it in the unsatisfiable core library.

5. An IC3 accelerated verification system based on an unsatisfiable core, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the IC3 accelerated verification method based on unsatisfiable cores as described in any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the IC3 accelerated verification method based on unsatisfiable cores as described in any one of claims 1 to 4 through a processor.

7. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the IC3 accelerated verification method based on unsatisfiable cores as described in any one of claims 1 to 4 through a processor.

Images