An IC3 algorithm optimization method and system based on error state tree
By using the error state tree to multiplex error states in the IC3 algorithm, the problem of repeated solutions in the IC3 algorithm is solved, the verification efficiency is improved, and the error state removal is achieved faster.
Patent Information
- Application Number
- CN202411378254.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-30
- Publication Date
- 2024-12-24
- Estimated Expiration
- 2044-09-30
AI Technical Summary
There is a problem of repeated solution during the verification process of the IC3 algorithm, which leads to insufficient efficiency and cannot effectively reduce the error state path.
By using the built error state tree in each block process of the IC3 algorithm to achieve error state reuse, reduce the number of constraint solutions, and establish an error state tree to save the error state and its predecessor state that can be reached in one step. Use model inspection Tool Kind2 optimization IC3 algorithm iterative solution.
It improves the efficiency of solving error states in the IC3 algorithm, reduces the number of constraint solutions, and reduces the scale of error states. The optimized IC3 algorithm eliminates error states faster under the same verification file.
Smart Images
Figure CN118917106B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a program model verification technology in the field of software engineering, and in particular to an IC3 algorithm optimization method and system based on an error state tree. Background Art
[0002] In recent years, the size and complexity of software in safety-critical systems such as aerospace, transportation, and medical devices have increased significantly. Lustre is a synchronous data flow model that has been widely used in the development of safety-critical equipment after years of development, such as in aerospace electronic systems by companies such as Rockwell Collins. After the Lustre model is built, ensuring the safety of the system depends largely on verifying the effectiveness of the Lustre model.
[0003] Kind2 is a Lustre automatic model checker that supports multiple model checking algorithms, such as bounded model checking (BMC), IC3, and k-induction. Kin2 supports starting multiple algorithm engines at the same time to achieve optimal performance, but this consumes unnecessary computing resources. In the previous research work, the verification efficiency of different algorithms in Kind was compared, and it was found that the IC3 algorithm performed best when each algorithm was run separately. The IC3 algorithm was proposed by Aaron Bradley in 2007. It uses the advantages of property guidance to incrementally enhance the security properties of the system, so it is also called the Property Directed Reachability (PDR) method. Unlike the BMC or k-induction algorithm, which gradually expands the state space, the IC3 algorithm only expands once, avoiding the problem of being unable to solve due to the large size of the SAT problem.
[0004] Before introducing the original IC3 algorithm, let's first introduce some background knowledge: All formulas in IC3 are expressed in conjunctive normal form (CNF). Each item in CNF is a clause, each clause is the disjunction of several literals, and each literal is an atomic proposition or its negated form. For example is a conjunctive normal form CNF, where and is a clause, and the 、 、 and It's all text. and Represents the two basic logical operators "or" (disjunction) and "and" (conjunction). Given a migration system ,use represents a collection of state variables, represents the initial state set (hereinafter referred to as ), Represents a migration relationship (hereinafter referred to as ). The system state is the state variable Since each variable assignment can be represented by a literal, the system state is actually a conjunctive normal form CNF formula. The property that all states in the transition system satisfy is called the safety property, which is represented by Indicates, later abbreviated as If a system state After one or more migration steps, it will arrive at P , but the initial state is unreachable, and such a system state is called an error state, also called a bad point. Indicates. After negating, we get a corresponding strengthening clause , this clause can only remove this error condition. If you can find a suitable Make ,Add to You can remove and A similar error state cluster. Find the corresponding The process of is the generalization process of bad points, where the subscript g is taken from the first letter of generalization.
[0005] The IC3 algorithm maintains a k The upper approximate state set sequence of step-reachable states , called frame ,in , each All must satisfy the following properties:
[0006] , (1)
[0007] , (2)
[0008] , (3)
[0009] In the above formula, Indicates implication, formula (1) shows that in addition to Other All by attributes and some clauses. Formula (2) can also be understood as .from frame In terms of structural design, these two formulas are well satisfied. Combining formulas (1) and (2), we can get ,when Then, combined with formula (3), we can get , that is to say, an inductive invariant (also called a fixed point) is found at this time . Actually This shows that is an invariant, property safety. In addition, if a system state satisfies , denoted as .
[0010] Now focus on frame In the sequence creation process, the outermost pointer k The main iterative process of the control algorithm is k In the iteration block and fwd The process will continue to improve the entire sequence. block The process is to Keep adding clauses to strengthen ,and fwd The process is to The part in the can be used clause to The following simulation of the IC3 algorithm is performed from the beginning.
[0011] Iteration 0 ( iteration 0): According to formula (1), the initial state Must meet , so check If satisfied, the initial state violates , no need to proceed to the following steps. If it does not meet the requirement, then , continue to check the above three conditions, formula (1) (2) has been passed is satisfied, we also need to check formula (3), If not satisfied, continue with the following steps.
[0012] Iteration 1 ( iteration 1): There are no other clauses in ,examine The satisfiability of is used to find the error state. (1) If it is not satisfied, then let ,because , the three conditions are still satisfied and a fixed point is found. (2) If satisfied, then there exists a , its next state can be reached Now we need to determine this Is it reachable? If yes, find a counterexample. If not, then explain this can be eliminated, then The corresponding generalization join in Repeat the search until Unsatisfactory, this is block The main role of the process.
[0013] Iteration 2 ( iteration 2): At this time Other clauses have been added to ,start up fwd Process inspection. ,if ,and ,So In Can be forwarded to middle, The clauses in This is the purpose of the fwd procedure. block Process, Inspection If the satisfiability of is satisfied, then there exists a , its next state can be reached Now we need to determine this Whether the initial state can be reached, first check , if satisfied, then there is a state, which can be reached after one step of migration , that is to say There is a predecessor state , continue to check The satisfaction of , the processing method of satisfaction or dissatisfaction is the same as that of iteration 1 ( iteration 1).
[0014] The IC3 algorithm continues to execute the above iterative process. There are two situations that terminate the IC3 algorithm. One is when fwd Encountered in the process All clauses in can be forwarded to If , find the fixed point, in this case the property is safe; second, blockDuring the execution, a counterexample is found that can reach the initial state. In this case, the attribute is unsafe. Finding error conditions in layers , it will be executed every time This constraint solver. frame The meaning of the sequence, each represent k The upper approximate state set of the reachable state in steps, according to formula (2), The state set represented by ,So The bad pixels that appeared in the Therefore, there are repeated solving processes in the execution of IC3 algorithm, which leads to insufficient efficiency. Summary of the invention
[0015] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, an IC3 algorithm optimization method and system based on an error state tree are provided. The present invention aims to utilize the optimized IC3 algorithm for iterative solution, including utilizing the established error state tree in each Block process of the IC3 algorithm to realize the reuse of error states so as to shorten the error state path and reduce the number of constraint solving times during the execution of the IC3 algorithm, thereby improving the error state solving efficiency in the IC3 algorithm.
[0016] In order to solve the above technical problems, the technical solution adopted by the present invention is:
[0017] An IC3 algorithm optimization method based on an error state tree comprises the following steps:
[0018] S1, get the verified program with attributes Lustre model file;
[0019] S2, will have attributes The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain the verification result and the error state tree, and the iterative solution using the optimized IC3 algorithm includes using the built error state tree in each Block process of the IC3 algorithm to realize the reuse of the error state to shorten the error state path and reduce the number of constraint solutions in the execution process of the IC3 algorithm; the The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain the verification results and error status tree including:
[0020] S2.1, attribute As the root node of the error status tree;
[0021] S2.2, in each Block process of the IC3 algorithm, check whether the error state in the error state tree will appear again. When the existing error state appears again, it is directly reused without constraint solving. Otherwise, constraint solving is performed according to the IC3 algorithm to find a new error state, and the found error state is added to the error state tree. The bad points corresponding to the error state are removed, and the process is iterated until the verification is completed;
[0022] S2.3, check whether all the error states found can be eliminated, and if so, output the properties of the verified program Safe verification result, otherwise find a counterexample path and output it as the verification result, and output the final error state tree;
[0023] When the found error state is added to the error state tree, the nodes stored in the error state tree are all clauses after the error state is negated, and the attribute Each clause is provided with a serial number id represented by an integer. The serial number id of the clause increases with the number of clauses and is not repeated. Therefore, the serial number id of the clause is used as the unique identifier of the node stored in the error status tree.
[0024] Optionally, the model checking tool in step S2 is a Kind2 model checker.
[0025] Optionally, when adding the found error state to the error state tree, the error state added to the error state tree includes two types of child nodes. The first type of child node is a one-step reachable The corresponding nodes of the error state are collectively referred to as Node, where Indicates an error state, and the subscript 1 indicates that it can be reached in one step , Representation attributes Of non, The front of the node Indicates that such a step can be reached The error state is negated; the second type is reachable in two or more steps The error state is not, the corresponding node is Node, in the subscript Indicates that two or more steps can be reached ; When adding the found error state to the error state tree, if the node corresponding to the found error state is Node, the root node of the error status tree is used as the The node's father node; if the node corresponding to the found error state is reachable in two steps of Node, then the corresponding one-step reachable of The node is reachable in two steps. of The node's father node; if the node corresponding to the error state found is reachable in three steps of Node, then the corresponding two-step reachable of Nodes are reachable in three steps of The parent node of the node; and so on, after finding the clause number id corresponding to the correct father node, add it as a child node.
[0026] Optionally, in step S2, when iteratively solving using the optimized IC3 algorithm, the solution also includes storing the loop invariant clauses obtained by the solution into a global invariant list; in step S2.2, when checking whether the error state in the error state tree will appear again, first check whether the error state in the error state tree will appear again. Whether the node's error state will reappear includes:
[0027] S2.2.1A, find all child nodes of the root node in the error state tree and store them as a one-step reachable node list;
[0028] S2.2.2A, filter out the invariant list corresponding to the invariant from the one-step reachable node list node;
[0029] S2.2.3A, filter out the current node from the list of nodes reachable in one step i Step-reachable state set Corresponding node;
[0030] S2.2.4A, determine whether there are still remaining nodes in the one-step reachable node list nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. The redundant operation of the node is performed on the remaining nodes in turn. The node is generalized and added to the current i Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the one-step reachable node list The node performs constraint solving to find a new error state, and then adds the found error state to the error state tree and removes the bad point corresponding to the error state. The process is iterated until the node in the one-step reachable node list is reached. All node verification is completed.
[0031] Optionally, in step S2, when using the optimized IC3 algorithm to iteratively solve, the iterative solution also includes storing the loop invariant clause obtained by solving it into a global invariant list; in step S2.2, when checking whether the error state in the error state tree will appear again, then checking the error state tree in the error state tree. Whether the node's error state will reappear includes:
[0032] S2.2.1B, find all Nodes are saved as a list of nodes reachable in two or more steps;
[0033] S2.2.2B, filter out the invariants in the invariant list from the list of nodes reachable in two or more steps. node;
[0034] S2.2.3B, filter out the current node from the list of nodes reachable in two or more steps i Step-reachable state set Corresponding node;
[0035] S2.2.4B, determine whether there are any remaining nodes in the list of nodes that can be reached in two or more steps nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. Redundant operation of nodes; the remaining The node is generalized and added to the current j Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the nodes in the list of two or more reachable steps The node performs constraint solving to find a new error state, and adds the found error state to the error state tree, then removes the bad point corresponding to the error state, and iterates the process until the node in the list of nodes that can be reached in two or more steps is reached. All node verification is completed.
[0036] In addition, the present invention also provides an IC3 algorithm optimization system based on an error state tree, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree.
[0037] In addition, the present invention also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree through a processor.
[0038] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the IC3 algorithm optimization method based on the error state tree through a processor.
[0039] Compared with the prior art, the present invention mainly has the following advantages:
[0040] 1. The IC3 algorithm optimization method based on the error state tree of the present invention establishes an error state tree ( bad state tree ), which saves all the one-step reachable Error status Corresponding and all its predecessor states , which is not done in the original IC3 algorithm.
[0041] 2. The IC3 algorithm optimization method based on the error state tree of the present invention realizes the reuse of error states by utilizing the established error state tree. Compared with the original algorithm which performs a series of constraint solving every time when searching for error states, the IC3 optimization algorithm based on the error state tree reduces the number of constraint solving times during the algorithm execution process, thereby improving the execution efficiency of the original algorithm.
[0042] 3. The IC3 algorithm optimization method based on the error state tree of the present invention reduces the scale of error states by reusing the nodes in the error state tree. When the same verification file is input, the optimized IC3 algorithm can find fewer error states through reusing and then eliminate them faster. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] Figure 1 Schematic diagram of the basic flow of the method of the embodiment of the present invention.
[0044] Figure 2 Schematic diagram of the execution flow of the optimized IC3 algorithm in an embodiment of the present invention.
[0045] Figure 3 1 is a comparison diagram of the effects before and after optimization in an embodiment of the present invention, wherein (a) is an error state tree obtained using the original IC3 algorithm, and (b) is an error state tree obtained using the optimized IC3 algorithm.
[0046] Figure 4 Schematic diagram of reusing error status in an embodiment of the present invention. DETAILED DESCRIPTION
[0047] The technical solution of the present invention is only an example, the purpose of which is to describe the specific implementation mode of the present invention more clearly and completely. At the same time, the present invention is not limited to the described embodiments, but includes all technical applications related to the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative inventions belong to the scope of protection of the present invention. The embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings and a specific use case.
[0048] like Figure 1 As shown, the IC3 algorithm optimization method based on the error state tree of this embodiment includes the following steps:
[0049] S1, get the verified program with attributes Lustre model file;
[0050] S2, will have attributes The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain verification results and an error state tree. The iterative solution using the optimized IC3 algorithm includes using the built error state tree in each Block process of the IC3 algorithm to reuse the error state to shorten the error state path and reduce the number of constraint solutions during the execution of the IC3 algorithm.
[0051] As an optional implementation, the model checking tool in step S2 of this embodiment is a Kind2 model checker. The original IC3 algorithm in the Kind2 model checker is replaced by the optimized IC3 algorithm. Given a model with attributes The Lustre model file is input into the Kind2 model checker to verify whether its attributes are safe. The improved IC3 algorithm is executed. If the attributes are safe, the verification ends; otherwise, a counterexample is found and output. At the same time, after each optimization algorithm is executed, a file with the error state tree built in this verification is output. The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain verification results and error status, including visual output of the error status tree. Specifically, each time the optimized IC3 algorithm is used, a pdf file with the same name as the input file and a drawing of the error status tree built in this verification will be output.
[0052] like Figure 2 As shown, the iterative solution using the optimized IC3 algorithm in step S2 of this embodiment includes:
[0053] S2.1, attribute As the root node of the error status tree;
[0054] S2.2, in each Block process of the IC3 algorithm, check whether the error state in the error state tree will appear again. When the existing error state appears again, it is directly reused without constraint solving. Otherwise, constraint solving is performed according to the IC3 algorithm to find a new error state, and the found error state is added to the error state tree. The bad points corresponding to the error state are removed, and the process is iterated until the verification is completed;
[0055] S2.3, check whether the bad pixels corresponding to all the error states found can be eliminated. If so, output the properties of the verified program. A safe verification result is obtained. Otherwise, a counterexample path is found and output as the verification result, and the final error state tree is output.
[0056] When the error state tree is established in this embodiment, the nodes stored in the error state tree are all clauses after the error state is negated, and each clause is provided with a number id represented by an integer. The number id of the clause increases with the number of clauses and is not repeated, so the number id of the clause is used as the unique identifier of the node stored in the error state tree. After the partial error state tree is built, you can start to check whether the existing nodes in the tree will appear repeatedly. In this process, once a clause is added to the constraint solver as an invariant, it will be stored in a global invariant list, which only increases and does not decrease, that is, it will gradually save all the invariants that appear during the execution of the algorithm. When checking whether the nodes in the tree will appear again later, the clauses in the entire invariant list are first filtered out from the reusable clause list before other checks are performed.
[0057] When the present embodiment adds the found error state to the error state tree, the error state added to the error state tree includes two types of child nodes. The first type of child node is a one-step reachable The corresponding nodes of the error state are collectively referred to as Node, where Indicates an error state, and the subscript 1 indicates that it can be reached in one step , Representation attributes Of non, The front of the node Indicates that such a step can be reached The error state is negated; the second type is reachable in two or more steps The error state is not, the corresponding node is Node, in the subscript Indicates that two or more steps can be reached ; When adding the found error state to the error state tree, if the node corresponding to the found error state is Node, the root node of the error status tree is used as the The node's father node; if the node corresponding to the found error state is reachable in two steps of Node, then the corresponding one-step reachable of The node is reachable in two steps. of The node's father node; if the node corresponding to the error state found is reachable in three steps of Node, then the corresponding two-step reachable of Nodes are reachable in three steps of The parent node of the node; and so on, after finding the clause number id corresponding to the correct father node, add it as a child node.
[0058] like Figure 3 As shown in the figure, the effect of the method of this embodiment on a specific use case is significant: the same Lustre model is verified, the left side (a) is the error state tree output when the original IC3 algorithm is used for verification, and the right side (b) is the error state tree when the optimized IC3 algorithm is used for verification, and the latter tree is significantly reduced. Furthermore, the verification using the original IC3 algorithm takes 0.517s, while the IC3 algorithm optimized by this embodiment only takes 0.417s, which shows that the verification efficiency of the optimized IC3 algorithm in this specific example is greatly improved.
[0059] Combine the following Figure 3 Detailed explanation of the optimized IC3 algorithm implementation steps: First, establish an error state tree, the root node of the tree is the attribute , the child nodes of the root node consist of clauses generated by negating all error states. In the tree, these nodes are represented by digital ids. To make it easier to distinguish, # is added in front to indicate that it is a node on the tree. Figure 3 In the error state tree (a) obtained by using the original IC3 algorithm on the left, the error states corresponding to the nine child nodes "4", "6", "8", "14", ..., "97" can be reached in one step. ,therefore is the parent node of these error states after they are negated. In the previous text, these nodes are called Node. When the error state is two steps away hour, These are The parent node of the node, such as "14" is the parent node of "15", "21" is the parent node of "20", etc.; when the error state is reachable in multiple steps hour, The father node is also Node, such as "98" is the parent node of "99", where the error state corresponding to "98" can be reached in two steps The error state corresponding to "99" can be reached in three steps .
[0060] In step S2 of this embodiment, the optimized IC3 algorithm is used to iteratively solve the loop invariant clauses obtained by the solution, and the loop invariant clauses are stored in a global invariant list. When checking whether the error state in the error state tree will appear again in step S2.2, the error state tree is first checked. Whether the node's error state will reappear includes:
[0061] S2.2.1A, find all child nodes of the root node in the error state tree and store them as a one-step reachable node list;
[0062] S2.2.2A, filter out the invariant list corresponding to the invariant from the one-step reachable node list node;
[0063] S2.2.3A, filter out the current node from the list of nodes reachable in one step i Step-reachable state set Corresponding node;
[0064] S2.2.4A, determine whether there are still remaining nodes in the one-step reachable node list nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. The redundant operation of the node is performed on the remaining nodes in turn. The node is generalized and added to the current i Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the one-step reachable node list The node performs constraint solving to find a new error state, and then adds the found error state to the error state tree and removes the bad point corresponding to the error state. The process is iterated until the node in the one-step reachable node list is reached. All node verification is completed.
[0065] exist Figure 3In the error state tree (b) obtained by using the optimized IC3 algorithm on the right, the above steps are used to check for repeated occurrences and reuse them, and one step can reach After negating the error status, only "4", "6", "8", and "53" remain. Figure 3 The error state (a) 14 in the error state tree on the left corresponds to the error state (a) 14 in the error state tree on the right. Figure 3 In the error state tree on the right (b), the error state "53" and the other nodes are repeated "4", "6", and "8", of which "4" appears twice and "6" appears once. In other words, only four error states are detected during the execution of the IC3 algorithm. , which is five less than the nine in the original IC3 algorithm. The reuse of nodes will change the path that the IC3 algorithm uses to search for error states. In the optimized IC3 algorithm of this embodiment, it will give priority to checking nodes that have appeared repeatedly, which may reduce the search path for error states.
[0066] In step S2 of this embodiment, the optimized IC3 algorithm is used to iteratively solve the loop invariant clauses obtained by the solution, and the loop invariant clauses are stored in a global invariant list; in step S2.2, when checking whether the error state in the error state tree will appear again, the error state tree is then checked. Whether the node's error state will reappear includes:
[0067] S2.2.1B, find all Nodes are saved as a list of nodes reachable in two or more steps;
[0068] S2.2.2B, filter out the nodes in the invariant list from the list of nodes reachable in two or more steps. node;
[0069] S2.2.3B, filter out the current node from the list of nodes reachable in two or more steps i Step-reachable state set Corresponding node;
[0070] S2.2.4B, determine whether there are any remaining nodes in the list of nodes that can be reached in two or more steps nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. Redundant operation of nodes; the remaining The node is generalized and added to the current j Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the nodes in the list of two or more reachable steps The node performs constraint solving to find a new error state, and adds the found error state to the error state tree, then removes the bad point corresponding to the error state, and iterates the process until the node in the list of nodes that can be reached in two or more steps is reached. All node verification is completed.
[0071] exist Figure 3 In the error state tree (b) obtained by using the optimized IC3 algorithm on the right, it is necessary to continue to check the error state tree Nodes will not appear repeatedly: If the current Layer found a duplicate If the tree shows that it still has a parent node, it means There may be a predecessor node Then go forward Layer continues to check this will not recur. There may still be a parent node , keep moving forward in correspondence The error state found by the layer is checked to see if it will appear again. If it does, it is directly reused. In the figure, "4" has two child nodes, namely "15" and "19". After the above steps, "15" appears once and "19" appears three times. When looking for the node "85", "19" appears repeatedly and is reused; when looking for the node "86", both "19" and "85" appear repeatedly and can be reused. This means that once a branch in the tree is found, there is a high possibility that the previous nodes on the branch will appear repeatedly and be reused as the branch extends backward.
[0072] Abstract the above example into Figure 4 In the form of, ideally, one step can be The error state can be reached by two or more steps as long as there is a previous state. , it will repeat. For example Figure 4 Search and hour, may be repeated and reused, while looking for hour, May be repeated. Similarly, in the search At node time, and All may be reused. Figure 4In the specific embodiment of the invention, the optimized IC3 algorithm gives priority to eliminating repeated error states, so the reuse of error states can not only reduce the number of constraint solving times, but may even reduce the path taken by the algorithm when searching for error states, thereby improving the verification efficiency of the IC3 algorithm.
[0073] In summary, the method of this embodiment includes obtaining the verified program with attributes Lustre model file, using the optimized IC3 algorithm in the model checking tool to iteratively solve to obtain the verification result and the error state tree, and using the optimized IC3 algorithm to iteratively solve includes using the built error state tree in each Block process of the IC3 algorithm to achieve the reuse of the error state to reduce the error state path and reduce the number of constraint solutions during the execution of the IC3 algorithm. This embodiment aims to use the optimized IC3 algorithm to iteratively solve, including using the built error state tree in each Block process of the IC3 algorithm to achieve the reuse of the error state to reduce the error state path and reduce the number of constraint solutions during the execution of the IC3 algorithm, thereby improving the error state solution efficiency in the IC3 algorithm.
[0074] In addition, this embodiment also provides an IC3 algorithm optimization system based on an error state tree, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree.
[0075] In addition, this embodiment also provides a computer-readable storage medium, in which a computer program or instruction is stored. The computer program or instruction is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree through a processor.
[0076] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the IC3 algorithm optimization method based on the error state tree through a processor.
[0077] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0078] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.
Claims
1. An IC3 algorithm optimization method based on an error state tree, characterized in that: The steps include: S1, get the verified program with attributes Lustre model file; S2, will have attributes The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain the verification result and the error state tree, and the iterative solution using the optimized IC3 algorithm includes using the built error state tree in each Block process of the IC3 algorithm to realize the reuse of the error state to shorten the error state path and reduce the number of constraint solutions in the execution process of the IC3 algorithm; the The Lustre model file is iteratively solved using the optimized IC3 algorithm in the model checking tool to obtain the verification results and error status tree including: S2.1, attribute As the root node of the error status tree; S2.2, in each Block process of the IC3 algorithm, check whether the error state in the error state tree will appear again. When the existing error state appears again, it is directly reused without constraint solving. Otherwise, constraint solving is performed according to the IC3 algorithm to find a new error state, and the found error state is added to the error state tree. The bad points corresponding to the error state are removed, and the process is iterated until the verification is completed; S2.3, check whether all the error states found can be eliminated, and if so, output the properties of the verified program Safe verification result, otherwise find a counterexample path and output it as the verification result, and output the final error state tree; When the found error state is added to the error state tree, the nodes stored in the error state tree are all clauses after the error state is negated, and the attribute Each clause is provided with a serial number id represented by an integer. The serial number id of the clause increases with the number of clauses and is not repeated. Therefore, the serial number id of the clause is used as the unique identifier of the node stored in the error status tree.
2. The IC3 algorithm optimization method based on the error state tree according to claim 1, characterized in that: The model checking tool in step S2 is a Kind2 model checker.
3. The IC3 algorithm optimization method based on the error state tree according to claim 2 is characterized in that: When the found error state is added to the error state tree, the error state added to the error state tree includes two types of child nodes. The first type of child node is a one-step reachable The corresponding nodes of the error state are collectively referred to as Node, where Indicates an error state, and the subscript 1 indicates that it can be reached in one step , Representation attributes Of non, The front of the node Indicates that such a step can be reached The error state is negated; the second type is reachable in two or more steps The error state is not, the corresponding node is Node, in the subscript Indicates that two or more steps can be reached ; When adding the found error state to the error state tree, if the node corresponding to the found error state is Node, the root node of the error status tree is used as the The node's father node; if the node corresponding to the found error state is reachable in two steps of Node, then the corresponding one-step reachable of The node is reachable in two steps. of The node's father node; if the node corresponding to the error state found is reachable in three steps of Node, then the corresponding two-step reachable of Nodes are reachable in three steps of The parent node of the node; and so on, after finding the clause number id corresponding to the correct father node, add it as a child node.
4. The IC3 algorithm optimization method based on the error state tree according to claim 3 is characterized in that: In step S2, the iterative solution using the optimized IC3 algorithm also includes storing the loop invariant clauses obtained by the solution into a global invariant list; in step S2.2, when checking whether the error state in the error state tree will appear again, first check the error state tree. Whether the node's error state will reappear includes: S2.2.1A, find all child nodes of the root node in the error state tree and store them as a one-step reachable node list; S2.2.2A, filter out the invariant list corresponding to the invariant from the one-step reachable node list node; S2.2.3A, filter out the current node from the list of nodes that can be reached in one step i Step-reachable state set Corresponding node; S2.2.4A, determine whether there are still remaining nodes in the one-step reachable node list nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. The redundant operation of the node is performed on the remaining nodes in turn. The node is generalized and added to the current i Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the one-step reachable node list The node performs constraint solving to find a new error state, and then adds the found error state to the error state tree and removes the bad point corresponding to the error state. The process is iterated until the node in the one-step reachable node list is reached. All node verification is completed.
5. The IC3 algorithm optimization method based on the error state tree according to claim 4 is characterized in that: In step S2, the iterative solution using the optimized IC3 algorithm also includes storing the loop invariant clauses obtained by the solution into a global invariant list; in step S2.2, when checking whether the error state in the error state tree will appear again, then checking the error state tree Whether the node's error state will reappear includes: S2.2.1B, find all Nodes are saved as a list of nodes reachable in two or more steps; S2.2.2B, filter out the invariants in the invariant list from the list of nodes reachable in two or more steps. node; S2.2.3B, filter out the current node from the list of nodes reachable in two or more steps i Step-reachable state set Corresponding node; S2.2.4B, determine whether there are any remaining nodes in the list of nodes that can be reached in two or more steps nodes, if there are any remaining nodes, the remaining The error states corresponding to the nodes are eliminated to omit the search for the remaining nodes through constraint solving. Redundant operation of nodes; the remaining The node is generalized and added to the current j Step-reachable state set to remove the corresponding error state cluster; if there is no remaining Node, then according to the IC3 algorithm for the nodes in the list of two or more reachable nodes The node performs constraint solving to find a new error state, and adds the found error state to the error state tree, then removes the bad point corresponding to the error state, and iterates the process until the node in the list of nodes that can be reached in two or more steps is reached. All node verification is completed.
6. An IC3 algorithm optimization system based on an error state tree, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the IC3 algorithm optimization method based on the error status tree as described in any one of claims 1 to 5.
7. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree described in any one of claims 1 to 5 through a processor.
8. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the IC3 algorithm optimization method based on the error state tree described in any one of claims 1 to 5 through a processor.