Bounded model detection method and device for circulating unit

Abstract

The embodiment of the invention provides a bounded model detection technical scheme about a loop unit, which comprises the following steps: abstracting a memory continuous variable in the loop unit of a to-be-verified module into a symbol variable, and setting a value interval of the symbol variable according to an element number corresponding to the memory continuous variable; therefore, the abstract description of the symbol variable is used for replacing exhaustion of the loop statement in the loop unit on the element value, and memory security verification of the loop unit is carried out. In addition, in consideration that a specific value cannot be obtained after the symbol variable is abstracted, an over-approximate value range covering a loop statement result value range is set for verification in a verification statement using a loop statement result value subsequently. Therefore, the verification efficiency can be improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer technology, and in particular, to a bounded model detection method and device for a cyclic unit. Background Art

[0002] Bounded Model Checking (BMC) is a technology that verifies whether the target properties are met by traversing the state space described by machine language in a limited manner. The target properties here can be predetermined business properties, such as various properties related to business logic, memory safety, etc. Specifically, BMC technology can abstract the machine language statements in an application or module into a finite state machine, thereby encoding the machine language statements and properties to be verified as SAT / SMT constraint expressions, and finally calling the automatic solver to solve counterexamples that violate the target properties. Usually, when a counterexample exists, it indicates that the corresponding target property is not met. When the target property is related to memory safety, BMC technology can be used to verify whether the machine language statement is memory safe.

[0003] Since BMC technology needs to exhaustively traverse the state space of the application or module, for loop statements, the loop body needs to be expanded to a preset number of times before traversing the state space. The degree of loop expansion determines the effectiveness of mining potential security issues. For security issues that require full loop expansion to be discovered, when the number of expansions is too large (such as 10 million times), there are too many converted constraint expressions, and the solution time for calling the solver is significantly increased, or even the final result cannot be generated. Therefore, how to optimize the verification scheme of the module to be tested of the loop unit and improve the verification efficiency of the application or module is a relatively important technical issue. Summary of the invention

[0004] One or more embodiments of the present specification describe a bounded model detection method and device for a cycle unit, to solve one or more problems mentioned in the background technology.

[0005] According to a first aspect, a bounded model detection method for a loop unit is provided, the method comprising: identifying a memory continuous variable in a first loop unit of a module to be tested; generating a first symbolic variable for the memory continuous variable and determining a first value range for the variable; rewriting a loop statement in the first loop unit by using the first symbolic variable to obtain a first test statement described by the first symbolic variable; for a statement that references a result value of the loop statement, rewriting it into a corresponding second test statement by determining a second value range covering the result value of the loop statement; and using a solver to solve a constraint expression containing the first test statement and the second test statement, thereby performing bounded model detection on the first loop unit.

[0006] In one embodiment, the memory continuous variable is one of the following: an array, a vector, and a slice.

[0007] In one embodiment, the first symbolic variable is used to abstractly describe each order of the memory continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory continuous variable.

[0008] In one embodiment, the first verification statement includes: a first statement for assigning a value to a second symbolic variable by performing an address operation on each memory continuous variable through the first symbolic variable, the second symbolic variable corresponding to the element address of each sequence of the memory continuous variable; a second statement for dereferencing each second symbolic variable; and a third statement for processing the elements obtained by dereferencing each second symbolic variable according to the loop statements in the first loop unit.

[0009] In one embodiment, the use of a solver to solve the constraint expression containing the first check statement and the second check statement to perform bounded model detection on the first loop unit includes: in the case where there is a counterexample in the numerical processing results or intermediate results that leads to a memory overflow problem, obtaining a counterexample to feed back to a user; otherwise, in the case where there is no counterexample in the numerical processing results or intermediate results that leads to a memory overflow problem, no operation is performed or verified information is obtained to feed back to the user.

[0010] According to a second aspect, a bounded model detection device for a cycle unit is provided, the device comprising:

[0011] An identification unit configured to identify a memory continuous variable in a first cycle unit of the module to be tested;

[0012] A generating unit configured to generate a first symbolic variable for the memory continuous variable and determine a first value interval for the variable;

[0013] a rewriting unit configured to rewrite the loop statement in the first loop unit through the first symbolic variable to obtain a first test statement described by the first symbolic variable; and

[0014] For a statement that references a result value of a loop statement, rewrite it into a corresponding second test statement by determining a second value range that covers the result value of the loop statement;

[0015] The verification unit is configured to use a solver to solve the constraint expression including the first check statement and the second check statement, thereby performing bounded model detection of the first loop unit.

[0016] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0017] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0018] Through the method and device provided by the embodiments of this specification, for the module to be tested including a loop unit, considering that the loop statement usually includes a memory continuous variable, a corresponding symbolic variable can be generated for the memory continuous variable, so as to abstractly describe the memory continuous variable through the symbolic variable, that is, the memory continuous variable corresponding to multiple values ​​is abstracted into a symbolic variable corresponding to the corresponding value interval, so that the constraint expression containing multiple values ​​of the memory continuous variable is abstracted into a small number of constraint expressions described by the symbolic variable, such as recorded as the first test statement. For the statement that references the result value of the loop statement, it is rewritten by determining a larger value interval covering the result value of the loop statement, and the corresponding constraint expression is obtained, such as recorded as the second test statement. In this way, a large amount of resources can be saved in the reading of the test statement writing and solving process. Afterwards, the solver is used to solve the two types of constraint expressions including the first test statement and the second test statement to test the corresponding loop unit, which greatly reduces the number of constraint expressions, and improves the overall test efficiency of the module to be tested by solving a small number of constraint expressions. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0020] Figure 1 A schematic diagram of a bounded model detection process of a cycle unit according to an embodiment of the present specification is shown;

[0021] Figure 2 A schematic diagram of writing bounded model detection statements for a specific example of a loop unit is shown; wherein, Figure 2 The screenshots are included, and the English characters included therein may be actual machine language sentences used, which are only some specific examples under the inventive concept of this specification;

[0022] Figure 3 A schematic block diagram of a bounded model detection device for a cycle unit according to an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0023] The technical solution provided in this specification is described below in conjunction with the accompanying drawings.

[0024] It can be understood that BMC is a formal verification method for memory safety. Formal verification can usually use mathematical methods to perform rigorous logical analysis on computer statements to prove that the attributes or values ​​involved in the computer statements meet predetermined attributes, specifications (such as collectively referred to as target attributes), etc. For example, whether the addition result overflows or other memory safety issues. This often involves a comprehensive enumeration and deduction of the variable value space and path space of the application or module formed by the computer statement. Formal proof can be performed through verification tools (such as Kani, etc.). Specifically, the computer statement can be encoded as a verification statement in the verification tool, and the counterexample can be solved using a solver (such as a SAT solver) according to the constraint expression (such as SAT / SMT constraint expression) given by the verification statement. In the absence of a counterexample, it indicates that the computer statement meets the target attribute, such as meeting the memory safety attribute.

[0025] BMC can be performed on an application or module used to implement a predetermined function. The predetermined function can be a function determined according to business needs, such as a social function, a navigation function, a prediction function, a classification function, a calculation function, and so on. The corresponding module to be tested can be a social application, a navigation application, a prediction service module, a classification service module, a privacy computing module, and so on. The processing object targeted by the BMC verification can be the source code of the module to be tested. In this specification, the application or module to be tested is collectively referred to as the module to be tested.

[0026] For modules to be tested that contain loop units (Loops), conventional techniques often only provide proofs under bounded constraints. Specifically, one method is to use loop invariants (such as CBMC, etc.), which can automatically infer invariants for certain types of loops, but may not be able to support all types of loops to automatically generate loop invariants. Manually providing loop invariants often requires the verification personnel to have a high level of experience and expertise, and the writing threshold is very high. It is difficult to ensure correctness and completeness, especially for nested loops. If all properties to be verified are not covered, the verification results may be incomplete and unreliable. Another method is to directly expand the loop (such as the --unwind N option provided by CBMC, where N is the number of times all loops are expanded). For larger upper bounds or nested loops, it is impossible to actually expand. In order to ensure the termination of verification analysis, it is usually necessary to determine an upper limit, that is, to limit the number of iterations of the loop (i.e., Loop Bound). Limiting the Loop Bound means that only the module behavior within a limited number of execution steps can be checked. This may cause BMC to fail to discover errors that only occur on longer execution paths. If the set Loop Bound is less than the actual number of Loop iterations, real errors may be missed. In addition, for large or complex practical systems containing a large number of loops, even if reasonable loop bounds conditions are provided, the large number of states that need to be verified may lead to exponential growth of the state space, that is, state space explosion, which significantly increases the computational complexity and memory requirements, affecting verification efficiency.

[0027] In view of this, the present specification provides a technical solution for bounded model detection. For a module to be tested that includes a loop unit, considering that the object usually operated in the loop statement is a memory continuous variable, a corresponding symbolic variable can be generated for the memory continuous variable, and the symbolic variable can correspond to an index interval, and each element in the memory continuous variable is represented by the index interval. For the operation of any element in the memory continuous variable using a loop, it can be replaced by the operation for the symbolic variable, so the loop can be removed by the symbolic variable in the verification statement. In this way, a large number of constraint expressions converted by the complete expansion of the original loop are converted into a small number of constraint expressions for a single symbolic variable. For the statement that rewrites the result value of the loop statement, it is rewritten by determining a larger value interval covering the result value of the loop statement to obtain the corresponding constraint expression. In the case of reading during the writing and solving of the test statement, a large amount of resources can be saved. Afterwards, the above two types of constraint expressions are solved by the solver to test the corresponding loop unit, thereby greatly reducing the number of constraint expressions and improving the overall test efficiency of the module to be tested.

[0028] Combine the following Figure 1The illustrated embodiments describe the technical concept of the present specification in detail.

[0029] Figure 1 The bounded model detection process of the loop unit according to an embodiment of the present specification is shown. The execution subject of the process can be any computer, device, or server with certain computing capabilities.

[0030] like Figure 1 As shown, the bounded model detection process of the cycle unit provided in the embodiment of this specification may include the following steps:

[0031] Step 101, identifying a memory continuous variable in a first loop unit of a module to be tested; Step 102, generating a first symbolic variable for the memory continuous variable and determining a first value range for it; Step 103, rewriting a loop statement in the first loop unit through the first symbolic variable to obtain a first test statement described by the first symbolic variable; Step 104, for a statement referencing a result value of the loop statement, rewriting it into a corresponding second test statement by determining a second value range covering the result value of the loop statement; Step 105, using a solver to solve a constraint expression including the first test statement and the second test statement, thereby performing bounded model detection of the first loop unit.

[0032] First, in step 101, a memory continuous variable in a first cycle unit of a module to be tested is identified.

[0033] The first circulation unit may be any operation unit of the module to be tested that realizes a circulation operation function.

[0034] For example, Figure 2 A specific example of a loop unit is shown, where the loop unit is an array summation unit described in the following machine language (such as Rust):

[0035]

[0036] Among them, 1 to 5 represent the number of rows, a and b are two arrays defined as generics, and this loop unit is used to sum arrays a and b, and the sum array is recorded as c. T defines the numeric type in the array. "&" is the address operator. When & acts on an object, it returns the address of the object. "a:&[T], b:&[T]" defines two address pointers, pointing to the first element addresses of arrays a and b respectively, and "c:&mut[T])" defines the address pointer of the sum array, pointing to the first element address of the sum array c. "*" is the dereference operator, which returns the value of the object pointed to by the corresponding pointer. *r, *x, and *y are the specific element values ​​in the corresponding addresses in the sum array c, array a, and array b respectively.

[0037] Generally, memory - continuous variables are variables stored with consecutive addresses in memory. Common memory - continuous variables include arrays, vectors, slices (such as the Rust slice type, etc.). When processing, corresponding elements are read out and processed successively as the address gradually increases. It can be seen that in the example of the loop unit described in the above statement, during the process of the address pointer gradually increasing, the elements in arrays a and b are added one by one. The number of loop rounds is the same as the number of elements in arrays a and b. Memory - continuous variables can be recognized according to a predetermined type (such as array type, vector type, slice type, etc.). For example, in this step 101, arrays a, b, and c can be recognized as memory - continuous variables.

[0038] Next, through step 102, a first symbolic variable is generated for the memory - continuous variable and a first value range is determined for it.

[0039] It can be understood that in order to access memory - continuous variables, pointers can be generated for the elements in arrays a, b, and c, pointing to the corresponding memory addresses. In other specific examples, the corresponding elements can also be accessed through references. Under the technical concept of this specification, a new index symbolic variable can be introduced to represent the access range (such as the address range) corresponding to the elements of the identified memory - continuous variable. Here, this symbolic variable can be denoted as the first symbolic variable, where "first" indicates the correspondence with the "first loop unit", without forming other substantial limitations on the symbolic variable itself.

[0040] As an example, for the loop unit exemplified above, an abstract symbolic variable i can be defined to represent each ordinal number of the memory - continuous variable. For example, it is defined as: "let i: usize = verifier::any()". And arrays a, b, and c have the same length. Therefore, their length range can be limited by the length of any one of arrays a, b, and c. For example, it is limited by the length of array b, b.len(), as "verifier::assume(i < b.len())". In this way, the first value range corresponding to the first symbolic variable is from 0 to b.len() - 1, which is the same as the length of arrays a, b, and c, b.len(). In practice, when the length is the same as that of arrays a, b, and c, the first value range can also be defined in other ways, which is not limited here.

[0041] Then, using step 103, the loop statement in the first loop unit is rewritten through the first symbolic variable to obtain a first verification statement described by the first symbolic variable.

[0042] Here, the first symbolic variable can be used as an abstract index of an element in a memory continuous variable. Through the abstract index symbolic variable, the addresses of each value of the memory continuous variable can be uniformly abstracted. That is to say, the first symbolic variable, as an abstract memory address pointed to by the memory continuous variable, can replace any element sequence in the memory continuous variable. In this way, the processing process of each element in the memory continuous variable can be abstracted into a variable processing process uniformly described by the first symbolic variable. The processing process includes at least three steps, taking out the numerical value in the memory continuous variable, processing the numerical value, and assigning a value to the return parameter (i.e., the return value). For example, "*r=*x+*y" includes taking out the numerical values ​​in the corresponding addresses of x and y, summing the taken values ​​(represented by the memory continuous variable r), and assigning the summation result to the corresponding address of r.

[0043] On the one hand, through the first symbolic variable and its corresponding first value interval, each element corresponding to the memory continuous variable in the first loop unit (such as the elements in a and b) and the corresponding result element (such as the element in c) can also be abstracted as a symbolic variable. For example, in the specific example above, according to the symbolic variable i, corresponding references can be introduced for the three memory continuous variables of arrays a, b, and c, such as by defining three symbolic variables rx, ry, and rr (such as the second symbolic variable) through "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])" (such as recorded as the first statement), which respectively represent the addresses &a[i], &b[i], and &mut c[i] corresponding to the elements of any order i in the three memory continuous variables a, b, and c. Among them, &a[i], &b[i], and &mut c[i] can be understood as the addresses of the elements corresponding to the order i in the three arrays a, b, and c. The test statement "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])" can replace the exhaustive enumeration of various values ​​of i by determining the first value interval of i.

[0044] In the loop unit, dereferencing is to obtain the corresponding value so that the specific operation on the corresponding element can be applied to the specific value through dereferencing. The test statement can abstract the specific element value, but in order to maintain the consistency of the parameters in the original loop unit, the dereferencing operation consistent with the original loop unit can be performed. The dereferencing operation is the process of getting the element at the corresponding address in the memory according to the address. In the test statement, the dereferencing operation can still be performed through "*". For example Figure 2In the example, corresponding to the dereference operation in line 3 of the loop unit, a corresponding check statement can be given: "let(x_, y_, r_) = (*rx, *ry, *rr)" (such as recorded as the second statement). For the dereference operation of the three symbolic variables, the dereference legality check of the add function in the original loop unit can be retained.

[0045] When rewriting statements in a loop unit using the first symbolic variable introduced, the second symbolic variable obtained through abstract indication of the first symbolic variable, etc., the principle of rewriting is to ensure that all checks related to memory safety in the loop unit are retained. Each variable obtained by dereferencing needs to be operated accordingly to obtain the operation result, such as Figure 2 In the example shown, the sum operation of adding two variables is used to check the memory safety of the sum operation, that is, to check whether the addition result will overflow, etc. Therefore, for the dereferenced variables, the constraint expression can be further rewritten according to the sum process, for example, as "r_=x_+y_;" (such as recorded as the third statement).

[0046] Among them, the above parameter assignment statements based on symbolic variables (recorded as the first statement, such as "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])"), dereference statements (recorded as the second statement, such as "let(x_, y_, r_) = (*rx, *ry, *rr)"), and processing of variables after dereference (recorded as the third statement, such as "r_ = x_+y_;") can all be used as the first test statements.

[0047] From the above description, it can be seen that compared with the conventional technology of fully expanding the loop unit (such as 100,000 times) and then converting it into a verification statement, the rewriting involves very few verification statements. Since the rewriting of the loop unit is for the access to the continuous memory variable, the rewriting task is lightweight and easy to ensure its correctness.

[0048] Further, according to step 104, for the statement referencing the result value of the loop statement, it is rewritten into a corresponding second test statement by determining a second value range covering the result value of the loop statement.

[0049] It can be understood that in the above rewriting process of loop statements according to symbolic variables, memory continuous variables are abstracted as symbolic variables, so the specific values ​​cannot be obtained during the verification process. Considering that the write operation inside the loop will cause side effects and affect the variables declared outside the loop. In order to ensure the correctness of the verification result (sound), appropriate intervals can be assigned to these variables for over-approximation. That is to say, a wider range covering the original numerical range is determined, for example, recorded as the second value interval. For example, the result interval is 1000 to 10000, and the second value interval can describe any reasonable value range covering the result interval, such as 0 to 20000. At this time, the statement for checking the sum value assignment is, for example, "*rr=verifier::any()". Here, any() means that any value within the second value interval can be taken, which is an over-approximation of the actual value.

[0050] The statement rewritten by the over-approximated second value interval (such as "*rr=verifier::any()") can be recorded as the second verification statement.

[0051] according to Figure 2 In the specific example shown, the test expression corresponding to the loop unit of array summation can be written as:

[0052]

[0053] Among them, line 1 specifies the parameter type in the loop unit as "T", line 3 limits the number of elements of memory continuous variables a, b, and c to be consistent, line 7 defines the first symbolic variable i and gives its corresponding first value range in line 8, line 10 can abstractly describe each element in the memory continuous variable under the first value range through the first symbolic variable, line 13 is dereference, line 15 performs a summation constraint expression, and line 17 is a constraint expression describing the summation result value. In this specific example, lines 10, 13, and 15 can be used as the first test statement, and line 17 can be used as the second test statement.

[0054] In step 105, a solver is used to solve the constraint expression including the first check statement and the second check statement, thereby performing bounded model detection of the first loop unit.

[0055] It can be understood that the above rewritten statements constitute a constraint expression. The solver can be used to solve the counterexample in the constraint expression. For example, the solver solves the constraint expression containing the first test statement and the second test statement (such as the constraint expression corresponding to the 10th, 13th, 15th, and 17th lines in the above example), that is, to find whether there are counterexamples in the numerical processing results or intermediate results that cause problems such as memory overflow. If there is a counterexample, the counterexample can be obtained to feed back to the user. If there is no counterexample, there is no operation or the information obtained that is verified to be correct is fed back to the user. The solver can be any reasonable solver in conventional technology that can be used to verify the corresponding test statement, which will not be repeated here. Various optimization algorithms are often included in the solver. For the verification statement described by the symbolic variable, it is not necessary to substitute each specific numerical value for real operation, but to complete the solution according to the value range limited by the symbolic variable.

[0056] Reviewing the above process, the bounded model detection technology concept of the loop unit provided in the embodiment of this specification abstracts the memory continuous variables in the loop unit of the module to be verified into symbolic variables, and sets the value range of the symbolic variables according to the number of elements corresponding to the memory continuous variables, thereby using the symbolic variable abstract description to replace the exhaustive enumeration of element values ​​in the loop unit to verify the memory security of the loop unit, which can greatly reduce the complexity of the verification statement, and can save a lot of resources in the reading of the verification statement writing and solving process. In addition, the verification efficiency can be improved by solving a small number of constraint expressions.

[0057] In addition, considering that the specific value cannot be obtained after being abstracted into a symbolic variable, an over-approximate value range covering the value range of the loop unit result is set for verification in the subsequent verification statements using the loop unit results, which effectively ensures the correctness of the subsequent statement verification results.

[0058] According to another embodiment, a bounded model detection device for a loop unit is also provided. The bounded model detection device for a loop unit may be provided on a computer, device or server with a certain computing capability. Figure 3 As shown, the bounded model detection device 300 of the cycle unit may include:

[0059] An identification unit 301 is configured to identify a memory continuous variable in a first loop unit of a module to be tested;

[0060] A generating unit 302 is configured to generate a first symbolic variable for a memory continuous variable and determine a first value interval for the variable;

[0061] A rewriting unit 303 is configured to rewrite the loop statement in the first loop unit through the first symbolic variable to obtain a first test statement described by the first symbolic variable; and

[0062] For a statement that references a result value of a loop statement, rewrite it into a corresponding second test statement by determining a second value range that covers the result value of the loop statement;

[0063] The verification unit 304 is configured to use a solver to solve the constraint expression including the first check statement and the second check statement, so as to perform bounded model detection of the first loop unit.

[0064] In one embodiment, the memory continuous variable is one of the following: an array, a vector, and a slice.

[0065] The first symbolic variable is used to abstractly describe the various sequences of the memory continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory continuous variable.

[0066] According to some optional implementations, the first verification statement may include: a first statement for assigning a value to a second symbolic variable by performing an address operation on each memory continuous variable through a first symbolic variable, the second symbolic variable corresponding to an element address of each sequence of the memory continuous variable; a second statement for dereferencing each second symbolic variable; and a third statement for processing the elements obtained by dereferencing each second symbolic variable according to the loop statements in the first loop unit.

[0067] In one embodiment, the verification unit 304 is further configured to:

[0068] In the case of counterexamples in numerical processing results or intermediate results that cause memory overflow problems, obtain counterexamples to provide feedback to users;

[0069] Otherwise, if there is no counterexample in the numerical processing results or intermediate results that lead to the memory overflow problem, no operation is performed or verified information is fed back to the user.

[0070] It is worth mentioning that Figure 3 The device 300 shown is Figure 1 The method flow described corresponds to Figure 1 The corresponding description in the illustrated method embodiment is also applicable to the device 300 and will not be repeated here.

[0071] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 1 The method described by et al.

[0072] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 1The method described by et al.

[0073] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0074] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above description is only the specific implementation method of the technical concept of this specification, and is not used to limit the protection scope of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the protection scope of the technical concept of this specification.

Claims

1. A bounded model detection method for a cycle unit, the method comprising: Identify the memory continuous variable in the first loop unit of the module to be tested; Generate a first symbolic variable for the memory continuous variable and determine a first value interval for it; Rewrite the loop statement in the first loop unit by using the first symbolic variable to obtain a first test statement described by the first symbolic variable; For a statement that references a result value of a loop statement, rewrite it into a corresponding second test statement by determining a second value range that covers the result value of the loop statement; A solver is used to solve the constraint expression including the first check statement and the second check statement, thereby performing bounded model detection of the first loop unit.

2. The method of claim 1, wherein: The memory continuous variable is one of the following: array, vector, slice.

3. The method of claim 1, wherein: The first symbolic variable is used to abstractly describe the various sequences of the memory continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory continuous variable.

4. The method of claim 1, wherein: The first test statement includes: Performing an address operation on each memory continuous variable through the first symbolic variable to obtain a first statement for assigning a value to a second symbolic variable, wherein the second symbolic variable corresponds to the element address of each order of the memory continuous variable; a second statement dereferencing each second symbolic variable; According to the loop statements in the first loop unit, a third statement is determined for processing elements obtained by dereferencing each second symbolic variable.

5. The method of claim 1, wherein: The using a solver to solve the constraint expression including the first check statement and the second check statement, thereby performing bounded model detection of the first loop unit includes: In the case of counterexamples in numerical processing results or intermediate results that cause memory overflow problems, obtain counterexamples to provide feedback to users; Otherwise, if there is no counterexample in the numerical processing results or intermediate results that lead to the memory overflow problem, no operation is performed or verified information is fed back to the user.

6. A bounded model detection device for a cycle unit, the device comprising: An identification unit configured to identify a memory continuous variable in a first cycle unit of the module to be tested; A generating unit configured to generate a first symbolic variable for the memory continuous variable and determine a first value interval for the variable; a rewriting unit configured to rewrite the loop statement in the first loop unit through the first symbolic variable to obtain a first test statement described by the first symbolic variable; as well as For a statement that references a result value of a loop statement, rewrite it into a corresponding second test statement by determining a second value range that covers the result value of the loop statement; The verification unit is configured to use a solver to solve the constraint expression including the first check statement and the second check statement, thereby performing bounded model detection of the first loop unit.

7. The device according to claim 6, wherein: The first symbolic variable is used to abstractly describe the various sequences of the memory continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory continuous variable.

8. The device of claim 6, wherein: The first test statement includes: Performing an address operation on each memory continuous variable through the first symbolic variable to obtain a first statement for assigning a value to a second symbolic variable, wherein the second symbolic variable corresponds to the element address of each order of the memory continuous variable; a second statement dereferencing each second symbolic variable; According to the loop statements in the first loop unit, a third statement is determined for processing elements obtained by dereferencing each second symbolic variable.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

10. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 5 is implemented.

Images