Method and apparatus for detecting bounded models of cyclic units

Abstract

The embodiment of the present specification provides a bounded model detection technical solution about a loop unit, abstracts a memory continuous variable in the loop unit of a to-be-verified module into a symbolic variable, and sets a value interval of the symbolic variable according to the number of elements corresponding to the memory continuous variable, so as to use the symbolic variable abstract description instead of the loop statement in the loop unit for the element value to perform the memory safety verification of the loop unit. In addition, considering that the specific value cannot be obtained after being abstracted into the symbolic variable, an over-approximate value range covering the loop statement result value range is also set in the verification statement using the loop statement result value in the subsequent use to perform verification. In this way, the verification efficiency can be improved.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of computer technology, and more particularly to a method and apparatus for detecting bounded models of cyclic units. Background Technology

[0002] Bounded Model Checking (BMC) is a technique that verifies whether a target attribute is satisfied by finitely traversing the state space described in machine language. The target attribute can be a predefined business attribute, such as various attributes related to business logic or memory safety. Specifically, BMC abstracts machine language statements in an application or module into a finite state machine, encoding the machine language statements and the attribute to be verified into SAT / SMT constraint expressions. Finally, it calls an automatic solver to find counterexamples that violate the target attribute. Typically, the existence of a counterexample indicates that the corresponding target attribute is not satisfied. When the target attribute is related to memory safety, BMC can be used to verify whether the machine language statement is memory-safe.

[0003] Because BMC (Block Module Control) technology requires exhaustively traversing the state space of an application or module, for loop statements, the loop body needs to be expanded to a pre-set number of times before traversing the state space. The degree of loop expansion determines the effectiveness of uncovering potential security issues. For security issues that require complete loop expansion to be discovered, when the number of expansions is too large (e.g., 10 million times), the number of transformed constraint expressions becomes excessive, significantly increasing the solver's solution time, and may even prevent the generation of a final result. Therefore, optimizing the verification scheme for the module under test with loop units and improving the verification efficiency of applications or modules is a crucial technical issue. Summary of the Invention

[0004] This specification describes one or more embodiments of a bounded model detection method and apparatus for cyclic units, which is used to solve one or more problems mentioned in the background art.

[0005] According to a first aspect, a bounded model detection method for a loop unit is provided. The method includes: identifying memory-continuous variables in a first loop unit of a module under test; generating a first symbolic variable for the memory-continuous variable and determining a first value range for it; rewriting the loop statement in the first loop unit using the first symbolic variable to obtain a first verification statement described by the first symbolic variable; for statements referencing the result value of the loop statement, rewriting them into corresponding second verification statements by determining a second value range covering the result value of the loop statement; and using a solver to solve the constraint expression containing the first verification statement and the second verification statement, thereby performing bounded model detection of the first loop unit.

[0006] In one embodiment, the memory-continuous variable is one of the following: an array, a vector, or a slice.

[0007] In one embodiment, the first symbolic variable is used to abstractly describe the various orders of the memory-continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory-continuous variable.

[0008] In one embodiment, the first verification statement includes: a first statement that performs an address-taking operation on each memory contiguous variable using the first symbolic variable to assign a value to a second symbolic variable, wherein the second symbolic variable corresponds to the element address of each sequence of the memory contiguous variable; a second statement that dereferences each second symbolic variable; and a third statement that processes the elements obtained by dereferencing each second symbolic variable according to the loop statement in the first loop unit.

[0009] In one embodiment, the step of using a solver to solve the constraint expression containing the first verification statement and the second verification statement to perform bounded model detection of the first loop unit includes: if there is a counterexample in the numerical processing result or intermediate result that causes a memory overflow problem, obtaining a counterexample and feeding it back to the user; otherwise, if there is no counterexample in the numerical processing result or intermediate result that causes a memory overflow problem, performing no operation or obtaining verified information and feeding it back to the user.

[0010] According to a second aspect, a bounded model detection device for cyclic units is provided, the device comprising:

[0011] The identification unit is configured to identify memory-continuous variables in the first loop unit of the module under test.

[0012] The generation unit is configured to generate a first symbolic variable for the memory-continuous variable and determine a first value range for it.

[0013] The rewriting unit is configured to rewrite the loop statement in the first loop unit using the first symbolic variable, thereby obtaining a first verification statement described by the first symbolic variable; and

[0014] For statements that reference the result value of a loop statement, the second check statement is rewritten by determining the second value range that covers the result value of the loop statement.

[0015] The verification unit is configured to use a solver to solve the constraint expression containing the first verification statement and the second verification statement, thereby performing bounded model detection of the first loop unit.

[0016] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0017] According to a fourth aspect, a computing device is provided, including a memory and a processor, characterized in that the memory stores executable code, and when the processor executes the executable code, it implements the method described in the first aspect.

[0018] The methods and apparatus provided in the embodiments of this specification, for a module under test containing loop units, considering that loop statements typically contain memory-continuous variables, can generate corresponding symbolic variables for these memory-continuous variables. These symbolic variables abstractly describe the memory-continuous variables; that is, memory-continuous variables with multiple values ​​are abstracted into symbolic variables corresponding to their respective value ranges. This allows constraint expressions containing multiple values ​​of memory-continuous variables to be abstracted into a small number of constraint expressions described by symbolic variables, such as the first verification statement. For statements referencing the result value of loop statements, they are rewritten by determining the larger value range covering the result value of the loop statement, resulting in the corresponding constraint expression, such as the second verification statement. This saves significant resources during the writing and solving of verification statements. Subsequently, a solver is used to solve the constraint expressions containing both the first and second verification statements to verify the corresponding loop units, greatly reducing the number of constraint expressions. By solving a small number of constraint expressions, the overall testing efficiency of the module under test is improved. Attached Figure Description

[0019] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A schematic diagram of the bounded model detection process for a cyclic cell according to an embodiment of this specification is shown.

[0021] Figure 2 This diagram illustrates the writing of a bounded model detection statement for a loop unit, using a specific example; where, Figure 2 The document contains screenshots, and the English characters contained therein can be actual machine language statements, which are only used as specific examples under the inventive concept of this specification.

[0022] Figure 3 A schematic block diagram of a bounded model detection apparatus for a cyclic cell according to an embodiment of this specification is shown. Detailed Implementation

[0023] The technical solutions provided in this specification are described below with reference to the accompanying drawings.

[0024] It can be understood that BMC (Browser Memory Safety) is a type of formal verification method for memory safety. Formal verification typically uses mathematical methods to rigorously analyze computer statements to prove that the attributes or values ​​involved in the statements satisfy predetermined properties or specifications (such as target properties). For example, it addresses memory safety issues such as whether an addition result will overflow. This often involves a comprehensive enumeration and deduction of the variable value space and path space of the application or module from which the computer statements are formed. Formal verification can be performed using verification tools (such as Kani). Specifically, the computer statements can be encoded into verification statements in the verification tool, and counterexamples can be found using a solver (such as a SAT solver) according to the constraint expressions given by the verification statements (such as SAT / SMT constraint expressions). If no counterexamples are found, it indicates that the computer statements satisfy the target properties, such as memory safety properties.

[0025] BMC (Business Component Analysis) can be performed on an application or module used to implement predetermined functions. These predetermined functions can be functions determined based on business requirements, such as social functions, navigation functions, prediction functions, classification functions, calculation functions, and so on. The corresponding module under test can be a social application, a navigation application, a prediction service module, a classification service module, a privacy calculation module, and so on. The object processed by BMC verification can be the source code of the module under test. In this specification, the application or module to be tested is collectively referred to as the module under test.

[0026] For modules under test containing loops, conventional techniques often only provide proofs under bounded constraints. Specifically, one approach is to utilize loop invariants (such as CBMC), which can automatically deduce invariants for certain types of loops, but may not support automatic generation of loop invariants for all types of loops. Manually providing loop invariants often requires verifiers with high levels of experience and expertise, making the writing process difficult and compromising correctness and completeness, especially for nested loops. If not all properties to be verified are covered, the verification results may be incomplete and unreliable. Another approach is to directly unwind the loop (such as the `--unwind N` option provided by CBMC, where N is the total number of loop unwindings). For large upper bounds or nested loops, actual unwinding is not feasible. To ensure the termination of the verification analysis, an upper limit is usually determined, i.e., limiting the number of loop iterations (i.e., the loop bound). Limiting the loop bound means that only module behavior within a finite number of execution steps can be examined. This may cause CBMC to miss errors that only occur on longer execution paths. If the set loop bound is less than the actual number of loop iterations, real errors may be missed. Furthermore, for large or complex real-world systems containing a large number of loops, even with reasonable loop bounds conditions, the state space may explode due to the large number of states that need to be verified, which significantly increases computational complexity and memory requirements, thus affecting verification efficiency.

[0027] In view of this, this specification provides a technical solution for bounded model testing. For modules under test containing loop units, considering that the objects typically manipulated in loop statements are continuously variable memory, corresponding symbolic variables can be generated for these continuously variable memory variables. Each symbolic variable can correspond to an index range, which represents each element within the continuously variable memory. Operations on any element within a continuously variable memory using a loop can be replaced by operations on that symbolic variable. Therefore, loops can be removed from the verification statements using symbolic variables. This transforms the large number of constraint expressions generated by the complete expansion of the original loop into a small number of constraint expressions targeting a single symbolic variable. For statements that rewrite the result value of loop statements, the corresponding constraint expressions are obtained by determining a larger value range covering the result value of the loop statement. This saves significant resources during the writing and solving of verification statements. Subsequently, the solver is used to solve these two types of constraint expressions to verify the corresponding loop units, thereby greatly reducing the number of constraint expressions and improving the overall verification efficiency of the module under test.

[0028] The following is combined with Figure 1The illustrated embodiments provide a detailed description of the technical concepts in this specification.

[0029] Figure 1 This document illustrates a bounded model detection process for a cyclic cell according to one embodiment of this specification. The process can be executed by any computer, device, or server with sufficient computing power.

[0030] like Figure 1 As shown, the bounded model detection process for cyclic units provided in the embodiments of this specification may include the following steps:

[0031] Step 101: Identify the memory-continuous variables in the first loop unit of the module under test; Step 102: Generate a first symbolic variable for the memory-continuous variables and determine a first value range for them; Step 103: Rewrite the loop statement in the first loop unit using the first symbolic variable to obtain the first verification statement described by the first symbolic variable; Step 104: For statements that reference the result value of the loop statement, rewrite them into corresponding second verification statements by determining a second value range covering the result value of the loop statement; Step 105: Use a solver to solve the constraint expression containing the first and second verification statements, thereby performing bounded model detection of the first loop unit.

[0032] First, in step 101, the memory-continuous variables in the first loop unit of the module under test are identified.

[0033] The first loop unit can be any operation unit of the module under test that implements the loop operation function.

[0034] For example, Figure 2 A concrete example of a loop unit is shown, where the loop unit is an array summation unit described in machine languages ​​such as Rust:

[0035]

[0036] Here, 1 to 5 represent row numbers, a and b are two arrays defined as generics, and this loop unit is used to sum arrays a and b, denoted as c. T defines the numeric type in the array. "&" is the address-of operator, which returns the address of an object when applied to it. "a:&[T],b:&[T]" defines two address pointers, pointing to the addresses of the first elements of arrays a and b respectively, and "c:&mut[T])" defines the address pointer of the sum array, pointing to the address of the first element of the sum array c. "*" is the dereference operator, which returns the value of the object pointed to by the corresponding pointer. *r, *x, and *y are the specific element values ​​at the corresponding addresses in the sum arrays c, a, and b, respectively.

[0037] Generally, memory - continuous variables are variables stored with consecutive addresses in memory. Common memory - continuous variables include arrays, vectors, slices (such as the Rust slice type, etc.). When processing, corresponding elements are read out and processed successively as the address gradually increases. It can be seen that in the example of the loop unit described above, during the process of the address pointer gradually increasing, the elements in arrays a and b are added one by one. The number of loop iterations is the same as the number of elements in arrays a and b. Memory - continuous variables can be recognized according to a predetermined type (such as array type, vector type, slice type, etc.). For example, in this step 101, arrays a, b, and c can be recognized as memory - continuous variables.

[0038] Next, through step 102, a first symbolic variable is generated for the memory - continuous variable and a first value range is determined for it.

[0039] It can be understood that in order to access memory - continuous variables, pointers can be generated for the elements in arrays a, b, and c, pointing to the corresponding memory addresses. In other specific examples, the corresponding elements can also be accessed through references. Under the technical concept of this specification, a new index symbolic variable can be introduced to represent the access range (such as the address range) corresponding to the elements of the identified memory - continuous variable. Here, this symbolic variable can be denoted as the first symbolic variable, where "first" indicates the correspondence with the "first loop unit", without forming other substantial limitations on the symbolic variable itself.

[0040] As an example, for the loop unit exemplified above, an abstract symbolic variable i can be defined to replace each ordinal number of the memory - continuous variable. For example, it is defined as: "let i: usize = verifier::any()". And arrays a, b, and c have the same length. Therefore, their length range can be limited by the length of any one of arrays a, b, and c. For example, it is limited by the length of array b, b.len(), as "verifier::assume(i < b.len())". In this way, the first value range corresponding to the first symbolic variable is from 0 to b.len() - 1, which is the same as the length of array b, b.len(), of a, b, and c. In practice, when the length is the same as the length of arrays a, b, and c, the first value range can also be defined in other ways, which is not limited here.

[0041] Then, using step 103, the loop statement in the first loop unit is rewritten through the first symbolic variable to obtain a first verification statement described by the first symbolic variable.

[0042] Here, the first symbolic variable can be used as an abstraction of the index of an element in a contiguous memory variable. This abstracted index symbolic variable can uniformly and abstractly represent the address of each value in the contiguous memory variable. In other words, the first symbolic variable, as an abstraction of the memory address pointed to by the contiguous memory variable, can replace the order of any element in the contiguous memory variable. Thus, the processing of each element in the contiguous memory variable can be abstracted into a variable processing process uniformly described by the first symbolic variable. This processing process includes at least three steps: retrieving the value from the contiguous memory variable, processing the value, and assigning a value to the return parameter (i.e., the return value). For example, "*r=*x+*y" includes retrieving the values ​​at the addresses corresponding to x and y, summing the retrieved values ​​(represented by the contiguous memory variable r), and assigning the summation result to the address corresponding to r.

[0043] On the one hand, through the first symbolic variable and its corresponding first value range, each element (such as elements in a and b) and the corresponding result element (such as elements in c) corresponding to the memory-contiguous variables in the first loop unit can also be abstracted as symbolic variables. For example, in the specific example above, based on the symbolic variable i, corresponding references can be introduced for the three memory-contiguous variables a, b, and c. For example, by defining three symbolic variables rx, ry, and rr (such as the second symbolic variables) through "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])" (as the first statement), they respectively represent the addresses &a[i], &b[i], and &mut c[i] corresponding to any element of order i in the three memory-contiguous variables a, b, and c. Here, &a[i], &b[i], and &mut c[i] can be understood as the addresses of the elements corresponding to order i in the three arrays a, b, and c. The test statement "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])" can replace the exhaustive search of all possible values ​​of i by determining the first range of values ​​of i.

[0044] In a loop, dereferencing is used to retrieve the corresponding value so that specific operations on that element can be applied to that value via dereferencing. Check statements can abstract specific element values, but to maintain consistency with the parameters in the original loop, they can perform the same dereferencing operation. A dereferencing operation is the process of retrieving the element at the corresponding memory address based on its address. In check statements, dereferencing can still be performed using "*". For example... Figure 2In the example, corresponding to the dereference operation in line 3 of the loop unit, the corresponding verification statement can be given: "let(x_, y_, r_) = (*rx, *ry, *rr)" (as denoted as the second statement). For the dereference operation of the three symbolic variables, the check on the dereference validity of the add function in the original loop unit can be retained.

[0045] When rewriting statements within a loop unit using the introduced first symbolic variable, the second symbolic variable obtained through abstraction of the first symbolic variable, etc., the principle of rewriting is to ensure that all memory safety-related checks within the loop unit are preserved. The variables obtained through dereferencing still need to undergo corresponding operations to obtain the results, such as... Figure 2 The example shown demonstrates a summation operation involving two variables to check the memory safety of the summation operation, specifically to check for potential overflow. Therefore, for the dereferenced variable, the constraint expression can be further rewritten based on the summation process, for example, as "r_=x_+y_;" (as denoted as the third statement).

[0046] Among them, the above statements based on symbolic variables, such as parameter assignment statements (denoted as the first statement, such as "let(rx, ry, rr) = (&a[i], &b[i], &mut c[i])"), dereference statements (denoted as the second statement, such as "let(x_, y_, r_) = (*rx, *ry, *rr)"), and variable processing after dereference (denoted as the third statement, such as "r_ = x_ + y_;"), can all be used as the first verification statement.

[0047] As described above, compared to conventional techniques that fully expand the loop unit (e.g., 100,000 times) and convert it into verification statements, the rewritten version involves very few verification statements. Since the rewriting of the loop unit targets access to contiguous memory variables, the rewriting task is lightweight and its correctness is easily guaranteed.

[0048] Furthermore, according to step 104, for statements that reference the result value of loop statements, the statements are rewritten as corresponding second verification statements by determining the second value range covering the result value of loop statements.

[0049] It's understandable that in the above rewriting of the loop statement based on symbolic variables, continuously typed variables are abstracted into symbolic variables, therefore, their specific values ​​cannot be obtained during the verification process. Considering that write operations inside the loop can cause side effects, affecting variables declared outside the loop, to ensure the correctness (sound) of the verification results, these variables can be assigned an appropriate range for over-approximation. That is, a wider range covering the original numerical range is determined, for example, denoted as the second value range. For example, if the result range is 1000 to 10000, this second value range can describe any reasonable range of values ​​covering that result range, such as 0 to 20000. In this case, the statement for checking the sum assignment is, for example, "*rr = verifier::any()". Here, any() indicates that any value within the second value range can be taken, which is an over-approximation of the actual value.

[0050] A statement rewritten using an over-approximated second value range (such as "*rr=verifier::any()") can be denoted as a second verification statement.

[0051] according to Figure 2 In the specific example shown, the check expression corresponding to the loop unit of array summation can be written as:

[0052]

[0053] In this example, line 1 specifies the parameter type as "T" in the loop unit; line 3 ensures that the number of elements in the memory-continuous variables a, b, and c is the same; line 7 defines the first symbolic variable i and gives its corresponding first value range in line 8; line 10 uses the first symbolic variable to abstractly describe each element in the memory-continuous variables within the first value range; line 13 dereferences; line 15 performs the summation constraint expression; and line 17 describes the constraint expression for the summation result. In this specific example, lines 10, 13, and 15 can be used as the first verification statement, and line 17 can be used as the second verification statement.

[0054] In step 105, the constraint expression containing the first and second verification statements is solved using a solver, thereby performing bounded model detection of the first loop unit.

[0055] It is understandable that the rewritten statements above constitute a constraint expression. A solver can be used to find counterexamples in the constraint expression. For example, a solver can solve constraint expressions containing a first check statement and a second check statement (such as the constraint expressions corresponding to lines 10, 13, 15, and 17 in the example above), that is, to find whether there are counterexamples in the numerical processing results or intermediate results that could cause memory overflow or other problems. If a counterexample exists, it can be obtained and fed back to the user; if no counterexample exists, no operation is performed or the user is notified of the verification result. The solver can be any reasonable solver from conventional techniques that can be used to verify the corresponding check statements, which will not be elaborated further here. Solvers often contain various optimization algorithms. For verification statements described by symbolic variables, it is not necessary to substitute each specific numerical value into the actual calculation; instead, the solution is completed based on the range of values ​​defined by the symbolic variables.

[0056] Reviewing the above process, the bounded model detection technology for loop units provided in this specification abstracts the continuous memory variables in the loop unit of the module to be verified into symbolic variables, and sets the value range of the symbolic variables according to the number of elements corresponding to the continuous memory variables. This uses the abstract description of symbolic variables to replace the exhaustive enumeration of element values ​​in the loop unit for memory safety verification, which can greatly reduce the complexity of verification statements and save significant resources in both writing and solving verification statements. Furthermore, by solving a small number of constraint expressions, verification efficiency can be improved.

[0057] In addition, considering that a specific value cannot be obtained after abstracting to a symbolic variable, an overly approximate value range covering the value range of the loop unit result is set in the subsequent verification statement that uses the loop unit result for verification, which effectively ensures the correctness of the verification results of the subsequent statements.

[0058] According to another embodiment, a bounded model detection device for cyclic units is also provided. This bounded model detection device for cyclic units can be installed in a computer, device, or server with a certain computing power. Figure 3 As shown, the bounded model detection device 300 for cyclic units may include:

[0059] The identification unit 301 is configured to identify continuous memory variables in the first loop unit of the module under test;

[0060] The generation unit 302 is configured to generate a first symbolic variable for a memory-continuous variable and determine a first value range for it.

[0061] Rewrite unit 303 is configured to rewrite the loop statement in the first loop unit using the first symbolic variable, thereby obtaining the first verification statement described by the first symbolic variable; and

[0062] For statements that reference the result value of a loop statement, the second check statement is rewritten by determining the second value range that covers the result value of the loop statement.

[0063] Verification unit 304 is configured to use a solver to solve the constraint expression containing the first verification statement and the second verification statement, thereby performing bounded model detection of the first loop unit.

[0064] In one embodiment, a memory-continuous variable is one of the following: an array, a vector, or a slice.

[0065] Among them, the first symbolic variable is used to abstractly describe the various orders of the memory-continuous variable, and the value range of the first value interval is consistent with the range of the number of elements corresponding to the memory-continuous variable.

[0066] According to some optional implementations, the first verification statement may include: a first statement that performs an address-taking operation on each memory contiguous variable through a first symbolic variable to obtain a value for a second symbolic variable, wherein the second symbolic variable corresponds to the element address of each sequence of the memory contiguous variable; a second statement that dereferences each second symbolic variable; and a third statement that processes the elements obtained by dereferencing each second symbolic variable according to the loop statement in the first loop unit.

[0067] In one embodiment, the verification unit 304 is further configured as follows:

[0068] If there are counterexamples in the numerical processing results or intermediate results that cause memory overflow problems, obtain the counterexamples and provide feedback to the user.

[0069] Otherwise, if there are no counterexamples in the numerical processing results or intermediate results that would cause a memory overflow problem, no operation or verified information is returned to the user.

[0070] It is worth noting that, Figure 3 The device 300 shown and Figure 1 The described method and process correspond to this. Figure 1 The corresponding descriptions in the illustrated method embodiments also apply to apparatus 300, and will not be repeated here.

[0071] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 1 The methods described above.

[0072] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 1The methods described above.

[0073] Those skilled in the art will recognize that the functions described in the embodiments of this specification in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0074] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the technical concept in this specification. It should be understood that the above description is only a specific embodiment of the technical concept in this specification and is not intended to limit the scope of protection of the technical concept in this specification. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solutions of the embodiments in this specification should be included within the scope of protection of the technical concept in this specification.

Claims

1. A method for bounded model checking of a loop unit, the method comprising: identifying memory continuous variables in a first loop unit of a module to be tested; generating a first symbolic variable for the memory continuous variables and determining a first value interval for the first symbolic variable, the first symbolic variable being used to replace any element sequence of the memory continuous variables, and the first value interval being used to describe the element sequence of the memory continuous variables; rewriting a loop statement in the first loop unit by using the first symbolic variable to represent any element sequence of the memory continuous variables, to obtain a first checking statement described by the first symbolic variable; for a statement referencing a result value of the loop statement, rewriting the statement into a corresponding second checking statement by determining a second value interval covering the result value of the loop statement; and solving a constraint expression containing the first checking statement and the second checking statement by using a solver, to perform the bounded model checking of the first loop unit.

2. The method of claim 1, wherein, The memory continuous variables are one of: an array, a vector, and a slice.

3. The method of claim 1, wherein, The first symbolic variable is used to abstractly describe each element sequence of the memory continuous variables, and a value range of the first value interval is consistent with a range of element numbers corresponding to the memory continuous variables.

4. The method of claim 1, wherein, The first checking statement comprises: a first statement assigning a second symbolic variable with a result of an address-of operation on each memory continuous variable by using the first symbolic variable, the second symbolic variable corresponding to an element address of each element sequence of the memory continuous variables; a second statement dereferencing each second symbolic variable; and a third statement processing an element obtained by dereferencing each second symbolic variable according to the loop statement in the first loop unit.

5. The method of claim 1, wherein, The solving of the constraint expression containing the first checking statement and the second checking statement by using the solver to perform the bounded model checking of the first loop unit comprises: in a case where there is a counterexample of a numerical processing result or an intermediate result causing a memory overflow problem, obtaining the counterexample to feed back to a user; and otherwise, in a case where there is no counterexample of the numerical processing result or the intermediate result causing the memory overflow problem, performing no operation or obtaining information of a correct verification to feed back to the user. 6.A device for bounded model checking of a loop unit, the device comprising: an identifying unit configured to identify memory continuous variables in a first loop unit of a module to be tested; a generating unit configured to generate a first symbolic variable for the memory continuous variables and determine a first value interval for the first symbolic variable, the first symbolic variable being used to replace any element sequence of the memory continuous variables, and the first value interval being used to describe the element sequence of the memory continuous variables; a rewriting unit configured to rewrite a loop statement in the first loop unit by using the first symbolic variable to represent any element sequence of the memory continuous variables, to obtain a first checking statement described by the first symbolic variable; and for a statement referencing a result value of the loop statement, rewriting the statement into a corresponding second checking statement by determining a second value interval covering the result value of the loop statement; and solving a constraint expression containing the first checking statement and the second checking statement by using a solver, to perform the bounded model checking of the first loop unit. A verification unit configured to solve a constraint expression containing the first verification statement and the second verification statement by using a solver, so as to perform bounded model checking of the first loop unit.

7. The apparatus of claim 6, wherein, The first symbolic variable is used to abstractly describe each sequence of the memory continuous type variable, and a value range of the first value interval is consistent with an element number range corresponding to the memory continuous type variable.

8. The apparatus of claim 6, wherein, The first verification statement comprises: A first statement of assigning a second symbolic variable to a result of performing an address operation on each memory continuous type variable by using the first symbolic variable, the second symbolic variable corresponding to an element address of each sequence of the memory continuous type variable; A second statement of dereferencing each second symbolic variable; A third statement of processing elements obtained by dereferencing each second symbolic variable according to a loop statement in the first loop unit. 9.A computer readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-5.

10. A computing device comprising a memory and a processor, wherein: The memory stores executable code, and the processor implements the method of any one of claims 1-5 when executing the executable code.

Images