SCADE time sequence property verification method based on nuXmv

Abstract

The invention discloses an SCADE time sequence property verification method based on nuXmv. The SCADE time sequence property verification method comprises the steps that 1, a text expression form of an SCADE model is extracted; 2, constructing a syntax tree according to a text expression form of the SCADE model; 3, extracting SCADE model elements from the syntax tree, and constructing an intermediate symbol table container; 4, extracting related information from the intermediate symbol table container, generating a related module of the nuXmv model, and forming the nuXmv model; and 5, importing the system property described by the sequential logic language into the nuXmv model, and verifying to obtain a verification result.

Description

Technical Field

[0001] The invention belongs to the technical field of safety-critical software, and in particular is a SCADE timing property verification method based on nuXmv. Background Art

[0002] Safety-critical systems are systems whose failure or malfunction may cause casualties, widespread environmental degradation, or huge property losses. They have extremely high requirements for safety, reliability, and other properties. And as safety-critical software becomes increasingly complex, traditional paper-based software development methods can no longer meet the development needs of complex software. Model-based software development is gradually being recognized by academia and industry.

[0003] Model-based software development is a formal method that is model-centric. When developing complex systems, from the conceptual design stage to the subsequent development stage, and then to the subsequent software life cycle, this development method supports the completion of activities related to system requirements, system design, system analysis and system verification through modeling. Because each element in the model has a clear definition, the consistency between the models at each stage is guaranteed, so there will be no ambiguity problems that often occur in traditional document-driven development. Since the models at different stages omit some irrelevant details, design loopholes can be discovered and modified early in the system life cycle.

[0004] In order to ensure that the established model meets all requirements, the industry currently uses two methods: testing and formal verification. Due to the limitation of the number of test cases, even if the model passes all the designed test cases, there may still be some bugs. Formal verification can ensure that the model meets the requirements of the system and does not contain bugs. Formal verification is divided into: model checking and theorem proving. Model checking can automatically verify properties and output counterexamples that violate the properties. Therefore, model checking is a formal verification method that is widely used in the industry.

[0005] ANSYS SCADE Suite is a model-based software development environment that uses the formal language SCADE as the underlying language. Through this integrated development environment, users can model the system and simulate the operation of the system program. In addition, the SCADE model can automatically generate C language code. Since the code generator of ANSYS SCADE Suite has passed the TQL1 level certification, the code it generates meets many industrial standards. In addition, ANSYS SCADE Suite provides a formal verification module Design Verifier for model testing.

[0006] However, Desgin Verifier requires users to build a synchronous observer model based on the original system model to express the properties to be verified. However, the expressive power of this synchronous observer model is limited and is not enough to describe the verification properties of the sequential logic description that often appears in safety-critical fields. Existing tools that can verify the properties described by sequential logic formulas, such as UPPAAL and nuXmv, do not support system models described in the SCADE language and are difficult to use directly. Therefore, it is of great significance to convert the SCADE model into a model described in other formal languages ​​to verify the properties of sequential logic, thereby indirectly improving the verification capabilities of the SCADE model. Summary of the invention

[0007] Purpose of the invention: To solve the problem that existing tools that can verify the properties described by temporal logic formulas do not support system models described in SCADE language, the present invention proposes a SCADE temporal property verification method based on nuXmv, which improves the verification efficiency of the SCADE model and enhances the SCADE model verification capability without introducing errors.

[0008] Technical solution: A SCADE timing property verification method based on nuXmv, including the following steps:

[0009] Step 1: Extract the textual representation of the SCADE model;

[0010] Step 2: Construct a syntax tree based on the textual expression of the SCADE model;

[0011] Step 3: Extract SCADE model elements from the syntax tree and build an intermediate symbol table container;

[0012] Step 4: Extract relevant information from the intermediate symbol table container, generate relevant modules of the nuXmv model, and form the nuXmv model;

[0013] Step 5: Import the system properties described by the temporal logic language into the nuXmv model, perform verification, and obtain the verification results.

[0014] Furthermore, in the process of constructing the intermediate symbol table container, it includes: converting the SCADE model elements into nuXmv model elements through a custom conversion rule;

[0015] The self-defined conversion rules include: variable name conversion rules, data type conversion rules and predefined operator conversion rules;

[0016] The variable name conversion rule is used to define the name of each variable used in the SCADE model in the nuXmv model, as well as the name of the newly added nuXmv model element;

[0017] The data type conversion rule is used to define the correspondence between SCADE numerical types and nuXmv numerical types;

[0018] The predefined operator conversion rules are used to define the representation of basic operators in the SCADE model in the nuXmv model.

[0019] Furthermore, in the process of constructing the intermediate symbol table container, it also includes: when a security state machine exists in the SCADE model, a monitoring mechanism based on STP is introduced;

[0020] The STP-based monitoring mechanism is used to define a monitoring module for each output variable or local variable of the model, aggregate all assignment expressions of the monitored variables, and control specific execution branches through monitoring variables.

[0021] Furthermore, the intermediate symbol table container is represented as: nuXmv<I,O,L,SM,M,Func> , where I, O, and L represent the input variables, output variables, and local variables of the model, respectively; SM represents the set of state machines in the model; M represents the hash mapping table of monitored variables and monitoring modules in the model; and Func represents the set of function modules in the model.

[0022] Furthermore, the extraction of SCADE model elements from the syntax tree and construction of an intermediate symbol table container specifically includes:

[0023] Traverse the SCADE model elements in the syntax tree;

[0024] When the SCADE model element type in the syntax tree is a top-level operator, let I, O, and L record the input variables, output variables, and local variables used by it respectively;

[0025] When the SCADE model element type in the syntax tree is a safe state machine, a 4-tuple is created<VAR,MVAR,TRANS,SUB_SM> Put them into the set SM, where VAR represents all variables in the state machine, MVAR represents all monitored variables, TRANS represents all state transitions in the state machine, and SUB_SM represents all sub-state machines of the current state machine; if there is an assignment operation to the input variable or local variable in the state machine, then create a key-value pair <A,<MA,action,func_m> >Put it into set M, where A represents the assigned input variable or local variable, MA is the set of all monitored variables of A, action is the set of all assignment expressions of variable A, func_m is the set of functions called in action, if no function is called in action, then func_m is an empty set;

[0026] When the SCADE model element type in the syntax tree is an operator consisting of pure data flow, a tuple is created<VAR,ACTION> Put them into the collection Func, where VAR represents all variables used by the operator and ACTION represents all assignment expressions in the operator.

[0027] Further, in step 4, the relevant information is extracted from the intermediate symbol table container to generate the relevant modules of the nuXmv model to form the nuXmv model. The specific operations include:

[0028] Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the state machine module of the nuXmv model;

[0029] Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate monitoring module of nuXmv model;

[0030] Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate function modules of the nuXmv model representing the data flow operators in the SCADE model;

[0031] Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the top-level module of the nuXmv model.

[0032] Furthermore, the data type conversion rules include:

[0033] Define the SCADE value type bool to correspond to the nuXmv value type boolean;

[0034] Define the SCADE numeric type int N to correspond to the nuXmv numeric type integer; N is any number among 8, 16, 32, and 64;

[0035] Define the SCADE numeric type uint N to correspond to the nuXmv numeric type integer; N is any number among 8, 16, 32, and 64;

[0036] Define the SCADE value type float32 to correspond to the nuXmv value type real;

[0037] Define the SCADE value type float64 to correspond to the nuXmv value type real;

[0038] In the predefined operator conversion rules, basic operators in the SCADE model include mathematical operators, logical operators, comparison operators and branch operators.

[0039] Furthermore, the specific execution branch is controlled by monitoring variables, and the specific operations include:

[0040] The monitoring variables reset_V_SM_S and set_V_SM_S are two Boolean variables. If the SCADE model enters state S in the state machine SM, the variable V is assigned a value. At this time, reset_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module. If the SCADE model remains in state S in the state machine SM and cannot jump to other states, then set_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module. In this case, if there is an assignment operation on the variable V in the SCADE model, the branch corresponding to set_V_SM_S is the assignment expression for the monitored variable. When set_V_SM_S is TRUE and the SCADE model does not assign a value to the variable V at this time, the value of the variable V is determined by the default attribute of the variable. If the variable V has a default attribute, V is assigned the default attribute value. If the variable V does not have a default attribute, the original value remains unchanged.

[0041] Further, the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the state machine module of the nuXmv model. The specific operations include:

[0042] Traversing the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> All state machine 4-tuples recorded in<VAR,MVAR,TRANS,SUB_SM> SM set; for each state machine in the SM set, first generate the state machine module name and parameter list, the parameter list includes hierarchical structure variables, input variables of the state machine, output variables of the state machine, local variables of the state machine and related monitoring variables; if the current state machine has a sub-state machine, instantiate the hierarchical structure variables and sub-state machines of the sub-state machine, and assign values ​​to the hierarchical structure variables; then generate the state variable representing the state of the state machine and the state machine transfer expression; finally, generate the assignment expression of the related monitoring variables according to the assignment of the variables;

[0043] The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the monitoring module of the nuXmv model. The specific operations include:

[0044] By traversing the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> For each key-value pair in the hash map recorded in M, a monitoring module is generated for each output variable and local variable;

[0045] For a key-value pair<MA,action,func_m> , if func_m is not an empty set, all used functions are instantiated; then initialization and subsequent cycle assignment expressions are generated for the monitored variables.

[0046] Further, the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generates the function modules of the nuXmv model representing the data flow operators in the SCADE model. The specific operations include:

[0047] Intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Each function tuple Func in the Func collection i First, generate a function module declaration and use Func i All input variables are used as parameters, and then Func is declared i Output variables and local variables of Func i Other functions are called, and the corresponding functions need to be instantiated. Finally, initialization is generated for each output variable and local variable, as well as assignment expressions used in subsequent cycles;

[0048] The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the top-level module of the nuXmv model. The specific operations include:

[0049] First, generate the top-level module name MODULE main, then declare the input variables, output variables, and local variables of the outermost operator of the entire model;

[0050] If there is a safety state machine in the SCADE model, declare the hierarchical structure variables default and active of the top-level state machine, then declare all monitoring variables in the model and instantiate all monitoring modules. Next, instantiate the top-level state machine and generate assignment expressions for default and active. Finally, initialize all monitoring variables.

[0051] If the SCADE model is a model composed of pure data flow operators, then the top-level function module is directly instantiated.

[0052] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0053] (1) The present invention converts the SCADE model into a nuXmv model, and ensures that the converted nuXmv model is a faithful implementation of the SCADE model, without missing elements or introducing other content. By verifying whether the nuXmv model satisfies a certain temporal logic property, it proves whether the SCADE model satisfies the target property.

[0054] (2) The present invention supports all modeling methods of SCADE models, including pure data flow operators, safety state machine operators, and operators composed of the two. At the same time, the present invention supports the hierarchical structure of SCADE models, and deep nesting is also allowed. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 Run a flow chart for the invention;

[0056] Figure 2 is model conversion rule 1;

[0057] Figure 3 is the model transformation rule 2. DETAILED DESCRIPTION

[0058] By referring to the exemplary embodiments, the objects and functions of the present invention and the methods for achieving these objects and functions will be explained. However, the present invention is not limited to the exemplary embodiments disclosed below; it can be implemented in different forms. The essence of the description is only to help those skilled in the relevant art to comprehensively understand the specific details of the present invention.

[0059] Embodiments of the present invention will now be described with reference to the accompanying drawings.

[0060] This embodiment is developed based on the open source toolkit ANTLR4, the model-based software development environment ANSYS SCADE Suite, the model checking tool nuXmv, and the development environment IDEA. This embodiment proposes a SCADE timing property verification method based on nuXmv, which mainly includes the following steps:

[0061] Convert the graphical SCADE model into a textual description SCADE model through ANSYS SCADE Suite;

[0062] Use ANTLR4 to parse the text SCADE model and build a syntax tree;

[0063] Generate nuXmv model through defined algorithms and transformation rules;

[0064] The user imports the temporal logic properties described in LTL and CTL to be verified, and the tool calls the model detector of nuXmv for verification. If a property fails to pass the verification, the tool automatically outputs the requirement traceability matrix and the execution path of the counterexample.

[0065] Each step is described in detail as follows.

[0066] Step 1: Use ANSYS SCADE Suite to extract the textual representation of the SCADE model, that is, convert the graphical SCADE model into a textual description SCADE model. If there are multiple operators, the textual models of all operators need to be written into the same file. Converting the graphical SCADE model into a textual representation is a built-in function of ANSYS SCADE Suite.

[0067] Step 2: Use ANTLR to read the SCADE model described in the text and build a syntax tree. When performing this step, you need to provide the SCADE grammar file, which can be written according to the grammar manual provided by SCADE and the ANTLR rule grammar. Table 1 shows the comparison of some grammars before and after the conversion.

[0068] Table 1 Syntax comparison table

[0069]

[0070] Step 3: Traverse the syntax tree of the SCADE model, convert the SCADE model elements into nuXmv model elements through custom rules, and build an intermediate symbol container. The custom rules include variable name conversion rules, data type conversion rules, and predefined operator conversion rules.

[0071] The variable name conversion rules define what names should be used for each variable used in the SCADE model, as well as for the newly added nuXmv model elements.

[0072] The input variables, output variables and local variables of each SCADE operator can be used directly.

[0073] In SCADE, add the prefix "SM_" to each state machine name and the prefix "Func_" to each function name. When instantiating state machines and functions, if it is a top-level state machine, the instance name is prefixed with "topSM_", and the functions used in it are prefixed with "topFunc_". If it is a sub-state machine, it is prefixed with "Sub_State_", and the "State" in the prefix should be replaced with the specific state name. The functions used in the sub-state machine are prefixed with "func_".

[0074] The monitoring module is named "Set_V", where V should be replaced by the specific monitored variable name, and the corresponding monitoring module instance name is "monitor_Set_V", where V is the specific monitored variable name.

[0075] The top-level module name is fixed to "main".

[0076] The monitoring variables used in the model are named "set_V_SM_S" and "reset_V_SM_S", where V represents the name of the monitored variable, SM represents the state machine for assigning values ​​to the variable, and S represents the specific state of the variable assignment operation.

[0077] The hierarchical structure variables default and active used in the model use "_SubSM_S" as the suffix, where SubSM should be replaced with the specific sub-state machine name and S should be replaced with the state of the parent state machine where the sub-state machine is located. The top-level state machine does not use a suffix.

[0078] Since the data types of SCADE are different from those of nuXmv, the data types involved need to be converted. The data type conversion rules define this relationship, as shown in Table 2.

[0079] Table 2 Data type correspondence

[0080] SCADE Numeric Types nuXmv numeric type bool boolean int N integer uint N integer float32 real float64 real

[0081] Among them, N can be replaced by any number of 8, 16, 32, and 64.

[0082] The predefined operators in SCADE refer to the basic operators in SCADE, including mathematical operators, logical operators, comparison operators, branch operators, etc. The predefined operators specify the representation of these operators in nuXmv. Table 3 shows these conversion rules.

[0083] Table 3 Correspondence between predefined operators of SCADE and nuXmv

[0084] SCADE Predefined Operators nuXmv expression form x=a+b x:=a+b x=ab x:=ab x=a*b x:=a*b x=a / b x:=a / b x=-(a) x:=-a x=a mod b x=mod(a,b) x=a and b x:=a&b x=a or b x:=a|b x=a xor b x:=a xor b x=not(a) x:=! a x=a=b x:=a=b x=a<b x:=a<b x=a<=b x:=a<=b x=a>b x:=a>b x=a>=b x:=a>=b x=a<>b x:=a!=b

[0085] Among them, x represents the variable to be assigned, and x, a and b all represent a variable.

[0086] Among them, mod in the nuXmv expression is a custom function, and its specific code is as follows:

[0087]

[0088]

[0089] For branch operators, the transformation rules are as follows:

[0090]

[0091] Among them, cond1 represents a Boolean expression, and i1, i2 and i3 represent assignment expressions.

[0092] Since nuXmv prohibits multiple assignments to the same variable using multiple different expressions in the model, which mostly occurs in the safety state machine of SCADE, a monitoring mechanism based on STP is introduced when the safety state machine exists in the SCADE model.

[0093] A monitoring mechanism based on STP is to define a monitoring module for each output variable or local variable, aggregate all the assignment expressions of the monitored variables using case expressions, and control the specific execution branches through monitoring variables.

[0094] The monitoring variables reset_V_SM_S and set_V_SM_S are two Boolean variables. If SCADE enters state S in the state machine SM, it will assign a value to the variable V, and these two variables will exist.

[0095] If SCADE enters state S in the state machine SM and needs to assign a value to the variable V, reset_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module.

[0096] If SCADE remains in state S in the state machine SM and cannot jump to other states, then set_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module. In this case, if the variable V needs to be assigned a value, the branch corresponding to set_V_SM_S is the assignment expression for the monitored variable, otherwise the value of the variable V is determined by the default attribute of the variable. If the variable V has a default attribute, then V is assigned the default attribute value, otherwise the original value remains unchanged.

[0097] With the conversion rules from SCADE elements to nuXmv elements, an intermediate symbol table container containing all the information can be constructed according to the defined algorithm. The intermediate symbol table container is a 6-tuple nuXmv<I,O,L,SM,M,Func> , where I, O, and L represent the input variables, output variables, and local variables of the model respectively, SM represents the set of state machines in the model, M is the hash mapping table of monitored variables and monitoring modules in the model, and Func is the set of function modules in the model.

[0098] Traverse the syntax tree of the SCADE text model to construct the target 6-tuple. Different processing methods are used depending on the node type:

[0099] If the node is a top-level operator, let I, O, and L record the input variables, output variables, and local variables used by it respectively.

[0100] If the node is a secure state machine, then create a 4-tuple<VAR,MVAR,TRANS,SUB_SM> Put it into the set SM. VAR represents all variables in the state machine, MVAR represents all monitoring variables, TRANS represents all state transitions in the state machine, and SUB_SM represents all sub-state machines of the current state machine. If there is an assignment operation to input variables or local variables in the state machine, then create a key-value pair <A,<MA,action,func_m> >Put it into the set M. A represents the assigned input variable or local variable, MA is the set of all monitored variables of A, action is the set of all assignment expressions of variable A, func_m is the set of functions called in action, if no function is called in action, then func_m is an empty set.

[0101] If the node is a pure data flow operator, then create a tuple<VAR,ACTION> Put it into the collection Func. VAR represents all variables used by the operator, and ACTION represents all assignment expressions in the operator.

[0102] Algorithm 1 shows the details of the algorithm.

[0103] Algorithm 1 builds the intermediate symbol table

[0104] Input:SCADE Grammar Tree Output:nuXmv<I,O,L,SM,M,Func>

[0105]

[0106]

[0107] Step 4: Based on the 6-tuple intermediate symbol container nuXmv<I,O,L,SM,M,Func> Generate the state machine module described by nuXmv. Traverse the SM of all state machines in the 6-tuple 4-tuple<VAR,MVAR,TRANS,SUB_SM> For each state machine in the SM set, the state machine module name is first generated, including the state machine name and parameter list. The parameter list includes hierarchical structure variables, inputs, outputs, local variables of the state machine, and related monitoring variables.

[0108] If the current state machine has a sub-state machine, then the hierarchical structure variables and sub-state machines of the sub-state machine are instantiated, and the hierarchical structure variables are assigned values.

[0109] Next, generate the state variable representing the state of the state machine and the state machine transfer expression, that is, the state assignment expression.

[0110] Finally, according to the assignment of variables, the assignment expression of related monitoring variables is generated.

[0111] Figure 2 Several rules used when generating state machine modules are shown. Among them, Rule 1 is the instantiation of the sub-state machine and the declaration of the corresponding hierarchical variables. Rule 2 describes the initialization of hierarchical variables and the assignment method after the first cycle. Rule 3 describes the state transition in the state machine, and Rule 4 and Rule 5 are the assignment expressions for the monitoring variables after the first cycle. Algorithm 2 combines these five rules to give an algorithm for generating state machine modules. Algorithm 2 generates state machine modules

[0112] Input:nuXmv<I,O,L,SM,M,Func>

[0113] Output:State Machine Module

[0114]

[0115]

[0116] Step 5: Based on the intermediate symbol container 6-tuple nuXmv<I,O,L,SM,M,Func> Generate monitoring module.

[0117] By traversing each key-value pair in the hash map, a monitoring module is generated for each output variable and local variable.<MA,action,func_m> , if func_m is not an empty set, instantiate all used functions. Next, generate initialization and subsequent cycle assignment expressions for the monitored variables.

[0118] Figure 3 The following table shows the two rules used to generate the monitoring module. Rule 6 describes the expression to copy the monitored variable in the first cycle. Rule 7 describes the expression to assign the monitored variable after the first cycle. Among them, Init_var(V) represents the initial value of the variable V in state S of the state machine SM. ResetValue(V) represents the specific operation on the variable V in state S of the state machine SM.

[0119] Two functions are also used in rule 7, namely NextResetValue(V) and NextDefVal(V). Among them, NextResetValue(V) represents the specific operation of the variable V in the state S of the state machine SM, which is modified by the operator next of nuXmv. Its meaning is to use the value of the next cycle to assign a value to the variable V in the next cycle. NextDefVal(V) represents the default value of the variable V in the next cycle, that is, the "default" value defined by the user for V in SCADE.

[0120] Algorithm 3 generates monitoring modules

[0121] Input:nuXmv<I,O,L,SM,M,Func>

[0122] Output:Monitor Module

[0123]

[0124]

[0125] Step 6: Generate function modules representing data flow operators in the SCADE model based on the intermediate symbol container 6-tuple. For each function tuple Func in the set Func i First, generate a function module declaration and use Func i All input variables are used as parameters, and then Func is declared i Output variables and local variables. If Func i Other functions are called and the corresponding functions need to be instantiated. Finally, initialization is generated for each output variable and local variable, as well as assignment expressions used in subsequent cycles.

[0126] Algorithm 4 Generator Function Module

[0127] Input:nuXmv<I,O,L,SM,M,Func>

[0128] Output:Function Module

[0129]

[0130]

[0131] Step 7: Generate the module name MODULE main, and then declare the input variables, output variables, and local variables of the outermost operator of the entire model.

[0132] If there is a safety state machine in the SCADE model, declare the hierarchical structure variables default and active of the top-level state machine, then declare all monitoring variables in the model and instantiate all monitoring modules. Next, instantiate the top-level state machine and generate assignment expressions for default and active. Finally, initialize all monitoring variables.

[0133] If the SCADE model is a model composed of pure data flow operators, then the top-level function module is directly instantiated.

[0134] Algorithm 5 gives the algorithm for generating the top-level module.

[0135] Algorithm 5 generates top-level modules

[0136] Input:nuXmv<I,O,L,SM,M,Func>

[0137] Output:main Module

[0138]

[0139] 22: Initialize the default of the top-level state machine and assign values ​​to subsequent cycles

[0140] 23: Assign a value to the active variable of the top-level state machine

[0141] 24:for M i <V,<MA,action,func_m> >in M do

[0142] 25:for ma <set_var_SM j _S,reset_var_SM j _S>in MA do

[0143] 26: Initialize monitoring variable set_var_SM j _S and reset_var_SM j _S

[0144] 27: end for

[0145] 28: end for

[0146] 29:else

[0147] 30: Instantiate the top-level function module

[0148] 31:end if

[0149] Step 8: Import the properties described in the temporal logic language into the nuXmv tool and call the nuXmv model checker for verification. This tool currently only supports properties described in LTL and CTL. Users can directly import properties into the nuXmv model through the tool. The properties are located after the main module. The prefix "LTLSPEC" must be added before each LTL formula, and the prefix "CTLSEPC" must be added before each CTL formula.

Claims

1. A SCADE timing property verification method based on nuXmv, characterized by: The following steps are involved: Step 1: Extract the textual representation of the SCADE model; Step 2: Construct a syntax tree based on the textual expression of the SCADE model; Step 3: Extract SCADE model elements from the syntax tree and build an intermediate symbol table container; Step 4: Extract relevant information from the intermediate symbol table container, generate relevant modules of the nuXmv model, and form the nuXmv model; Step 5: Import the system properties described by the temporal logic language into the nuXmv model for verification and obtain the verification results.

2. A SCADE timing property verification method based on nuXmv according to claim 1, characterized in that: The process of constructing the intermediate symbol table container includes: converting SCADE model elements into nuXmv model elements through custom conversion rules; The custom conversion rules include: variable name conversion rules, data type conversion rules and predefined operator conversion rules; The variable name conversion rule is used to define the name of each variable used in the SCADE model in the nuXmv model, as well as the name of the newly added nuXmv model element; The data type conversion rule is used to define the correspondence between SCADE numerical types and nuXmv numerical types; The predefined operator conversion rules are used to define the expression form of the basic operators in the SCADE model in the nuXmv model.

3. The SCADE timing property verification method based on nuXmv according to claim 1, characterized in that: The process of constructing the intermediate symbol table container also includes: when a security state machine exists in the SCADE model, a monitoring mechanism based on STP is introduced; The STP-based monitoring mechanism is used to define a monitoring module for each output variable or local variable of the model, aggregate all assignment expressions of the monitored variables, and control specific execution branches through monitoring variables.

4. The SCADE timing property verification method based on nuXmv according to claim 3 is characterized in that: The intermediate symbol table container is represented by: nuXmv<I,O,L,SM,M,Func> , where I, O, and L represent the input variables, output variables, and local variables of the model, respectively; SM represents the set of state machines in the model; M represents the hash mapping table of monitored variables and monitoring modules in the model; and Func represents the set of function modules in the model.

5. The SCADE timing property verification method based on nuXmv according to claim 4, characterized in that: The extracting of SCADE model elements from the syntax tree and constructing an intermediate symbol table container specifically includes: Traverse the SCADE model elements in the syntax tree; When the SCADE model element type in the syntax tree is a top-level operator, let I, O, and L record the input variables, output variables, and local variables used by it respectively; When the SCADE model element type in the syntax tree is a safe state machine, a 4-tuple is created<VAR,MVAR,TRANS,SUB_SM> Put them into the set SM, where VAR represents all variables in the state machine, MVAR represents all monitored variables, TRANS represents all state transitions in the state machine, and SUB_SM represents all sub-state machines of the current state machine; if there is an assignment operation to the input variable or local variable in the state machine, then create a key-value pair <A,<MA,action,func_m> >Put it into the set M, where A represents the assigned output variable or local variable, MA is the set of all monitored variables of A, action is the set of all assignment expressions of variable A, func_m is the set of functions called in action, if no function is called in action, then func_m is an empty set; When the SCADE model element type in the syntax tree is an operator consisting of pure data flow, a tuple is created<VAR,ACTION> Put them into the collection Func, where VAR represents all variables used by the operator and ACTION represents all assignment expressions in the operator.

6. The SCADE timing property verification method based on nuXmv according to claim 5, characterized in that: In step 4, the relevant information is extracted from the intermediate symbol table container to generate the relevant modules of the nuXmv model to form the nuXmv model. The specific operations include: Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the state machine module of the nuXmv model; Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate monitoring module of nuXmv model; Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate function modules of the nuXmv model representing the data flow operators in the SCADE model; Based on the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the top-level module of the nuXmv model.

7. The SCADE timing property verification method based on nuXmv according to claim 2, characterized in that: The data type conversion rules include: Define the SCADE value type bool to correspond to the nuXmv value type boolean; Define the SCADE numeric type int N to correspond to the nuXmv numeric type integer; N is any number among 8, 16, 32, and 64; Define the SCADE numeric type uint N to correspond to the nuXmv numeric type integer; N is any number among 8, 16, 32, and 64; Define the SCADE value type float32 to correspond to the nuXmv value type real; Define the SCADE value type float64 to correspond to the nuXmv value type real; In the predefined operator conversion rules, basic operators in the SCADE model include mathematical operators, logical operators, comparison operators and branch operators.

8. The SCADE timing property verification method based on nuXmv according to claim 3, characterized in that: The specific execution branch is controlled by monitoring variables, and the specific operations include: The monitoring variables reset_V_SM_S and set_V_SM_S are two Boolean variables. If the SCADE model enters state S in the state machine SM, the variable V is assigned a value. At this time, reset_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module. If the SCADE model remains in state S in the state machine SM and cannot jump to other states, then set_V_SM_S will be set to TRUE to activate the corresponding execution branch in the monitoring module. In this case, if there is an assignment operation on the variable V in the SCADE model, the branch corresponding to set_V_SM_S is the assignment expression for the monitored variable. When set_V_SM_S is TRUE and the SCADE model does not assign a value to the variable V at this time, the value of the variable V is determined by the default attribute of the variable. If the variable V has a default attribute, V is assigned the default attribute value. If the variable V does not have a default attribute, the original value remains unchanged.

9. The SCADE timing property verification method based on nuXmv according to claim 6, characterized in that: The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the state machine module of the nuXmv model. The specific operations include: Traversing the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> All state machine 4-tuples recorded in<VAR,MVAR,TRANS,SUB_SM> SM set; for each state machine in the SM set, first generate the state machine module name and parameter list, the parameter list includes hierarchical structure variables, input variables of the state machine, output variables of the state machine, local variables of the state machine and related monitoring variables; if the current state machine has a sub-state machine, instantiate the hierarchical structure variables and sub-state machines of the sub-state machine, and assign values ​​to the hierarchical structure variables; then generate the state variable representing the state of the state machine and the state machine transfer expression; finally, according to the assignment of the variables, generate the assignment expression of the related monitoring variables; The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the monitoring module of the nuXmv model. The specific operations include: By traversing the intermediate symbol table container nuXmv<I,O,L,SM,M,Func> For each key-value pair in the hash map recorded in M, a monitoring module is generated for each output variable and local variable; For a key-value pair<MA,action,func_m> , if func_m is not an empty set, all used functions are instantiated; then initialization and subsequent cycle assignment expressions are generated for the monitored variables.

10. The SCADE timing property verification method based on nuXmv according to claim 6, characterized in that: The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generates function modules of the nuXmv model representing the data flow operators in the SCADE model. The specific operations include: Intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Each function tuple Func in the Func collection i First, generate a function module declaration and use Func i All input variables are used as parameters, and then Func is declared i Output variables and local variables of Func i Other functions are called, and the corresponding functions need to be instantiated. Finally, initialization is generated for each output variable and local variable, as well as assignment expressions used in subsequent cycles; The intermediate symbol table container nuXmv<I,O,L,SM,M,Func> Generate the top-level module of the nuXmv model. The specific operations include: First, generate the top-level module name MODULE main, then declare the input variables, output variables, and local variables of the outermost operator of the entire model; If there is a safety state machine in the SCADE model, declare the hierarchical structure variables default and active of the top-level state machine, then declare all monitoring variables in the model and instantiate all monitoring modules. Next, instantiate the top-level state machine and generate assignment expressions for default and active. Finally, initialize all monitoring variables. If the SCADE model is a model composed of pure data flow operators, then the top-level function module is directly instantiated.

Images