Synchronous data stream language trusted translation method combined with 8114 criterion

Abstract

The invention relates to a synchronous data stream language trusted translation method combined with an 8114 criterion, and belongs to the field of code generation. According to the method, an abstract syntax tree of a Ctemp intermediate language is obtained through the steps of Lustre source code lexical and grammatical analysis, translation and the like; traversing the Ctemp abstract syntax tree, and designing a translation method for control flow statements and assignment statements in statements in the tree structure; traversing expressions in the statements, designing and adding a translation method of forced conversion, and ensuring that implicit type conversion does not exist while semantics of the statements are correct; the theorem about the type relationship in the Cltype is expanded, and the method is used for verifying the type operation; and expanding the theorem about the forced transformation and binary operation of the Ctemp semantics to realize semantic formalized verification. According to the method, the satisfaction of the C code generated by the code generation tool to the GJB 8114 standard is greatly improved.

Description

Technical Field

[0001] The invention belongs to the field of code generation, and in particular relates to a synchronous data stream language trusted translation method combined with 8114 criteria. Background Art

[0002] The generation of high-confidence code is the core technical difficulty of model-based software development. Code generation technology is an advanced programming technology that can automatically generate code through models. The core advantage of this type of technology is that it can effectively improve development efficiency and reduce human programming errors.

[0003] At present, synchronous data flow languages ​​play an important role in model-based software development. In safety-critical fields such as aerospace and nuclear power, model-based software development has become an important research direction. In these fields, any small software error may cause huge loss of life or property. How to achieve trusted translation of synchronous data flow languages ​​has gradually become a research focus in this field.

[0004] Traditional methods of ensuring compiler correctness mostly involve extensive testing of generated code or strict process management of the production process. However, as the scale of software increases, such methods gradually become inefficient. The ability to ensure code security is also gradually approaching its limit. Another means of ensuring code security: formal verification, is gradually becoming a research hotspot. In 2011, the American Radio Technical Commission for Aeronautics supplemented the DO-331 standard (model-based development and verification) and the DO-333 standard (formal method) in the DO-178C series of airworthiness standards for model development and verification.

[0005] In the research on trusted compilation of modeling languages ​​in China, the L2C trusted compiler is an outstanding achievement. The source language of the L2C compiler is Lustre*, which is an extension of the synchronous data flow language Lustre V6. The target language is Clight, which is an intermediate language of the CompCert compiler and a subset of the C language that complies with the C99 standard. The CompCert compiler is a fully formally verified C language compiler developed based on the interactive theorem proving tool Coq. Its security has reached the highest level of current C language compilers. The L2C compiler is also developed based on the interactive theorem proving tool Coq, in which the core steps of the translation are strictly formally verified to ensure the semantic simulation equivalence of the translation process. By docking with the CompCert compiler in the Clight step, the L2C compiler can not only fully complete the formally verified compilation, but also directly output C code based on the Clight abstract syntax tree for code debugging and porting.

[0006] In order to further enhance the maintainability and portability of C code, it is crucial to define and implement safe C code safety programming specifications. In order to improve the security of military software, my country has proposed the GJB 8114-2103 standard for military software C / C++ language. It strictly restricts many aspects of the use of C / C++ language and constructs a safe C code subset, which greatly improves the security, maintainability and portability of C code that meets the standard.

[0007] However, none of the current model-based C code generation tools can meet the GJB 8114-2103 standard and conduct complete formal verification, which affects its applicability in high-risk fields, especially in aerospace and military fields. Taking L2C as an example, its violation rate of the 8114 standard is very high. In the test of 50,000 lines of code, there are 19,660 violations of the rules, of which 17,192 are violations of the R-1-10-4 rule, that is, the rule that implicit type conversion is not allowed, accounting for 87.4% of the total. Summary of the invention

[0008] 1. Technical issues to be resolved

[0009] The technical problem to be solved by the present invention is how to provide a trusted translation method of a synchronous data flow language in combination with the 8114 standard, so as to solve the problem that there is implicit type conversion in the code generated by the current code generator, resulting in a high violation rate of the GJB 8114 standard.

[0010] (II) Technical solution

[0011] In order to solve the above technical problems, the present invention proposes a synchronous data stream language trusted translation method combined with the 8114 criterion, the method comprising the following steps:

[0012] S1. Generate the intermediate language Ctemp abstract syntax tree from the Lustre source code using the synchronous data flow language translation tool L2C;

[0013] S2. Translate the expression layer in the Ctemp abstract syntax tree: detect and eliminate implicit type conversions in the expression layer;

[0014] S3, traverse the statement layer, function layer, and program layer in the abstract syntax tree to complete the complete translation; at the statement layer, detect and eliminate the implicit type conversion of the connection part between the statement and the expression;

[0015] S4, traverse the translated Ctemp abstract syntax tree and output the abstract syntax tree as C code;

[0016] S5. Perform formal verification on the translation process to prove that the programs before and after the translation are analog equivalent, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0017] (III) Beneficial effects

[0018] The present invention proposes a synchronous data stream language trusted translation method combined with the 8114 criterion, which has at least the following beneficial effects:

[0019] (1) The abstract syntax tree of the Ctemp intermediate language code was modified to ensure that the generated code does not contain implicit type conversions, thereby improving the security of the code generated by the OnModel modeling platform. Among the C code generated by the current tool, implicit type conversions account for more than 87% of the violations of the 8114 guidelines. Eliminating implicit type conversions can significantly reduce the violation rate of the generated code to the 8114 safe code guidelines.

[0020] (2) Code optimization and formal verification are implemented on Ctemp, ensuring the integrity of the formal verification chain of the new code generation method.

[0021] (3) While conducting the formal verification work, several practical lemmas are proved for the syntax and operational semantics of Cltypes and Ctemp, which can be applied to the formal verification of other code optimization processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a schematic diagram of the abstract syntax tree;

[0023] Figure 2 This is a flow chart of the core translation steps of the present invention;

[0024] Figure 3 The complete code translation flow chart of the present invention;

[0025] Figure 4 This is a formal verification flow chart of the present invention;

[0026] Figure 5 This is the model diagram of the implementation example program in OnModel. DETAILED DESCRIPTION

[0027] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0028] The technical problem to be solved by the present invention is how to provide a trusted translation method of a synchronous data flow language in combination with the 8114 standard, so as to solve the problem that there is implicit type conversion in the code generated by the current code generator, resulting in a high violation rate of the GJB 8114 standard.

[0029] In order to solve the above technical problems, the present invention proposes a synchronous data stream language trusted translation method combined with the 8114 criteria. Before describing the method, it is necessary to introduce the concepts and special terms that appear below:

[0030] The main work of the present invention is carried out in Coq. Coq is one of the popular theorem proving tools. The core theory of this tool is inductive construction calculus. Under this theoretical framework, Coq combines functional programming language and high-order logic and has a strong mathematical theoretical foundation. The power of Coq also lies in that the terms and functions defined in it can be directly extracted into the OCaml language. This means that it is possible to build a program that is directly verified by formal verification.

[0031] The present invention is based on an abstract syntax tree of an intermediate language Ctemp in a Lustre compilation process. The Ctemp abstract syntax tree is formally defined in Coq and is divided into four layers from top to bottom: program layer, function layer, statement layer, and expression layer.

[0032] In Coq, an inductive construct can contain several construct parameters, and construct parameters can also be inductive constructs. This allows for tree representation. The statements and expressions mentioned below refer to the statements and expressions in the Ctemp abstract syntax tree.

[0033] Take the forced conversion expression as an example. It is defined in Coq as a constructor Ecast of the expression induction type expr, which can accept an expression and a data type (such as int, float, etc.) as construction parameters. Ecast e ty means: apply the forced conversion of data type ty to the expression e. Ecast e ty can also be used as an expression to participate in the construction of other expressions or statements. For example: Ecast(Ecast e ty)ty2 is also a legal expression construction.

[0034] The expression can be operated on the right side. The data type of the value finally obtained is referred to as the data type of the expression in the present invention.

[0035] The expressions in the abstract syntax tree are all in a certain context structure: they are either used as construction parameters of a statement (a subtree of a statement) or as construction parameters of an upper-level expression (a subtree of an expression). If there is a data type ty, when the data type of an expression is equal to ty, no direct implicit type conversion is performed in the context in which it is located according to the operational semantics. In the present invention, ty is called the context type of the expression.

[0036] As an intermediate language for formal verification, Ctemp not only defines an abstract syntax tree in Coq, but also defines formalized operational semantics based on it. Operational semantics reflects the process of program execution at a highly abstract level. The formal definition of operational semantics allows us to verify whether the translation process can ensure that the semantics remain unchanged.

[0037] The present invention relates to a synchronous data flow language trusted translation method combined with 8114 criteria, belonging to the field of code generation. The present invention can convert Lustre source code into C language code without any implicit type conversion. The abstract syntax tree of the Ctemp intermediate language is obtained by analyzing the lexical and grammatical aspects of the Lustre source code and translating them; the Ctemp abstract syntax tree is traversed, and translation methods are designed for control flow statements and assignment statements in the tree structure; the expressions in the statements are traversed, and a translation method for adding forced conversion is designed to ensure that the statements are semantically correct and there is no implicit type conversion; the theorem on type relations in Cltype is extended to verify type operations; the theorem on forced conversion and binary operations of Ctemp semantics is extended to achieve semantic formal verification; in view of the problem that more than 87% of the violations of the GJB 8114 specification by current code generation tools are implicit type conversions, this method uses the reconstructed abstract syntax tree to complete the reconstruction of the generated code and proves the correctness of the generated code through formal verification methods, thereby improving the security of the C code generated by the self-developed OnModel tool and greatly improving the compliance of the C code generated by the code generation tool with the GJB 8114 specification.

[0038] The present invention provides a method for credible translation of synchronous data stream language in combination with 8114 criteria, the method comprising the following steps:

[0039] S1. Use the existing synchronous data flow language translation tool L2C to generate the intermediate language Ctemp abstract syntax tree from the Lustre source code.

[0040] S2. Translate the expression layer in the Ctemp abstract syntax tree: Detect and eliminate implicit type conversions in the expression layer.

[0041] S3. Traverse the statement layer, function layer, and program layer in the abstract syntax tree to complete the complete translation; at the statement layer, detect and eliminate the implicit type conversion of the connection part between the statement and the expression.

[0042] S4. Traverse the translated Ctemp abstract syntax tree and output the abstract syntax tree as C code.

[0043] S5. Perform formal verification on the translation process to prove that the programs before and after the translation are analog equivalent, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0044] Furthermore, the step S2 specifically includes:

[0045] S21. Create a recursive function safe_type_of(e)=ty to solve the data type of the expression, where e is the expression to be solved, and ty is the data type of e obtained by the solution.

[0046] For variables and constant expressions, you can get their type directly from their type tag.

[0047] For other types of expressions, inference needs to be made based on the operational semantics.

[0048] S22. Create a recursive function trans_expr(e, ty) = e' to translate an implicit type conversion expression into an explicit type conversion expression, eliminating the implicit type conversion at the expression level. e is an expression, ty is its context type, and e' is the modified expression.

[0049] For an expression e, its sub-expression is defined as: the expression used as the construction parameter (subtree) of e. If the expression of trans_expr input has sub-expressions, its sub-expressions are also translated by trans_expr. The context type of the sub-expression is inferred by the expression operation semantics.

[0050] Furthermore, the step S3 specifically includes:

[0051] S31. Create a recursive function trans_stmt(s)=s' to translate the function body, where s is a statement and s' is the translated statement.

[0052] For a control flow statement, recursively traverse its substatements and apply trans_stmt to complete the translation.

[0053] For the assignment statement, let the left value expression be e1 and the right value expression be e2, and translate e2 into: trans_expr(e2, safe_type_of(e1)).

[0054] S32, traverse the program layer and the function layer, apply trans_stmt to the function body statement of each function in the function layer, and complete the translation of the entire program.

[0055] Furthermore, the step S5 specifically includes:

[0056] S51. Determine the semantic equivalence theorem before and after translation: If program p1 is translated into p2 through S3, for any numerical sequences v1 and v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2.

[0057] If the theorem is proved in the theorem proving tool Coq, it can be shown that the translation of the program through the S3 step can ensure that the program behavior remains consistent at the input and output levels, and the translation process will not cause semantic changes.

[0058] S52. Decompose the proof of this theorem into proofs of several important lemmas.

[0059] Furthermore, the important lemmas described in S52 mainly include: 1. Initial environment matching; 2. Function execution matching; 3. Expression evaluation matching. The above proof is completed based on operational semantics, and the correctness of the translation process is fully proved.

[0060] Embodiment 1:

[0061] In order to solve the above technical problems, the present invention proposes a code translation method combined with the 8114 standard, and the specific implementation method includes:

[0062] Operation S1: Call L2C to generate a Ctemp abstract syntax tree from the Lustre source code. In this embodiment, the Lustre source code is generated by the OnModel tool based on the model. Figure 5 The generated Lustre code is shown in Table 1. Since the Ctemp abstract syntax tree is difficult to represent, the C language source code constructed from it is used here to demonstrate this process (the code in the example omits the input structure and context structure). The C code generated by the Ctemp abstract syntax tree is shown in Table 2:

[0063] Table 1 Lustre source code

[0064]

[0065]

[0066] Table 2 C code before conversion

[0067]

[0068] Operation S2: Implement expression-level translation in Coq. The specific implementation includes:

[0069] S21: Create a recursive function safe_type_of to solve the expression data type. Discuss each different expression based on the operational semantics.

[0070] For variables and constant expressions, you can get their data types directly from their type tags.

[0071] For other expressions, their data types need to be inferred based on the operational semantics.

[0072] For example, for a binary operation expression, it is necessary to first obtain the type of its sub-expression, and then determine the data type of the binary operation expression based on the definition of binary operation semantics.

[0073] To establish this function, we need to define a type equality judgment function: type_eq(ty1,ty2)=b, which accepts two data types and returns a Boolean value. Further, by proving the proposition:

[0074] forall ty1 ty2,ty1=ty2<=>type_eqty1 ty2=true.

[0075] It proves that type_eq is the determination function of whether the data types in Ctemp are equal, and proves that the data types in Ctemp are decidable, which is crucial for the subsequent definition and proof.

[0076] S22: In the expression layer, let the current expression be e, the context type of e be t1, and the data type of e be t2, and implement the recursive function trans_expr(e, t1):

[0077] If t1=t2, continue to execute step S2 for all its sub-expressions.

[0078] If t1≠t2, if e is: Econst, Evar, Etempvar, Etempret, Ederef, then e will be translated into: Ecast e t1, which means that the forced conversion of the expression e to the data type t1 is applied.

[0079] Operation S3: Implement translation of statement level, function level, and program level in Coq.

[0080] Furthermore, the step S3 specifically includes:

[0081] S31: Create a recursive function trans_stmt(s)=s' to translate the function body, where s is the statement (function body) and s' is the translated statement.

[0082] Trans_stmt classifies and discusses statements. For sub-statements of control flow statements, trans_stmt is recursively applied for translation. For assignment statements, let the left value expression be e1 and the right value expression be e2, then e2 is translated as: trans_expr(e2, safe_type_of(e1)).

[0083] S32: traverse the program layer and the function layer, apply trans_stmt to the function body of each function in the function layer, and complete the translation of the entire program.

[0084] The algorithm in S3 is written as a program translation function, encapsulated as an AddCast translation step, and connected to the synchronous data flow language translation tool L2C. The complete translation process is as follows Figure 3 shown.

[0085] Operation S4: traverse the converted Ctemp abstract syntax tree and output the abstract syntax tree as C code, as shown in Table 3:

[0086] Table 3. Converted C code

[0087]

[0088]

[0089] As you can see, the implicit type conversion has disappeared.

[0090] Operation S5: Formal verification is performed on the translation process to prove that the programs before and after the translation have simulation equivalence, thereby ensuring that the translation process does not affect the correctness of the generated code.

[0091] Furthermore, the step S5 specifically includes:

[0092] S51: Determine the theorem to be proved: Assume that program p1 is translated into p2 through AddCast. For any numerical sequence v1 v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2. Formalize the theorem in the theorem proving tool Coq.

[0093] S52: Decompose the proof of this theorem into proofs of several important lemmas in Coq.

[0094] Furthermore, the important lemmas described in S52 mainly include:

[0095] 1. Initial environment matching: After initializing p1 and p2, the initial environment matching.

[0096] 2. Function execution matching: For any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, memory state m1, m2, if statement a is in the global environment e1, local variable environment le1, local return value environment te1, memory state m1, the memory state changes to m2 after execution, and e2 matches e1, le2 matches le1, and te2 matches te1, then the statement a' obtained after translation, in the global environment e2, local variable environment le2, local return value environment te2, memory state m1, the memory state also changes to m2 after execution.

[0097] 3. Expression evaluation matching: If a1 is translated into a2 when the specified context type is ty, then for any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, and value v1, v2, if statement a1 is evaluated to v1 in the global environment e1, local variable environment le1, and local return value environment te1, and e2 matches e1, le2 matches le1, and te2 matches te1, then the a2 expression is evaluated in the global environment e2, local variable environment le2, and local return value environment te2, and the result is castv1 ty.

[0098] Based on the Ctemp operational semantics and environment semantics, the above theorem is proved inductively. Finally, the formal proof of the translation correctness theorem is completed. The framework of the proof is as follows Figure 4 shown.

[0099] The present invention proposes a synchronous data stream language trusted translation method combined with the 8114 criterion, which has at least the following beneficial effects:

[0100] (1) The abstract syntax tree of the Ctemp intermediate language code was modified to ensure that the generated code does not contain implicit type conversions, thereby improving the security of the code generated by the OnModel modeling platform. Among the C code generated by the current tool, implicit type conversions account for more than 87% of the violations of the 8114 guidelines. Eliminating implicit type conversions can significantly reduce the violation rate of the generated code to the 8114 safe code guidelines.

[0101] (2) Code optimization and formal verification are implemented on Ctemp, ensuring the integrity of the formal verification chain of the new code generation method.

[0102] (3) While conducting the formal verification work, several practical lemmas are proved for the syntax and operational semantics of Cltypes and Ctemp, which can be applied to the formal verification of other code optimization processes.

[0103] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for credible translation of synchronous data stream language in combination with 8114 criteria, characterized in that: The method comprises the following steps: S1. Generate the intermediate language Ctemp abstract syntax tree from the Lustre source code using the synchronous data flow language translation tool L2C; S2. Translate the expression layer in the Ctemp abstract syntax tree: detect and eliminate implicit type conversions in the expression layer; S3, traverse the statement layer, function layer, and program layer in the abstract syntax tree to complete the complete translation; At the statement level, detect and eliminate implicit type conversions in the connection between statements and expressions; S4, traverse the translated Ctemp abstract syntax tree and output the abstract syntax tree as C code; S5. Formal verification of the translation process is performed to prove that the programs before and after the translation are analog equivalent, thereby ensuring that the translation process does not affect the correctness of the generated code.

2. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 1, characterized in that: The S2 specifically includes: S21. Create a recursive function safe_type_of(e)=ty to solve the expression data type, where e is the expression to be solved, and ty is the data type of e obtained by the solution; S22. Create a recursive function trans_expr(e, ty) = e' to translate an implicit type conversion expression into an explicit type conversion expression, eliminating the implicit type conversion at the expression level, where e is the expression, ty is its context type, and e' is the modified expression.

3. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 2, characterized in that: In S21, for variable and constant expressions, their types are directly obtained from their type tags; for other types of expressions, they need to be inferred based on operational semantics.

4. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 2, characterized in that: In S22, for an expression e, its sub-expression is defined as: the expression used as the construction parameter of e; if the expression input by trans_expr has a sub-expression, its sub-expression is also translated by trans_expr; the context type of the sub-expression is inferred by the expression operation semantics.

5. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 4, characterized in that: The S22 specifically includes: In the expression layer, let the current expression be e, the context type of e be t1, and the data type of e be t2. Implement the recursive function trans_expr(e, t1): If t1=t2, continue to execute step S2 for all its sub-expressions; If t1≠t2, if e is: Econst, Evar, Etempvar, Etempret, Ederef, then e will be translated into: Ecast et1, which means that the forced conversion of the expression e to the data type t1 is applied.

6. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in any one of claims 2 to 5, characterized in that: The S3 includes: S31, create a recursive function trans_stmt(s)=s' to translate the function body; s is a statement, s' is the translated statement; S32, traverse the program layer and the function layer, apply trans_stmt to the function body statement of each function in the function layer, and complete the translation of the entire program.

7. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 6, characterized in that: The S31 specifically includes: For control flow statements, recursively traverse its substatements and apply trans_stmt to complete the translation; For the assignment statement, let the left value expression be e1 and the right value expression be e2, and translate e2 into: trans_expr(e2, safe_type_of(e1)).

8. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 6, characterized in that: The algorithm in S3 is written as a program translation function, encapsulated as an AddCast translation step, and connected to the synchronous data flow language translation tool L2C.

9. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 6, characterized in that: The S5 includes: S51. Determine the semantic equivalence theorem before and after translation: If program p1 is translated into p2 through S3, for any numerical sequences v1 and v2, if the input sequence of p1 is v1 and the output sequence is v2, then when the input sequence of p2 is v1, the output sequence is also v2; this theorem is proved in the theorem proving tool Coq; S52. Decompose the proof of this theorem into proofs of several important lemmas.

10. The method for translating a synchronous data stream language in accordance with the 8114 criterion as claimed in claim 9, characterized in that: The important lemmas in S52 include: Initial environment matching: After initializing p1 and p2, the initial environment matches; Function execution matching: For any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, memory state m1, m2, if statement a is in global environment e1, local variable environment le1, local return value environment te1, memory state m1, the memory state changes to m2 after execution, and e2 matches e1, le2 matches le1, te2 matches te1, then the statement a′ obtained after translation, in global environment e2, local variable environment le2, local return value environment te2, memory state m1, the memory state changes to m2 after execution; Expression evaluation matching: If a1 is translated into a2 when the specified context type is ty, then for any global environment e1, e2, local variable environment le1, le2, local return value environment te1, te2, and value v1, v2, if statement a1 is evaluated to v1 in the global environment e1, local variable environment le1, and local return value environment te1, and e2 matches e1, le2 matches le1, and te2 matches te1, then the expression a2 is evaluated in the global environment e2, local variable environment le2, and local return value environment te2, and the result is castv1 ty; According to the operational semantics and environmental semantics of Ctemp, the above theorem is proved inductively, and finally the formal proof of the translation correctness theorem is completed.

Images