System verification method and device

Abstract

The invention provides a system verification method and device, and relates to the technical field of computer science. The method comprises the steps that formalized modeling is carried out according to fault data of a to-be-verified system and a time sequence diagram of the to-be-verified system, and a target model is determined; and verifying the target model to obtain a verification result of the to-be-verified system. Fault data is added to the target model. According to the invention, system verification in a fault scene can be efficiently carried out.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer science and technology, and in particular to a system verification method and device. Background Art

[0002] A system can be understood as a whole with specific functions composed of several parts that interact and depend on each other. Taking a computer system as an example, a computer system can be understood as a system composed of hardware and software for performing various computing tasks.

[0003] With the rapid development of computer technology, computer systems have been widely used in various fields. Computer system verification is one of the means to ensure the reliability and security of computer systems. Computer system verification can be understood as the verification of the logical correctness, functional satisfaction, performance efficiency, security, etc. of computer systems by using theoretical analysis, simulation testing and other means to establish mathematical models and experimental data. Computer system verification involves computer software, hardware, the entire system and other aspects, and plays an important role in whether a computer system is effective, safe, reliable and compliant with specifications.

[0004] Formal methods can be used for system verification. In the prior art, formal method system verification can be performed on timing diagrams or state diagrams. System verification based on timing diagrams is only suitable for normal scenarios, and the technical threshold and investment for complex systems are relatively low, but it cannot cope with fault scenarios. System verification based on state diagrams can adapt to normal scenarios and fault scenarios, but the technical threshold and investment for complex systems are relatively high.

[0005] Therefore, how to efficiently conduct system verification under fault scenarios has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] The present application provides a system verification method and device, which can efficiently perform system verification in a fault scenario.

[0007] In a first aspect, the present application relates to a system verification method, comprising: performing formal modeling based on fault data of a system to be verified and a timing diagram of the system to be verified, determining a target model, and verifying the target model to obtain a verification result of the system to be verified.

[0008] The target model is added with fault data.

[0009] The fault data of the system to be verified may be understood as data related to the fault occurring in the system to be verified, and the fault data of the system to be verified may at least include the fault of the system to be verified.

[0010] According to the system verification method of the present application, the target model is determined by formalizing modeling according to the fault data of the system to be verified and the timing diagram of the system to be verified. On the one hand, the target model determined based on the fault data is added with the fault data, and the fault data may at least include the fault of the system to be verified, thereby adapting to the fault scenario of the system to be verified. On the other hand, the target model is determined based on the fault data and the timing diagram. Compared with the state diagram, the timing diagram only represents the system interaction under the normal state, so the timing diagram is relatively simple, which makes the system verification method of the present application not only adaptable to the fault scenario, but also has lower technical threshold requirements for technicians, and lower modeling costs and labor costs. On the other hand, the formal method of determining the target model and verifying the target model by adopting the formal modeling method is based on a strict and accurate mathematical foundation, and can accurately and efficiently perform system verification to ensure system reliability. At the same time, compared with the method of using expert experience to verify the system, the probability of verification omissions is smaller, which can ensure the completeness of verification, avoid the risk of omissions, and be more comprehensive and efficient. It is especially suitable for complex systems such as data storage systems, and is also suitable for computer systems in existing networks under high reliability scenarios.

[0011] In a possible example, formal modeling is performed based on the fault data of the system to be verified and the timing diagram of the system to be verified, and determining the target model may include: formal modeling the timing diagram to obtain an initial model. Determining the target model based on the fault data and the initial model.

[0012] In a possible example, for example, a formal modeling language may be used to transform the timing diagram to implement formal modeling of the timing diagram and obtain an initial model.

[0013] According to the system verification method of the present application, the timing diagram can be formally modeled, and the obtained initial model adapts to the system behavior under normal conditions. On this basis, the target model with added fault data is obtained through fault data and the initial model (for example, fault data can be added to the initial model), so that the target model can be determined to adapt to the fault scenario.

[0014] In a possible example, formally modeling the sequence diagram to obtain the initial model may include: adding variable assignment semantics to the lifeline of the sequence diagram and adding variable initialization semantics to the message of the sequence diagram to obtain the target sequence diagram. Formal modeling is performed on the target sequence diagram to obtain the initial model.

[0015] Through formal methods, the timing diagram can be converted into an initial model. According to the system verification method of the present application, since the fault data represents the relevant data of the fault existing in the system to be verified, the elements of the timing diagram of the system to be verified with a fault will change compared with the system to be verified in a normal state. The system verification method of the present application makes the elements of the timing diagram variable by adding variable assignment semantics to the lifeline of the timing diagram and adding variable initialization semantics to the messages of the timing diagram to cope with the situation that the elements of the timing diagram change under the fault scenario. The obtained target timing diagram and the target model obtained by formal modeling based on the target timing diagram can adapt to the fault scenario.

[0016] In a possible example, determining the target model according to the fault data and the initial model may include: converting the fault data into a formal language to obtain formal fault data. Determining the target model according to the formal fault data and the initial model.

[0017] The target model obtained by formal modeling the timing diagram meets the requirements of the formal language. The system verification method of the present application also meets the requirements of the formal language by converting the fault data into the formal language to obtain formal fault data. Therefore, the language of the formal fault data and the initial model is consistent, which facilitates the subsequent determination of the target model by the formal fault data and the initial model. The target model is a formal model.

[0018] In a possible example, the fault data may include faults and fault repair data, and determining the target model according to the fault data and the initial model may include: adding the fault to the initial model to obtain the initial model after the fault is added, and repairing the initial model after the fault is added according to the fault repair data to obtain the target model.

[0019] In some cases, the system to be verified determines that a fault exists in the system to be verified during a test or other stage, and a relevant technician may determine fault repair data for repairing the fault based on the detected fault.

[0020] According to the system verification method of the present application, by adding faults to the initial model, the initial model after adding the faults can adapt to the fault scenario, and by performing fault repair on the initial model after adding the faults according to the fault repair data, the target model obtained has higher system reliability. The goal of system verification includes improving system reliability, and therefore the system verification method of the present application is more efficient.

[0021] In a possible example, the fault data may also include, for example, at least one of a fault subject, a fault interval, a fault note, and a fault sequence number.

[0022] The fault subject may be understood as a subject that causes the fault to occur. The fault subject may correspond to an object in a timing diagram, for example.

[0023] The fault interval may be understood as a time range affected by the fault. The fault interval may correspond to at least a portion of the lifelines of the timing diagram, for example.

[0024] Fault notes can be understood as annotations to the fault.

[0025] The fault sequence number can be used to mark the occurrence sequence of the faults, for example.

[0026] In the case where the fault data includes multiple ones of the fault, fault repair data, fault subject, fault interval, fault note and fault sequence number, the fault can be characterized more comprehensively.

[0027] In a possible example, the system verification method further includes: performing a function test on the target model to obtain the target model after the function test.

[0028] The target model after functional testing is used for verification.

[0029] The target model is modeled based on the timing diagram and fault data. In order to ensure that the modeling process is correct, the system verification method of the present application performs functional testing on the target model to ensure that the modeled target model can realize the system function and avoid new faults caused by the modeled target model during the system verification process.

[0030] In a possible example, verifying the target model to obtain the verification result of the system to be verified may include: verifying the target model according to a formal specification to obtain the verification result of the system to be verified.

[0031] According to the system verification method of the present application, the target model can be verified accurately and efficiently using formal specifications to ensure the security of the system to be verified, etc.

[0032] In a possible example, at least one of the system verification methods: when the verification result indicates that the system to be verified has a fault, display the fault; when the verification result indicates that the system to be verified has a fault, repair the fault.

[0033] In a second aspect, the present application relates to a system verification device, including: a target model determination module and a verification module.

[0034] The target model determination module is used to perform formal modeling based on the fault data of the system to be verified and the timing diagram of the system to be verified to determine the target model.

[0035] The target model is added with fault data.

[0036] The verification module is used to verify the target model and obtain the verification result of the system to be verified.

[0037] In a possible example, the target model determination module includes: an initial model determination submodule and a target model determination submodule.

[0038] The initial model determination submodule is used to formally model the timing diagram to obtain the initial model.

[0039] The target model determination submodule is used to determine the target model according to the fault data and the initial model.

[0040] In a possible example, the initial model determination submodule includes: a semantic adding unit and an initial model determination unit.

[0041] The semantic adding unit is used to add variable assignment semantics to the lifeline of the timing diagram and to add variable initialization semantics to the message of the timing diagram to obtain the target timing diagram.

[0042] The initial model determination unit is used to formally model the target timing diagram to obtain an initial model.

[0043] In a possible example, the target model determination submodule includes: a conversion unit and a target model determination unit.

[0044] The conversion unit is used to convert the fault data into a formal language to obtain formal fault data.

[0045] The target model determination unit is used to determine the target model according to the formalized fault data and the initial model.

[0046] In a possible example, the fault data includes fault and fault repair data, and the target model determination submodule includes: a fault adding unit and a fault repairing unit.

[0047] The fault adding unit is used to add the fault to the initial model to obtain the initial model after the fault is added.

[0048] The fault repair unit is used to perform fault repair on the initial model after adding the fault according to the fault repair data to obtain the target model.

[0049] In a possible example, the verification module includes: a verification submodule, which is used to verify the target model according to the formal specification to obtain a verification result of the system to be verified.

[0050] In a possible example, the system verification device further includes: a function detection module, which is used to perform a function detection on the target model to obtain the target model after the function detection, wherein the target model after the function detection is used for verification.

[0051] In a possible example, the system verification device further includes at least one of the following: a display module and a repair module,

[0052] The display module is used to display the fault when the verification result indicates that the system to be verified has a fault.

[0053] The repair module is used to repair the fault when the verification result indicates that the system to be verified has a fault.

[0054] In a possible example, the fault data also includes: at least one of a fault subject, a fault interval, a fault note, and a fault sequence number, wherein the fault subject corresponds to an object in a timing diagram, and the fault interval corresponds to at least a portion of a lifeline in the timing diagram.

[0055] In one possible example, the system to be verified includes a computer data storage system.

[0056] In a third aspect, the present application relates to an electronic device, comprising: at least one processor; the at least one processor is used to execute instructions so that the system verification device executes the above-mentioned system verification method.

[0057] In some embodiments, the instructions are stored in a memory that is communicatively connected or coupled to the at least one processor.

[0058] In a fourth aspect, a computer-readable storage medium storing computer instructions is provided, wherein when the computer instructions are executed, the computer executes the above-mentioned system verification method. In some embodiments, the computer-readable storage medium is a non-transitory storage medium.

[0059] In a fifth aspect, the present application relates to a computer program product, including a computer program, wherein the computer program is stored on a readable storage medium, and when the computer program is executed, the computer implements the above-mentioned system verification method. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The following is an introduction to the drawings used in the embodiments of the present application.

[0061] Figure 1A A schematic diagram of a system verification of a timing diagram using a formal method in some embodiments is schematically shown;

[0062] Figure 1B A schematic diagram of a system verification of a state diagram using a formal method in some embodiments is schematically shown;

[0063] Figure 2 A system architecture of a system verification method and device according to an embodiment of the present disclosure is schematically shown;

[0064] Figure 3 A flowchart of a system verification method according to an embodiment of the present disclosure is schematically shown;

[0065] Figure 4 A schematic diagram schematically shows a system verification method according to another embodiment of the present disclosure;

[0066] Figure 5A A schematic diagram schematically shows a timing diagram of a system to be verified when the system to be verified is a computer data storage system;

[0067] Figure 5B A schematic diagram showing a system verification result marked on a timing diagram after the system verification is performed on the system to be verified by the system verification method according to an embodiment of the present disclosure, when the system to be verified is a computer data storage system;

[0068] Figure 5C A schematic diagram of fault data represented in a tabular form is schematically shown;

[0069] Figure 6 A block diagram schematically shows a system verification device according to an embodiment of the present disclosure; and

[0070] Figure 7 The block diagram schematically shows an electronic device that can implement the embodiments of the present disclosure. DETAILED DESCRIPTION

[0071] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0072] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0073] The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of objects. For example, a first target object and a second target object are used to distinguish different target objects rather than to describe a specific order of target objects.

[0074] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0075] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0076] The background of the system verification method according to the embodiment of the present disclosure will be described in detail below.

[0077] A system can be understood as a whole with specific functions composed of several parts that interact and depend on each other. Taking a computer system as an example, a computer system can be understood as a system composed of hardware and software for performing various computing tasks.

[0078] With the rapid development of computer technology, computer systems have been widely used in various fields. Computer system verification is one of the means to ensure the reliability and security of computer systems. Computer system verification can be understood as the verification of the logical correctness, functional satisfaction, performance efficiency, security, etc. of computer systems by using theoretical analysis, simulation testing and other means to establish mathematical models and experimental data. Computer system verification involves computer software, hardware, the entire system and other aspects, and plays an important role in whether a computer system is effective, safe, reliable and compliant with specifications.

[0079] The following will take the computer system as an example of a data storage system. The processing logic and interaction of the key input and output paths in the data storage system are very complex. In some cases, the analysis and verification of the data storage system rely on expert experience, which may result in verification omissions, making it difficult to ensure the completeness of verification and omission of risks. Once these risks occur in the existing network (the existing network can be understood as a network that is in operation and has been "commercially available"), serious consequences will occur, especially in high-reliability scenarios such as finance. Therefore, it is necessary to verify the correctness of the system and / or the system design method to discover system problems.

[0080] Formal methods can be used for system verification. Formal methods are based on rigorous mathematical foundations and use mathematical logic proofs to model, specify, analyze, reason, and verify the system to ensure system correctness and security.

[0081] Formal specification: a system model or a property that a system needs to satisfy that is strictly described by a formal specification language. The former is a model specification and the latter is a property specification. The model specification language uses mathematical structures to describe the state changes or event trajectories of a system. It directly defines the structure, functional behavior, and even non-functional behavior (such as time) of the described system model. The model specification provides models at different levels of abstraction in the system development process, and has a corresponding logical reasoning system to support its decomposition and combination, completing the conversion and refinement of specifications between different levels. The property specification language is based on a program logic system and uses logical formulas to describe a set of properties to define the desired system behavior. The property specification does not directly define the specific behavior of the system. Formal specifications based on properties tend to be descriptive, and logical constraints are often the minimum necessary to provide a larger implementation space.

[0082] Formal modeling: The behavior and properties of a system are accurately described using a formal model. Formal models can be developed using general formal modeling languages ​​(such as Petri Net, Event-B, Pi-calculus, CSP, SysML, Lusture, etc.) or special formal models (such as finite automata, pushdown automata, probabilistic automata, etc.). Functional programs can be modeled using tree automata and high-order pushdown automata. Adaptive systems and multi-agents are generally modeled using Petri nets, UML, Z, and Markov models. Deep neural networks can also be used for formal modeling.

[0083] Formal language: A language defined using precise mathematical or machine-processable formulas.

[0084] Formal verification: Use mathematical methods to prove the correctness or incorrectness of a certain formal specification or property.

[0085] Figure 1AA schematic diagram of performing a formal method system verification on a timing diagram in some embodiments is schematically shown, which specifically includes the following steps:

[0086] 1) Use timing diagrams to model the system functions to be designed.

[0087] 2) Convert the timing diagram into a formal description.

[0088] 3) Describe system requirements and generate formal specifications.

[0089] 4) Use formal tools to perform formal verification to determine whether the system meets system requirements.

[0090] Figure 1B A schematic diagram of a system verification of a state diagram using a formal method in some embodiments is schematically shown, which specifically includes the following steps:

[0091] 1) Use state diagrams to model the system functions to be designed.

[0092] 2) Convert the state diagram into a formal description.

[0093] 3) Describe system requirements and generate formal specifications.

[0094] 4) Use formal tools to perform formal verification to determine whether the system meets system requirements.

[0095] For complex systems, the modeling technology threshold and investment of system verification based on timing diagrams are relatively low. However, since the timing diagram represents the system behavior in the normal state (the normal state can be understood as the state when the system has no faults), this method can only be used to verify normal scenarios (normal scenarios are scenarios where the system has no faults) and cannot perform system verification on fault scenarios.

[0096] Verification based on state diagrams can be used to verify systems in normal scenarios as well as in fault scenarios (fault scenarios are scenarios where system failures occur). However, state diagrams require abstraction of model / system states, and there are more states in state diagrams under fault scenarios, making state diagrams more complex. Therefore, for complex systems, the modeling technology threshold and investment are relatively high.

[0097] In summary, how to adapt to fault scenarios for efficient system verification has become a technical problem that needs to be solved urgently.

[0098] The embodiment of the present disclosure provides a system verification method to improve the traditional system verification method.

[0099] Figure 2 The following is a schematic diagram showing the system architecture of the system verification method and device according to an embodiment of the present disclosure. It should be noted that: Figure 2 It is only an example of a system architecture to which the system verification method and apparatus of the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure cannot be applied to other devices, systems, environments or scenarios.

[0100] like Figure 2 As shown, the system architecture in the embodiment of the present disclosure may include: clients 201, 202, 203, a network 204 and a server 205. The network 204 is used to provide a medium for a communication link between the clients 201, 202, 203 and the server 205. The network 204 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0101] Users can use clients 201, 202, 203 to interact with server 205 through network 204 to receive or send messages, etc. Various communication client applications can be installed on clients 201, 202, 203, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0102] The clients 201, 202, 203 may be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, etc. The clients 201, 202, 203 of the disclosed embodiment may, for example, run applications.

[0103] The server 205 may be a server that provides various services, such as a backend management server that provides support for websites browsed by users using the clients 201, 202, and 203 (for example only). The backend management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the client. In addition, the server 205 may also be a cloud server, that is, the server 205 has a cloud computing function.

[0104] It should be noted that the system verification method provided in the embodiment of the present disclosure can be executed by the server 205. Accordingly, the system verification device provided in the embodiment of the present disclosure can be set in the server 205. The system verification method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 205 and can communicate with the client 201, 202, 203 and / or the server 205. Accordingly, the system verification device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 205 and can communicate with the client 201, 202, 203 and / or the server 205.

[0105] Illustratively, various types of systems such as computer systems run on clients or servers.

[0106] Exemplarily, taking the case where the system to be verified runs on the client, the server can obtain the fault data of the system to be verified and the timing diagram of the system to be verified from the client through the network, and perform formal modeling based on the fault data of the system to be verified and the timing diagram of the system to be verified, determine the target model, and verify the target model to obtain the verification result of the system to be verified. In addition, when the system to be verified runs on the client, the client can also perform formal modeling based on the fault data of the system to be verified and the timing diagram of the system to be verified, determine the target model, and verify the target model to obtain the verification result of the system to be verified.

[0107] It should be understood that Figure 2 The number of clients, networks and servers in the embodiment is only for illustration. Any number of clients, networks and servers may be provided as required.

[0108] The present disclosure provides a system verification method. Figure 2 The system architecture of Figures 3 to 5C The system verification method of the exemplary embodiment of the present disclosure is described as follows. The system verification method of the exemplary embodiment of the present disclosure can be, for example, Figure 2 The server execution shown.

[0109] Figure 3 The flowchart of the system verification method 300 according to an embodiment of the present disclosure is schematically shown.

[0110] like Figure 3 As shown, the system verification method 300 according to an embodiment of the present disclosure includes operations S310 to S320.

[0111] In operation S310 , formal modeling is performed according to fault data of the system to be verified and a timing diagram of the system to be verified to determine a target model.

[0112] The target model is added with fault data.

[0113] The system to be verified can be understood as a system that requires system verification.

[0114] The fault data of the system to be verified may be understood as data related to the fault occurring in the system to be verified, and the fault data of the system to be verified may at least include the fault of the system to be verified.

[0115] The fault data of the system to be verified and the timing diagram of the system to be verified can be predetermined, for example, For example, the timing diagram of the system to be verified can be predetermined by relevant technicians, and the fault data of the system to be verified can be predetermined in the testing stage, for example.

[0116] In operation S320, the target model is verified to obtain a verification result of the system to be verified.

[0117] According to the system verification method of the embodiment of the present disclosure, the target model is determined by formal modeling based on the fault data of the system to be verified and the timing diagram of the system to be verified. On the one hand, the target model determined based on the fault data is added with the fault data, and the fault data may at least include the fault of the system to be verified, thereby adapting to the fault scenario of the system to be verified. On the other hand, the target model is determined based on the fault data and the timing diagram. Compared with the state diagram, the timing diagram only represents the system interaction under the normal state, so the timing diagram is relatively simple, which makes the system verification method of the embodiment of the present disclosure not only adaptable to the fault scenario, but also has lower technical threshold requirements for technicians, and lower modeling costs and labor costs. On the other hand, the formal method of determining the target model and verifying the target model by using the formal modeling method is based on a strict and accurate mathematical foundation, and can accurately and efficiently perform system verification to ensure system reliability. At the same time, compared with the method of using expert experience to verify the system, the probability of verification omissions is smaller, which can ensure the completeness of verification, avoid the risk of omissions, and be more comprehensive and efficient. It is particularly suitable for complex systems such as data storage systems, and is also suitable for computer systems in existing networks under high reliability scenarios.

[0118] According to another embodiment of the system verification method of the present disclosure, for example, the following embodiments can be used to implement a specific example of determining a target model by formally modeling the fault data of the system to be verified and the timing diagram of the system to be verified: Formal modeling is performed on the timing diagram to obtain an initial model. The target model is determined based on the fault data and the initial model.

[0119] Exemplarily, for example, a formal modeling language may be used to transform the timing diagram to implement formal modeling of the timing diagram and obtain an initial model.

[0120] Exemplarily, the formal modeling language may include Promela language, UPPAAL language, TLA language (TLA stands for Temporal Logic of Actions), and BIP language (BIP stands for Behavior, Interaction, Priority).

[0121] According to the system verification method of the embodiment of the present disclosure, the timing diagram can be formally modeled, and the obtained initial model adapts to the system behavior under normal conditions. On this basis, the target model with added fault data is obtained through fault data and the initial model (for example, fault data can be added to the initial model), so that the target model can be determined to adapt to the fault scenario.

[0122] Figure 4 A schematic diagram of a system verification method according to another embodiment of the present disclosure is schematically shown.

[0123] like Figure 4 As shown, the fault data of the system to be verified may be in the form of a table, for example, Figure 4 The fault injection table shown in Figure 4 In the example, it is also schematically shown that the fault data in tabular form (i.e., the fault injection table) and the timing diagram are interpreted by the fault injection table interpreter and the timing diagram interpreter, and the fault injection table object and the timing diagram object can be obtained accordingly. Interpreting the fault injection table by the fault injection table interpreter can be understood as a process of parsing the fault injection table, and the fault injection table object can be obtained. Figure 4 In the example of , a specific example of converting a timing diagram using a formal modeling language to achieve formal modeling of the timing diagram to obtain an initial model is schematically shown.

[0124] According to a system verification method of another embodiment of the present disclosure, for example, the following embodiments can be used to implement formal modeling of a timing diagram to obtain a specific example of an initial model: adding variable assignment semantics to the lifeline of the timing diagram and adding variable initialization semantics to the message of the timing diagram to obtain a target timing diagram. Formal modeling is performed on the target timing diagram to obtain an initial model.

[0125] The sequence diagram includes elements such as roles, objects, lifelines, and messages.

[0126] Actor: A system role, which can be a person, system, subsystem, etc.

[0127] Object: The object is located at the top of the timing diagram and is represented by a rectangle.

[0128] Lifeline: Each object in the timing diagram has a vertical line at the bottom center, which is the lifeline of the object (the timeline of the object).

[0129] Message: Information sent between objects.

[0130] It should be noted that, through formal methods, the timing diagram can be converted into an initial model. According to the system verification method of the embodiment of the present disclosure, since the fault data represents the relevant data of the fault existing in the system to be verified, the elements of the timing diagram of the system to be verified with the fault will change compared with the system to be verified in the normal state. The system verification method of the embodiment of the present disclosure makes the elements of the timing diagram variable by adding variable assignment semantics to the lifeline of the timing diagram and adding variable initialization semantics to the messages of the timing diagram to cope with the situation that the elements of the timing diagram change under the fault scenario. The obtained target timing diagram and the target model obtained by formal modeling based on the target timing diagram can adapt to the fault scenario.

[0131] For example, in a fault scenario, the lifeline of the timing diagram may change, such as the operation performed by some objects may change. The operation performed by the object may be changed by changing the assignment of the corresponding variable, that is, adjusting the timing diagram to the target timing diagram.

[0132] Exemplarily, for example, sequence number semantics may be added to the messages in the sequence diagram, and corresponding messages may be mapped through the sequence number semantics.

[0133] According to another embodiment of the system verification method of the present disclosure, for example, the following embodiments can be used to implement a specific example of determining a target model based on fault data and an initial model: converting the fault data into a formal language to obtain formal fault data. Determining a target model based on the formal fault data and the initial model.

[0134] The target model obtained by formal modeling the timing diagram meets the requirements of the formal language. The system verification method of the embodiment of the present disclosure obtains formal fault data by converting the fault data into a formal language, which also meets the requirements of the formal language. Therefore, the language of the formal fault data and the initial model is consistent, which facilitates the subsequent determination of the target model by the formal fault data and the initial model. The target model is a formal model.

[0135] Exemplarily, the fault data may be converted using a formal language such as TLA language or BIP language to obtain formalized fault data.

[0136] According to a system verification method of another embodiment of the present disclosure, the fault data may include faults and fault repair data. For example, the following embodiments may be used to implement a specific example of determining a target model based on the fault data and the initial model: adding the fault to the initial model to obtain the initial model after the fault is added. Perform fault repair on the initial model after the fault is added according to the fault repair data to obtain the target model.

[0137] In some cases, the system to be verified determines that a fault exists in the system to be verified during a test or other stage, and a relevant technician may determine fault repair data for repairing the fault based on the detected fault.

[0138] According to the system verification method of the embodiment of the present disclosure, by adding faults to the initial model, the initial model after adding the faults can adapt to the fault scenario, and by performing fault repair on the initial model after adding the faults according to the fault repair data, the target model obtained has higher system reliability. The goal of system verification includes improving system reliability. Therefore, the system verification method of the embodiment of the present disclosure is more efficient.

[0139] It should be noted that in some cases, the fault repair data may not be able to correctly repair the fault. For example, the fault repair data may introduce new faults, or the fault repair data cannot cope with some undetected faults. Therefore, compared with the initial model after adding the fault, the target model obtained by repairing the initial model after adding the fault according to the fault repair data has a higher system reliability, but the fault cannot be eliminated, so the target model still needs to be verified.

[0140] It should also be noted that some faults may not currently have corresponding fault repair data (for example, the relevant personnel have not repaired the fault, so there is currently no corresponding fault repair data). Therefore, these faults that do not have corresponding fault repair data still exist in the target model and can be repaired after the target model is verified and the fault is discovered.

[0141] Exemplarily, the fault data may also include, for example, at least one of a fault subject, a fault interval, a fault note, and a fault sequence number.

[0142] The fault subject may be understood as a subject that causes the fault to occur. The fault subject may correspond to an object in a timing diagram, for example.

[0143] The fault interval may be understood as a time range affected by the fault. The fault interval may correspond to at least a portion of the lifelines of the timing diagram, for example.

[0144] Fault notes can be understood as annotations to the fault.

[0145] The fault sequence number can be used to mark the occurrence sequence of the faults, for example.

[0146] In the case where the fault data includes multiple ones of the fault, fault repair data, fault subject, fault interval, fault note and fault sequence number, the fault can be characterized more comprehensively.

[0147] According to another embodiment of the present disclosure, the system verification method further includes: performing a function test on the target model to obtain the target model after the function test.

[0148] The target model after functional testing is used for verification.

[0149] The target model is modeled based on the timing diagram and fault data. In order to ensure that the modeling process is correct, the system verification method of the embodiment of the present invention performs functional testing on the target model to ensure that the modeled target model can realize the system function and avoid new faults caused by the modeled target model during the system verification process.

[0150] like Figure 4 As shown, a specific example of performing functional testing on a target model by a system verification method according to an embodiment to obtain a target model after functional testing is schematically shown. Figure 4 A specific example of using an adapted SMC tool (SMC, or Statistical Model Checking) to perform functional testing on a target model is also schematically shown.

[0151] According to another embodiment of the system verification method of the present disclosure, for example, the following embodiment can be used to implement verification of the target model to obtain a specific example of the verification result of the system to be verified: verify the target model according to the formal specification to obtain the verification result of the system to be verified.

[0152] For example, a formal language can be used to describe the system requirements of the system to be verified to obtain a formal specification. More specifically, a formal language such as LTL (Linear Temporal Logic) or MTL (Metric Temporal Logic) can be used to mathematically express the system requirements of the system to be verified. For example, a formal language such as LTL or MTL can also be used to mathematically express the security attributes of the system to be verified.

[0153] According to the system verification method of the embodiment of the present disclosure, the target model can be verified accurately and efficiently using formal specifications to ensure the security of the system to be verified.

[0154] like Figure 4 As shown, a specific example of verifying a target model according to a formal specification in an embodiment is schematically shown, that is, verifying the target model by using the SMC formal verification tool and the formal specification.

[0155] According to another embodiment of the present disclosure, the system verification method may further include at least one of the following: displaying the fault when the verification result indicates that the system to be verified has a fault; and repairing the fault when the verification result indicates that the system to be verified has a fault.

[0156] According to the system verification method of the embodiment of the present disclosure, by displaying the fault when the verification result indicates that the system to be verified has a fault, the fault can be visualized, which facilitates relevant personnel to quickly locate the fault. By repairing the fault when the verification result indicates that the system to be verified has a fault, the system repair speed and efficiency are higher.

[0157] Exemplarily, for some faults, for example, a fault repair method may be determined in advance, so that when the verification result indicates that the system to be verified has the fault, the fault repair may be automatically performed.

[0158] Exemplarily, the system to be verified may include, for example, a computer data storage system.

[0159] The following description will be made by taking the system to be verified as a computer data storage system as an example. The computer data storage system is used to store computer data in a memory, and the memory includes various types such as a hard disk.

[0160] Figure 5A The schematic diagram schematically shows a timing diagram of the system to be verified when the system to be verified is a computer data storage system.

[0161] Figure 5A A specific example of a computer data storage system including memory A, memory B1, memory B2, memory C1 and memory C2 is schematically shown. One of the memory clusters of the computer data storage system includes memory B1 as a slave node in the cluster and memory B2 as a master node in the cluster, and another memory cluster includes memory C1 as a master node in the cluster and memory C2 as a slave node in the cluster.

[0162] The computer data storage system may further include, for example, a controller for controlling data storage. The controller may, for example, adopt a data storage strategy based on the state information of the memory.

[0163] The computer data storage system may also include a device manager, which may be used to obtain status information of each memory of the data storage system and send the status information to the controller. Figure 5AIn the example, for example, the half-life state is used as a variable to represent the state information, and a value assigned to the half-life state can indicate whether the memory is pre-failed: for example, the half-life state is assigned a value of false to indicate that the memory is not failed.

[0164] like Figure 5A As shown, the device manager receives the memory status information in a self-cyclic manner (in Figure 5A In the example, the status information indicates whether the memory of the computer data storage system is pre-failed). When the status information of the memory indicates that there is no pre-failure, the status information is reported to the memory B2 via the device manager, the memory A, and the memory B1 in sequence. When the status information of the memory indicates that there is a pre-failure, the half-life state is assigned a value of true (indicating that the memory is pre-failed). Figure 5A The computer data storage system shown includes a storage cluster. When the half-life status is set to true, the storage cluster can notify all nodes in the cluster of the status information.

[0165] Figure 5B The schematic diagram shows a system verification result marked on a timing diagram after the system verification is performed on the system to be verified according to the system verification method of an embodiment of the present disclosure when the system to be verified is a computer data storage system.

[0166] like Figure 5B As shown, a specific example in which one of the memory clusters of the computer data storage system includes memory B1, memory B2, and memory B3 is schematically shown, wherein memory B1 is a slave node, memory B3 is a master node, and memory B2 is all other slave nodes.

[0167] Figure 5B The timing diagram shown schematically shows the fault of resetting the memory B2, which indicates that a new master node of the cluster needs to be selected and the slave node reports information to the new master node. Figure 5B Still taking the reporting of pre-failure as an example, reporting of pre-failure can be understood as reporting status information indicating whether the memory is pre-failed. For example, the assignment of a half-life status can be used to indicate whether the memory is pre-failed.

[0168] like Figure 5B As shown, the message "Processing Completed" from memory B3 to memory B1 was not successfully sent ( Figure 5B In the example, "×" represents unsuccessful transmission, and "×" can also be used as an indication that the system verification result is a fault), indicating that the computer data storage system has a "reset memory B2" fault.

[0169] Figure 5CA schematic diagram of fault data represented in a table form is schematically shown, and the fault data includes a fault sequence number, a fault, a fault subject, a fault interval, fault repair data, and a fault note.

[0170] Figure 6 A block diagram of a system verification device according to an embodiment of the present disclosure is schematically shown.

[0171] like Figure 6 As shown, the system verification device 600 of the embodiment of the present disclosure includes, for example: a target model determination module 610 and a verification module 620 .

[0172] The target model determination module 610 is used to perform formal modeling according to the fault data of the system to be verified and the timing diagram of the system to be verified, and determine the target model.

[0173] The target model is added with fault data.

[0174] The verification module 620 is used to verify the target model and obtain the verification result of the system to be verified.

[0175] Exemplarily, according to a system verification device of another embodiment of the present disclosure, the target model determination module includes: an initial model determination submodule and a target model determination submodule.

[0176] The initial model determination submodule is used to formally model the timing diagram to obtain the initial model.

[0177] The target model determination submodule is used to determine the target model according to the fault data and the initial model.

[0178] Exemplarily, according to a system verification device of yet another embodiment of the present disclosure, the initial model determination submodule includes: a semantic adding unit and an initial model determination unit.

[0179] The semantic adding unit is used to add variable assignment semantics to the lifeline of the timing diagram and to add variable initialization semantics to the message of the timing diagram to obtain the target timing diagram.

[0180] The initial model determination unit is used to formally model the target timing diagram to obtain an initial model.

[0181] Exemplarily, according to a system verification device of yet another embodiment of the present disclosure, the target model determination submodule includes: a conversion unit and a target model determination unit.

[0182] The conversion unit is used to convert the fault data into a formal language to obtain formal fault data.

[0183] The target model determination unit is used to determine the target model according to the formalized fault data and the initial model.

[0184] Exemplarily, according to a system verification device of yet another embodiment of the present disclosure, the fault data includes fault and fault repair data, and the target model determination submodule includes: a fault adding unit and a fault repairing unit.

[0185] The fault adding unit is used to add the fault to the initial model to obtain the initial model after the fault is added.

[0186] The fault repair unit is used to perform fault repair on the initial model after adding the fault according to the fault repair data to obtain the target model.

[0187] Exemplarily, according to a system verification device of yet another embodiment of the present disclosure, the verification module includes: a verification submodule, which is used to verify the target model according to the formal specification to obtain a verification result of the system to be verified.

[0188] Exemplarily, the system verification device according to another embodiment of the present disclosure further includes: a function detection module, which is used to perform function detection on the target model to obtain the target model after function detection, wherein the target model after function detection is used for verification.

[0189] Exemplarily, the system verification device according to another embodiment of the present disclosure further includes at least one of the following: a display module and a repair module,

[0190] The display module is used to display the fault when the verification result indicates that the system to be verified has a fault.

[0191] The repair module is used to repair the fault when the verification result indicates that the system to be verified has a fault.

[0192] Exemplarily, according to a system verification device of another embodiment of the present disclosure, the fault data also includes: a fault subject, a fault interval, a fault note and at least one of a fault sequence number, wherein the fault subject corresponds to an object in the timing diagram, and the fault interval corresponds to at least a part of the lifeline of the timing diagram.

[0193] Exemplarily, according to a system verification device of yet another embodiment of the present disclosure, the system to be verified includes a computer data storage system.

[0194] It should be understood that Figure 6 The embodiments of the device part of the present disclosure shown are the same or similar to the embodiments of the method part of the present disclosure, and the technical problems solved and the technical effects achieved are also the same or similar, which will not be repeated in this disclosure.

[0195] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a computer-readable storage medium, and a computer program product.

[0196] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. Electronic devices include various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Electronic devices may also include various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0197] like Figure 7 As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 to a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0198] Multiple components in the electronic device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0199] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSP), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 701 performs the various methods and processes described above, such as the system verification method. For example, in some embodiments, the aforementioned method may be implemented as a computer software program, which is tangibly included in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the system verification method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to execute the system verification method in any other appropriate manner (eg, by means of firmware).

[0200] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems on a chip (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0201] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0202] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, a flash memory, or any suitable combination of the foregoing.

[0203] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0204] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0205] A computer system may include clients and servers. Clients and servers are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship to each other.

[0206] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0207] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A system verification method, characterized in that: include: Performing formal modeling according to the fault data of the system to be verified and the timing diagram of the system to be verified to determine a target model, wherein the fault data is added to the target model; The target model is verified to obtain a verification result of the system to be verified.

2. The method according to claim 1, characterized in that in, The performing formal modeling according to the fault data of the system to be verified and the timing diagram of the system to be verified to determine the target model comprises: Formalizing the timing diagram to obtain an initial model; The target model is determined according to the fault data and the initial model.

3. The method according to claim 2, characterized in that in, The formal modeling of the timing diagram to obtain an initial model includes: Adding variable assignment semantics to the lifeline of the timing diagram and adding variable initialization semantics to the message of the timing diagram to obtain a target timing diagram; The target timing diagram is formally modeled to obtain the initial model.

4. The method according to claim 2, characterized in that in, Determining the target model according to the fault data and the initial model comprises: Converting the fault data into a formal language to obtain formal fault data; The target model is determined according to the formalized fault data and the initial model.

5. The method according to claim 2, characterized in that: in, The fault data includes fault and fault repair data, and the determining the target model according to the fault data and the initial model includes: Adding the fault to the initial model to obtain the initial model after the fault is added; The initial model after adding the fault is repaired according to the fault repair data to obtain the target model.

6. The method according to any one of claims 1 to 5, characterized in that in, The verifying of the target model to obtain the verification result of the system to be verified includes: The target model is verified according to the formal specification to obtain the verification result of the system to be verified.

7. The method according to any one of claims 1 to 5, characterized in that Also includes: Performing a function test on the target model to obtain a target model after the function test, wherein the target model after the function test is used for verification.

8. The method according to any one of claims 1 to 5, characterized in that Also includes at least one of the following: If the verification result indicates that the system to be verified has a fault, display the fault; When the verification result indicates that the system to be verified has a fault, the fault is repaired.

9. The method according to any one of claims 1 to 5, characterized in that in, The fault data also includes: at least one of a fault subject, a fault interval, a fault note, and a fault sequence number, wherein the fault subject corresponds to an object in the timing diagram, and the fault interval corresponds to at least a part of the lifeline of the timing diagram.

10. The method according to any one of claims 1 to 5, characterized in that in, The system to be verified includes a computer data storage system.

11. A system verification device, characterized in that: include: A target model determination module, used for performing formal modeling according to the fault data of the system to be verified and the timing diagram of the system to be verified, and determining the target model, wherein the fault data is added to the target model; The verification module is used to verify the target model and obtain the verification result of the system to be verified.

12. The device according to claim 11, characterized in that in, The target model determination module comprises: An initial model determination submodule is used to formally model the timing diagram to obtain an initial model; The target model determination submodule is used to determine the target model according to the fault data and the initial model.

13. The device according to claim 12, characterized in that in, The initial model determination submodule includes: A semantic adding unit, used for adding variable assignment semantics to the lifeline of the timing diagram and adding variable initialization semantics to the message of the timing diagram, so as to obtain a target timing diagram; The initial model determination unit is used to perform formal modeling on the target timing diagram to obtain the initial model.

14. The device according to claim 12, characterized in that in, The target model determination submodule includes: A conversion unit, used for converting the fault data into a formal language to obtain formal fault data; The target model determination unit is used to determine the target model according to the formalized fault data and the initial model.

15. The device according to claim 12, characterized in that in, The fault data includes fault and fault repair data, and the target model determination submodule includes: A fault adding unit, used for adding the fault to the initial model to obtain the initial model after the fault is added; A fault repair unit is used to perform fault repair on the initial model after the fault is added according to the fault repair data to obtain the target model.

16. The device according to any one of claims 11 to 15, characterized in that in, The verification module comprises: The verification submodule is used to verify the target model according to the formal specification to obtain the verification result of the system to be verified.

17. The device according to any one of claims 11 to 15, characterized in that Also includes: The function detection module is used to perform function detection on the target model to obtain the target model after function detection, wherein the target model after function detection is used for verification.

18. The device according to any one of claims 11 to 15, characterized in that Also includes at least one of the following: A display module, used for displaying the fault when the verification result indicates that the system to be verified has a fault; The repair module is used to repair the fault if the verification result indicates that the system to be verified has a fault.

19. The device according to any one of claims 11 to 15, characterized in that in, The fault data also includes: at least one of a fault subject, a fault interval, a fault note, and a fault sequence number, wherein the fault subject corresponds to an object in the timing diagram, and the fault interval corresponds to at least a part of the lifeline of the timing diagram.

20. The device according to any one of claims 11 to 15, characterized in that in, The system to be verified includes a computer data storage system.

21. An electronic device comprising: At least one processor The at least one processor is used to execute instructions so that the system verification device can perform the method according to any one of claims 1-10.

22. A computer-readable storage medium storing computer instructions, wherein: When the computer instructions are executed, the computer is caused to perform the method according to any one of claims 1-10.

Images