Model inspection method and device

Abstract

The invention provides a model checking method and device, which are used for realizing parallel checking of models when equipment verification is carried out, so that the verification efficiency is greatly improved. The method comprises the steps that a model set is obtained, the model set comprises a plurality of coding models, and the coding models are divided into coding models which do not have a dependency relationship in the Tick dimension of a clock beat and can also be called discontinuous models in the Tick dimension and coding models which have a dependency relationship in the Tick dimension and can also be called continuous models in the Tick dimension, the dependency relationship is that an execution sequence among the models meets a Tick continuous increasing sequence when the models are executed; the model set is subjected to model checking, a model checking result is obtained, the model checking result is used for representing whether the multiple coding models comprise the coding models which do not pass verification or not, and in the model checking process, the model checking process comprises parallel model checking on the multiple coding models which do not have the dependency relationship in the Tick dimension.

Description

Technical Field

[0001] The present application relates to the field of equipment verification, and in particular to a model checking method and device. Background Art

[0002] As we all know, reliability is still a huge challenge faced by complex engineering. For example, the existing recalls due to automobile switch failures and aircraft accidents are closely related to the inadequate reliability work. In order to ensure the safety of the system, especially to improve the reliability of the product, the commonly used means are still traditional testing and simulation. Although these methods can discover most problems to a certain extent and then take care of the quality of the product, it is easy to miss some bugs that are more hidden and have more stringent triggering conditions, which may be very dangerous for high-security systems and generally cannot be tolerated.

[0003] In order to solve such problems, model checking technology has become a mainstream solution due to its advantages of "high automation and low threshold for use". Commonly used model checking uses the idea of ​​"exhaustive search" to ensure the completeness of the verification results. Because of this, the model checking method has a natural shortcoming in verification efficiency due to the constraints of the technology itself. Therefore, how to improve the efficiency of model checking has become an urgent problem to be solved. Summary of the invention

[0004] The present application provides a model checking method and device, which can realize parallel checking of models when performing equipment verification, thereby greatly improving verification efficiency.

[0005] In view of this, in a first aspect, the present application provides a model checking method, the method comprising: obtaining a model set, the model set including multiple coding models, the models corresponding to the multiple coding models are used to implement at least one function in the device, the multiple coding models are divided into coding models that have no dependency in the clock beat (Tick) dimension, which can also be called discontinuous models in the Tick dimension, and coding models that have a dependency in the Tick dimension, which can also be called continuous models in the Tick dimension, the dependency is that the execution order between the models when the models are executed satisfies the order of continuous increment of Tick, that is, if a certain coding model has no dependency on other models in the Tick dimension, then the coding model is a discontinuous model, if the execution order of two models in the Tick dimension needs to be in a Tick increment relationship, then the two models are continuous models; perform model checking on the model set to obtain a model checking result, the model checking result is used to indicate whether the multiple coding models include a coding model that has not passed the verification, wherein, during the model checking process, the model checking process includes performing model checking on multiple coding models that have no dependency in the Tick dimension in parallel.

[0006] In the implementation manner of the present application, the coding model to be checked can be divided into a discontinuous model and a continuous model. For the discontinuous model, parallel checking or jump verification can be implemented, thereby greatly improving the model checking efficiency.

[0007] In a possible implementation, the aforementioned model check may be divided into multiple checks. In any one check: the coding models in the model set may be divided into a clock-independent coding model and a clock-dependent coding model, the clock-independent coding model being included in a coding model that is not related to Tick, and the clock-dependent coding model being included in a coding model that is related to Tick; subsequently, at least one of the clock-independent coding model or the clock-dependent coding model is verified based on the current clock beat to obtain a model check result of the current model check.

[0008] In an implementation manner of the present application, in each iterative check process, the coding model to be checked can be divided into a clock-independent coding model and a clock-dependent coding model, that is, the model type to be verified can be selected based on the current Tick, thereby selecting a more efficient model checking method.

[0009] In a possible implementation, during any iterative check process, the aforementioned verification of at least one of the clock-independent coding model or the clock-dependent coding model based on the current clock beat to obtain the model check result of the current model check may include: if the current clock beat is the first clock beat, the clock-independent coding model and the clock-dependent coding model are verified to obtain the model check result of the current model check; if the current clock beat is not the first clock beat, the clock-dependent coding model is verified to obtain the model check result of the current model check. It can be understood that if the current Tick is not the first tick, the tick-independent coding model is discarded.

[0010] In the implementation manner of the present application, the clock-independent coding model is verified only in the first tick, and only the incremental part model generated with each cycle is focused on in the subsequent ticks. That is, the large-scale clock-independent coding model is verified in the first tick, and only the incremental part model needs to be focused on in the subsequent ticks, without repeated verification, which can greatly improve the efficiency of model checking.

[0011] In a possible implementation, in any check, the above method may further include: obtaining a verification strategy, the verification strategy including a parallel number or a step parameter, the parallel number being the number of instances generated when performing parallel verification on the coding models in the model set, and the step parameter including the number of clock beats jumped when performing a model check.

[0012] In the implementation manner of the present application, the model can also be verified in parallel in combination with the verification strategy, so that the parallel number or step size of the verification can be adaptively determined.

[0013] In a possible implementation, the aforementioned obtaining of the verification strategy includes: obtaining environment perception information, where the environment perception information includes information about resources used when performing model checking; and determining the verification strategy according to the environment perception information.

[0014] In the implementation manner of the present application, the verification strategy can be adaptively adjusted based on the available resources, so as to obtain a verification strategy that is more suitable for the available resources, improve resource utilization, and achieve maximum model verification efficiency.

[0015] In a possible implementation, the environmental perception information includes at least one of the following: remaining memory, CPU load, encoding model complexity, and information generated by the model check that has been performed. Therefore, in the implementation of the present application, the verification strategy can be adjusted in real time based on available resources, model information itself, or information generated by the verification that has been performed, so as to obtain a verification strategy that is more suitable for the actual scenario.

[0016] In a possible implementation, any check also includes: grouping the coding models to be detected according to the verification strategy to obtain multiple coding model groups; respectively verifying the coding models in the multiple coding model groups to obtain model checking results; wherein, if the first coding model group includes a coding model that fails the verification, the model checking result is output, and the model checking result is used to indicate that the first coding model group includes a coding model that fails the verification, and the first coding model group is any group of at least one coding model group.

[0017] In an implementation manner of the present application, the models can be grouped for verification. When a model that fails verification is detected in a group, the output model check result may include an indication that a model that fails verification exists in the group. At this time, the search can continue or the model check can be stopped, which can be determined based on the actual application scenario.

[0018] In a possible implementation, the above method may further include: if the first coding model group includes a coding model that has not passed the verification, searching the coding models in the first coding model group to determine the information of the coding models in the first coding model group that have not passed the verification, that is, after discovering that there is a group of models that have not passed the verification, the coding model that has not passed the verification can be further located.

[0019] In the implementation manner of the present application, when there is a model that has not passed the verification in a certain model group, further search can be performed to obtain more fine-grained model inspection results. For example, when there is a model that has not passed the verification in a certain group, the search can be continued, such as searching for a preset number of times or a preset duration, so that more fine-grained information of the model that has not passed the verification can be obtained.

[0020] In a possible implementation, the above-mentioned searching for the coding models in the first coding model group to determine the information of the coding models in the first coding model group that have not passed the verification may include: searching the coding models in the first coding model group by a heuristic search algorithm or a binary search algorithm to determine the information of the coding models in the first coding model group that have not passed the verification. In the implementation of the present application, a counter-example search may be performed by a heuristic or binary search algorithm, and an adapted search algorithm may be selected according to the actual application scenario.

[0021] In a possible implementation, the above-mentioned verifying the coding models in multiple coding model groups separately to obtain model checking results may include: verifying the multiple coding model groups in parallel through multiple verification channels to obtain model checking results, wherein the first verification channel verifies the second coding model group, and the second verification channel verifies the third coding model group, and the Tick corresponding to the coding model in the second coding model group is in an increasing relationship with the Tick of the coding model in the third coding model group. If the second verification channel completes the verification of the third coding model group and the third coding model group does not include a coding model that fails the verification, if the second verification channel has not completed the verification of the second coding model group, then the verification of the second coding model group is skipped in the second verification channel.

[0022] In the implementation mode of the present application, after completing the verification of the coding model that is after the Tick, if the coding model group that is before the Tick has not been verified, there is no need to perform verification. It can be understood that if there is a Tick dependency relationship between the coding models, then when the verification of the coding model group that is verified later passes, it is considered that the verification of the previous coding model group has also passed, thereby realizing skippable model verification and greatly improving the efficiency of model checking.

[0023] In a possible implementation, the above-mentioned device may include a vehicle, and the aforementioned acquisition of a model set may include: acquiring multiple behavior models, where the multiple behavior models are used to implement at least one function in the vehicle, such as the vehicle's automatic driving function or assisted driving function; then encoding the behavior model to obtain a model set, where the running order of the multiple encoded models in the model set is discretized in the Tick dimension, and the Tick dimension includes the Tick sequence corresponding to when the multiple behavior models are used to implement at least one function.

[0024] In the implementation manner of the present application, the behavioral model that realizes the vehicle function can be encoded so that the behavioral model can be encoded into a mathematical problem that can be formally verified, and can be encoded from the Tick dimension to obtain a Tick-independent coding model to facilitate subsequent jump verification, or a large number of Tick-independent coding models can be verified in the first Tick without repeated verification, thereby improving the efficiency of model checking.

[0025] Optionally, the behavior model may be encoded in an SMT encoding manner, thereby decomposing the behavior model into mathematical problems for subsequent verification.

[0026] In a second aspect, the present application provides a model checking device, the device comprising:

[0027] A coding module, used for obtaining a model set, where the model set includes multiple coding models, where the models corresponding to the multiple coding models are used to implement at least one function in the device, and where the multiple coding models are divided into coding models that have no dependency in the Tick dimension and coding models that have a dependency in the Tick dimension, where the dependency is that the execution order between the models when the models are executed satisfies the order of continuous increment of Ticks;

[0028] The model checking module is used to perform model checking on the model set to obtain a model checking result, and the model checking result is used to indicate whether a plurality of coding models include a coding model that has not passed the verification. The model checking process includes performing model checking on a plurality of coding models that have no dependency in the Tick dimension in parallel.

[0029] Among them, the effects of the second aspect or any second optional implementation manner can refer to the description of the first aspect or any optional implementation manner of the first aspect, and will not be repeated here.

[0030] In a possible implementation, the aforementioned model check is divided into multiple checks. In any one of the checks, the model check module is specifically used to: divide the model set into a clock-independent coding model and a clock-dependent coding model, the clock-independent coding model includes a coding model that is not related to Tick, and the clock-dependent coding model includes a coding model that is related to Tick; verify at least one of the clock-independent coding model or the clock-dependent coding model based on the current clock beat to obtain a model check result of the current model check.

[0031] In one possible implementation, the model checking module is specifically used to: if the current clock beat is the first clock beat, verify the clock-independent coding model and the clock-dependent coding model to obtain the model checking result of the current model check; if the current clock beat is not the first clock beat, verify the clock-dependent coding model to obtain the model checking result of the current model check.

[0032] In a possible implementation, the device may further include: a verification strategy adaptation module, used to: obtain a verification strategy in any check, where the verification strategy includes a parallel number or a step parameter, where the parallel number is the number of instances generated when parallel verification is performed on the coding models in the model set, and the step parameter includes the number of clock beats jumped when performing a model check.

[0033] In a possible implementation, the above device may further include: an environment perception module;

[0034] The environment perception module is used to obtain environment perception information, and the environment perception information includes information about resources used when performing model checking;

[0035] A verification strategy adaptive module is specifically used to determine the verification strategy according to the environmental perception information;

[0036] In a possible implementation, the environment perception information includes at least one of the following: remaining memory, CPU load, encoding model complexity, and information generated by a performed model check.

[0037] In a possible implementation, the model checking module is also used to: group the coding models to be checked according to the verification strategy to obtain multiple coding model groups; verify the coding models in the multiple coding model groups respectively to obtain model checking results; wherein, if the first coding model group includes a coding model that fails the verification, the model checking result is output, and the model checking result is used to indicate that the first coding model group includes a coding model that fails the verification, and the first coding model group is any group of at least one coding model group.

[0038] In a possible implementation, the above-mentioned device may also include: a counterexample enhancement module, which is used to search the coding models in the first coding model group if the first coding model group includes a coding model that has not passed the verification, and determine the information of the coding model in the first coding model group that has not passed the verification.

[0039] In a possible implementation, the counterexample enhancement module is specifically used to: search the coding models in the first coding model group by using a heuristic search algorithm or a binary search algorithm to determine information of the coding models in the first coding model group that have not passed the verification.

[0040] In a possible implementation, the model checking module is further used to: verify multiple coding model groups in parallel through multiple verification channels to obtain model checking results, wherein the first verification channel verifies the second coding model group, and the second verification channel verifies the third coding model group, and the Tick corresponding to the coding model in the second coding model group is in an increasing relationship with the Tick of the coding model in the third coding model group. If the second verification channel completes the verification of the third coding model group and the third coding model group does not include a coding model that fails the verification, if the second verification channel has not completed the verification of the second coding model group, then the verification of the second coding model group is skipped in the second verification channel.

[0041] In one possible implementation, the above-mentioned device includes a vehicle and a coding module, which is specifically used to: obtain multiple behavior models, and the multiple behavior models are used to implement at least one function in the vehicle; encode the behavior models to obtain a model set, and the running order of the multiple encoded models in the model set is discretized in the Tick dimension, and the Tick dimension includes the Tick sequence corresponding to when the multiple behavior models are used to implement at least one function.

[0042] In a third aspect, an embodiment of the present application provides a model checking device, comprising: a processor and a memory, wherein the processor and the memory are interconnected via a line, and the processor calls a program code in the memory to execute the processing-related functions in any of the methods shown in the first aspect above. Optionally, the model checking device can be a chip.

[0043] In the fourth aspect, an embodiment of the present application provides a model checking device, which can also be called a digital processing chip or chip. The chip includes a processing unit and a communication interface. The processing unit obtains program instructions through the communication interface, and the program instructions are executed by the processing unit. The processing unit is used to perform functions related to processing in the above-mentioned first aspect or any optional embodiment of the first aspect.

[0044] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute the method in the above-mentioned first aspect or any optional implementation of the first aspect.

[0045] In a sixth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute a method in any optional implementation of the first aspect or the second aspect.

[0046] In a seventh aspect, an embodiment of the present application provides a vehicle function configuration system, including a development device, which can be used to implement the method in the aforementioned first aspect or any optional implementation of the first aspect.

[0047] In an eighth aspect, an embodiment of the present application provides a vehicle, comprising the device as described in the third aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of the structure of a vehicle provided for this application;

[0049] Figure 2 A schematic diagram of the structure of another vehicle provided for this application;

[0050] Figure 3 A schematic diagram of the system architecture of a CP classic platform deployed on a vehicle provided in this application;

[0051] Figure 4 A schematic diagram of the system architecture of an AP platform deployed on a vehicle provided in this application;

[0052] Figure 5 A flow chart of a model checking method provided in this application;

[0053] Figure 6 A flowchart of another model checking method provided for this application;

[0054] Figure 7 A flowchart of another model checking method provided for this application;

[0055] Figure 8 A flowchart of another model checking method provided for this application;

[0056] Fig. 9 A schematic diagram of the structure of a model checking device provided in this application;

[0057] Fig.10 A schematic diagram of the structure of another model checking device provided by the present application;

[0058] Fig.11 A schematic diagram of the structure of a chip provided in this application. DETAILED DESCRIPTION

[0059] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0060] The method provided in this application can be applied to a variety of equipment verification scenarios, such as equipment correctness, safety or reliability verification. Equipment verification is crucial in the fields of smart cars, aviation, industrial control or rail transit, etc. For example, verifying the reliability of aircraft in the aviation field, verifying the reliability of industrial equipment in the industrial control field, and verifying the reliability of rail transit vehicles in the rail transit field. This application exemplarily introduces the reliability verification of a vehicle as an example. The vehicles mentioned below can also be replaced by other equipment that needs to be verified, which will not be repeated below.

[0061] In order to facilitate the understanding of this solution, the present application embodiment first combines Figure 1 The structure of the vehicle provided in this application is introduced.

[0062] Please read first Figure 1 , Figure 1 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application, Figure 1 It is a functional block diagram of the vehicle 100 provided in an embodiment of the present application. The vehicle 100 can be configured in a fully or partially autonomous driving mode. For example, the vehicle 100 can obtain environmental information about its surroundings through the perception system 120, and obtain an autonomous driving strategy based on the analysis of the surrounding environmental information to achieve fully autonomous driving, or present the analysis results to the user to achieve partially autonomous driving. The model that needs to be verified mentioned in the method provided in the present application can include a model for realizing the autonomous driving function of the vehicle.

[0063] The vehicle 100 may include various subsystems, such as an infotainment system 110, a perception system 120, a decision control system 130, a drive system 140, and a computing platform 150. Optionally, the vehicle 100 may include more or fewer subsystems, and each subsystem may include multiple components. In addition, each subsystem and component of the vehicle 100 may be interconnected by wire or wirelessly. The models that need to be verified mentioned below in this application may include models for implementing various systems or subsystems in the vehicle.

[0064] In some embodiments, the infotainment system 110 may include a communication system 111 , an entertainment system 112 , and a navigation system 113 .

[0065] The communication system 111 may include a wireless communication system 111, which can communicate wirelessly with one or more devices directly or via a communication network. For example, the wireless communication system 111 can use 3G cellular communication, such as CDMA, EVDO, GSM / GPRS, or 4G cellular communication, such as LTE, or 5G cellular communication. The wireless communication system 111 can communicate with a wireless local area network (WLAN) using WiFi. In some embodiments, the wireless communication system 146 can communicate directly with the device using an infrared link, Bluetooth, or ZigBee. The wireless communication system 111 may include one or more dedicated short range communications (DSRC) devices, which may include public and / or private data communications between vehicles and / or roadside stations.

[0066] The entertainment system 112 may include a central control screen, a microphone and a speaker. The user can listen to the radio and play music in the car based on the entertainment system 112; or connect the mobile phone to the vehicle and realize the projection of the mobile phone on the central control screen. The central control screen may be touch-sensitive, and the user can operate by touching the screen. In some cases, the user's voice signal can be obtained through the microphone, and the user can control certain aspects of the vehicle 100 based on the analysis of the user's voice signal, such as adjusting the temperature in the car. In other cases, music can be played to the user through the speaker.

[0067] The navigation system 113 may include a map service provided by a map provider, thereby providing navigation of the driving route for the vehicle 100. The navigation system 113 may be used in conjunction with the vehicle's global positioning system 121 and inertial measurement unit 122. The map service provided by the map provider may be a two-dimensional map or a high-precision map.

[0068] The perception system 120 may include several sensors that sense information about the environment around the vehicle 100. For example, the perception system 120 may include a global positioning system 121 (the global positioning system may be a GPS system, or a Beidou system or other positioning systems), an inertial measurement unit (IMU) 122, a laser radar 123, a millimeter wave radar 124, an ultrasonic radar 125, and a camera 126. The perception system 120 may also include sensors of the internal systems of the monitored vehicle 100 (for example, an in-vehicle air quality monitor, a fuel gauge, an oil temperature gauge, etc.). Sensor data from one or more of these sensors can be used to detect objects and their corresponding characteristics (position, shape, direction, speed, etc.). Such detection and recognition are key functions for the safe operation of the vehicle 100.

[0069] The global positioning system 121 may be used to determine the geographic location of the vehicle 100 .

[0070] The inertial measurement unit 122 is used to sense the position and orientation changes of the vehicle 100 based on inertial acceleration. In some embodiments, the inertial measurement unit 122 may be a combination of an accelerometer and a gyroscope.

[0071] The LiDAR 123 may utilize laser light to sense objects in the environment in which the vehicle 100 is located. In some embodiments, the LiDAR 123 may include one or more laser sources, a laser scanner, and one or more detectors, among other system components.

[0072] The millimeter wave radar 124 may utilize radio signals to sense objects in the surrounding environment of the vehicle 100. In some embodiments, in addition to sensing objects, the millimeter wave radar 124 may also be used to sense the speed and / or heading of the objects.

[0073] The ultrasonic radar 125 may sense objects around the vehicle 100 using ultrasonic signals.

[0074] The camera device 126 may be used to capture image information of the surrounding environment of the vehicle 100. The camera device 126 may include a monocular camera, a binocular camera, a structured light camera, a panoramic camera, etc. The image information acquired by the camera device 126 may include static image information or video stream information.

[0075] The decision control system 130 includes a computing system 131 for analyzing and making decisions based on the information obtained by the perception system 120. The decision control system 130 also includes a vehicle controller 132 for controlling the power system of the vehicle 100, and a steering system 133, a throttle 134 and a braking system 135 for controlling the vehicle 100.

[0076] The computing system 131 may process and analyze various information acquired by the perception system 120 in order to identify targets, objects and / or features in the surrounding environment of the vehicle 100. The targets may include pedestrians or animals, and the objects and / or features may include traffic signals, road boundaries and obstacles. The computing system 131 may use object recognition algorithms, Structure from Motion (SFM) algorithms, video tracking and other technologies. In some embodiments, the computing system 131 may be used to map the environment, track objects, estimate the speed of objects, and so on. The computing system 131 may analyze the various information acquired and derive a control strategy for the vehicle.

[0077] The vehicle controller 132 can be used to coordinate and control the vehicle's power battery and engine 141 to improve the power performance of the vehicle 100.

[0078] The steering system 133 may be used to adjust the forward direction of the vehicle 100. For example, in one embodiment, it may be a steering wheel system.

[0079] The throttle 134 is used to control the operating speed of the engine 141 and thus the speed of the vehicle 100 .

[0080] The braking system 135 is used to control the deceleration of the vehicle 100. The braking system 135 can use friction to slow down the rotation speed of the wheel 144. In some embodiments, the braking system 135 can convert the kinetic energy of the wheel 144 into electric current. The braking system 135 can also take other forms to slow down the rotation speed of the wheel 144 to control the speed of the vehicle 100.

[0081] The drive system 140 includes components that provide power movement for the vehicle 100. In one embodiment, the drive system 140 may include an engine 141, an energy source 142, a transmission system 143, and wheels 144. The engine 141 may be an internal combustion engine, an electric motor, an air compression engine, or a combination of other types of engines, such as a hybrid engine composed of a gasoline engine and an electric motor, or a hybrid engine composed of an internal combustion engine and an air compression engine. The engine 141 converts the energy source 142 into mechanical energy.

[0082] Examples of energy source 142 include gasoline, diesel, other petroleum-based fuels, propane, other compressed gas-based fuels, ethanol, solar panels, batteries, and other sources of electricity. Energy source 142 may also provide energy to other systems of vehicle 100.

[0083] The transmission system 143 can transmit mechanical power from the engine 141 to the wheels 144. The transmission system 143 may include a gearbox, a differential, and a drive shaft. In one embodiment, the transmission system 143 may also include other devices, such as a clutch. Among them, the drive shaft may include one or more shafts that can be coupled to one or more wheels 144.

[0084] Some or all functions of the vehicle 100 are controlled by a computing platform 150. The computing platform 150 may include at least one processor 151 that may execute instructions 153 stored in a non-transitory computer-readable medium such as a memory 152. In some embodiments, the computing platform 150 may also be a plurality of computing devices that control individual components or subsystems of the vehicle 100 in a distributed manner.

[0085] The processor 151 may be any conventional processor, such as a commercially available CPU. Alternatively, the processor 151 may also include a graphics processing unit (GPU), a field programmable gate array (FPGA), a system on chip (SOC), an application-specific integrated circuit (ASIC), or a combination thereof. The processor 151 may be located on a device remote from the vehicle and communicate wirelessly with the vehicle.

[0086] In some embodiments, the memory 152 may include instructions 153 (e.g., program logic) that may be executed by the processor 151 to perform various functions of the vehicle 100. The memory 152 may also include additional instructions, including instructions to send data to, receive data from, interact with, and / or control one or more of the infotainment system 110, the perception system 120, the decision control system 130, and the drive system 140.

[0087] In addition to instructions 153, memory 152 may also store data such as road maps, route information, the vehicle's location, direction, speed, and other similar vehicle data, as well as other information. Such information may be used by vehicle 100 and computing platform 150 during operation of vehicle 100 in autonomous, semi-autonomous, and / or manual modes.

[0088] The computing platform 150 may control functions of the vehicle 100 based on input received from various subsystems, such as the drive system 140, the perception system 120, and the decision control system 130. For example, the computing platform 150 may utilize input from the decision control system 130 in order to control the steering system 133 to avoid an obstacle detected by the perception system 120. In some embodiments, the computing platform 150 may be operable to provide control over many aspects of the vehicle 100 and its subsystems.

[0089] Alternatively, one or more of the above-mentioned components may be installed or associated separately from the vehicle 100. For example, the memory 152 may exist partially or completely separately from the vehicle 100. The above-mentioned components may be communicatively coupled together in a wired and / or wireless manner.

[0090] Optionally, the above components are only examples. In actual applications, the components in the above modules may be added or deleted according to actual needs. Figure 1 It should not be understood as limiting the embodiments of the present application.

[0091] An autonomous vehicle traveling on a road, such as vehicle 100 above, can identify objects in its surrounding environment to determine adjustments to the current speed. The objects can be other vehicles, traffic control devices, or other types of objects. In some examples, each identified object can be considered independently, and based on the object's respective characteristics, such as its current speed, acceleration, spacing from the vehicle, etc., can be used to determine the speed to be adjusted by the autonomous vehicle.

[0092] Optionally, the vehicle 100 or a sensing and computing device associated with the vehicle 100 (e.g., computing system 131, computing platform 150) can predict the behavior of the identified object based on the characteristics of the identified object and the state of the surrounding environment (e.g., traffic, rain, ice on the road, etc.). Optionally, each identified object depends on the behavior of each other, so all the identified objects can also be considered together to predict the behavior of a single identified object. The vehicle 100 can adjust its speed based on the predicted behavior of the identified object. In other words, the autonomous vehicle can determine what stable state the vehicle will need to adjust to (e.g., accelerate, decelerate, or stop) based on the predicted behavior of the object. In this process, other factors can also be considered to determine the speed of the vehicle 100, such as the lateral position of the vehicle 100 in the road it is traveling on, the curvature of the road, the proximity of static and dynamic objects, etc.

[0093] In addition to providing instructions to adjust the speed of the autonomous vehicle, the computing device may also provide instructions to modify the steering angle of vehicle 100 so that the autonomous vehicle follows a given trajectory and / or maintains a safe lateral and longitudinal distance from objects near the autonomous vehicle (e.g., cars in adjacent lanes on the road).

[0094] The vehicle 100 may be a car, a truck, a motorcycle, a bus, a ship, an airplane, a helicopter, a lawn mower, an entertainment vehicle, an amusement park vehicle, construction equipment, a tram, a golf cart, a train, etc., and the embodiments of the present application do not make any particular limitation.

[0095] Figure 2 A system architecture diagram of a vehicle 100 based on some embodiments is shown, where the vehicle 100 includes multiple vehicle integration units (VIU) 11, a telematic box (T-BOX) 12, a cockpit domain controller (CDC), a mobile data center (MDC) 14, and a vehicle domain controller (VDC) 15.

[0096] The vehicle 100 also includes multiple types of sensors disposed on the vehicle body, including: a laser radar 21, a millimeter wave radar 22, an ultrasonic radar 23, and a camera 24. Each type of sensor may include multiple sensors. It should be understood that although Figure 2 FIG. 1 shows the location layout of different sensors on the vehicle 100 , but Figure 2 The number and position layout of the sensors are only for illustration, and those skilled in the art can reasonably select the type, number and position layout of the sensors according to their needs.

[0097] exist Figure 2 Four VIUs are shown, it should be understood that Figure 2 The number and position of the VIUs are only an example, and those skilled in the art can select the appropriate number and position of the VIUs according to actual needs.

[0098] The vehicle integrated unit VIU 11 provides part or all of the data processing functions or control functions required by the vehicle components for the vehicle components. The VIU may have one or more of the following functions.

[0099] 1. Electronic control function, that is, VIU is used to implement the electronic control function provided by the electronic control unit (ECU) inside some or all vehicle parts. For example, the control function required by a certain vehicle part, or the data processing function required by a certain vehicle part.

[0100] 2. The same functions as the gateway, that is, the VIU may also have some or all of the same functions as the gateway, such as protocol conversion function, protocol encapsulation and forwarding function, and data format conversion function.

[0101] 3. The function of processing data across vehicle components, that is, processing and calculating data obtained from actuators of multiple vehicle components.

[0102] It should be noted that the data involved in the above functions may include the operating data of the actuator in the vehicle parts, such as the motion parameters of the actuator, the working status of the actuator, etc. The data involved in the above functions may also be data collected by the data collection unit (e.g., sensitive element) of the vehicle parts, such as the road information collected by the sensitive element of the vehicle, or weather information, etc., which is not specifically limited in the embodiments of the present application.

[0103] exist Figure 2 In the example of the vehicle 100, the vehicle 100 can be divided into multiple domains, each of which has an independent domain controller. Specifically, Figure 2 In the figure, two domain controllers are shown: a cockpit domain controller CDC13 and a vehicle domain controller VDC 15.

[0104] The cockpit domain controller CDC 13 can be used to implement functional control of the cockpit area of ​​the vehicle 100. Vehicle components in the cockpit area may include a head-up display (HUD), an instrument panel, a radio, a central control screen, a navigation, a camera, etc.

[0105] The vehicle domain controller VDC 15 may be used to coordinate and control the vehicle's power battery and engine 141 to improve the power performance of the vehicle 100. In some embodiments, Figure 1 The vehicle controller 132 can realize various functions of VDC.

[0106] Figure 2 The figure also shows a vehicle networking device T-BOX 12 and a mobile data center MDC 13. T-BOX 12 can be used to realize the communication connection between the vehicle 100 and the internal and external devices of the vehicle. T-BOX can obtain the data of the in-vehicle devices through the bus of the vehicle 100, and can also communicate with the user's mobile phone through a wireless network. In some embodiments, T-BOX 12 can be included in Figure 1 The mobile data center MDC 13 is used to output driving, transmission, steering and braking execution control instructions based on core control algorithms such as environment perception positioning, intelligent planning decision and vehicle motion control to achieve automatic control of the vehicle 100, and can also achieve human-computer interaction of vehicle driving information through a human-computer interaction interface. In some embodiments, Figure 1 The computing platform 150 in can implement various functions of MDC 13.

[0107] exist Figure 2 The four VIUs 11 in the network form a ring topology connection network, each VIU 11 is connected to the sensor in its neighboring position, and the T-BOX 12, CDC 13, MDC 14 and VDC 15 are connected to the ring topology connection network of the VIU. The VIU 11 can obtain information from each sensor and report the obtained information to the CDC 13, MDC 14 and VDC 15. Through the ring topology network, the T-BOX 12, CDC 13, MDC 14 and VDC 15 can also communicate with each other.

[0108] It should be understood that the above ring topology network connection is only an illustration, and those skilled in the art can select other appropriate VIU connection methods according to requirements.

[0109] The connection between VIUs can adopt, for example, Ethernet, the connection between VIU and T-BOX 12, CDC 13, MDC 14 and VDC 15 can adopt, for example, Ethernet or peripheral component interconnect express (PCIe) bus, and the connection between VIU and sensors can adopt, for example, controller area network (CAN), local interconnect network (LIN), FlexRay, multimedia data transmission (MOST) and the like.

[0110] Based on the aforementioned Figure 2 The hardware structure in the vehicle, and the software structure of the vehicle, the vehicle's Automotive Open System Architecture (AUTOSAR) can be divided into AP AUTOSAR and CP AUTOSAR, CP AUTOSAR can also be called classic AUTOSAR. Among them, CP has been widely used in traditional automotive embedded ECUs, and can meet the needs of scenarios including engine controllers, brake controllers, etc. with high functional safety and real-time requirements but low computing power requirements. AP is a new architecture that has emerged to meet the high performance and high computing power requirements of the next generation of intelligent connected vehicles, as well as the needs of continuous connection and integration in complex scenarios such as autonomous driving and cloud computing. It will be widely used in autonomous driving vehicles in the future.

[0111] The method provided in this application can be applied to the AP or CP platform of a vehicle, etc. For example, it can be used to verify the vehicle function in the AP or CP platform when developing the vehicle function, thereby improving the safety, correctness or reliability of the vehicle.

[0112] Figure 3 The schematic diagram of the CP AUTOSAR architecture is shown. CP AUTOSAR can be divided into three layers from top to bottom: application software layer, runtime environment layer, and basic software layer. CP AUTOSAR runs on a microcontroller unit.

[0113] Application Software (ASW): software that implements specific application functions. It can contain multiple software components (SWC).

[0114] Runtime Environment (RTE): It separates the application software layer from the basic software layer and provides a running environment for the application layer software, such as process time slice scheduling, data exchange between application layer modules and between the application layer and the basic software layer.

[0115] Basic Software (BSW): The basic software layer consists of the following four parts:

[0116] Microcontroller Abstraction Layer (MCAL): It is the driver software directly related to the hardware, such as the operation of memory, communication registers, IO ports, etc.

[0117] ECU Abstraction Layer (ECUAL): unifies the basic functions and interfaces of the controller, such as parsing the content of CAN messages, forwarding gateway messages, controlling the memory read and write processes, etc.

[0118] Services Layer: Provides various background services for the application layer, such as network management, memory management, bus communication management services, and operating systems.

[0119] Complex Device Drivers (CDD): Provides users with the possibility to write their own special device driver software.

[0120] Figure 4 The schematic diagram of AP AUTOSAR architecture is shown in Figure 4 As shown, from top to bottom, AP AUTOSAR may include a user layer (User Application), which includes multiple adaptive applications (Adaptive Application, AA); AUTOSAR runtime adaptive application layer (Runtime for Adaptive Application, ARA), which includes multiple functional modules; POSIX layer; virtual machine / container / operating system layer and the bottom hardware layer, which may include but is not limited to hardware devices such as CPU / SoC / FPGA / NPU / GPU.

[0121] ARA can include multiple functional units, each of which provides a service. The services provided by ARA are called Adaptive Platform Services, including:

[0122] ara::exec Execution Management(EM)

[0123] The main function of EM is to manage the life cycle of AP platforms and applications, including starting and stopping processes (meeting process dependencies), setting resource limits (CPU and memory usage), configuring core binding, setting scheduling priorities and scheduling policies, etc. When the system starts, the OS will initialize EM as the initial process, and EM will load other functional groups. For example, setting the status of a functional group to state up means that the functional group has been started. When the basic components of the platform are running, EM will start platform applications (such as platform functional modules) and ordinary applications (such as user-installed apps) in sequence according to the Machine Manifest and Execution Manifest configuration files.

[0124] ara::sm State Management(SM)

[0125] EM is responsible for loading, starting, and shutting down FC and AA, while SM is responsible for when to load and start, and when to shut down. In addition, the main function of SM is to manage the operating mode of the normal operation of the Machine, which is similar to the operating mode management of the ECU in the CP. The relationship between SM and EM in AP is similar to the relationship between BswM and EcuM in CP.

[0126] ara::phm Platform Health Management(PHM)

[0127] The health status of the application is managed, which mainly includes multiple error detection functions: Alive Supervision, Deadline Supervision, Logical Supervision, and Health Status, and can trigger corresponding recovery actions for the errors found.

[0128] For the aforementioned vehicle architecture, such as the CP platform or the AP platform, when implementing vehicle functions, such as the throttle, brake, steering or entertainment system functions, one or more functions in the vehicle can usually be implemented through one or more behavioral models, and each function can be implemented through one or more behavioral models. Usually, in order to improve the reliability of vehicle equipment, the models of various functions of the vehicle can be verified.

[0129] The present application relates to the field of device verification, such as safety, correctness or reliability verification, etc. For ease of understanding, some concepts involved in the verification field are explained below.

[0130] Formal Method: In the field of computer science and software engineering, formal methods are special techniques based on mathematics, suitable for the description, development and verification of software and hardware systems. The use of formal methods in software and hardware design is expected to improve the reliability and robustness of the design by using appropriate mathematical analysis, just like other engineering disciplines. Generally, formal methods are expensive and are generally only used to develop highly integrated systems that focus on safety.

[0131] Formal Verification: A verification method based on formal methods. In the design process of computer hardware (especially integrated circuits) and software systems, the meaning of formal verification is to use mathematical methods to prove the correctness or incorrectness according to one or more formal specifications or properties.

[0132] Model Checking: In computer science, model checking is a method of checking whether the finite state model of a system satisfies a given specification (also called correctness). In simple terms, it is a method of exhaustively traversing the finite state space.

[0133] Bounded Model Checking: A type of model checking method. Simply put, the bounded model checking algorithm fixes the maximum number of expansion steps of the finite state machine to alleviate the "state explosion" problem in the model checking field.

[0134] Parallelization: is the act of designing a computer program or system to process data in parallel. Normally, computer programs compute data sequentially: they solve one problem, then the next, then the next. If a computer program or system is parallelized, it breaks a problem into smaller parts that are solved independently and simultaneously by discrete computing resources. When optimized for such computations, a parallelized program can arrive at a solution faster than a program that executes the processes serially. Specific implementations can use multithreading, multi-core, etc. to achieve parallelization.

[0135] Incremental verification: Incremental verification is relative to exhaustive verification. Incremental verification does not need to re-verify the complete model in detail every time. It only needs to ensure that the stable and unchanging model will not affect the verification results, and then provide verification for the changing part of the model. It is an effective means to improve verification efficiency.

[0136] Synchronous reactive (SR): Synchronous reactive computing models can model systems that involve synchronization, especially those applications with complex control logic are very suitable for this model. In the synchronous reactive domain, the flow is synchronous, and on a clock beat, each communication link either has a message or the message is clearly missing.

[0137] Tick: It can also be called Cycle. In the field of SR models, it usually represents the global clock beat.

[0138] Satisfiability modulo theories (SMT): In computer science and mathematical logic, satisfiability modulo theories are the problem of determining whether a mathematical formula, such as x, is satisfiable. 2 +y 2 = -1 is satisfiable. The SMT encoding mentioned in the method provided in this application is to decompose the model to be verified into more fine-grained formulas for satisfiability.

[0139] SMT-LIB (Satisfiability Modulo Theories Library): is an international initiative standard aimed at promoting the research and development of Satisfiability Modulo Theories (SMT).

[0140] Z3: Also known as the Z3 theorem prover, it is an open source satisfiability modulo theory (SMT) solver.

[0141] K-Induction: In simple terms, k-Induction is a well-known formal scheme for verifying migration systems.

[0142] Model-Based Reliability Systems Engineering (MERSE): Also known as Model-Based RSE (Reliability Systems Engineering), it is a reliability systems engineering, or an independent discipline system with unified goals and quantitative indicators. The latest one is Model-Based RSE, which is model-based reliability systems engineering.

[0143] Usually, model checking uses the idea of ​​"exhaustive search" to ensure the completeness of the verification results. Because of this, model checking methods have natural shortcomings in verification efficiency due to the constraints of the technology itself. At the same time, the verification efficiency of the model checker is also a key factor affecting the usability and ease of use of the product.

[0144] KIND 2 is a verification platform based on model checking technology. Similar verification platforms include PKIND, JKIND, etc. These verification platforms are all automatic model checkers based on SMT, and are all applied to the security specification verification of synchronous reactive (SR) systems. In the field of model verification, for the same SMT model, different types of verification engines (algorithms) usually have their own application scenarios and different types of verification conclusions. For example, the BMC engine in KIND 2 is used to find counterexamples within the bound, while the K-Induction engine tries to find a generalizable proof within the bound. Therefore, the focus of the work of these verification platforms mentioned above is to integrate more different types of verification engines. For example, the JKIND verification platform supports the BMC engine, the K-Induction engine, and the PDR engine (a verification engine that can find both counterexamples and correctness proofs). However, when it comes to a single engine, there is room for improvement in engine acceleration.

[0145] Therefore, platforms such as KIND 2, PKIND, and JKIND can implement formal verification functions based on model checking in SR systems. For example, the BMC engine can be used to find counterexamples within the bounds and obtain conclusions that are safe within the bounds. However, none of them provide acceleration functions for the verification engine, but follow the traditional model checking idea, that is, after completing the SMT model verification of a tick, the SMT model of the next consecutive tick is verified, and there is a strict order dependency, which results in the current engine being unable to jump to verify the SMT model of a future tick. Therefore, when dealing with the common scenario where a larger tick triggers a bug, the verification efficiency may become very low. And because the engine algorithm does not allow the SMT model of a future tick to be jumped to be verified, it is difficult to achieve verification acceleration in parallel with different jump granularities, and it is also impossible to fully utilize the computing power advantages of modern computer clusters, and it is even more impossible to dynamically adjust the verification strategy of the parallelized verification engine according to the perceived execution environment to make it more intelligent and efficient.

[0146] In addition, the interaction between the verification engine and the SMT solver also adopts the traditional idea, that is, the SMT model corresponding to each tick contains the sum of all descriptions of all behaviors of the SR model from the 0th tick to the current tick. In other words, as the ticks increase, the SMT model corresponding to each tick will continue to expand, and many of the contents contained in it have already appeared in the SMT model of the previous tick. This will cause the interaction data between the verification engine and the SMT solver to become increasingly large, and also affect the verification efficiency.

[0147] Therefore, the efficiency of the commonly used formal verification method based on model checking usually includes the following issues:

[0148] In the process of verifying the SR system, the traditional method of the model checking-based verification engine has strict continuity dependence requirements on Tick iterations, that is, the effective calculation of the SMT model of the i+1th Tick must be completed in advance after the effective calculation of the SMT model of the i-th Tick has been completed. Therefore, it is impossible to use parallelization to accelerate the verification engine, where i is a positive integer.

[0149] The model-checking-based verification engine adopts a deterministic verification strategy when verifying the SR system, that is, continuous iteration of Ticks, serial calculation of the verification results of the SMT model corresponding to each Tick. Therefore, the verification engine does not have the ability to use the perception feedback of the execution environment to guide its dynamic adjustment of the parallel verification strategy.

[0150] When the verification engine based on model checking verifies the SR system, as the tick increases, the SMT model corresponding to each tick will continue to expand, and many of the contents contained in it have already appeared in the SMT model of the previous tick. This will cause the interactive data between the verification engine and the SMT solver to become increasingly large, and also affect the verification efficiency.

[0151] Therefore, the present application provides a formal verification method based on model checking, which is used to improve verification efficiency by parallelizing dynamic strategy verification. The method provided by the present application is introduced below in conjunction with the accompanying drawings and specific application scenarios.

[0152] See also Figure 5 , a flow chart of a model checking method provided in this application is as follows.

[0153] 501. Obtain a model set, where the models in the model set are divided into discontinuous models and continuous models.

[0154] The models in this model set are divided into models that have dependencies in the Tick dimension, such as models that do not need to be executed in continuously increasing Ticks (such as models that can be called discontinuous models), and models that do not have dependencies in the Tick dimension, such as models that need to be executed in continuously increasing Ticks, such as models that can be called continuous models.

[0155] The model set includes multiple coding models, and the models corresponding to the multiple coding models can be used to implement at least one function in the device. For example, taking the device as a vehicle, the models in the vehicle corresponding to the multiple coding models can be used to implement functions such as windshield wipers, brakes, or window lifts of the vehicle.

[0156] The multiple coding models can be divided into multiple types, such as at least one coding model that has no dependency in the Tick dimension (or called discontinuous model), and a coding model that has a dependency in the Tick dimension (or called continuous model), and the dependency is that the execution order between the models satisfies the execution order of Tick continuous increment when the model is executed. For example, if the execution order between a certain coding model and other coding models has no dependency in the Tick dimension, it is divided into a coding model that has no dependency in the Tick dimension. If the execution order between two coding models has a dependency in the Tick dimension, such as the triggering of one coding model depends on the output result of another coding model, the two coding models are coding models with a dependency in the Tick dimension. Usually, the Ticks corresponding to the discontinuous model are usually discontinuous. For example, if the Ticks corresponding to two coding models are separated by N cycles, the two coding models are discontinuous models, and the Ticks corresponding to the continuous model are usually continuous. For example, if the Ticks corresponding to two coding models are tick and tick+1 respectively, the two coding models are continuous models.

[0157] In the implementation manner of the present application, the obtained multiple coding models include models that have no dependencies or are discontinuous in the Tick dimension. Therefore, in the process of model checking, models that are unrelated in the Tick dimension can be checked in parallel, which greatly improves the efficiency of model checking.

[0158] In a possible implementation, the multiple coding models in the model set can be obtained by encoding multiple behavior models, and the multiple behavior models can be used to implement at least one function in the device. Taking the device as a vehicle as an example, the multiple behavior models can be used to implement one or more functions in the vehicle. The running order of the multiple coding models is discrete in the Tick dimension, and the Tick dimension is the Tick sequence corresponding to the multiple behavior models when implementing the one or more functions. Each function can correspond to one or more coding models, or each behavior model can be encoded into one or more coding models. It can be understood that when encoding the behavior model, it can be encoded based on the Tick dimension to obtain a coding model discrete in the Tick dimension, that is, a coding model that does not need to be executed in continuous Ticks. Therefore, in the subsequent model checking process, parallel checking can be implemented for coding models that do not need to be executed in continuous Ticks, thereby improving the efficiency of model checking.

[0159] 502. Perform model checking on the model set to obtain model checking results, wherein discontinuous models can be checked in parallel.

[0160] Among them, the models in the model set can be divided into continuous models and discontinuous models. There is no dependency between discontinuous models. Therefore, during the model checking process, the discontinuous models can be checked in parallel, thereby greatly improving the model checking efficiency.

[0161] Therefore, in the implementation manner of the present application, the coding model to be checked can be divided into a continuous model and a discontinuous model. Therefore, for the discontinuous model, parallel checking can be implemented, thereby improving the model checking efficiency.

[0162] Optionally, the model checking process can be divided into multiple checks, such as each clock beat can be divided into one check. In any check process: the coding model to be checked can be divided into a clock-independent coding model and a clock-independent coding model. The clock-independent coding model is a coding model that is not related to Tick, such as a model that does not need to be executed in a continuously increasing Tick or a model that is executed in a fixed Tick, etc. The clock-dependent coding model is a model that is related to Tick, such as a model that needs to be executed in a continuously increasing Tick or a model that is executed in a specified Tick, etc.; at least one of the clock-independent coding model or the clock-dependent coding model is verified in the current Tick, and the model checking result of the current model check can be obtained. Therefore, in the implementation of the present application, the coding model can be divided into a clock-independent coding model and a clock-dependent coding model. Therefore, when performing model checking, parallel checking of clock-independent coding models can be achieved, which greatly improves the efficiency of model checking.

[0163] Optionally, when performing model checking on the current Tick, it can be determined whether the current Tick is the first Tick. If the current Tick is the first Tick, both the clock-independent coding model and the clock-dependent coding model can be verified to obtain the check result of the current model check; if the current Tick is not the first Tick, only the time-dependent model can be checked to obtain the model check result of the current Tick.

[0164] In the implementation manner of the present application, model checking is performed on the time-independent model only in the first Tick. Usually, clock-independent coding models occupy a larger proportion in the model set. Therefore, model checking can be performed on the clock-independent coding model in the first Tick, and there is no need to perform model checking on the clock-independent coding model again in subsequent Ticks, which greatly reduces the model checking workload of subsequent Ticks, thereby improving the model checking efficiency of subsequent Ticks and achieving more efficient model checking.

[0165] In an optional implementation, a verification strategy may also be obtained, which may include a parallel number or a step parameter, etc. The parallel number may be the number of corresponding instances generated when performing a model check in one Tick, or it may also be understood as the number of parallel verification channels when performing parallel verification, and the step parameter is the number of clock beats skipped in a verification in each verification channel.

[0166] Optionally, environmental perception information may be obtained, and a verification strategy may be determined based on the environmental perception information. The environmental perception information may include information about resources used when performing model checking. Therefore, during the process of performing model checking, the verification strategy for performing model checking may be adjusted in a timely manner based on the available resource information, so that a more reasonable verification strategy may be set.

[0167] Specifically, the aforementioned environmental perception information may include but is not limited to one or more of the following: remaining memory, CPU load, encoding model complexity, information generated by the performed model check, etc.

[0168] In a possible implementation, the coding models to be detected may be grouped according to the verification strategy to obtain multiple coding model groups, and the multiple coding model groups are verified respectively to obtain the model checking result. Taking the model checking of any group of model groups as an example, for the convenience of distinguishing, it is called the first coding model group. If, during the model checking process, it is determined that the first model group includes a coding model that has not passed the verification, the output model checking result may be used to indicate that the first coding model group includes a coding model that has not passed the verification.

[0169] Optionally, when it is detected that a certain model group includes a model that has not passed the verification, the model check can be continued, or the model check can be stopped and the model check result can be output. Therefore, during the model check process, if a model that has not passed the verification is detected, the check can be stopped and the check result can be output, thereby achieving efficient model check.

[0170] Optionally, if it is determined that the first coding model group includes a coding model that has not passed verification, a further fine-grained search can be performed on the model that has not passed verification in the first coding model group, thereby further determining the information of the coding model that has not passed verification in the first coding model group. Therefore, in the implementation manner of the present application, after determining that there is a model that has not passed verification in the coding model group, the model that has not passed verification can be further searched, thereby locating the model that has not passed verification.

[0171] Optionally, the models in the first coding model group can be searched by a heuristic search algorithm or a binary search algorithm to determine the specific information of the coding models that have not passed the verification in the first coding model group, so as to locate the coding models that have not passed the verification. Therefore, in the implementation mode of the present application, the parallel checking of the coding models can be realized by the model grouping method, and after locating the model group that has not passed the verification, further refined search can be performed to further locate the model that has not passed the verification, so as to locate the specific information of the coding model that has not passed the verification.

[0172] Optionally, when performing a more fine-grained counterexample search, further searches may be performed according to a preset duration or a preset number of times. For example, when determining that a certain model group includes a model that has not passed verification, the number of searches does not exceed a preset number of times, or the search duration does not exceed a preset duration, etc. For example, the number of searches does not exceed 30 or 50 times, or the search duration does not exceed 5 minutes or 10 minutes, etc.

[0173] In addition, in a possible implementation, during the process of model checking, the coding models to be checked can be grouped to obtain multiple coding model groups. The multiple model groups can be verified in parallel through multiple verification channels to obtain model checking results. Among them, taking two parallel verification channels as an example, referred to as the first verification channel and the second verification channel, the second coding model group is verified in the first verification channel, and the third coding model group is verified in the second verification channel, wherein the coding model included in the third coding model group is executed after the coding model in the second coding model group in the Tick dimension, and the model in the third coding model group and the model in the second coding model group are in a sequential execution relationship in the Tick dimension, that is, the execution order of the model in the second coding model group and the model in the third coding model group in the Tick dimension is a Tick increasing relationship. If the third coding model group is completed in the second verification channel, and there is no model that has not passed the verification, if the verification of the second model group is not completed in the first verification channel, the verification of the second model group in the first verification channel can be terminated, and the next coding model group to be verified is selected from the verification queue for verification. In the implementation manner of the present application, for coding models that have a sequential relationship in time sequence, if the model verification in the later model group passes, the verification result of the previous coding model usually also passes, so jump verification can be performed to achieve more efficient model checking.

[0174] The above is an introduction to the method provided by the present application. The following is a more detailed introduction to the method provided by the present application in conjunction with specific application scenarios.

[0175] See also Figure 6, a schematic diagram of a model checking and verification architecture for the method provided in the present application. The model architecture can be deployed in a device by means of a verification engine, such as a server, a cloud platform or other development tools.

[0176] Among them, the model checking and verification architecture can be divided into several parts, such as Figure 6 The SMT model encoding conversion module, environment perception module, verification strategy adaptation module, verification arbitration module, counterexample enhancement module and solution interaction execution module shown in it, where the number of solution interaction execution modules can be one or more.

[0177] (1) SMT model encoding conversion module: It can be used to perform SMT encoding on the SR system model to obtain multiple encoding models. The behavior model of the SR system is converted into an SMT-encoded model to be verified. The generated SMT model does not need to strictly limit the continuity of the Tick iteration during the verification process, that is, the SMT model corresponding to a future Tick can be verified in a jumpy manner. At the same time, the structure of the SMT model is optimized to make it conform to the basic structure of incremental verification, that is, as the Tick iteration occurs, the part of the model related to the Tick is separated from the original SMT model for dynamic loading and verification.

[0178] (2) Environment perception module: It can be used to perceive the environment of the hardware and software platform running the device model check, and feed back the environment perception results to the verification strategy adaptation module. That is, during the execution of the verification engine, the environment information of interest is collected and transmitted to the verification strategy adaptation module after certain sorting work, so as to provide data basis for the verification strategy adaptation module to make decisions.

[0179] (3) Verification strategy adaptive module: It can be used to adjust the verification strategy according to the perception results fed back by the environment perception module. The verification strategy is the strategy used by the solution interaction execution module when performing model checking. That is, according to the data fed back by the environment perception module, a specific execution strategy is specified for the solution interaction execution module, mainly including the number of dynamic parallel solutions for the solution interaction execution module and the step size setting in each solution interaction execution module instance.

[0180] (4) Solving interactive execution module: It can be used to perform solution verification on the input coding model. Among them, the solving interactive execution module can include one or more. When there are multiple solving interactive execution modules, the model check can be performed in parallel. The number of instances of the solving interactive execution module corresponds to the "parallel number" of the verification engine, and each solving interactive execution module instance can dynamically set its own "step size". At the same time, different solving interactive execution module instances maintain "consistency", that is, to ensure that multiple parallel instances iterate Tick in an orderly manner.

[0181] (5) Verification Arbitration Module: It is used to analyze and verify the verification results output by the solution interactive execution module. For example, it can analyze whether the verification results fed back by the solution interactive execution module are legal, whether they are sufficient to generate a verification report, and decide whether it is necessary to continue iterating the Tick verification.

[0182] (6) Counterexample enhancement module: when the solution interaction module verifies that a certain model group has a model that fails the verification, it is used to further search for counterexamples in it and search for counterexamples with the smallest granularity. Whether the counterexample enhancement module is started or not will not affect the correctness of the counterexamples given by the verification engine, but after the counterexample enhancement module is started, the smallest counterexample can be found, that is, the Tick is required to be the minimum value when the counterexample is triggered. The SMT model generated by the optimized SMT model encoding conversion module has such a feature that if the i-th Tick triggers a counterexample, then the j-th Tick will also trigger a counterexample, 0<=j<=i. At this time, if i is not equal to j, the counterexample triggered by the i-th Tick is not the smallest counterexample. Therefore, the counterexample enhancement module is suitable for application scenarios where there is a need to find the smallest counterexample, where j is a positive integer.

[0183] Among them, the counterexample enhancement module is an optional module, that is, when it is determined through the solution interactive execution module that a certain model group includes a coding model that has not passed the verification, the model checking result can be output, that is, indicating that there is a coding model that has not passed the verification.

[0184] More specifically, the steps performed by each module in the aforementioned architecture can be as follows: Figure 7 As shown, it is introduced in more detail below.

[0185] (1) SMT model encoding conversion module

[0186] The SMT model encoding conversion module can be used to encode the SR system behavior model used to implement one or more functions of the vehicle and generate a corresponding SMT model. In the embodiment of the present application, the generated SMT model can be used to describe the SR system behavior of discontinuous ticks, which is equivalent to the generated SMT model being discretized in the tick dimension, so that the verification engine can support jump verification of the SMT model corresponding to a future tick.

[0187] In addition, during the model checking process, the SMT model can also be abstracted, that is, the Tick-independent model (or clock-independent coding model) and the Tick-dependent model (or clock-dependent coding model) can be separated based on whether the model is related to the Tick information. The Tick-independent model means that its execution order is independent of the Tick, and the Tick-dependent model is affected by the Tick changes, such as the model that needs to be executed with other models in continuously increasing Ticks.

[0188] Among them, the Tick-independent model will be loaded into the solution interaction execution module at the beginning of the interaction with the SMT solver; and the Tick-related model will be dynamically loaded into the solution interaction execution model with the iteration of Tick, and a part of new Tick-independent models will be generated after each loading. This part of the new Tick-independent model will also be separated out so that there is no need to pay attention to and use it in subsequent Tick iterations.

[0189] Among them, the SMT encoding method can refer to the following formula:

[0190]

[0191] Wherein, M represents the tick-independent model, fi represents the tick-dependent model of the i-th tick, vi represents the variable constraint model of the i-th tick, and Pi represents the specification model of the i-th tick. Here, Pi and Pj (i≠j) are independent of each other, that is, there is no need to make continuity requirements for the iteration of ticks as in the prior art 1.

[0192] In addition, the SMT model encoding conversion module can communicate with the environment perception module and the solution interaction execution module. The volume of the SMT model (such as model complexity) can be used as one of the indicators for evaluating the environment perception module. All models generated by the SMT model encoding conversion module are loaded into the solution interaction execution module, and the solution interaction execution module is responsible for the specific interaction between the SMT model and the SMT solver.

[0193] (2) Environmental Perception Module

[0194] The environment perception module can be used to collect the internal and external environment during the execution of the current verification engine. Among them, the external environment mainly includes some hardware configuration information used by the current operating platform, such as remaining memory, CPU load level, etc. The internal environment mainly includes model-related information generated during the verification process, such as the complexity of the SMT model during the interaction with the SMT solver, and the time statistics of the last N tick iterations. The environment perception module can clarify the specific information of interest and to be collected based on the configuration file or other means, and push the sorted data information to the verification strategy adaptive module for dynamic adjustment of the verification strategy.

[0195] (3) Verification strategy adaptive module

[0196] The verification strategy adaptive module is a decision-making module. According to the sorted data transmitted by the environment perception module, it dynamically adjusts the number of parallel instances of the solution interaction execution module and the step size parameters in each solution interaction execution module during the verification process, so that the verification engine can better utilize hardware computing resources and improve the verification efficiency of the model checker. The specific adjustment method includes a pre-set mapping relationship or an adjustment method obtained after reinforcement learning.

[0197] (4) Solving the interactive execution module

[0198] Mainly responsible for the interaction between the verification engine and the SMT solver. The solution interaction execution module receives the SMT model information from the SMT model encoding conversion module and the verification strategy update instructions from the verification strategy adaptation module. At the same time, the solution interaction execution module will perform self-coherent management (for example, how to manage that the parallel channel with known results can be terminated and switched to the next unsolved parallel channel), that is, to ensure that multiple parallel instances iterate the tick in an orderly manner. In addition, the solution interaction execution module obtains the solution results of the SMT solver and feeds back to the verification arbitration module.

[0199] (5) Verification Arbitration Module

[0200] The main task is to determine whether the verification result fed back by the solution interaction execution module is legal and whether the shutdown action of the verification engine can be enabled. The arbitration result of the verification arbitration module can also be used as one of the evaluation indicators of the environment perception module, and when the verification result is a counterexample, it can also be used as input data for the counterexample enhancement module.

[0201] (6) Counterexample Enhancement Module

[0202] Among them, the counterexample enhancement module is an optional module. Even if it is not enabled, it will not affect the correctness of the counterexamples found by the verification arbitration module. Due to the optimization of the SMT model encoding conversion module, the SMT model corresponding to a future tick can be verified in a jumpy manner, but the price paid is that the counterexamples found by the verification arbitration module are not necessarily the minimum counterexamples (i.e., the counterexamples that can be triggered when the tick is the smallest). Therefore, if there is a need to find the minimum counterexample, the counterexample enhancement module can be enabled, which can be, but not limited to, using the idea of ​​continuous approximation to find the minimum counterexample within the obtained counterexample boundary, and can be implemented by heuristic search algorithms or optimized binary search algorithms.

[0203] The following is a more detailed introduction to the process of the method provided by this application in combination with the aforementioned architecture.

[0204] See also Figure 8 , a flow chart of another model checking method provided by the present application is as follows.

[0205] 801. Obtain a SR system behavior model.

[0206] Among them, an SR system behavior model including business and specifications is obtained, and the SR system model can be used to implement one or more functions in the vehicle.

[0207] For example, after the development of the vehicle is completed, each function in the vehicle can be verified to verify the reliability of the vehicle. The SR system behavior model can be used to implement one or more functions in the vehicle. For example, the SR system behavior model can include models in the entire vehicle system, such as models in the wiper system, models for headlight control, etc., or models for vehicle control, etc.

[0208] 802. Encode to obtain an SMT model.

[0209] Before model checking, the behavior model can be SMT encoded by the aforementioned SMT encoding model conversion module to obtain multiple SMT models. It can be understood that the behavior model usually includes multiple behavior actions for realizing vehicle functions, that is, steps to be executed. By performing SMT encoding, the behavior model can be decomposed into mathematical problems to be formally verified, so that the correctness of the model can be verified by formal verification. That is, by decomposing the model into mathematical problems to verify its correctness or incorrectness, it can be identified whether the model has been verified.

[0210] In addition to SMT encoding, encoding can also be performed in other ways, which is not limited in this application. Generally, the behavior performed by the corresponding behavior model of the encoding model obtained by encoding in the SMT encoding method can be discretized in the Tick dimension. Therefore, in the subsequent verification, parallel verification and jump verification can be achieved, thereby greatly improving the verification efficiency.

[0211] For example, the encoding method of SMT can refer to the following formula:

[0212]

[0213] Among them, M represents the tick-independent model, fi represents the tick-dependent model of the i-th tick, vi represents the variable constraint model of the i-th tick, and Pi represents the specification model of the i-th tick. Here, Pi and Pj (i≠j) are independent of each other, that is, there is no need to make continuity requirements for the iteration of ticks.

[0214] Therefore, in the implementation of the present application, the SMT coding model is optimized to support the "parallelization" verification acceleration of the verification engine. For a certain specification to be verified, parallel verification calculation can be implemented through a certain verification engine, and for multiple specifications to be verified, multiple verification engines can be started in parallel, and the calculation in each verification engine is also parallel.

[0215] 803. Perform abstract processing on the SMT model.

[0216] Generally, for a model that implements one or more functions in a vehicle, it may include actions that need to be executed synchronously or actions that do not need to be executed synchronously. In an embodiment of the present application, the SMT model can be divided into a tick-independent model and a tick-related model based on whether the model includes information related to Tick.

[0217] For example, the vehicle's braking system usually needs to respond in a timely manner. For example, when the user steps on the brake pedal, the vehicle's braking system needs to be controlled to brake the vehicle. From the detection of the user stepping on the brake pedal to the completion of the vehicle braking, a series of behaviors have been executed in the vehicle. In order to improve vehicle safety, this series of behaviors need to be completed within a certain tick, and the execution order of each behavior may have a sequence relationship, such as a certain behavior needs to be executed after other behaviors or needs to be executed in a specified tick. For models of systems that may be unrelated in the vehicle, they do not need to be completed within continuous ticks, such as behaviors that need to be executed for functions in the vehicle that are not related to vehicle safety. Therefore, SMT models related to ticks can be divided into tick-related models, and models unrelated to ticks can be divided into tick-unrelated models.

[0218] Therefore, in the implementation mode of the present application, a model abstraction processing mechanism based on Tick information is introduced to divide the original SMT model into two types of models: Tick-related models and Tick-independent models. Combined with the management of the loading timing of these two types of models, "incremental" verification acceleration of the SMT model can be achieved, thereby improving the working efficiency of the verification engine.

[0219] 804. Determine whether it is the initial Tick. If so, execute step 805; if not, execute step 806.

[0220] Generally, the model check can be divided into multiple iterative processes, and in each iterative process, one or more ticks can be used as an iterative process. In each iterative check process, the current tick can be identified to determine whether the current tick is the initial tick, that is, the first tick. If so, step 805 is executed, and if not, step 806 is executed.

[0221] 805. Determine whether the SMT model is related to Tick. If so, execute step 807; if not, execute step 808.

[0222] Before verifying the model through the solution interactive execution module, it can be determined whether the SMT model is related to Tick, and all Tick-independent models are input into the solution interactive execution module for solution, that is, step 807 is executed. Tick-related models are iteratively loaded into the solution interactive execution module for solution, that is, step 808 is executed.

[0223] 806. Determine whether the SMT model is related to Tick. If so, execute step 808; if not, execute step 809.

[0224] For non-first Tick, it is also possible to identify whether the SMT model is related to Tick. The Tick-related model can be iteratively loaded into the solution interaction execution module for solution, that is, step 808 is executed. And the Tick-irrelevant model is discarded in non-initial Tick.

[0225] 807. Load the model into the solution interactive execution module once as the initial tick-independent model.

[0226] In the implementation manner of the present application, in the initial Tick, all Tick-independent models are loaded into the solution interaction execution module for solution, and there is no need to verify the Tick-independent models again in subsequent Ticks.

[0227] Usually, the tick-independent models separated in the initial tick are much larger than the tick-related models separated in the subsequent ticks. Therefore, the SMT models corresponding to most of the behavioral descriptions of the SR system will actually be loaded in this step, thereby realizing the verification of most of the tick-independent models in the initial tick.

[0228] 808. Load the Tick related model into the solution interaction execution module.

[0229] In the initial tick or subsequent ticks, the tick-related model can be loaded into the solution execution module for iterative solution.

[0230] Each Tick iteration dynamically loads the currently separated Tick-related model into the solution interactive execution module. Tick-related models are usually generated with each Tick iteration, such as models that need to execute different behaviors in different Ticks, but usually require fewer solution resources than the Tick-independent model in step 807, thus meeting the structural form of the model loaded in the incremental verification.

[0231] 809. Discard the Tick-irrelevant model.

[0232] The repeated tick-irrelevant models can be discarded at non-initial ticks, thereby reducing repeated verification of tick-irrelevant models.

[0233] In the implementation mode of the present application, by abstracting the SMT model, separating the Tick-related model and the Tick-independent model, and converting the verification method of the SMT model into an incremental verification method, the problem of rapid expansion of data interacting with the SMT solver in existing solutions can be effectively alleviated, thereby improving the interaction efficiency and further improving the working efficiency of the verification engine.

[0234] 810. Obtain environmental parameters.

[0235] Specifically, the external and internal environment parameters of interest can be collected and processed by screening, aggregation, etc. Among them, the external environment mainly includes some hardware configuration information used by the current running platform, such as remaining memory, CPU load, etc.; the internal environment mainly includes model-related information generated during the verification process, such as the time statistics of the last N tick iterations, etc. These collected and processed data will be handed over to the verification strategy adaptation module as the data basis for formulating the verification strategy.

[0236] For example, the collected environmental parameters include but are not limited to the number of physical cores and logical cores, CPU load information, memory usage information, verification time statistics of the last 10 ticks (which can also be replaced by other values), the number of specifications verified in parallel, the number of instances of the solution interactive execution module enabled in parallel in each specification being verified, and the step size information in each tick iteration. The collected parameters need to be sorted out in a timely manner, and general filtering, aggregation, compression and other processing methods can be used to obtain usable data.

[0237] 811. Adjust verification strategy according to environmental parameters.

[0238] The collected environmental parameters can be used as data basis for dynamically adjusting the verification strategy. This step is responsible for formulating the latest verification strategy to guide the interactive execution module to generate the corresponding number of instances, that is, the number of parallel verifications, and the step size parameters in each instance. The strategy provided by this step can better enable the verification engine to fully utilize the hardware computing power, especially multi-core devices and cluster devices.

[0239] For example, one implementation method of formulating the verification strategy in this step may be to construct a decision state machine, and when certain parameters meet the state transition conditions of the state machine, the state is updated, and a new verification strategy is generated.

[0240] Therefore, in the implementation mode of the present application, on the basis that the verification engine can perform parallel verification, a dynamic perception mechanism is introduced, and the verification engine can "dynamically" and "adaptively" adjust the verification strategy during the verification process, so as to give full play to the computing power advantages of modern computer clusters.

[0241] 812. Perform parallel model checking based on verification strategy.

[0242] The model check can be completed by the solution interaction execution module, which is mainly responsible for the parallel interaction between the verification engine and the SMT solver. The input information of this step involves the SMT model loaded in each Tick iteration, the latest verification strategy updated by the verification strategy adaptive module, and the solution feedback information of the SMT solver. At the same time, it is necessary to manage the synchronization problem in the parallel dynamic verification process, that is, to ensure that multiple parallel instances iterate the Tick in an orderly manner.

[0243] Usually, an SMT solver can be set to solve. The object that interacts with the SMT solver is the instance generated by the solution interaction execution module. Usually, multiple instances interact with the SMT solver in parallel to achieve parallel solving. For example, one implementation method is that the solution interaction execution module maintains a thread pool, and each instance runs on an independent thread. At this time, each instance will receive its own feedback information from the SMT solver. The solution interaction execution module will maintain a synchronized state between its different instances, that is, to ensure that multiple parallel instances iterate the tick in an orderly manner.

[0244] Moreover, the SMT coding model obtained through SMT coding does not require continuity in the iteration of Tick, so that the SMT model corresponding to a non-continuous Tick in the future can be verified in a jumpy manner.

[0245] In addition, when performing model checking through multiple solution passes, the number of parallel passes and the number of models verified by each parallel pass can be determined based on the verification strategy.

[0246] For example, the solution can be performed in parallel through multiple solution channels. The coding model corresponding to Tick 5 can be verified in channel 1, and the coding model corresponding to Tick 7 can be verified in channel 2, etc., thereby realizing parallel and jumpable model verification.

[0247] For another example, the solution can be performed in parallel through multiple solution channels. If the SMT coding models 1-20 executed by Tick5 are verified in channel 1, and the SMT coding models 21-40 executed by Tick6 are verified in channel 2, if the verification of the SMT coding models 21-40 is completed in channel 2, and there is no model that has not passed the verification, then if the verification in channel 1 is not completed, the verification in channel 1 can be terminated and the verification of the next group of models can be carried out, thereby achieving efficient verification.

[0248] 813. Analyze the verification results.

[0249] The verification results can be summarized, analyzed or judged. Since the solution interaction execution module can dynamically interact with the SMT solver in parallel, when multiple verification results are generated, the verification arbitration module needs to give the final judgment result, that is, whether there are legal verification results and whether the shutdown action of the verification engine can be enabled. When the model checker runs multiple verification engines to verify multiple specifications of the same SR system in parallel, each verification engine will have its own verification arbitration module instance. At this time, from the perspective of the model checker, there are multiple parallel verification arbitration module instances.

[0250] For example, when multiple instances of the current interactive execution module interact with the SMT solver, parallel verification will also generate multiple verification results at the same time. At this time, step 813 is required to arbitrate the current verification result and give a legal verification result. For example, the solution result of the 5th tick iteration is that the model meets the specification, but the solution result of the 10th tick iteration is returned at the same time and a counterexample is found. In this case, there is a bug in the current model and a counterexample can be triggered at the 10th tick.

[0251] 814. Determine whether a valid verification result is obtained. If so, execute step 815; if not, execute step 803.

[0252] After analyzing the verification results, it can be determined whether a valid verification result is obtained. If the number of iterations reaches the preset number, the verification results include counterexamples, or all SMT models are verified, the next step can be executed, that is, step 815. If the model verification is not completed, the verification can continue, and step 803 can be continued, such as continuing to verify subsequent ticks.

[0253] 815. Determine whether a counterexample occurs. If so, execute step 816; if not, execute step 817.

[0254] When it is determined that the verification result output is satisfied, it can be determined whether a counterexample appears, i.e., a model that fails the verification or is illegal. If so, the search for the minimum counterexample can be continued, i.e., step 816 is executed; if not, step 817 can be executed, i.e., the verification result is output.

[0255] 816. Search for the minimum counterexample.

[0256] Generally, the solving interactive execution module solves the model grouping, and when it is determined that a counterexample has occurred, the output result generally indicates that a counterexample has occurred in the model grouping. Therefore, in order to further locate the counterexample more precisely, a counterexample with the smallest granularity can be further searched. For example, the smallest counterexample can be found within the obtained counterexample bound by using the idea of ​​continuous approximation, which can be implemented by a heuristic search algorithm or an optimized binary search algorithm.

[0257] It should be understood that step 816 is an optional step, that is, in the event of a counterexample, the verification result may be directly output, that is, step 817 is executed.

[0258] 817. Output verification results.

[0259] In the implementation manner of the present application, outputting the verification result may include various situations. For example, after completing the model check and no model fails to pass the verification, a verification result indicating that no model fails to pass the verification may be output; if a model fails to pass the verification during the model check, a verification result indicating that there is a model that fails to pass the verification may be output; if a model fails to pass the verification and step 816 is executed, a verification result indicating information about the model that fails to pass the verification may be output.

[0260] 818. Stop model checking.

[0261] After obtaining the verification results, you can stop model checking and output the verification results.

[0262] Therefore, in the implementation manner of the present application, when performing SMT encoding, the SMT encoding model can be divided into a Tick-related model and a Tick-independent model based on the discrete behavior of the corresponding behavior model in the Tick dimension. The Tick-independent model can be loaded into the solution interaction execution module for solution at one time in the initial Tick, and only the smaller Tick-related model needs to be verified in the subsequent Ticks, thereby realizing incremental verification. The interaction data between the verification engine and the SMT solver is reduced through the incremental verification method, and only a small amount of necessary incremental models are provided in each Tick iteration, which greatly improves the efficiency of model checking. That is, there is no continuity requirement for the iteration of Ticks during the verification process, so different step sizes and different numbers of instances of interaction with the solver can be used to perform parallel verification on the SMT model. Parallel verification can be performed in multiple solution channels, and jumpable verification can be achieved, further improving the efficiency of model checking. During the verification process, the verification engine automatically senses changes in the current execution environment and adaptively adjusts the verification strategy. The verification strategy is not fixed and can be dynamically updated as the current environment changes. It can more intelligently select the ticks to be iterated, estimate the required computing resources, etc., fully utilize computing resources, and give full play to the computing performance of multi-core hardware devices.

[0263] For example, compared with existing verification engines, existing verification engines verify the corresponding SMT model with strictly continuous and incremental Tick iterations, and therefore do not have the basis for parallel verification and dynamic strategy updates. At the same time, the model of each Tick iteration is not abstracted, that is, there is no basis for incremental verification. For example, existing solutions require Tick continuous incremental iterations when generating SMT models, and therefore do not have the basis for parallel verification and dynamic verification strategy updates. At the same time, the interactive verification method of the model without abstract processing will transmit a large amount of data each time it interacts with the SMT solver, and the amount of data is also growing rapidly as the Tick increases. Therefore, the verification efficiency of existing verification engines has a lot of room for improvement.

[0264] The method provided by this application optimizes SMT encoding and supports parallel verification acceleration and verification strategy adaptive tuning. In addition, the SMT model is abstracted to support incremental verification, thereby achieving the effect of accelerating the verification engine. That is, the verification engine is accelerated by the method provided by this application, while supporting parallel verification, verification strategy adaptive, incremental verification and other functions, greatly improving the model verification efficiency and greatly improving the reliability verification of the device.

[0265] The above describes the process of the method provided by the present application. The following describes the structure of the device provided by the present application.

[0266] References Fig. 9, a schematic diagram of the structure of a model checking device provided in the present application, the model checking device can be used to perform the above Figures 5 to 8 The corresponding method flow.

[0267] The model checking device may specifically include:

[0268] The encoding module 901 is used to obtain a model set, where the model set includes multiple encoding models, where the models corresponding to the multiple encoding models are used to implement at least one function in the device, and the multiple encoding models are divided into encoding models that have no dependency in the Tick dimension and encoding models that have a dependency in the Tick dimension, where the dependency is that the execution order between the models when the models are executed satisfies the order of continuous increment of Tick;

[0269] The model checking module 902 is used to perform model checking on the model set to obtain a model checking result, where the model checking result is used to indicate whether the multiple coding models include a coding model that has not passed the verification. The model checking process includes performing model checking on multiple coding models that have no dependency in the Tick dimension in parallel.

[0270] In a possible implementation, the aforementioned model check is divided into multiple checks. In any one of the checks, the model check module 902 is specifically used to: divide the model set into a clock-independent coding model and a clock-dependent coding model, the clock-independent coding model includes a coding model that is not related to Tick, and the clock-dependent coding model includes a coding model that is related to Tick; verify at least one of the clock-independent coding model or the clock-dependent coding model based on the current clock beat to obtain a model check result of the current model check.

[0271] In one possible implementation, the model checking module 902 is specifically used to: if the current clock beat is the first clock beat, verify the clock-independent coding model and the clock-dependent coding model to obtain the model checking result of the current model check; if the current clock beat is not the first clock beat, verify the clock-dependent coding model to obtain the model checking result of the current model check.

[0272] In a possible implementation, the above-mentioned device may also include: a verification strategy adaptation module 903, which is used to: obtain a verification strategy in any check, and the verification strategy includes a parallel number or a step parameter, the parallel number is the number of instances generated when parallel verification is performed on the coding model in the model set, and the step parameter includes the number of clock beats jumped when performing a model check.

[0273] In a possible implementation, the above device may further include: an environment perception module 904;

[0274] The environment perception module 904 is used to obtain environment perception information, and the environment perception information includes information about resources used when performing model checking;

[0275] Verification strategy adaptive module 903, specifically used to determine the verification strategy according to the environmental perception information;

[0276] In a possible implementation, the environment perception information includes at least one of the following: remaining memory, CPU load, encoding model complexity, and information generated by a performed model check.

[0277] In a possible implementation, the model checking module 902 is also used to: group the coding models to be checked according to the verification strategy to obtain multiple coding model groups; verify the coding models in the multiple coding model groups respectively to obtain model checking results; wherein, if the first coding model group includes a coding model that fails the verification, the model checking result is output, and the model checking result is used to indicate that the first coding model group includes a coding model that fails the verification, and the first coding model group is any group of at least one coding model group.

[0278] In a possible implementation, the above-mentioned device may also include: a counterexample enhancement module 905, which is used to search the coding models in the first coding model group if the first coding model group includes a coding model that has not passed the verification, and determine the information of the coding model in the first coding model group that has not passed the verification.

[0279] In a possible implementation, the counterexample enhancement module 905 is specifically used to: search the coding models in the first coding model group by using a heuristic search algorithm or a binary search algorithm to determine information of the coding models in the first coding model group that have not passed the verification.

[0280] In a possible implementation, the model checking module is further used to: verify multiple coding model groups in parallel through multiple verification channels to obtain model checking results, wherein the first verification channel verifies the second coding model group, and the second verification channel verifies the third coding model group, and the Tick corresponding to the coding model in the second coding model group is in an increasing relationship with the Tick of the coding model in the third coding model group. If the second verification channel completes the verification of the third coding model group and the third coding model group does not include a coding model that fails the verification, if the second verification channel has not completed the verification of the second coding model group, then the verification of the second coding model group is skipped in the second verification channel.

[0281] In one possible implementation, the above-mentioned device includes a vehicle, and an encoding module 901 is specifically used to: obtain multiple behavior models, and the multiple behavior models are used to implement at least one function in the vehicle; encode the behavior models to obtain a model set, and the running order of the multiple encoded models in the model set is discretized in the Tick dimension, and the Tick dimension includes the Tick sequence corresponding to when the multiple behavior models are used to implement at least one function.

[0282] like Fig.10 , which is a schematic diagram of the hardware structure of a model checking device 100 provided in an embodiment of the present application.

[0283] Fig.10 The model checking device 100 shown may include: a processor 1001 , a memory 1002 , a communication interface 1003 , and a bus 1004 . The processor 1001 , the memory 1002 , and the communication interface 1003 may be connected via the bus 1004 .

[0284] The processor 1001 is the control center of the generated model checking device 100, and can be a general-purpose central processing unit (CPU) or other general-purpose processors, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0285] As an example, the processor 1001 may include one or more CPUs, such as Fig.10 CPU 0 and CPU 1 are shown in .

[0286] The memory 1002 may be a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0287] In a possible implementation, the memory 1002 may exist independently of the processor 1001. The memory 1002 may be connected to the processor 1001 via a bus 1004 and used to store data, instructions, or program codes. When the processor 1001 calls and executes the instructions or program codes stored in the memory 1002, the resource scheduling method provided in the embodiment of the present application can be implemented.

[0288] In another possible implementation, the memory 1002 may also be integrated with the processor 1001 .

[0289] The communication interface 1003 is used for connecting the model checking apparatus 100 with other devices through a communication network, and the communication network may be Ethernet, a radio access network (RAN), a wireless local area network (WLAN), etc. The communication interface 1003 may include a receiving unit for receiving data and a sending unit for sending data.

[0290] The bus 1004 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0291] It should be pointed out that Fig.10 The structure shown in the figure does not constitute a limitation on the model checking device 100. Fig.10 In addition to the components shown, the model checking apparatus 100 may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0292] Optionally, the aforementioned Fig.10 The model checking device shown in FIG. 1 is a chip.

[0293] The embodiment of the present application also provides a digital processing chip. The digital processing chip integrates a circuit and one or more interfaces for implementing the above-mentioned processor 1001 or the functions of the processor 1001. When the digital processing chip integrates a memory, the digital processing chip can complete the method steps of any one or more of the above-mentioned embodiments. When the digital processing chip does not integrate a memory, it can be connected to an external memory through a communication interface. The digital processing chip implements the actions performed by the model checking device in the above-mentioned embodiment according to the program code stored in the external memory.

[0294] The present application also provides a computer program product which, when executed on a computer, enables the computer to execute the above Figure 5-Figure 8 The illustrated embodiments describe steps in a method.

[0295] The model checking device provided in the embodiment of the present application may be a chip, and the chip includes: a processing unit and a communication unit. The processing unit may be, for example, a processor, and the communication unit may be, for example, an input / output interface, a pin or a circuit. The processing unit may execute the computer execution instructions stored in the storage unit, so that the chip executes the above-mentioned Figure 5-Figure 8 Optionally, the storage unit is a storage unit in the chip, such as a register, a cache, etc. The storage unit may also be a storage unit located outside the chip in the wireless access device, such as a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0296] Specifically, the aforementioned processing unit or processor may be a central processing unit (CPU), a neural-network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0297] For example, see Fig.11 , Fig.11 A schematic diagram of the structure of a chip provided in an embodiment of the present application, the chip can be expressed as a neural network processor NPU 110, NPU 110 is mounted on the host CPU (Host CPU) as a coprocessor, and the host CPU assigns tasks. The core part of the NPU is the operation circuit 1103, which is controlled by the controller 1104 to extract matrix data from the memory and perform multiplication operations.

[0298] In some implementations, the operation circuit 1103 includes multiple processing units (PEs) inside. In some implementations, the operation circuit 1103 is a two-dimensional systolic array. The operation circuit 1103 can also be a one-dimensional systolic array or other electronic circuits capable of performing mathematical operations such as multiplication and addition. In some implementations, the operation circuit 1103 is a general-purpose matrix processor.

[0299] For example, assume there is an input matrix A, a weight matrix B, and an output matrix C. The operation circuit takes the corresponding data of matrix B from the weight memory 1102 and caches it on each PE in the operation circuit. The operation circuit takes the matrix A data from the input memory 1101 and performs matrix operations with matrix B, and the partial results or final results of the matrix are stored in the accumulator 1108.

[0300] The unified memory 1106 is used to store input data and output data. The weight data is directly transferred to the weight memory 1102 through the direct memory access controller (DMAC) 1105. The input data is also transferred to the unified memory 1106 through the DMAC.

[0301] The bus interface unit (BIU) 1110 is used for the interaction between the AXI bus and the DMAC and the instruction fetch buffer (IFB) 1109 .

[0302] The bus interface unit 1110 (BIU) is used for the instruction fetch memory 1109 to obtain instructions from the external memory, and is also used for the storage unit access controller 1105 to obtain the original data of the input matrix A or the weight matrix B from the external memory.

[0303] DMAC is mainly used to transfer input data in the external memory DDR to the unified memory 1106 or to transfer weight data to the weight memory 1102 or to transfer input data to the input memory 1101.

[0304] The vector calculation unit 1107 includes multiple operation processing units, and further processes the output of the operation circuit when necessary, such as vector multiplication, vector addition, exponential operation, logarithmic operation, size comparison, etc. It is mainly used for non-convolutional / fully connected layer network calculations in neural networks, such as batch normalization, pixel-level summation, upsampling of feature planes, etc.

[0305] In some implementations, the vector calculation unit 1107 can store the processed output vector to the unified memory 1106. For example, the vector calculation unit 1107 can apply a linear function and / or a nonlinear function to the output of the operation circuit 1103, such as linear interpolation of the feature plane extracted by the convolution layer, and then, for example, a vector of accumulated values ​​to generate an activation value. In some implementations, the vector calculation unit 1107 generates a normalized value, a pixel-level summed value, or both. In some implementations, the processed output vector can be used as an activation input to the operation circuit 1103, for example, for use in a subsequent layer in a neural network.

[0306] An instruction fetch buffer 1109 connected to the controller 1104 is used to store instructions used by the controller 1104;

[0307] Unified memory 1106, input memory 1101, weight memory 1102 and instruction fetch memory 1109 are all on-chip memories. External memories are private to the NPU hardware architecture.

[0308] The operations of each layer in the recurrent neural network may be performed by the operation circuit 1103 or the vector calculation unit 1107 .

[0309] The processor mentioned in any of the above can be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits for controlling the above Figure 5-Figure 8 The method of procedure.

[0310] The present application also provides a vehicle, which includes the above Fig. 9 or Fig.10 The device shown.

[0311] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0312] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0313] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0314] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or a data center that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)), etc.

[0315] The terms "first", "second", "third", "fourth", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0316] Finally, it should be noted that the above is only a specific implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A model checking method, characterized in that: The method comprises: Obtain a model set, where the model set includes multiple coding models, where models corresponding to the multiple coding models are used to implement at least one function in a device, where the multiple coding models are divided into coding models that have no dependency in a clock tick Tick dimension and coding models that have a dependency in a Tick dimension, where the dependency is that an execution order between the models when the models are executed satisfies an order of continuously increasing Ticks; Performing model checking on the model set to obtain a model checking result, wherein the model checking result is used to indicate whether the multiple coding models include a coding model that has not passed the verification, wherein the model checking process includes performing model checking in parallel on the multiple coding models that have no dependency in the clock tick dimension.

2. The method according to claim 1, characterized in that The model check is divided into multiple checks. In any one check: Divide the coding models in the model set into a clock-independent coding model and a clock-dependent coding model, wherein the clock-independent coding model includes a coding model that is irrelevant to the clock beat Tick, and the clock-dependent coding model includes a coding model that is relevant to Tick; At least one of the clock-independent coding model or the clock-dependent coding model is verified based on the current clock beat to obtain a model checking result of the current model checking.

3. The method according to claim 2, characterized in that The verifying at least one of the clock-independent coding model or the clock-dependent coding model based on the current clock beat to obtain a model checking result of the current model checking includes: If the current clock beat is the first clock beat, verifying the clock-independent coding model and the clock-dependent coding model to obtain a model check result of the current model check; If the current clock beat is not the first clock beat, the clock-related coding model is verified to obtain a model check result of the current model check.

4. The method according to claim 2 or 3, characterized in that: In any of the inspections, the method further includes: A verification strategy is obtained, where the verification strategy includes a parallel number or a step size parameter, where the parallel number is the number of instances generated when parallel verification is performed on the coding models in the model set, and the step size parameter includes the number of clock beats jumped when performing a model check.

5. The method according to claim 4, characterized in that The acquisition verification strategy includes: Acquiring environment perception information, wherein the environment perception information includes information about resources used when performing model checking; The verification strategy is determined according to the environmental perception information.

6. The method according to claim 5, characterized in that The environmental perception information includes at least one of the following: remaining memory, CPU load, encoding model complexity, and information generated by a performed model check.

7. The method according to any one of claims 4 to 6, characterized in that: Any of the above inspections also include: Grouping the coding models to be detected according to the verification strategy to obtain multiple coding model groups; Verifying the coding models in the plurality of coding model groups respectively to obtain the model checking result; Among them, if the first coding model group includes a coding model that fails verification, the model check result is output, and the model check result is used to indicate that the first coding model group includes a coding model that fails verification, and the first coding model group is any group of the at least one coding model group.

8. The method according to claim 7, characterized in that The method further comprises: If the first coding model group includes a coding model that has not passed the verification, the coding models in the first coding model group are searched to determine information about the coding models in the first coding model group that have not passed the verification.

9. The method according to claim 8, characterized in that The step of searching the coding models in the first coding model group to determine information of the coding models in the first coding model group that have not passed verification includes: The coding models in the first coding model group are searched by using a heuristic search algorithm or a binary search algorithm to determine information of the coding models in the first coding model group that have not passed the verification.

10. The method according to any one of claims 7 to 9, characterized in that: The respectively verifying the coding models in the plurality of coding model groups to obtain the model checking result includes: The multiple coding model groups are verified in parallel through multiple verification channels to obtain the model checking result, wherein the first verification channel verifies the second coding model group, and the second verification channel verifies the third coding model group, and the Tick corresponding to the coding model in the second coding model group is in an increasing relationship with the Tick of the coding model in the third coding model group. If the second verification channel completes the verification of the third coding model group and the third coding model group does not include a coding model that fails the verification, if the second verification channel does not complete the verification of the second coding model group, then the verification of the second coding model group is skipped in the second verification channel.

11. The method according to any one of claims 1 to 10, characterized in that The device includes a vehicle, and the acquiring model set includes: Acquire a plurality of behavior models, wherein the plurality of behavior models are used to implement the at least one function in the vehicle; The behavior model is encoded to obtain the model set, wherein the running order of the multiple encoded models in the model set is discretized in a Tick dimension, and the Tick dimension includes Tick sequences corresponding to the multiple behavior models when they are used to implement the at least one function.

12. A model checking device, characterized in that: The device comprises: A coding module, used to obtain a model set, wherein the model set includes multiple coding models, and the models corresponding to the multiple coding models are used to implement at least one function in the device, and the multiple coding models are divided into coding models that have no dependency in the clock beat Tick dimension and coding models that have a dependency in the Tick dimension, and the dependency is that the execution order between the models when the models are executed satisfies the order of continuous increment of Tick; A model checking module is used to perform model checking on the model set to obtain a model checking result, wherein the model checking result is used to indicate whether the multiple coding models include a coding model that has not passed the verification, wherein the model checking process includes performing model checking in parallel on the multiple coding models that have no dependency in the clock tick dimension.

13. The device according to claim 12, characterized in that The model check is divided into multiple checks. In any one of the checks, the model check module is specifically used to: Divide the coding models in the model set into a clock-independent coding model and a clock-dependent coding model, wherein the clock-independent coding model includes a coding model that is irrelevant to the clock beat Tick, and the clock-dependent coding model includes a coding model that is relevant to Tick; At least one of the clock-independent coding model or the clock-dependent coding model is verified based on the current clock beat to obtain a model checking result of the current model checking.

14. The device according to claim 13, characterized in that The model checking module is specifically used for: If the current clock beat is the first clock beat, verifying the clock-independent coding model and the clock-dependent coding model to obtain a model check result of the current model check; If the current clock beat is not the first clock beat, the clock-related coding model is verified to obtain a model check result of the current model check.

15. The device according to claim 13 or 14, characterized in that The device also includes: a verification strategy adaptive module, which is used to: In any of the checks, a verification strategy is obtained, where the verification strategy includes a parallel number or a step size parameter, where the parallel number is the number of instances generated when parallel verification is performed on the coding models in the model set, and the step size parameter includes the number of clock beats jumped when performing a model check.

16. The device according to claim 15, characterized in that The device also includes: an environment perception module; The environment perception module is used to obtain environment perception information, and the environment perception information includes information about resources used when performing model checking; The verification strategy adaptive module is specifically used to determine the verification strategy according to the environmental perception information.

17. The device according to claim 16, characterized in that The environmental perception information includes at least one of the following: remaining memory, CPU load, encoding model complexity, and information generated by a performed model check.

18. The device according to any one of claims 15 to 17, characterized in that The model checking module is further used in any one of the checks: Grouping the coding models to be detected according to the verification strategy to obtain multiple coding model groups; Verifying the coding models in the plurality of coding model groups respectively to obtain the model checking result; Among them, if the first coding model group includes a coding model that fails verification, the model check result is output, and the model check result is used to indicate that the first coding model group includes a coding model that fails verification, and the first coding model group is any group of the at least one coding model group.

19. The device according to claim 18, characterized in that The device also includes: The counterexample enhancement module is used to search the coding models in the first coding model group if the first coding model group includes a coding model that has not passed the verification, and determine the information of the coding model in the first coding model group that has not passed the verification.

20. The device according to claim 19, characterized in that The counterexample enhancement module is specifically used for: The coding models in the first coding model group are searched by using a heuristic search algorithm or a binary search algorithm to determine information of the coding models in the first coding model group that have not passed the verification.

21. The device according to any one of claims 18 to 20, characterized in that The model checking module is further used for: The multiple coding model groups are verified in parallel through multiple verification channels to obtain the model checking result, wherein the first verification channel verifies the second coding model group, and the second verification channel verifies the third coding model group, and the Tick corresponding to the coding model in the second coding model group is in an increasing relationship with the Tick of the coding model in the third coding model group. If the second verification channel completes the verification of the third coding model group and the third coding model group does not include a coding model that fails the verification, if the second verification channel does not complete the verification of the second coding model group, then the verification of the second coding model group is skipped in the second verification channel.

22. The device according to any one of claims 12 to 21, characterized in that The device includes a vehicle, and the encoding module is specifically used for: Acquire a plurality of behavior models, wherein the plurality of behavior models are used to implement the at least one function in the vehicle; The behavior model is encoded to obtain the model set, wherein the running order of the multiple encoded models in the model set is discretized in a Tick dimension, and the Tick dimension includes Tick sequences corresponding to the multiple behavior models when they are used to implement the at least one function.

23. A model checking device, characterized in that: The method comprises a processor, wherein the processor is coupled to a memory, wherein the memory stores a program, and when the program instructions stored in the memory are executed by the processor, the method according to any one of claims 1 to 11 is implemented.

24. A computer-readable storage medium comprising a program, which, when executed by a processing unit, performs the method according to any one of claims 1 to 11.

25. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

26. A vehicle, characterized in that: Comprising the apparatus of claim 23.

Images