Interrupt program verification method based on formalized language and probability model

Abstract

The invention discloses an interrupt program verification method based on a formalized language and a probability model. The method comprises the following steps: establishing a formalized language model grammar; establishing formalized language model semantics; instantiating the formalized language model by using a Maude programming language, and further establishing a verification system; performing formalized programming on the embedded system software to be verified; and inputting the embedded system software to be verified into the verification system and obtaining a verification result. Compared with the prior art, by establishing the formalized language model and combining the probability model, formalized derivation can be carried out on embedded system software operation, the whole process has the automation capacity, the method is suitable for all embedded system software, the operation analysis result is comprehensive and accurate, different operation result probabilities can be calculated, and the method is high in practicability. Therefore, the reliability of the embedded system software can be deduced and checked.

Description

Technical Field

[0001] The present invention relates to the field of formal language processing. Specifically, the present invention is based on a formal language model, uses Maude programming language to instantiate the model, provides a programmable system, and combines a probability model to verify the reliability of embedded system software. Background Art

[0002] Interrupts are a basic mechanism in modern computers, and they play an important role in the communication between the CPU and hardware. The interrupt mechanism allows the hardware to send a signal to the CPU to pass request information, and then the CPU will suspend the current program to process the request and call the corresponding interrupt handler to solve the problem. Compared with the polling mechanism, the interrupt mechanism is more efficient and is widely used in embedded systems. However, if the interrupt program contains code parts that change the variables of the main program, it will cause the main program to run incorrectly or unstable. In addition, the occurrence of interrupts is random, and it is difficult to predict when and where they will have an impact. These reasons make it difficult to evaluate and verify the reliability of embedded system software with interrupt programs.

[0003] In the prior art, the methods used to verify embedded system software with interrupt programs mainly involve building a physical experimental platform or a simulation verification environment to build a test environment and design corresponding test cases. There are also monitoring systems such as health monitoring to detect defects through long-term operation monitoring. These methods have the disadvantages that test cases are difficult to cover all scenarios, the test environment is costly and time-consuming to build, and it is difficult to find system vulnerabilities in the early stages of system design, making it difficult to fully and accurately verify embedded system software. Summary of the invention

[0004] The purpose of the present invention is to solve the reliability verification problem of the interrupt program operation of the embedded system, and to provide an interrupt program verification method based on a formal language and a probability model. The formal language model can be instantiated and modeled through the Maude language, and a programmable verification system is established, which can automatically calculate a specific formal model, so that it can be used to verify the reliability of the embedded operating system. The present invention can provide a reliable verification method for embedded system verification.

[0005] In order to achieve the above object, the present invention provides the following technical solution: an interrupt program verification method based on formal language and probability model, the method comprising the following steps:

[0006] Step 1: Establish a formal language model grammar;

[0007] Step 2: Establish the semantics of the formal language model;

[0008] Step 3: Use Maude programming language to instantiate the formal language model and then establish a verification system;

[0009] Step 4: Formalize the embedded system software to be verified;

[0010] Step 5: Input the embedded system software to be verified into the verification system and obtain the verification result.

[0011] Compared with the prior art, the present invention has the following beneficial effects:

[0012] The present invention can formally deduce the operation of embedded system software by establishing a formal language model and combining it with a probability model. The whole process has automation capability and is applicable to all embedded system software. The operation analysis results are comprehensive and accurate, and the probabilities of different operation results can be calculated, so that the reliability of embedded system software can be derived and verified. The present invention can provide reliability verification capability for embedded system software development and testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 Flowchart of the interrupt program verification method based on formal language and probabilistic model.

[0014] Figure 2 This is the Maude code architecture diagram. DETAILED DESCRIPTION

[0015] In order to better explain the present invention, the present invention will be further described below in conjunction with embodiments. It should be stated that the following content is only for better illustrating the present invention and is not intended to limit the protection scope of the claims of the present invention.

[0016] An interrupt program verification system based on formal language and probability model includes the following steps:

[0017] Step 1: Establish a formal language model grammar.

[0018] Step 1.1: Define the formal grammar of common programs.

[0019] Ordinary programs P and Q refer to all ordinary programs. Ordinary programs can be defined as follows:

[0020]

[0021] In this definition, “|” represents an or relationship, and all expressions linked by “|” can be the expression of a common program. skip represents the end state of the program (indicates the end of the program). x:=e is an assignment statement, where x is a variable, e is an expression, and “:=” is an assignment symbol, indicating that the expression on the right side of the symbol is assigned to the left side of the symbol. The expression e is composed of a series of variables and operation symbols. The symbol “;” represents a connection operation, indicating that “;” can be used to connect two different programs and execute them in sequence. is a logical choice, b is a Boolean expression. If b is true, the program on the left of the symbol will be executed, otherwise the program on the right will be executed. b* is a loop statement, which means that the program on the right of the symbol will be executed unless the Boolean expression b is false. Atomic() means that the program in the brackets is an atomic program, which cannot be interrupted.

[0022] Step 1.2: Define the formal syntax of the interrupt program.

[0023] Ordinary programs iP and iQ refer to all interrupt programs. The definitions of interrupt programs iP and iQ are as follows:

[0024]

[0025] Among them, "skip", "x:=e", ";", Symbols such as "b*" and "b*" are the same as those in ordinary program definitions. In addition, the probability model is integrated into the grammatical definition of the formal language through the knot, so that it has the ability to deduce the probability of the execution result of the program containing interrupts. It is a probability selection, which means that the program has a probability of r to select the program on the left side of the operator and a probability of 1-r to execute the program on the right side of the operator. Interrupt programs support interruption between them. It is an interrupt symbol, which means that the program on the left side of the operator is interrupted by the program on the right side of the operator. The symbol is an interrupt symbol, indicating that the current preemption point will not be interrupted, but it may be interrupted at the next preemption point. It describes that the right program will wait for the left program to run to the next preemption point and then interrupt the left program with a certain probability. The preemption point is defined as before and after each assignment statement, and a program can only be interrupted at the preemption point.

[0026] Step 1.3: Define the formal syntax part of the program configuration.

[0027] The configuration of the program is defined as<P,σ,tr> , the content inside the symbol “<>” is the specific configuration content of the program, which consists of three parts: the program itself, the variable status in the program, and the execution status of the program. Using common characters to define, program P refers to all kinds of program bodies, and the variable σ is the status of the program, which stores the variables inside the program and their corresponding values. tr represents the trajectory of program operation, that is, a series of state sequences of whether an interruption occurs at the preemption point.

[0028] Step 2: Establish formal language model semantics.

[0029] Step 2.1: Define the formal semantics of common programs.

[0030] <skip,σ,tr> term#(1

[0031]

[0032] The semantics of ordinary programs are pretty straightforward.

[0033] Rule 1 is the final state of a normal program, indicating a normal stop. All programs are in this state after they have completed their normal operation. Term means that the program has ended and will not continue to run.

[0034] Rule 2 states that a normal program containing only one assignment statement will terminate normally after completing the assignment statement. At the end of the assignment statement, the value of the variable and the previous state of the program will be stored in the program's state and trace, respectively. It means that the value of variable x has become the result of the operation of expression e, and the latest state of the variable is stored in the state σ of the program. tr·σ means that the program trace records whether an interruption occurs at the interruption point of the program. It means that the program configuration on the left can eventually lead to the program configuration on the right after one or more steps of calculation.

[0035] Rule 3 states that the atomic program will be completed as a normal ordinary program, and its running track will not record any state during the process, only the state at the last moment is stored. This rule consists of two parts, the part above the horizontal line is the execution condition of the part below the horizontal line.<P,σ,tr> After execution, it becomes<skip,σ',tr'> , σ' and tr' indicate that the state and trajectory of the program have changed after running, and σ' and tr' are used to represent the changed program state and trajectory.

[0036] Rule 4 shows the connection of two programs, which means that the two connected programs will be completed one by one in order. Rule 5 is another case of Rule 4. If the first program P is partially completed, the connection between P and Q can be changed to the connection between the remaining part of P and Q. P' represents the unexecuted part of the original program P after one or more steps of operation.

[0037] Rule 6 and Rule 7 are transition rules for if statements. if b(σ)=true means that Boolean expression b is true, and if b(σ)=false means that Boolean expression b is false. Rule 8 is a loop rule. If Boolean statement b is true, the program will become an if statement between a loop program and a stop state.

[0038] Step 2.2: Define the formal semantic part of the interrupt program. Here, since the interrupt program is relatively complex, the trajectory part of the program is omitted, and only the program body and the program status are retained.

[0039] <skip,σ> term#(1.1

[0040]

[0041] The semantics of an interrupt program is similar to that of a normal program, but there are unique interrupt rules. Rules 1.1-1.10 are the basic operations of an interrupt program. The difference from a normal program is that the program body becomes an interrupt program. In the design of the rules for the interrupt program, the probability of the occurrence or non-occurrence of the interrupt is clarified by incorporating a probability model, thus enabling the ability to deduce the probability of the final result of program execution. Symbols Indicates that the program configuration on the left is obtained by the operation without interruption. Symbol It means that the left program configuration is obtained by the operation of interruption, and the probability of the interruption is r. This operation can be done by Operator derivation can also be done through Operator deduction.

[0042] Rules 1.11-1.13 are the rules by which interruptions occur. The symbol indicates that the left program configuration has 1-p 0 The probability of performing uninterrupted operations is N, thus obtaining the program configuration on the right. p (P,σ) represents the number of preemption points contained in program P. If the program does not contain preemption points, then During the execution of P, program P cannot be interrupted by program Q. Rules 1.11 and 1.12 indicate that if program P contains a preemption point, then In the program P, there is p 0 The probability of being interrupted by Q at the current preemption point is 1-p0 The probability that the program Q will not be interrupted at the current preemption point and will run to the next interruption point for re-judgment. Rule 1.13 indicates that if program Q can be executed to completion, then there is p 0 The probability of interruption at the current preemption point is , and the current program P remains unchanged, only the state in the program configuration changes, and after the interruption, it will run to the next interruption point for re-judgment. The symbol indicates that the left program is configured with p 0 The probability of interruption is calculated to obtain the program configuration on the right.

[0043] Rule 1.14 indicates that when two sequentially executed programs P and Q are interrupted by another program R, they can be converted into a sequential execution of P interrupted by R and Q interrupted by R. Rule 1.15 indicates that after the program is finished running, it cannot proceed even if there are still interruptions, and can only be converted into the program end state. Rule 1.16 is that when a program consisting of a single assignment statement is interrupted by an interrupt symbol, it will run to the next preemption point to perform interrupt judgment. However, the next interrupt point of a single assignment statement has reached the end position of the program, which means that it cannot be interrupted, that is, when a program consisting of a single assignment statement is interrupted by an interrupt symbol, the interruption will not occur.

[0044] Rule 1.17 is the interruption rule for atomic programs, which indicates that the atomic program composed of the symbol "Atomic()" cannot be interrupted and can only run until the program ends. Rule 1.18 is similar to Rule 1.14, which indicates that the interruption of the if selection statement for programs P and Q can be converted into an if statement that interrupts programs P and Q respectively. Rule 1.19 indicates that when program b*P is interrupted by program Q, the part in the brackets to the left of the interrupt symbol can be expanded normally using Rule 1.8.

[0045] Step 3: Use the Maude programming language to instantiate the formal language model and then establish a verification system.

[0046] Maude is a high-performance language and system that supports equation and rewrite logic programming. In Maude, the basic unit of programming is called a module, which is divided into two types: functional module and system module. In the functional module, equations, identification data and member relationships can be defined. In the system module, rules can be defined to describe the transition between states. The code framework of the instantiation modeling of the method of the present invention through Maude is as follows Figure 2 shown. Figure 2 In the example, LIST, MAP, STRING, INT, BOOL, and FLOAT (grey modules) are the basic class modules that come with Maude, and the remaining modules (white modules) are the modules designed for the first time by the present invention. The upper-level modules will call the lower-level associated modules when used, and the module that the program finally runs is the PCONFIG module.

[0047] The EXPRESSION module is an expression function module, and the BOOL-EXPRESSION module is a Boolean expression function module. The two modules reference the INT, BOOL, and FLOAT modules that come with Maude. The INT module is an integer module, the BOOL module is a Boolean operator module, and the FLOAT module is a floating point module. The EXPRESSION module defines basic arithmetic equations such as "addition, subtraction, multiplication, and division".

[0048] The BOOL-EXPRESSION module is a basic module like the EXPRESSION module. It defines the logic operation rules, including logical operations such as "AND" and "OR", and judgment operations such as "greater than", "less than", and "equal to".

[0049] The SKIP module is a simple module that defines an empty program, which is the state after the normal operation of the program ends.

[0050] The ASSIGNMENT module is an assignment module that implements the assignment statement in the program, that is, "x:=e" in the program definition.

[0051] The ORDINARY-PROGRAM module instantiates the ordinary program body. It contains various operations of ordinary programs, such as loop "b*P", conditional selection Atomic program "atomic(P)" and connection "P;Q". This module is based on the EXPRESSION, BOOLEXPRESSION, SKIP and ASSIGNMENT modules to complete the definition and modeling of ordinary programs.

[0052] The INTERRUPT-PROGRAM module implements the instantiation of the interrupt program. Similar to the ORDINARY-PROGRAM module, in addition to defining the program's operation, this module also defines the interrupt With interrupt one Operation, thereby realizing the definition and modeling of interrupt programs.

[0053] The VAR module defines the variable class, that is, the variables that need to be stored in the program state. This module introduces Maude's built-in STRING module to assist in defining the variable name.

[0054] The STATE module defines a mapping from variable type to FLOAT type by introducing the MAP module predefined by Maude, thereby completing the instantiation of the program state.

[0055] The TRACE module completes the instantiation of the program trace. By introducing the built-in LIST module of Maude, a list of State type is established to complete the modeling of the program trace.

[0056] The CONFIG module instantiates the common program configuration based on the program body, program state, and program trace. In the CONFIG module, the semantic part of the common program (i.e., common program semantic rules 1-8) is instantiated and modeled, and the derivation of the formal common program configuration can be completed through the established common program semantics.

[0057] The PCONFIG module is based on the CONFIG module and completes the instantiation of the interrupt program configuration based on the ordinary program configuration. In the PCONFIG module, the semantic part of the interrupt program (i.e., the interrupt program semantic rules 1.1-1.19) is instantiated and modeled. The formal interrupt program configuration can be deduced through the established interrupt program semantics. In addition, an interrupt signal list is established in the PCONFIG module to indicate the order and number of interrupt signal transmissions, so that the interrupt mechanism of the interrupt program can be simulated more clearly.

[0058] By encapsulating the above modules, a verification system for verifying the interrupt program based on the formal language model defined in step 1 and step 2 can be obtained.

[0059] Step 4: Formalize the embedded system software to be verified to obtain the embedded system software;

[0060] Based on the formal language model established in steps 1 and 2, the source code of an embedded system software can be formally expressed, and further transformed according to the verification system defined in step 3 to obtain the embedded system software in a formal programming form suitable for the verification system.

[0061] Specifically, take a common program and its corresponding interrupt service in the embedded system AUTOSAR (AUTomotive Open System ARchitecture) system as an example. Define program P as a common program in the system that is executed sequentially by two assignment statements, where the interrupt signal list is L, and all interrupt services corresponding to the interrupt signal are given as Q. P, Q, and L are defined as follows:

[0062] P=x:=x+0;x:=x+1

[0063]

[0064] L = [1,2]

[0065] In the initial state of program P, the value of variable x is 0. The interrupt signal list L corresponding to P has two interrupt signals, 1 and 2. In addition, the probability of interrupt service occurring at each interruption point is defined as 0.2. Use the above assumptions to simulate program configuration During the operation process, according to the instantiation code definition in step 3 of the present invention, variables such as program P, Q and interrupt signal table L can be converted into the following form.

[0066] Program P: ((v(x): = 1); (v(y): = 2))

[0067] Interrupt service Q: ((v(x): = 4) <(v(flag) eq 1)> ((v(x): = 3) <(v(flag) eq 2)> stop))

[0068] Initial state of program P: sigma(empty)

[0069] Interrupt signal list: append(2,append(1,nil))

[0070] Probability of service interruption: <-0.2

[0071] In the converted form of program P, v(x) and v(y) are the expressions of variables x and y in the verification system; the symbols “:=” and “;” have the same meaning as in step 1.2; “()” is used to more clearly express the operation hierarchy so that the verification system can recognize and complete the derivation.

[0072] In the converted form of the interrupt service Q, v(flag) is the expression of the interrupt signal variable in the verification system; the symbol "<>" corresponds to step 1.2 Symbol, indicating logical selection; "eq" is the operation symbol for verifying whether the inequality is equal in the system. If the left and right sides are equal, it returns true, otherwise it returns false; "stop" is the situation where the program ends abnormally, indicating that the input interrupt signal has no corresponding interrupt service.

[0073] The initial state of program P, "sigma(empty)", is the expression of the symbol "σ" in step 2.1 in the verification system, where the "sigma()" symbol contains a dictionary in parentheses, which records the values ​​of all variables during the running of program P. "empty" means that the current dictionary is empty, that is, no variable values ​​are stored before program P is run.

[0074] The interrupt signal list "append(2,append(1,nil))" is a list format in the verification system. The list contains two values ​​1 and 2, and the two values ​​have a sequence, with 1 being before 2.

[0075] The probability of service interruption occurring is "<-0.2" which is the symbol in step 2.2. The expression in the verification system means that the interruption has a probability of 0.2.

[0076] Program P has two preemption points where interruption can occur, before and after the first assignment statement. The program ends after the second assignment statement, so it is not a preemption point. Since there are two interrupt signals in the interrupt signal table L, there are a total of six possibilities for program interruption execution.

[0077] Step 5: Input the embedded system software to be verified into the verification system and obtain the verification result.

[0078] The formally programmed embedded system software obtained in step 4 is input into the verification system. By verifying the various modules defined in the system, automatic deduction can be performed to simulate the possibility of interruption and the final execution of the program, and the corresponding verification results can be obtained.

[0079] Inputting the converted program P, interrupt signal list L and interrupt service Q into the verification system can obtain the following results:

[0080] Result 1 is no interruption. In this case, no interruption occurred and the final value of variable x is 1. The probability of this result is 1*0.8*0.8=0.64.

[0081] Result 2 is that there is no interruption at the first preemption point and there is an interruption at the second preemption point. In this case, only the first signal is completed and the interrupt service x:=x+2 is executed once. The final value of variable x is 3. The probability of this result is 1*0.2*0.8*0.8=0.128.

[0082] Result 3 means that the first preemption point has an interruption, and the second preemption point has no interruption. Similar to case 2, x:=x+2 will be executed once. The final value of variable x is 3. The probability of this result is 1*0.8*0.2*0.8=0.128.

[0083] Result 4 means that the first preemption point has two interrupts and the second preemption point has no interrupt. Both signals are executed, and the final value of variable x is 6. The probability of this result is 1*0.2*0.2*0.8*0.8=0.0256.

[0084] Result 5 means that there is no interruption at the first preemption point and two interruptions at the second preemption point. Both signals are executed and the final value of variable x is 6. The probability of this result is 1*0.8*0.2*0.2*0.8=0.0256.

[0085] The result 6 means that there is an interrupt at the first preemption point and an interrupt at the second preemption point. Both signals are executed, and the final value of variable x is 6. The probability of this result is 1*0.8*0.2*0.8*0.2=0.0256.

[0086] In the normal execution of program P, the value of variable x should be 1 after the execution ends. However, due to the intervention of the interrupt, five other running results appear. The method of the present invention deduces all the situations in which program P is interrupted by interrupt service Q, and generates the probability corresponding to each result. The results show that the present invention can derive the probability of the interrupt program ending normally, thereby completing the reliability verification of program P.

[0087] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An interrupt program verification method based on formal language and probability model, characterized in that: The method comprises the following steps: Step 1: Establish a formal language model grammar; Step 2: Establish the semantics of the formal language model; Step 3: Use Maude programming language to instantiate the formal language model and then establish a verification system; Step 4: Formalize the embedded system software to be verified to obtain the embedded system software; Step 5: Input the embedded system software to be verified into the verification system and obtain the verification result.

2. The interrupt program verification method according to claim 1, characterized in that: The specific steps of step 1 are: Step 1.1: Define the formal grammar of common programs; Step 1.2: Define the formal syntax of the interrupt program; Step 1.3: Define the formal syntax part of the program configuration.

3. The interrupt program verification method according to claim 2, characterized in that: In step 1.1, the formal syntax of the general program is defined as follows: In the formula, P and Q refer to common programs, "|" indicates an OR relationship, and all the formulas linked by "|" are expressions of common programs; skip indicates the end state of the program; x:=e is an assignment statement, where x is a variable and e is an expression, ":=" is an assignment symbol, indicating that the expression on the right side of the symbol is assigned to the left side of the symbol; the symbol ";" represents a connection operation, indicating that ";" can be used to connect two different programs and execute them in sequence; is a logical choice, b is a Boolean expression. If b is true, the program on the left of the symbol will be executed, otherwise the program on the right will be executed; b* is a loop statement, which means that the program on the right of the symbol will be executed unless the Boolean expression b is false; Atomic() means that the program in the brackets is an atomic program, which cannot be interrupted.

4. The interrupt program verification method according to claim 3, characterized in that: In step 1.2, the formal syntax of the interrupt program is defined as follows: In the formula, iP and iQ refer to the interrupt program. It is a probabilistic selection, which means that the program has a probability of r to select the program on the left side of the operator, and a probability of 1-r to execute the program on the right side of the operator; the interrupt program supports interruption between them; is an interrupt symbol, which means that the program on the left side of the operator is interrupted by the program on the right side of the operator; The symbol is an interrupt symbol, indicating that no interruption occurs at the current preemption point, but an interruption occurs at the next preemption point. This describes that the right program will wait for the left program to run to the next preemption point and then interrupt the left program according to the probability. Preemption points are defined before and after each assignment statement, and a program can only be interrupted at a preemption point.

5. The interrupt program verification method according to claim 4, characterized in that: In step 1.3, the program configuration is defined as: <S,σ,tr> ; The content within the symbol "<>" is the specific configuration content of the program, which consists of three parts: the program itself, the state of the variables in the program, and the execution status of the program; it is defined using common characters, S refers to all kinds of program entities, the variable σ is the state of the program, which stores the variables inside the program and their corresponding values, and tr represents the trajectory of the program operation, that is, a series of state sequences of whether an interruption occurs at the preemption point.

6. The interrupt program verification method according to claim 5, characterized in that: The specific steps of step 2 are: Step 2.1: Define the formal semantics of common programs; Step 2.2: Define the formal semantics of the interrupt procedure.

7. The interrupt program verification method according to claim 6, characterized in that: In step 2.1, the formal semantics of the general program is defined as follows: <skip,σ,tr> term#(1) Rule 1 is the final state of a normal program, indicating a normal stop. All programs that have completed their normal operation will be in this state; term means that the program has ended and will not continue to run; Rule 2 states that a normal program containing only one assignment statement will terminate normally after completing the assignment statement; at the end of the assignment statement, the value of the variable and the previous state of the program will be stored in the program's state and trace respectively; Indicates that the value of variable x has become the result of the operation of expression e, and the latest state of the variable is stored in the state σ of the program; tr·σ indicates that the program trajectory records whether an interruption occurs at the interruption point of the program; It means that the program configuration on the left is finally derived from the program configuration on the right after one or more steps of operation; Rule 3 states that the atomic program will be completed as a normal ordinary program, and its running track will not record any state during the process, only the state at the last moment is stored; this rule consists of two parts, the part below the horizontal line is the execution condition of the part below the horizontal line; the part below the horizontal line represents<P,σ,tr> After execution, it becomes<skip,σ′,tr′> ,σ′ and tr′ indicate that the state and trajectory of the program have changed after running, and σ′ and tr′ are used to represent the changed state and trajectory of the program; Rule 4 shows the connection between two programs, which means that the two programs connected together will be completed one by one in sequence; Rule 5 is another case of Rule 4. If the first program P is partially completed, the connection between P and Q is changed to the connection between the remaining part of P and Q, where P′ represents the unexecuted part of the original program P after one or more steps of operation; Rules 6 and 7 are transition rules for if statements. If b(σ)=true means that the Boolean expression b is true. if b(σ)=false means that the Boolean expression b is false; Rule 8 is the rule for looping. If Boolean statement b is true, the program will become an if statement between the looping program and the stop state.

8. The interrupt program verification method according to claim 7, characterized in that: In step 2.1, the formal semantics of the interrupt program is defined as follows: <skip,σ> term#(1.1) The interrupt program omits the trace part of the program and only retains the program body and the program status; Rules 1.1-1.10 are the basic operations of the interrupt program, and the program body is the interrupt program; symbol Indicates that the program configuration on the left is obtained by the operation without interruption; the symbol Indicates that the left program configuration is obtained by the operation in which the interrupt occurs; the symbol This indicates that the operation has been Operator deduction, also via Operator derivation; Rules 1.11-1.13 are the rules for when interruptions occur; The symbol indicates that the left program configuration has a probability of 1-p0 to perform uninterrupted operations to obtain the right program configuration; N p (P, σ) represents the number of preemption points contained in program P. If the program does not contain preemption points, then During the execution of P, program P cannot be interrupted by program Q; Rules 1.11 and 1.12 indicate that if program P contains a preemption point, then In the example, program P has a probability of p0 to be interrupted by Q at the current preemption point, and a probability of 1-p0 not to be interrupted at the current preemption point and to run to the next interruption point for re-judgment; Rule 1.13 indicates that if program Q is executed, there is a probability of p0 to be interrupted at the current preemption point, and the current program P remains unchanged, only the state in the program configuration changes, and after the interruption, it will run to the next interruption point for re-judgment; The symbol indicates that the left program configuration has the probability of p0 to perform the interrupt operation to obtain the right program configuration; Rule 1.14 indicates that when two sequentially executed programs P and Q are interrupted by another program R, they are converted into sequential execution of P being interrupted by R and Q being interrupted by R; Rule 1.15 indicates that when a program is finished running, it cannot proceed even if there are still interruptions, and can only be converted into the program end state; Rule 1.16 indicates that when a program consisting of a single assignment statement is interrupted by an interrupt symbol, it will run to the next preemption point to make an interrupt judgment; but the next interrupt point of a single assignment statement has reached the end position of the program, indicating that it cannot be interrupted, that is, when a program consisting of a single assignment statement is interrupted by an interrupt symbol, the interruption will not occur; Rule 1.17 is the interruption rule for atomic programs, which indicates that an atomic program consisting of the symbol "Atomic()" cannot be interrupted and can only run until the program ends; Rule 1.18 states that the interruption of the if selection statement for procedures P and Q is transformed into an if statement that interrupts procedures P and Q separately; Rule 1.19 states that when program b*P is interrupted by program Q, the part in parentheses to the left of the interrupt symbol is expanded normally using Rule 1.

8.

9. The interrupt program verification method according to claim 1, characterized in that: In step 3, each module is encapsulated, and the formal language model is used to verify the verification system of the interrupt program; The modules of the verification system include: The EXPRESSION module defines basic arithmetic equations; BOOL-EXPRESSION module defines the operation rules of logic class; The SKIP module defines an empty program; The ASSIGNMENT module implements the assignment statements in the program; The ORDINARY-PROGRAM module completes the instantiation of the ordinary program body; The INTERRUPT-PROGRAM module implements the instantiation of the interrupt program; The VAR module defines the variable class, that is, the variables that need to be stored in the program state; this module introduces Maude's built-in STRING module to assist in defining the variable name; The STATE module defines a mapping from variable type to FLOAT type by introducing the MAP module predefined by Maude, thus completing the instantiation of the program state; The TRACE module instantiates the program trace. By introducing the built-in LIST module of Maude, a list of State type is established to complete the modeling of the program trace. The CONFIG module instantiates common program configuration based on the program body, program status, and program trajectory. The PCONFIG module is based on the CONFIG module and completes the instantiation of the interrupt program configuration based on the ordinary program configuration.

10. The interrupt program verification method according to claim 9, characterized in that: The EXPRESSION module and BOOL-EXPRESSION module refer to Maude's own INT, BOOL and FLOAT modules; among them, the INT module is an integer module, the BOOL module is a Boolean operator module, and the FLOAT module is a floating-point module.

Images