A formal modeling method and device, electronic equipment and storage medium

Abstract

The application discloses a formal modeling method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining scene architecture data, wherein the scene architecture data is used for describing physical entities in a scene and information interaction relationship between the entities; completing a formal modeling process according to the scene architecture data, and finally obtaining a verifiable formal model describing the scene and the architecture. The embodiment of the application can improve the reachability of the property in the state space determined by the model checking technology, and improve the precision and accuracy of the system state space and the execution trace, and can be widely applied to the computer technology field.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a formal modeling method, apparatus, electronic device, and storage medium. Background Technology

[0002] System modeling is a technical method that uses tabular, graphical, and formulaic approaches to present the system's components and the relationships between them; it is essentially a process of abstracting the system. System abstraction can be performed at multiple levels, meaning modeling can be done from multiple dimensions. During the modeling process, the system gradually becomes unambiguous.

[0003] Formal methods are analytical techniques based on mathematical foundations and rigorous mathematical proofs, commonly used in the description, development, and verification of software and hardware systems. Formal modeling applies formal methods to the modeling process. It is based on unambiguous formal specification languages, using precisely defined formal languages ​​to describe system functions. It utilizes mathematical abstractions of known characteristics to construct models of the state and behavioral features of the target software system, thus completing the formal modeling process. Formal models should lie between programming languages ​​and high-level requirements, possessing precision and unambiguity, but without presenting excessive detail.

[0004] Some classic formal languages, such as Z, B, Event-B, and VDM, have their own formal semantics. Formal models obtained by using formal languages ​​and following modeling specifications can accurately describe the system, facilitating subsequent formal analysis and verification.

[0005] However, the formal modeling methods mentioned in the current technologies have the following problems: 1. The reachability of properties in the state space is poor when using model checking techniques, making it impossible to verify the ATS architecture; 2. The system state space and execution trace cannot be accurately obtained, which is not conducive to the application of subsequent model checking techniques. Summary of the Invention

[0006] The main objective of this invention is to propose a formal modeling method, apparatus, electronic device, and storage medium that can improve the determination of the reachability of properties in the state space through model checking techniques, and improve the accuracy and precision of obtaining the system state space and execution traces.

[0007] To achieve the above objectives, one aspect of this invention proposes a formal modeling method, comprising the following steps: Acquire scene architecture data, which is used to describe the physical entities in the scene and the information interaction relationships between the entities; The formal modeling process is completed based on the scenario architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network that can be supported by UPPAAL using a model conversion algorithm. The final result is a verifiable formal model describing the scenario and architecture.

[0008] In some embodiments, in the step of completing the formal modeling process based on the scenario architecture data, the autonomous traffic architecture modeling language ML4TSA is used as the formal modeling language. The requirements of the autonomous traffic architecture modeling language include: explicitly expressing the system state, incorporating architecture and scenario characteristics, and providing formal semantic support. Among them, ML4TSA is an extension based on UML state diagrams to express the system state space and describe the system operation process through variable evolution and state transitions; To address the characteristics of ATS architecture and traffic scenarios, modeling elements are added to enrich the language's descriptive capabilities. By defining the language's formal syntax and semantics, subsequent formal verification research is supported. ML4TSA uses states and transitions to describe objects. ML4TSA extends the ability to describe states through state constraints and evolution rules. Constraint is used to specify the range of values ​​of state-related variables. It formally describes the set of expressions that the variables must maintain in the state and defines the boundaries of the state. Evolution describes the time-related rules of variable changes within the state constraints, reflecting ML4TSA's adaptability to continuous system processes. Meanwhile, ML4TSA extends the state diagram through guard conditions, action actions, and signal triggering signals. The transition is triggered by the signal event represented by the signal and is restricted by the guard conditions specified by the guard. The reassignment of discrete variables and the generation of signals are specified by the action corresponding to the transition. To reflect the cyber-physical fusion characteristics in the ATS model, ML4TSA defines the port and execution function of an object, and represents the information processing process of the object through the change of interface information values.

[0009] In some embodiments, the ML4TSA model describes the state change process within several components and the synchronous interaction process between components, wherein, for an ML4TSA object, the following applies:

[0010] in, Let be a set of state names, where The name of the information interaction status. This refers to the physical motion state name. For any component, its state can be represented as: Based on its participation in the information space and physical space, it is determined whether to use a composite state for description; at the same time, state s is constrained by invariant constraints. c Evolutionary rules Common description; A set of variables used to describe a state, including a set of discrete variables. Continuous variables Clock variables probability variables Signal variables Five categories; A set of transitions for connection states, consisting of triples, is denoted as: That is, a source state is transformed into a target state through a transition, where For the source state, For the target state, The migration tag is described by three attributes: This is a trigger signal used to indicate the start time of the migration; These are the conditions for defense, used to determine whether migration can occur; For migration actions, it indicates the discrete state changes that occur inside the component after the migration occurs; This is the initial state set, which specifies the initial state of the component and also determines the initial distribution of variables within the component; For the set of ports of the component, where and These are the input and output ports, used to store the information streams received and generated by the component; These are the information processing functions for a component, used to describe the functionality performed by the component. It is a set of evolutionary rules; This is the set of state constraints.

[0011] In some embodiments, the ML4TSA model organizes type variables through expressions to construct modeling elements, thereby formally describing the system state and state transition process. Boolean expressions are used to describe guard conditions, trigger signals, state constraints, and interface values; action expressions are used to describe transition actions and evolution rules; clock expressions are used to define time-related constraints; differential expressions are used to describe the response of continuous variables to time; and function expressions are encapsulations of multiple sets of predicates to represent complex expression logic relationships. make For clock variables, , These are discrete variables and continuous variables, respectively. For probability variables, For signal variables, the semantic definitions of Boolean expressions, action expressions, and time expressions are as follows: Boolean expressions: ,in, This is a Boolean value; when a signal is generated in the system, the corresponding variable value is... At this point, the expression is satisfied; and For algebraic inequalities or equations involving discrete variables and clock variables, the expression is true when each value of the variable makes the expression true. and Values For discrete variables that satisfy an algebraic expression, the values ​​can be... , is represented as: ; For differential inequalities or differential equations relating to continuous variables, describe a time-dependent continuous variable. Within a specific time range If it exists inside Differential equation The solution is considered to be... To make the expression true, the process can be represented as: ; It is a function expression; Action expression:

[0012] in, To generate a signal, it will modify the boolean value of the signal variable. To enable communication between multiple objects or process synchronization; and These are algebraic equations for discrete variables and clock variables, respectively, both representing the reassignment of values ​​to variables. In the modeling process... Its function is to reset the local clock to zero; and The definition is consistent with the definition in Boolean expressions; Clock expression: ,in, and These are algebraic inequalities and clock assignment operations, respectively. The former checks whether time-related inequalities are true and returns a boolean value; the latter modifies the clock value or definition and is a branch of the action expression. To ensure real-time synchronization between different objects, ML4TSA uses a global clock. To achieve synchronization of multiple clock types across multiple objects, ML4TSA employs a mapped time accumulation mechanism to record the impact of clock reset operations on the timeline, ensuring accurate mapping with the global clock. The resulting changes.

[0013] In some embodiments, the method further includes: representing the semantics of the system as state transition rules through the operational semantics of the Label Transition System (LTS) definition language, and describing the dynamic process of the system through state transitions. The definitions of state, transition validity, and failure are given below: Valid State: In ML4TSA, a model instance typically consists of multiple components and their interactions; a component state is defined as a four-tuple. ,in The state name represents the discrete state in which the component is located; Showing the status Related function values; This represents a clock variable, which is displayed as a special variable due to the real-time nature of the system. This provides real-time information flow data for each port of the component; based on the definition of component state, LTS describes the reasonable state of the component; a component state A state is considered reasonable if and only if it satisfies the following conditions: 1) The variable values, clock value, and port value satisfy the constraint expression of the state: iff 2) When the state is the initial state, the variable values, clock value, and port value satisfy the initial conditions: ; Effective transitions: LTS describes the dynamic process of a system as state changes, including state transitions and variable evolution. A single state change process is represented as... Its validity requires the following conditions to be met: 1) Both the state before and after the change are valid states: 2) If the state names are different before and after the change, then there is a corresponding transition between the states, and the transition conditions are met: 3) If the state names are the same before and after the change, then the variables within the state have corresponding evolution rules: ; System failure: A state change process occurs if and only if the following conditions are met. Invalid: 1) Changes to the original state become invalid: 2) The previous state is about to become invalid, but the transition conditions are not met: ,in It represents a positive number that approaches 0.

[0014] In some embodiments, the state change process of the system includes two categories: state transition and variable evolution. These two types of processes are respectively determined by state constraints. Evolutionary rules Defense conditions Trigger signal and migration actions Five types of factors determine the state of a component; among them, the state of a component is determined by the factors that determine the state of a component. If there is no transfer in the model Then its state change process is only affected by The following defines two state transition rules and three variable evolution rules to describe the operational semantics of ML4TSA: (1) State transition caused by trigger signal:

[0015] Rule 1.1 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the state change are valid states, and the constraints are as follows. It can be satisfied, and the signal When triggered, the component changes state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned The entire state change process is represented as This represents a discrete change in the state of a component; in Rule 1.1 For probability variables, it represents the random switching that may occur during the state change process, and the final component changes from state to state. Switch to status ; (2) State transitions caused by state constraint violations:

[0016] Rule 1.2 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. At the same time, there exists a time interval that is greater than 0 and approaches 0. This makes the component in It will enter an invalid state after a certain time. If the state is changed at this time... For valid states and constraints Can be satisfied, and signal When triggered, the component exits its state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned ; and The meaning is consistent with Rule 1.1, and the final component starts from the state. Switch to status ; (3) Variable evolution without trigger signal:

[0017] Rule 2.1 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the change are valid states, but the constraints are now in effect. The condition cannot be satisfied, therefore the component cannot escape from the state. After migration Transform into state If the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to status ; The process by which the evolutionary rules work is described as follows: The evolutionary rules consist of a set of differential expressions, that is, a set of time-dependent, continuously differentiable functions. Its first derivative is expressed as For a period of time ,have , At the same time , ,for They all And it satisfies the valid state constraints; (4) Variable evolution due to failure to meet the transition conditions:

[0018] Rule 2.2 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the change are valid states, but at this time the signal It cannot be triggered, therefore the component cannot be triggered from the state. After migration Transform into state If the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to status ; (5) Variable evolution without transfer:

[0019] Rule 2.3 indicates that the component is in state. There is no change. This enables components to transition to a state. But the state If the memory follows an evolutionary rule, and both the state before and after the change are valid states, then... It will evolve over time, and eventually the component will change from a state. Switch to status ; The above five state change rules define the operational semantics of ML4TSA to ensure the normal operation of the model. Simultaneously, ML4TSA provides two methods for modeling the cyber-physical fusion process between the ATS architecture and the scene: (1) Modeling elements containing port values: In specific ATS architectures and scenario models, port values ​​are included. The expressions formed participate in the construction of elements such as state constraints, trigger signals, guard conditions, and migration actions, and are used to represent the interaction between architectural information and the physical world; (2) Strict information-physical clock mapping: In the ML4TSA modeling process, the information processing process and the physical motion process describe the system operation process on the information side and the physical side, respectively. In this process, the information process and the physical process adopt strict clock mapping to ensure that the interaction between the two is smooth.

[0020] In some embodiments, the method further includes: Based on the ML4TSA modeling language, a graphical modeling platform is built, and the conversion between ML4TSA models and stochastic hybrid automata networks is realized to obtain the support of the UPPAAL verification engine. The graphical modeling platform includes a main modeling interface, a tool panel for modeling elements, and a detailed attribute editing interface. In the main interface, elements such as states, transitions, and ports defined by ML4TSA are represented as graphics, and the relationships between elements are represented by line segments. The tool panel provides functions for creating, deleting, and modifying modeling elements. The attribute editing interface supports editing the names and expressions of modeling elements. During the model conversion process, based on the meta-model analysis of ML4TSA and NSHA stochastic hybrid automata network, mapping rules including global variables, states, transitions, and ports are designed. In ML4TSA, ports and execution functions exist as variables in NSHA. By maintaining a global matrix variable, the port values ​​of each physical object are stored.

[0021] Another aspect of the present invention provides a formal modeling apparatus, comprising: The first module is used to acquire scene architecture data, which describes the physical entities in the scene and the information interaction relationships between the entities. The second module is used to complete the formal modeling process based on the scene architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network that can be supported by UPPAAL using a model conversion algorithm. The third module is used to finally obtain a verifiable formal model describing the scenario and architecture.

[0022] To achieve the above objectives, another aspect of the present invention provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0023] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0024] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0025] The embodiments of the present invention include at least the following beneficial effects: The present invention provides a formal modeling method, apparatus, electronic device, and storage medium. This scheme acquires scene architecture data, which describes the physical entities in the scene and the information interaction relationships between entities; completes the formal modeling process based on the scene architecture data, and finally obtains a verifiable formal model describing the scene and architecture. The embodiments of the present invention can improve the determination of the reachability of properties in the state space through model checking techniques, and improve the accuracy and precision of acquiring the system state space and execution traces. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention; Figure 2 This is a flowchart of the overall steps provided in the embodiments of the present invention; Figure 3This is a schematic diagram illustrating the relationship between modeling elements and expressions in ML4TSA provided in this embodiment of the invention; Figure 4 This is a schematic diagram of a cyber-physical fusion modeling case provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the ML4TSA meta-model provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the graphical modeling environment of ML4TSA provided in an embodiment of the present invention; Figure 7 This is a graphical representation of the modeling elements and tools provided in the embodiments of the present invention; Figure 8 This is a schematic diagram of a time automaton network within the UPPAAL interface provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0028] It is understood that the terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data used can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] It should be understood that in this invention, "at least one (item)" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0031] Before providing a detailed description of the embodiments of the present invention, the meanings of the relevant variables involved in the embodiments of the present invention are first explained as follows: : A set of state names, where The name of the information interaction status. The name of a physical state of motion; : A set of variables; A set of transitions for a connected state; : Trigger signal, used to indicate the start time of migration; : Guarding conditions, used to determine whether migration can occur; The migration action indicates the discrete state changes that occur within the component after the migration occurs. : Initial state set; The set of ports for a component; : Information processing functions for components; The set of evolutionary rules, consisting of the evolutionary rules mentioned above. constitute; The set of state constraints consists of the invariant constraints mentioned above. constitute; , : Algebraic inequalities or algebraic equations relating discrete variables and clock variables, where For discrete variables, For clock variables; : Differential inequalities or differential equations for continuous variables, where For continuous variables; Functional expressions are encapsulations of the algebraic and differential expressions mentioned above; : Signal generation operation, where This is a signal variable, which is a Boolean value. Local clock reset operation; The current reading of the clock; : The function that defines the clock; A dense time sequence; Dense time sequences constructed based on a global clock; Clock mapping function; Network of Stochastic Hybrid Automata (NSHA).

[0032] The formal modeling method, apparatus, electronic device, and storage medium provided in this invention relate to the field of computer technology. The formal modeling method provided in this invention can be applied to terminals, servers, or software running on either a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the formal modeling method, but is not limited to the above forms.

[0033] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0034] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0035] Server 101 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0036] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0037] Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc. It can also be a vehicle-mounted terminal of the various device types described above, but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0038] Exemplary based on Figure 1The implementation environment shown in this embodiment of the invention provides a formal modeling method. The following description uses the application of this formal modeling method in server 101 as an example. It can be understood that this method can also be applied to terminal 102.

[0039] Reference Figure 2 , Figure 2 The flowchart illustrates a formal modeling method for servers provided in this embodiment of the invention. The execution subject of this method can be any of the aforementioned computer devices (including servers or terminals). (Refer to...) Figure 2 The method may include the following steps: Acquire scene architecture data, which is used to describe the physical entities in the scene and the information interaction relationships between the entities; The formal modeling process is completed based on the scenario architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network that can be supported by UPPAAL using a model conversion algorithm. The final result is a verifiable formal model describing the scenario and architecture.

[0040] The following is a detailed description of the implementation process of the present invention in a specific application scenario: To address the problems existing in the prior art, the overall modeling process provided in this embodiment of the invention includes: 1. Data Input: Scene architecture data is used to describe the physical entities in the scene and the information interaction relationships between them.

[0041] 2. Modeling process: (1) Identify the modeling subject. Identify the modeling objects based on the scene architecture and analyze the physical interaction mechanism between the objects.

[0042] (2) Define parameters. For each modeling object, define parameter variables that can describe its state and state transition process. ML4TSA supports discrete variables, continuous variables, clock variables, probability variables, signal variables, etc. A suitable data structure can be defined for each modeling object to organize variables.

[0043] (3) Construct ports and execute functions. Based on the information interaction relationship described in the scene architecture, determine the input and output information flow of each object to construct the ports of each modeling object; determine the execution function based on the triggering relationship of the information flow.

[0044] (3) Determining State and Transition. Based on the cyber-physical interaction mechanism of objects, the state and state transition process of objects are determined. Variables are used to describe the state, and relevant invariants and variable evolution rules are defined. State boundaries are determined by setting variable constraints. Considering the state transition process during information transmission and physical movement, the process is described by transition, and trigger signals, guard conditions, and transition actions are set for each transition. In this process, port values ​​are applied to guard conditions and transition actions to achieve cyber-physical fusion modeling.

[0045] (4) Model Conversion. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network that can be supported by UPPAAL using a model conversion algorithm.

[0046] 3. Output data results: Verifiable formal models describing the scenario and architecture.

[0047] Specifically, to formally describe the architecture and operational processes of autonomous transportation systems (ATS), this invention proposes a domain-specific formal modeling language: the Autonomous Transportation Architecture Modeling Language (ML4TSA), which can be used to characterize information flow within the architecture and physical motion processes within the scene. The requirements for the modeling language to verify the properties of the ATS architecture are summarized as follows: (1) Explicitly express the system state. The ATS domain-specific modeling language needs to be able to explicitly describe the system state and its change process so that the reachability of properties in the state space can be determined through model checking techniques, thereby verifying the ATS architecture; (2) Integrating architecture and scenario characteristics. The specific modeling language in the ATS domain must be able to reflect the architecture and scenario characteristics of ATS, including: ① characterizing random events, that is, requiring the model to be able to simulate probabilistic events in the traffic system and information transmission process; ② describing hybrid phenomena, that is, requiring the model to be able to represent discrete events and continuous changes in the system; ③ real-time response, that is, requiring the model to be able to characterize the system state path of the system evolution over time; ④ abstract representation of the system, that is, requiring the model to model at the architecture level, reducing the focus on specific control algorithms to reduce the complexity of the model; ⑤ integrating cyber-physical processes, that is, requiring the model to describe the interaction process between information interaction within the system architecture and physical motion within the scenario.

[0048] (3) Provide formal semantic support. The specific modeling language in the ATS domain needs to describe its operational semantics through formal language so as to obtain accurate system state space and execution trace, which facilitates the application of subsequent model checking techniques.

[0049] Based on the above requirements, ML4TSA extends UML state diagrams to visually represent the system state space and describes the system's operation through variable evolution and state transitions. Simultaneously, considering the characteristics of ATS architecture and traffic scenarios, modeling elements are added to enrich the language's descriptive capabilities. Furthermore, the formal syntax and semantics of the language are defined to support subsequent formal verification research. Similar to UML state diagrams, ML4TSA uses states and transitions to describe objects. Building upon this, ML4TSA extends the descriptive capabilities of states through constraint and evolution rules. Constraint specifies the range of values ​​for state-related variables, formally describing the set of expressions that variables must maintain in that state, thus defining the state boundary. Evolution describes the time-related rules of variable changes within the state constraints, demonstrating ML4TSA's adaptability to continuous system processes. ML4TSA also extends transitions in state diagrams through guard, action, and signal. Transitions can be triggered by signal events represented by signals and are constrained by the guard conditions specified by the guard. The reassignment of discrete variables and the generation of signals are specified by the corresponding action of the transition. To reflect the cyber-physical fusion characteristics of the ATS model, ML4TSA defines object ports and execution functions, representing the object's information processing process through changes in interface information values. The following sections will discuss the syntax, semantics, rationality, tool development, and model transformation algorithms of the modeling language.

[0050] (a) Syntax declaration: The ML4TSA model describes the state change process within several components and the synchronous interaction process between components. For an ML4TSA object, we have:

[0051] 1) Let be a set of state names, where The name of the information interaction status. This refers to the physical motion state name. For any component, its state can be represented as: Based on its participation in both the information and physical spaces, it is determined whether to use a composite state description. Simultaneously, state s is constrained by invariant rules. c Evolutionary rules Joint description.

[0052] 2) A set of variables used to describe a state, including a set of discrete variables. Continuous variables Clock variables probability variables Signal variables Five categories, organized through expressions, can represent constraints. c Evolutionary rules Modeling elements, etc.

[0053] 3) A set of transitions for connection states, consisting of triples, is denoted as: That is, a source state is transformed into a target state through a transition, where For the source state, For the target state, The migration tag is described by three attributes. As a trigger signal, it is used to indicate the start time of migration. The ML4TSA model uses it to realize communication and state synchronization between different objects, such as the information flow transmission signal received during vehicle movement. As a safeguard condition, it is used to determine whether migration can occur. Essentially, it is a constraint on migration, such as the minimum safe distance constraint between workshops during the operation of an autonomous vehicle. The transition action indicates the discrete state changes that occur within the component after the transition, including the reassignment of discrete variables and the generation of signals. A transition does not always require three attributes to describe it; that is, a transition can be described by any combination of attributes.

[0054] 4) This is the initial state set, which specifies the initial state of the component and also determines the initial distribution of variables within the component.

[0055] 5) For the set of ports of the component, where and These are input and output ports, used to store the information streams received and generated by the component. Each port corresponds to one information stream, and has... ,when At that time, the component does not have a port. The corresponding information flow. Typically, a component's port set consists of an input port set. With output port set The model, through changes in port values, can describe the information interaction process of components.

[0056] 6) This is the information processing function of the component, used to describe the functionality performed by the component (the process of generating the information flow is regarded as an instantiation of the functionality). It is an abstract mapping function, where The execution time for generating the information flow. During the modeling process, the information processing function is typically determined based on the knowledge graph obtained earlier.

[0057] 7) The set of evolutionary rules, consisting of the evolutionary rules mentioned above. The evolution rules are represented as a set of differential expressions, describing the internal mechanism of a component's state, i.e., how continuous / clock variables change with time in that state. When a component's transition cannot be triggered, the component's state change process is primarily specified by the evolution rules. 8) For the set of state constraints, defined by the invariant constraints mentioned above... Composition. Invariants are represented as a set of Boolean expressions used to describe the range of values ​​for variables within a component's state; they define the component's state boundaries. All variables within a state must satisfy the constraints; otherwise, the component will detach from that state. Typically, this requires... .

[0058] Similar to other UML extension languages, ML4TSA uses typed variables for modeling to support the description of stochastic, hybrid, and real-time systems. These variables include probabilistic variables, discrete variables, continuous variables, signal variables, and clock variables. Based on these variable types, a set of expressions can be used to construct... , In ML4TSA, each expression can be considered a predicate of a specific type of variable. ML4TSA allows five types of expressions: Boolean expressions, clock expressions, differential expressions, action expressions, and function expressions.

[0059] Figure 3 This demonstrates the relationship between type variables, modeling elements, and expressions. ML4TSA organizes type variables and constructs modeling elements through expressions, thereby formally describing system states and state transition processes. Boolean expressions are used to describe guard conditions, trigger signals, state constraints, and interface values; action expressions describe transition actions and evolution rules; clock expressions define time-related constraints; differential expressions describe the response of continuous variables to time; and function expressions encapsulate multiple sets of predicates, representing more complex logical relationships. Furthermore, expressions also have hierarchical relationships; for example, a set of time or differential expressions can constitute a Boolean expression, and action expressions can include both differential and function expressions.

[0060] make For clock variables, , These are discrete variables and continuous variables, respectively. For probability variables, For signal variables, the semantic definitions of Boolean expressions, action expressions, and time expressions are as follows.

[0061] Definition 1: Boolean expression:

[0062] in This is a Boolean value; when a signal is generated in the system, the corresponding variable value is... At this point, the expression is satisfied; and For algebraic inequalities or equations involving discrete variables and clock variables, the expression is true when each value of the variable makes the expression true. and Values For discrete variables that satisfy an algebraic expression, the values ​​can be... , can be represented as: Clock variable value The definition is similar.

[0063] For differential inequalities or differential equations relating to continuous variables, describe a time-dependent continuous variable. Within a specific time frame If it exists inside Differential equation The solution is considered to be... This makes the expression true. The process can be represented as: .

[0064] This is a function expression, a wrapper around the algebraic and differential expressions mentioned above. It returns a Boolean value, supporting more complex variable judgments in the model. In addition, ML4TSA supports... The operators defined by first-order predicate logic are shown below.

[0065] .

[0066] Definition 2: Action Expression:

[0067] in To generate a signal, it will modify the boolean value of the signal variable. This is to enable communication between multiple objects or process synchronization.

[0068] and These are algebraic equations for discrete variables and clock variables, respectively, both representing the reassignment of values ​​to variables. In the modeling process... Its function is to reset the local clock to zero.

[0069] and The definition is consistent with that in Boolean expressions. In addition, some action expressions are described by probability variables to represent random events in the model.

[0070] Definition 3: Clock Expression:

[0071] in and These are algebraic inequalities and clock assignment operations, respectively. The former determines whether a time-related inequality is true and returns a Boolean value; the latter modifies the clock value or definition and is a branch of the action expression.

[0072] Clock variables are a special type of variable used to describe time-dependent events. They are specified in two parts: c .in This represents the current reading of the clock, its set of readings. This constitutes a dense time sequence. This function defines the clock, providing ML4TSA with the means to modify the physical definition of the clock. (Default clock) Inside, there is This means that the clock rate is consistent with the actual time, but in the actual modeling process, Various clock types can be defined, such as representing and Clocks and representations at different rates and Clocks with different physical meanings can be compared within the same framework, thanks to the isomorphism of the defining functions over their domains.

[0073] To ensure real-time synchronization between different objects, ML4TSA uses a global clock. To achieve synchronization of multiple clock types across multiple objects. For ,have Clearly, for any clock in ML4TSA... They all This means that any clock can be mapped to a global clock: Therefore, different clock variables in the model can be synchronized and compared using a global clock. During the modeling process, the clock may be modified through clock assignment operations to avoid accumulated errors during system operation. It is worth noting that clock operations... It will not affect the synchronization between variables. It uses a clock reset operation. For example, if the clock readings before and after the operation are respectively and The clock reading sequence after the operation is It is obvious that However, as shown below, to ensure the accuracy of the mapping with the global clock, ML4TSA employs a mapped time accumulation mechanism to record the impact of the zeroing operation on the clock. The resulting changes.

[0074]

[0075]

[0076] Clearly, through the accumulation mechanism, the local clock... The segments mapped to the global clock before and after zeroing are non-repeating and adjacent, effectively ensuring the synchronization of clocks within different components.

[0077] Definition 4: Port: A component's port set consists of input ports and output ports, as shown below.

[0078]

[0079]

[0080] in, A unique identifier for the port. Indicate whether the port is an input port or an output port. This refers to the specific content of the information stream corresponding to the port. This is a Boolean value that indicates the presence and status of information flow within the port.

[0081] It's worth noting that, to simplify the modeling process of information transmission, ML4TSA does not provide channel definitions between different components. Instead, it sets up a synchronization mechanism for input and output port values ​​to ensure information transfer between components. Simply put, if there is an information exchange relationship between two components, it means that component A and component B share the same port content, i.e. At this point, synchronization is achieved through global variables. and The port value will remain consistent, that is .

[0082] (II) Semantic Definition: Formal syntax defines the constituent elements of a model, while formal semantics defines the dynamic operating rules of the model. In this embodiment, the Labeled Transition System (LTS) is used to define the operational semantics of the language. The LTS represents the semantics of the system as state transition rules, describing the dynamic process of the system through state transitions. The definitions of states, valid transitions, and invalid transitions are given below.

[0083] Definition 5 Valid State: In ML4TSA, a model instance typically consists of multiple components and the interactions between them. A component's state is defined as a four-tuple. ,in The state name represents the discrete state in which the component is located; Showing the status Related function values; This represents a clock variable, which is displayed as a special variable due to the real-time nature of the system. This describes the real-time information flow of each port of the component. Based on the component state definition above, LTS describes the reasonable state of the component. A component... state A state is considered reasonable if and only if it satisfies the following conditions: 1) The constraint expression for the state to be satisfied by the variable values, clock, and port values: iff ; 2) When the state is the initial state, the variable values, clock value, and port value satisfy the initial conditions: .

[0084] Definition 6 Valid Transfer: LTS describes the dynamic process of a system as state changes, including state transitions and variable evolution. A single state change process is represented as... Similarly, its validity requires the following conditions to be met: 1) Both the state before and after the change are valid states: ; 2) If the state names are different before and after the change, then there is a corresponding transition between the states, and the transition conditions are met: .

[0085] 3) If the state names are the same before and after the change, then the variables within the state have corresponding evolution rules: .

[0086] Definition 7 System Failure: A state change process occurs if and only if the following conditions are met. Invalid: 1) Changes to the original state become invalid: .

[0087] 2) The previous state is about to become invalid, but the transition conditions are not met: ,in It represents a positive number that approaches 0.

[0088] The state change process of a system includes two categories: state transition and variable evolution. These two types of processes are respectively governed by the aforementioned state constraints. Evolutionary rules Defense conditions Trigger signal and migration actions Five factors determine the state of a component. If there is no transfer in the model Then its state change process is only affected by The constraints are as follows. Based on this, two state transition rules and three variable evolution rules are proposed to describe the operational semantics of ML4TSA. The definition of each semantic rule is given below.

[0089] (1) State transition caused by trigger signal:

[0090] Rule 1.1 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the state change are valid states, and the constraints are as follows. It can be satisfied, and the signal When triggered, the component changes state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned The entire state change process is represented as This represents a discrete change in the state of a component. In Rule 1.1... For probability variables, it represents the random switching that may occur during the state change process, and the final component changes from state to state. Switch to status .

[0091] (2) State transitions caused by state constraint violations:

[0092] Rule 1.2 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. At the same time, there exists a time interval that is greater than 0 and approaches 0. This makes the component in It will enter an invalid state after a certain time. If the state is changed at this time... For valid states and constraints Can be satisfied, and signal When triggered, the component exits its state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned . and The meaning is consistent with Rule 1.1, and the final component starts from the state. Switch to status .

[0093] (3) Variable evolution without trigger signal:

[0094] Rule 2.1 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the change are valid states, but the constraints are now in effect. The condition cannot be satisfied, therefore the component cannot escape from the state. After migration Transform into state However, if the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to status .

[0095] The process of the evolution rule is described as follows: The evolution rule consists of a set of differential expressions, that is, a set of time-dependent, continuously differentiable functions. Its first derivative is expressed as For a period of time ,have , At the same time , ,for They all And it satisfies the valid state constraints.

[0096] (4) Variable evolution due to failure to meet the transition conditions:

[0097] Rule 2.2 indicates that the component is in state. Below, there are changes. This enables components to transition to a state. Both the state before and after the change are valid states, but at this time the signal It cannot be triggered, therefore the component cannot be triggered from the state. After migration Transform into state However, if the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to status .

[0098] (5) Variable evolution without transfer:

[0099] Rule 2.3 indicates that the component is in state. There is no change. This enables components to transition to a state. But the state If the memory follows an evolutionary rule, and both the state before and after the change are valid states, then... It will evolve over time, and eventually the component will change from a state. Switch to status .

[0100] The above five state change rules define the operational semantics of ML4TSA to ensure the normal operation of the model. In actual modeling, ML4TSA provides two methods to model the cyber-physical fusion process between the ATS architecture and the scene.

[0101] (1) Modeling elements containing port values: ML4TSA provides the port modeling element, expanding the descriptive capabilities of traditional UML activity diagrams to model information interactions within an ATS architecture. In specific ATS architectures and scenario models, port values... The expressions formed participate in the construction of elements such as state constraints, trigger signals, guard conditions, and migration actions, and can represent the interaction between architectural information and the physical world.

[0102] Figure 4 This describes a simple case of vehicle-pedestrian interaction. The lower left diagram illustrates the impact of information transmission in the architecture on scene state transitions. It shows that the vehicle can switch from a constant-speed motion (No_acc) state to a decelerating motion (Neg_acc) state. The guard condition for this state transition is that the port value of the information stream containing "vehicle braking control scheme" in vehicleObj is not empty, meaning that vehicleObj has made the corresponding braking decision. Similarly, the lower right diagram shows the impact of the physical scene on the generation and transmission of information streams. The generation of the information stream containing "surrounding pedestrian information" in vehicleObj requires a signal trigger, namely, the presence of a pedestrian within the detection range of vehicleObj in the physical world. Through this setup, the information space and physical space can be linked, achieving the fusion of information processes and physical processes.

[0103] (2) Strict information physical clock mapping: In ML4TSA modeling, the information processing process and the physical motion process describe the system operation on the information side and the physical side, respectively. During this process, the information process and the physical process employ a strict clock mapping to ensure smooth interaction between them.

[0104] As mentioned earlier, the ML4TSA clock consists of a clock reading and a clock definition. Different clock definitions can be used on the information side and the physical side, and different clock rates can be set to meet specific modeling requirements. ML4TSA also provides a clock mapping function. This technology can map the local clocks of each process to a global clock for clock comparison. Therefore, information-side processes and physical-side processes can achieve real-time synchronization and strict mapping, ensuring the effectiveness of information-physical process interaction.

[0105] (III) Modeling tool development and model conversion: In this embodiment of the invention, a graphical modeling platform is constructed for the proposed ML4TSA modeling language, and the conversion between ML4TSA models and stochastic hybrid automata networks is realized to obtain the support of the UPPAAL verification engine.

[0106] like Figure 5 As shown, the ML4TSA metamodel covers all elements in the modeling language and explicitly considers the syntactic relationships of inclusion, reference, and inheritance between elements. Since the modeling process is essentially the instantiation of elements and relationships in the language, providing constraints on model instances through the metamodel can prevent the generation of unreasonable models. Therefore, this section, based on the metamodel, uses Sirius to develop a graphical interface, providing an instantiated editing tool as an implementation means of the ATS architecture domain modeling language. Figure 6 The main modules are showcased, including a main modeling interface, a tool panel for modeling elements, and a detailed attribute editing interface. In the main interface, elements defined by ML4TSA, such as states, transitions, and ports, are represented graphically, with relationships between elements expressed by line segments. The tool panel provides functions for creating, deleting, and modifying modeling elements, and these functions are constrained by the metamodel to avoid unreasonable operations. The relevant graphical interfaces and tool representations are as follows: Figure 7 As shown; the attribute editing interface supports editing the name, expression, and other content of modeling elements.

[0107] Model files can be exported via EMF (Eclipse Modeling Framework). During the model conversion process, based on meta-model analysis using ML4TSA and NSHA, mapping rules including global variables, states, transitions, and ports are designed. The conversion process is shown in Table 1. It is worth noting that during information interaction, the functional execution of each physical object is highly correlated with its input port values, and its input comes from the output ports of other physical objects. To avoid port value access errors caused by request delays, ports and execution functions in ML4TSA exist as variables in NSHA. A global matrix variable is maintained to store the port values ​​of each physical object. During interaction, physical objects can directly access and modify the port value matrix. Efficient matrix lookup and computation reduce model verification costs, and this integration also ensures a high degree of consistency between the information interaction clock and the physical runtime clock.

[0108] Table 1. Conversion process between ATS architecture domain model and stochastic hybrid automata network

[0109] During the transformation process, the five operational semantics were verified, as shown in Table 2. The verification results show that there are rules in NSHA that correspond to the operational semantics, which ensures the semantic consistency before and after the model mapping.

[0110] Table 2 Semantic mappings of MLTSA and NSHA

[0111] The instantiated model is converted into a stochastic hybrid automaton network supported by UPPAAL using a transformation algorithm, such as... Figure 8 As shown, multiple instantiated models can change their state over time and communicate and interact with each other. This section will verify the ATS property based on this.

[0112] Another aspect of the present invention provides a formal modeling apparatus, comprising: The first module is used to acquire scene architecture data, which describes the physical entities in the scene and the information interaction relationships between the entities. The second module is used to complete the formal modeling process based on the scene architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network that can be supported by UPPAAL using a model conversion algorithm. The third module is used to finally obtain a verifiable formal model describing the scenario and architecture.

[0113] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0114] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the formal modeling method described above. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0115] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the formal modeling method described above.

[0117] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0118] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0119] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0120] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0121] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0122] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0123] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0124] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0126] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks. The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A formal modeling method, characterized in that, Includes the following steps: Acquire scene architecture data, which is used to describe the physical entities in the scene and the information interaction relationships between the entities; The formal modeling process is completed based on the scenario architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network supported by UPPAAL using a model conversion algorithm. Finally, a verifiable formal model describing the scenario and architecture is obtained; In the step of completing the formal modeling process based on the scenario architecture data, the autonomous traffic architecture modeling language ML4TSA is used as the formal modeling language. The requirements of the autonomous traffic architecture modeling language include: explicitly expressing the system state, incorporating architecture and scenario characteristics, and providing formal semantic support. Among them, ML4TSA is an extension based on UML state diagrams to express the system state space and describe the system operation process through variable evolution and state transitions; To address the characteristics of ATS architecture and traffic scenarios, modeling elements are added to enrich the language's descriptive capabilities. By defining the language's formal syntax and semantics, subsequent formal verification research is supported. ML4TSA uses states and transitions to describe objects. ML4TSA extends the ability to describe states through state constraints and evolution rules. Constraint is used to specify the range of values ​​of state-related variables. It formally describes the set of expressions that the variables must maintain in the state and defines the boundaries of the state. Evolution describes the time-related rules of variable changes within the state constraints, reflecting ML4TSA's adaptability to continuous system processes. Meanwhile, ML4TSA extends the state diagram through guard conditions, action actions, and signal triggering signals. The transition is triggered by the signal event represented by the signal and is restricted by the guard conditions specified by the guard. The reassignment of discrete variables and the generation of signals are specified by the action corresponding to the transition. To reflect the cyber-physical fusion characteristics in the ATS model, ML4TSA defines the port and execution function of an object, and represents the information processing process of the object through the change of interface information values.

2. The formal modeling method of claim 1, wherein, The ML4TSA model describes the state change process within several components and the synchronous interaction process between components. For an ML4TSA object, the following applies: in, Let be a set of state names, where The name of the information interaction status. This refers to the physical motion state name. For any component, its state is represented as follows: Based on its participation in both the information and physical spaces, it is determined whether to use a composite state description; simultaneously, state s is constrained by state constraints. Evolutionary rules Common description; is a set of variables used to describe the state, including a set of discrete variables , continuous variables , clock variables , probabilistic variables , signal variables of the five categories; A set of transitions for connection states, consisting of triples, is denoted as: That is, a source state is transformed into a target state through a transition, where For the source state, For the target state, The migration tag is described by three attributes: This is a trigger signal used to indicate the start time of the migration; These are the conditions for defense, used to determine whether migration can occur; For migration actions, it indicates the discrete state changes that occur inside the component after the migration occurs; is the initial state set, which specifies the initial state of the component and also determines the initial distribution of variables within the component; a set of ports of the component, wherein and are input and output ports, respectively, for storing information flows received and generated by the component; an information processing function of the component, for describing a function performed by the component; an evolution rule set; a state constraint set.

3. The formal modeling method of claim 1, wherein, The ML4TSA model organizes type variables through expressions to construct modeling elements, thereby formally describing the system state and state transition process. Boolean expressions are used to describe guard conditions, trigger signals, state constraints, and interface values. Action expressions are used to describe migration actions and evolution rules; clock expressions are used to define time-related constraints. Differential expressions are used to describe the response of continuous variables to time; A function expression is an encapsulation of multiple predicates, used to represent complex logical relationships in expressions; Let be a clock variable, , be a discrete variable and a continuous variable, respectively, be a probability variable, be a signal variable. The semantics of Boolean expressions, action expressions, and time expressions are defined as follows: Boolean expressions: ,in, This is a Boolean value; when a signal is generated in the system, the corresponding variable value is... At this point, the expression is satisfied; For discrete variables, algebraic inequalities or algebraic equations For discrete variables, For clock variables, For an algebraic inequality or equation with clock variables, the expression is true for every value of the variable. and Values For discrete variables that satisfy an algebraic expression, the values ​​can be... , is represented as: ; For differential inequalities or differential equations relating to continuous variables, describe a time-dependent continuous variable. Within a specific time range If it exists inside Differential equation The solution is considered to be... To make the expression true, the process is represented as: ; It is a function expression; Action expression: wherein, for generating signal operation, it will modify the Boolean value of signal variable to to achieve the communication or process synchronization between multiple objects; for local clock reset operation; and the definition is consistent with the definition in Boolean expression; Clock expression: The former checks whether time-related inequalities are true and returns a boolean value; the latter modifies the clock value or definition and is a branch of the action expression. To ensure real-time synchronization between different objects, ML4TSA uses a global clock. To achieve synchronization of multiple clock types across multiple objects, ML4TSA employs a mapped time accumulation mechanism to record the impact of clock reset operations on the timeline, ensuring accurate mapping with the global clock. The resulting changes.

4. The formal modeling method of claim 1, wherein, The method further includes: representing the semantics of the system as state transition rules through the operational semantics of the label migration system LTS definition language, and describing the dynamic process of the system through state transitions. The definitions of state, transition validity, and failure are given below: Valid State: In ML4TSA, a model instance typically consists of multiple components and their interactions; a component state is defined as a four-tuple. ,in The state name represents the discrete state in which the component is located; Showing the status Related function values; This represents a clock variable, which is displayed as a special variable due to the real-time nature of the system. This provides real-time information flow data for each port of the component. For port values; according to the definition of component state, LTS describes the reasonable state of a component; a component state A state is considered reasonable if and only if it satisfies the following conditions: 1) The variable values, clock value, and port value satisfy the constraint expression of the state: iff ,in For state 1) Invariant constraints; 2) When the state is the initial state, the variable values, clock, and port values ​​satisfy the initial conditions: ; Effective transitions: LTS describes the dynamic process of a system as state changes, including state transitions and variable evolution. A single state change process is represented as... Its validity requires the following conditions to be met: 1) Both the state before and after the change are valid states: 2) If the state names are different before and after the change, then there is a corresponding transition between the states, and the transition conditions are met: 3) If the state names are the same before and after the change, then the variables within the state have corresponding evolution rules: , For state The rules of evolution, For the guard conditions of migration t, This is the trigger signal for migration t; System failure: A state change process fails if and only if fails: 1) Change from valid to invalid state: 2) Change from valid to invalid state, but migration condition is not met: where is a positive number approaching 0.

5. The formal modeling method of claim 1, wherein, The state change process of a system includes two categories: state transition and variable evolution. These two types of processes are respectively determined by state constraints. Evolutionary rules Defense conditions Trigger signal and migration actions Five types of factors determine the state of a component; among them, the state of a component is determined by the factors that determine the state of a component. If there is no transfer in the model Then its state change process is only affected by The following are the definitions of two state transition rules and three variable evolution rules, which are used to describe the operational semantics of ML4TSA: (1) State transition caused by trigger signal: Rule 1.1 indicates that the component is in state. Below, migration exists. Enables components to transition to a state. Both the state before and after the state change are valid states, and the constraints are as follows. It can be satisfied, and the signal When triggered, the component changes state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned The entire state change process is represented as This represents a discrete change in the state of a component; in Rule 1.1 For probability variables, it represents the random switching that may occur during the state change process, and the final component changes from state to state. Switch to state ; (2) State transitions caused by state constraint violations: Rule 1.2 indicates that the component is in state. Below, migration exists. Enables components to transition to a state. At the same time, there exists a time interval that is greater than 0 and approaches 0. This makes the component in It will enter an invalid state after a certain time. If the state is changed at this time... For valid states and constraints Can be satisfied, and signal When triggered, the component exits its state. After migration Transform into state Simultaneous migration The corresponding action will Reassigned ; and The meaning is consistent with Rule 1.1, and the final component starts from the state. Switch to state ; (3) Variable evolution without trigger signal: Rule 2.1 indicates that the component is in state. Below, migration exists. Enables components to transition to a state. Both the state before and after the change are valid states, but the constraints are now in effect. The condition cannot be satisfied, therefore the component cannot escape from the state. After migration Transform into state If the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to state ; The process by which the evolutionary rules work is described as follows: The evolutionary rules consist of a set of differential expressions, that is, a set of time-dependent, continuously differentiable functions. Its first derivative is expressed as For a period of time ,have , At the same time , ,for They all And it satisfies the valid state constraints; (4) Variable evolution due to failure to meet the transition conditions: Rule 2.2 indicates that the component is in state. Below, migration exists. This enables components to transition to a state. Both the state before and after the change are valid states, but at this time the signal It cannot be triggered, therefore the component cannot be triggered from the state. After migration, it is transformed into a state. If the state If memory has evolutionary rules, then... It will evolve over time, and eventually the component will change from a state. Switch to status ; (5) Variable evolution without transfer: Rule 2.3 indicates that the component is in state. Under these circumstances, there is no migration. This enables components to transition to a state. But the state If there are evolutionary rules in memory, and both the state before and after the change are valid states, then... It will evolve over time, and eventually the component will change from a state. Switch to status ; The above five state change rules define the operational semantics of ML4TSA to ensure the normal operation of the model. Simultaneously, ML4TSA provides two methods for modeling the cyber-physical fusion process between the ATS architecture and the scene: (1) Modeling elements containing port values: In the concrete ATS architecture and scenario model, the elements of state constraints, trigger signals, guard conditions and migration actions are constructed by the expressions composed of port values participate in the construction of the elements, for expressing the mutual influence of the architecture information and the physical world. (2) Strict information-physical clock mapping: In the ML4TSA modeling process, the information processing process and the physical motion process describe the system operation process on the information side and the physical side, respectively. In this process, the information process and the physical process adopt strict clock mapping to ensure that the interaction between the two is smooth.

6. The formal modeling method of claim 1, wherein, The method further includes: Based on the ML4TSA modeling language, a graphical modeling platform is built, and the conversion between ML4TSA models and stochastic hybrid automata networks is realized to obtain the support of the UPPAAL verification engine. The graphical modeling platform includes a main modeling interface, a tool panel for modeling elements, and a detailed attribute editing interface. In the main interface, elements such as states, migrations, and ports defined by ML4TSA are represented as graphics, and the relationships between elements are represented by line segments. The tool panel provides functions for creating, deleting, and modifying modeling elements. The attribute editing interface supports editing the names and expressions of modeling elements. During the model conversion process, based on the meta-model analysis of ML4TSA and NSHA random hybrid automata network, mapping rules including global variables, states, transitions, and ports are designed. In ML4TSA, ports and execution functions exist as variables in NSHA. By maintaining a global matrix variable, the port values ​​of each physical object are stored.

7. A formal modeling apparatus, characterized by, include: The first module is used to acquire scene architecture data, which describes the physical entities in the scene and the information interaction relationships between the entities. The second module is used to complete the formal modeling process based on the scene architecture data. This process includes the following steps: Based on the scene architecture, the objects to be modeled are identified, the physical interaction mechanism between the objects is analyzed, and the main body to be modeled is identified. For each modeling object, define parameter variables that can describe its state and state transition process, and complete the parameter definition; Based on the information interaction relationships described in the scene architecture, determine the input and output information flow of each object to construct the port of each modeling object; and determine the execution function based on the triggering relationship of the information flow. Based on the object-oriented cyber-physical interaction mechanism, the state and state transition process of the object are determined; variables are used to describe the state, and relevant invariants and variable evolution rules are defined. The state boundary is determined by setting variable constraints; the state transition process in the process of information transmission and physical movement is considered, and the process is described by migration. The trigger signal, guard condition and migration action corresponding to each migration are set; in this process, port values ​​are applied to guard conditions and migration actions to achieve the fusion modeling of cyber-physical systems. The model is visualized using modeling tools, and the ML4TSA model instance is converted into a stochastic hybrid automaton network supported by UPPAAL using a model conversion algorithm. In the step of completing the formal modeling process based on the scenario architecture data, the autonomous traffic architecture modeling language ML4TSA is used as the formal modeling language. The requirements of the autonomous traffic architecture modeling language include: explicitly expressing the system state, incorporating architecture and scenario characteristics, and providing formal semantic support. Among them, ML4TSA is an extension based on UML state diagrams to express the system state space and describe the system operation process through variable evolution and state transitions; To address the characteristics of ATS architecture and traffic scenarios, modeling elements are added to enrich the language's descriptive capabilities. By defining the language's formal syntax and semantics, subsequent formal verification research is supported. ML4TSA uses states and transitions to describe objects. ML4TSA extends the ability to describe states through state constraints and evolution rules. Constraint is used to specify the range of values ​​of state-related variables. It formally describes the set of expressions that the variables must maintain in the state and defines the boundaries of the state. Evolution describes the time-related rules of variable changes within the state constraints, reflecting ML4TSA's adaptability to continuous system processes. Meanwhile, ML4TSA extends the state diagram through guard conditions, action actions, and signal triggering signals. The transition is triggered by the signal event represented by the signal and is restricted by the guard conditions specified by the guard. The reassignment of discrete variables and the generation of signals are specified by the action corresponding to the transition. To reflect the cyber-physical fusion characteristics in the ATS model, ML4TSA defines the port and execution function of an object, and represents the information processing process of the object through the change of interface information values; The third module is used to finally obtain a verifiable formal model describing the scenario and architecture.

8. An electronic device, comprising: Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1 to 6.

Images