Formalized modeling and verification method based on distributed real-time dual-redundancy system

Abstract

The invention belongs to the technical field of distributed real-time dual-redundancy system verification, and particularly relates to a formalized modeling and verification method based on a distributed real-time dual-redundancy system. Comprising the following steps: 1, analyzing the architecture of the distributed real-time dual-redundancy system, and decomposing all clocks of the system architecture; 2, determining the period and random drift range of the corresponding clock based on the crystal oscillator frequency and drift of each clock; 3, constructing a clock model based on the clock period and the random drift range determined in the step 2 by adopting formalized semantics; 4, constructing a formalized model of the function logic of the distributed real-time dual-redundancy system based on the function logic of the architecture of the distributed real-time dual-redundancy system, and constructing the formalized model of the distributed real-time dual-redundancy system by superposing the clock model formed in the step 3 on the basis of the formalized model of the function logic of the distributed real-time dual-redundancy system; and 5, carrying out security analysis on the distributed real-time dual-redundancy system to obtain security attributes, and carrying out formalized verification based on the security attributes.

Description

Technical Field

[0001] The present invention belongs to the technical field of verification of distributed real-time dual-redundancy systems, and in particular relates to a formal modeling and verification method based on distributed real-time dual-redundancy systems. Background Art

[0002] Distributed real-time dual-redundant systems are representative of redundant systems in many safety-critical systems, such as aircraft and automotive systems. Redundant systems distribute functionality across multiple processing components connected by a redundant network to achieve system reliability. However, these components still need to agree on certain aspects of the global system state, such as which component is the current leader. Distributed real-time dual-redundant systems contain multiple independent clocks, so the asynchrony of their components makes them susceptible to potential race conditions and deadlock conditions.

[0003] Traditional verification methods rely on manually configured test stimuli, making it difficult to traverse the various asynchronous clock triggering sequences and interleaved execution orders of distributed real-time dual-redundant systems. Consequently, traditional verification methods suffer from insufficient coverage and high verification workload, making them incapable of guaranteeing the security of distributed real-time dual-redundant systems. However, without comprehensive system testing, these design errors often don't surface until late in system integration or even after deployment, significantly increasing system development costs. Summary of the Invention

[0004] Purpose of the invention: To provide a formal modeling and verification method based on distributed real-time dual-redundancy systems to solve the problems of insufficient coverage, large verification workload, and inability to ensure the security of distributed real-time dual-redundancy systems by traditional verification methods. If system design errors usually do not appear until the late stage of system integration or even after system deployment, the system development cost will be greatly increased.

[0005] Technical solution:

[0006] A formal modeling and verification method based on a distributed real-time dual-redundancy system includes:

[0007] Step 1: Analyze the architecture of the distributed real-time dual-redundancy system and decompose all clocks of the system architecture;

[0008] Step 2: Based on the crystal oscillator frequency and drift of each clock, determine the period and random drift range of the corresponding clock;

[0009] Step 3: Use formal semantics to construct a clock model based on the clock period and random drift range determined in step 2;

[0010] Step 4: Based on the functional logic of the distributed real-time dual-redundancy system architecture, a formal model of the functional logic of the distributed real-time dual-redundancy system is constructed. On this basis, the clock model formed in step 3 is superimposed to construct a formal model of the distributed real-time dual-redundancy system.

[0011] Step 5: Perform security analysis on the distributed real-time dual-redundancy system to obtain security properties, and perform formal verification on the formal model of the distributed real-time dual-redundancy system based on the security properties.

[0012] Preferably, step 1 is specifically:

[0013] Step 11: Analyze the topology of the distributed real-time dual-redundancy system and determine the system's clock strategy;

[0014] Step 12: Decompose all clocks of the system architecture based on the system's clock strategy.

[0015] Preferably, the clock strategy determined in step 11 includes centralized, distributed and hybrid strategies.

[0016] Preferably, in step 2, the clock period of the component is taken from the crystal oscillator frequency of the clock, and the random drift of the clock of the component is taken from the crystal oscillator drift of the clock.

[0017] Preferably, step 3 specifically includes:

[0018] Step 31: Use formal semantics to construct the first cycle of the clock model: starting from time t = 0, make the state of the clock driving flag true at a certain time within [0 + clock period T - maximum clock drift, 0 + clock period T + maximum clock drift], and false at all other times;

[0019] Step 32: Use formal semantics to construct the second cycle of the clock model: starting from the moment when the state of the first clock driving flag is true, make the state of the clock driving flag true at a certain moment within [the moment when the state of the first clock driving flag is true + clock period T - the maximum clock drift, the moment when the state of the first clock driving flag is true + clock period T + the maximum clock drift], and false at all other moments. This process is repeated to construct all cycles of the clock model.

[0020] Step 33: When the state of the clock driving flag is true, drive the corresponding component.

[0021] Preferably, in step 4, the content of the formal model of the functional logic includes: active / standby switching of the dual-redundancy system and bus transmission delay.

[0022] Preferably, step 5 specifically includes:

[0023] Step 51: Perform security analysis on the distributed real-time dual-redundancy system to obtain security attributes;

[0024] Step 52: Based on the characteristics of security attributes, the security attributes are described as a formal specification using LTL or invariant methods;

[0025] Step 53: Based on the formal specification and the formal model of the distributed real-time dual-redundancy system constructed in step 4, run the formal engine to verify whether the formal model of the distributed real-time dual-redundancy system satisfies the formal specification.

[0026] Preferably, in step 53, if the formal model of the distributed real-time dual-redundancy system satisfies the formal specification, the formal verification result is satisfied, indicating that the distributed real-time dual-redundancy system satisfies this safety property;

[0027] If the formal model of the distributed real-time dual-redundancy system does not meet the formal specification, the operation scenario of the formal model of the distributed real-time dual-redundancy system that does not meet the formal specification will be used as a counterexample. The counterexample content is the operation sequence of the distributed real-time dual-redundancy system, including the system's clock triggering and the key nodes of the system's functional logic operation, which is used by system designers to understand and modify the system design.

[0028] Beneficial effects:

[0029] The present invention provides a formal modeling and verification method based on a distributed real-time dual-redundancy system. The formal modeling and verification method is used for the distributed real-time dual-redundancy system, and a mathematical method is used to exhaustively traverse various asynchronous clock triggering timings and interleaved execution sequences of the distributed real-time dual-redundancy system to ensure the security of the system design. The method has the following specific effects: 1. It can automatically exhaustively traverse various asynchronous clock triggering timings and interleaved execution sequences of the distributed real-time dual-redundancy system; 2. It ensures the security of the design of the distributed real-time dual-redundancy system; 3. It reduces the workload of designers and increases test efficiency and accuracy; 4. It has strong versatility and can be applied to the verification method of distributed real-time redundant systems in other fields; 5. It improves the quality and reliability of the distributed real-time dual-redundancy system. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions implemented in the present invention, the following briefly explains the drawings required for the description of the present invention. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive effort.

[0031] Figure 1 A schematic diagram of the principles of a formal modeling and verification method for a distributed real-time dual-redundancy system provided by an embodiment of the present invention.

[0032] Figure 2 A schematic diagram illustrating the principle of formal modeling of a real-time clock provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0033] To make the purpose, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of the present application can be combined with each other in any manner.

[0034] As explained in the above background technology, traditional verification methods for the design and verification of distributed real-time dual-redundancy systems have the disadvantages of insufficient coverage and large verification workload. They are no longer capable of ensuring the security of distributed real-time dual-redundancy systems. If system design errors usually do not appear until the late stage of system integration or even after system deployment, the cost of system development will be greatly increased.

[0035] The technical solution provided by the embodiment of the present invention uses a formal modeling and verification method for a distributed real-time dual-redundancy system, and utilizes a mathematical method to exhaustively traverse various asynchronous clock trigger timings and interleaved execution sequences of the distributed real-time dual-redundancy system, thereby ensuring the design security of the distributed real-time dual-redundancy system; reducing the workload of designers, and increasing testing efficiency and accuracy; having strong versatility, and applicable to verification methods of distributed real-time redundant systems in other fields; and improving the quality and reliability of the distributed real-time dual-redundancy system.

[0036] The present invention provides the following specific embodiments that can be combined with each other. The same or similar concepts or processes may not be described in detail in some embodiments.

[0037] Figure 1 The flowchart of a formal modeling and verification method for a distributed real-time dual-redundancy system provided by an embodiment of the present invention. The formal modeling and verification method provided by an embodiment of the present invention may include the following steps:

[0038] Step 1: Analyze the architecture of the distributed real-time dual-redundancy system and decompose all clocks within the system. For example, in a distributed real-time dual-redundancy system, all components within each redundant system share a common clock set, with the same crystal oscillator frequency and drift for all clocks within each redundant system. The bus between one single-redundancy system and another uses a different clock set, with a different crystal oscillator frequency and drift. This process continues in this manner, decomposing all clocks within the system architecture.

[0039] Step 2: Based on the crystal oscillator frequency and drift of each clock, determine the period and random drift range of the corresponding clock;

[0040] Step 3: Use formal semantics to construct a clock model based on the clock period and random drift range determined in step 2;

[0041] Step 4: Based on the functional logic of the distributed real-time dual-redundancy system architecture, a formal model of the functional logic of the distributed real-time dual-redundancy system is constructed. On this basis, the clock model formed in step 3 is superimposed to construct a formal model of the distributed real-time dual-redundancy system.

[0042] Step 5: Perform security analysis on the distributed real-time dual-redundancy system to obtain security properties, and perform formal verification on the formal model of the distributed real-time dual-redundancy system based on the security properties.

[0043] For example, a safety property of a distributed real-time dual-redundancy system is "at any moment, the dual-redundancy system cannot be the primary system", where the safety property is usually expressed as a formal specification.

[0044] In another embodiment of the present invention, the specific implementation process of the above step 1 may include:

[0045] Step 11: Analyze the topology of the distributed real-time dual-redundancy system and determine the system's clock strategy. The topology is divided into centralized, distributed, and hybrid. For example, Figure 1 All components within one of the redundancy levels form a centralized topology. All components within this system redundancy adopt a centralized clock strategy and share the same clock. In a distributed real-time dual-redundancy system, system redundancy 1, communication component 1 from system redundancy 1 to system redundancy 2, system redundancy 2, and communication component 2 from system redundancy 2 to system redundancy 1 form a distributed topology, employing a distributed clock strategy and using different clocks. A distributed real-time dual-redundancy system forms a hybrid topology with a hybrid clock strategy for all components within and between redundancy levels.

[0046] Step 12: Decompose all clocks in the system architecture based on the system clock strategy. A centralized topology uses the same clock, a distributed topology uses different clocks, and a hybrid topology uses a clock that is the sum of the clocks in the centralized and distributed topologies.

[0047] It should be noted that the clock strategies determined in step 11 include centralized, distributed, and hybrid strategies. The clocks in the system decomposed in step 1 can be triggered at any time within the time range [period - drift, period + drift] to drive the corresponding components.

[0048] In another embodiment of the present invention, in the above step 2, the clock period of the component is obtained from the crystal oscillator frequency of the clock, and the random clock drift of the component is obtained from the crystal oscillator drift of the clock.

[0049] In another embodiment of the present invention, the specific implementation process of the above step 3 may include:

[0050] Step 31, construct the first cycle of the clock model using formal semantics. Starting from time t = 0, the state of the clock driving flag is true at a certain moment within [0 + clock cycle T - clock maximum drift, 0 + clock cycle T + clock maximum drift], and false at other times; Figure 2 Clock period and drift schematic diagram

[0051] Step 32: Use formal semantics to construct the second cycle of the clock model. Starting from the moment when the first clock driving flag is true, the state of the clock driving flag is set to true at a certain moment within [the moment when the first clock driving flag is true + clock period T - the maximum clock drift, the moment when the first clock driving flag is true + clock period T + the maximum clock drift], and false at all other moments. This process is repeated to construct all cycles of the clock model.

[0052] Step 33: When the state of the clock driving flag is true, drive the corresponding component.

[0053] In another embodiment of the present invention, in step 4 above, the content of the formal model of the functional logic includes: active / standby switching of the dual-redundancy system and bus transmission delay.

[0054] In another embodiment of the present invention, the specific implementation process of step 5 may include:

[0055] Step 51, performing security analysis on the distributed real-time dual-redundancy system to obtain security attributes;

[0056] Step 52: Based on the characteristics of security attributes, the security attributes are described as a formal specification using LTL or invariant methods;

[0057] In step 53, based on the formal specification and the formal model constructed in step 4, a formal engine is run to verify whether the formal model of the distributed real-time dual-redundancy system satisfies the formal specification, i.e., the safety property. The formal engine uses an exhaustive search-based model checking method based on the finite state machine in the mathematical model corresponding to the formal model of the distributed real-time dual-redundancy system to search all possible states of the finite state machine, including various asynchronous clock triggering sequences and interleaved execution orders of the distributed real-time dual-redundancy system, to verify whether the formal model satisfies the formal specification.

[0058] It should be noted that in step 5, the formal model is formally verified based on the safety property. If the formal model of the distributed real-time dual-redundancy system satisfies the formal specification, the formal verification result is satisfied, indicating that the distributed real-time dual-redundancy system satisfies this safety property.

[0059] If the formal model of a distributed real-time dual-redundancy system does not satisfy the formal specification, a counterexample will be formed based on the running scenario of the formal model of the distributed real-time dual-redundancy system that does not satisfy the formal specification. The counterexample content is the running sequence of the distributed real-time dual-redundancy system, including the key nodes of the system clock triggering and the system functional logic operation, which makes it easier for system designers to understand and modify the system design.

[0060] This method has the characteristics of strong design operability and good verification effect, and can greatly improve the efficiency of security design of distributed real-time dual-redundancy systems.

[0061] In some possible implementations of the embodiments of the present invention, the formal modeling and verification method for a specified distributed real-time dual-redundancy system uses all tools that can support modeling and formal verification of distributed real-time systems.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should all be covered by the scope of protection of the present invention.

Claims

1. A formal modeling and verification method based on distributed real-time dual-redundancy system, characterized by: include: Step 1: Analyze the architecture of the distributed real-time dual-redundancy system and decompose all clocks of the system architecture; Step 2: Based on the crystal oscillator frequency and drift of each clock, determine the period and random drift range of the corresponding clock; Step 3: Use formal semantics to construct a clock model based on the clock period and random drift range determined in step 2; Step 4: Based on the functional logic of the distributed real-time dual-redundancy system architecture, a formal model of the functional logic of the distributed real-time dual-redundancy system is constructed. On this basis, the clock model formed in step 3 is superimposed to construct a formal model of the distributed real-time dual-redundancy system. Step 5: Perform security analysis on the distributed real-time dual-redundancy system to obtain security properties, and perform formal verification on the formal model of the distributed real-time dual-redundancy system based on the security properties.

2. The method according to claim 1, characterized in that Step 1, specifically: Step 11: Analyze the topology of the distributed real-time dual-redundancy system and determine the system's clock strategy; Step 12: Decompose all clocks of the system architecture based on the system's clock strategy.

3. The method according to claim 2, characterized in that The clock strategies determined in step 11 include centralized, distributed, and hybrid.

4. The method according to claim 3, characterized in that In step 2, the component clock period is taken from the clock crystal oscillator frequency, and the component clock random drift is taken from the clock crystal oscillator drift.

5. The method according to claim 4, characterized in that Step 3 specifically includes: Step 31: Use formal semantics to construct the first cycle of the clock model: starting from time t = 0, make the state of the clock driving flag true at a certain time within [0 + clock period T - maximum clock drift, 0 + clock period T + maximum clock drift], and false at all other times; Step 32: Use formal semantics to construct the second cycle of the clock model: starting from the moment when the state of the first clock driving flag is true, make the state of the clock driving flag true at a certain moment within [the moment when the state of the first clock driving flag is true + clock period T - the maximum clock drift, the moment when the state of the first clock driving flag is true + clock period T + the maximum clock drift], and false at all other moments. This process is repeated to construct all cycles of the clock model. Step 33: When the state of the clock driving flag is true, drive the corresponding component.

6. The method according to claim 5, characterized in that In step 4, the content of the formal model of the functional logic includes: the active-standby switching of the dual-redundancy system and the bus transmission delay.

7. The method according to claim 6, characterized in that Step 5 specifically includes: Step 51: Perform security analysis on the distributed real-time dual-redundancy system to obtain security attributes; Step 52: Based on the characteristics of security attributes, the security attributes are described as a formal specification using LTL or invariant methods; Step 53: Based on the formal specification and the formal model of the distributed real-time dual-redundancy system constructed in step 4, run the formal engine to verify whether the formal model of the distributed real-time dual-redundancy system satisfies the formal specification.

8. The method according to claim 7, characterized in that In step 53, if the formal model of the distributed real-time dual-redundancy system satisfies the formal specification, the formal verification result is satisfied, indicating that the distributed real-time dual-redundancy system satisfies this safety property; If the formal model of the distributed real-time dual-redundancy system does not meet the formal specification, the operation scenario of the formal model of the distributed real-time dual-redundancy system that does not meet the formal specification will be used as a counterexample. The counterexample content is the operation sequence of the distributed real-time dual-redundancy system, including the system's clock triggering and the key nodes of the system's functional logic operation, which is used by system designers to understand and modify the system design.

Images