Behavior verification method and device of information physical system, electronic equipment and medium

Abstract

The invention provides a behavior verification method and device of an information physical system, electronic equipment and a medium, and the method comprises the steps: for a to-be-verified function of the to-be-verified information physical system, obtaining a mixed operation signal which is generated in the operation process of the system and is related to the to-be-verified function; obtaining a time-sequence point to be verified; calling a pre-defined mixed signal sequential logic formula for formally describing the function to be verified; utilizing Boolean semantics to judge whether the mixed operation signal meets a mixed signal sequential logic formula on a time-sequence point or not; and / or, calculating a robustness value of the mixed signal sequential logic formula on a time-sequence point by using robust semantics so as to quantify the degree of meeting or violating the mixed signal sequential logic formula; and determining whether the to-be-verified function passes verification or not according to the judgment result of the Boolean semantics or the robustness value. Unified processing and verification of the mixed operation signals are realized through the method.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and medium for verifying the behavior of a cyber-physical system. Background Technology

[0002] With the widespread application of cyber-physical systems (CPS) in safety-critical fields such as autonomous driving, smart industry, and medical devices, ensuring the correctness and reliability of their behavior has become crucial. Formal verification methods, especially verification techniques based on signal-timing logic (STL), have become important means of describing and verifying the dynamic behavioral properties of CPS. Traditional STL verification methods are typically designed for continuous-time signals, verifying system properties by judging whether the system's operating trajectory satisfies a preset logical formula.

[0003] However, actual CPS operation is typically a hybrid process intertwined with continuous dynamic evolution and discrete event triggering. For example, while continuously adjusting its speed, an autonomous vehicle may also trigger discrete control commands such as braking and gear shifting at specific moments; a smart washing machine, while continuously monitoring water level and temperature, may also respond to discrete user operations such as "door open" and "pause." Existing STL verification methods, which focus on processing purely continuous signals, struggle to directly and uniformly model and accurately analyze such hybrid operating signals composed of continuous signals and discrete events. This results in insufficient descriptive power and coarse verification granularity when verifying CPS functions involving complex interactive behaviors. It fails to fully characterize the system's behavior at the moment of discrete event triggering and its coupling relationship with continuous evolution, thus limiting the application scope and accuracy of verification techniques. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a method, apparatus, electronic device and medium for verifying the behavior of cyber-physical systems, so as to realize the unified processing and verification of mixed operating signals. It introduces the concept of time-series points, realizes the refinement of verification granularity, and provides a dual perspective of Boolean judgment and quantitative evaluation, thus providing an effective solution for the functional verification of cyber-physical systems.

[0005] In a first aspect, embodiments of this application provide a method for verifying the behavior of a cyber-physical system, including: For the function to be verified in the cyber-physical system, a mixed operational signal related to the function to be verified is acquired during the operation of the cyber-physical system. The mixed operational signal is composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time. The continuous signal array is used to describe the smooth change of variables over a continuous time interval, and the discrete signal array is used to describe instantaneous events occurring at a specific moment. The variables and the instantaneous events are related to the function to be verified. Obtain the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. Invoke a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified; Boolean semantics are used to determine whether the mixed-signal timing logic formula is satisfied at the time-series point (t1, i); and / or, robustness semantics are used to calculate the robustness value of the mixed-signal timing logic formula at the time-series point (t1, i) to quantify the degree to which the mixed-signal timing logic formula is satisfied or violated. Based on the Boolean semantics judgment result or the robustness value, determine whether the function to be verified has passed verification.

[0006] In conjunction with the first aspect, this application provides a first possible implementation of the first aspect, wherein the continuous signal array is represented as (t2, Δt, f), where t2 is the start time, Δt is the duration, and f is a continuous function describing the change of the variable with time over a continuous time interval; The discrete signal array is represented as (t3, a, s), where t3 is the time of occurrence of the instantaneous event, a is the action information that triggers the instantaneous event, and s is the operating state of the cyber-physical system after the instantaneous event occurs.

[0007] In conjunction with the first possible implementation of the first aspect, this application provides a second possible implementation of the first aspect, wherein the mixed-signal timing logic formula includes at least one of basic atomic formulas, logical combination operators, and timing operators; The basic atomic formula includes variable inequalities; the variable inequalities include variable expressions, comparison operators, and thresholds; the variable expressions reference variables defined in the continuous signal array or operating states defined in the discrete signal array; the comparison operators include greater than, less than, equal to, greater than or equal to, and less than or equal to; the variable inequalities are used to determine whether the values ​​of variables or operating states satisfy the conditions. The logical combination operators include: AND operator, OR operator, and NOT operator; The timing operators include: the next event operator, the global always operator, and the bounded until operator under time constraints.

[0008] In conjunction with the second possible implementation of the first aspect, this application provides a third possible implementation of the first aspect, wherein the step of using robust semantics to calculate the robustness value of the mixed-signal timing logic formula at the time-series point (t1, i) to quantify the degree to which the mixed-signal timing logic formula is satisfied or violated includes: If the mixed-signal timing logic formula is the variable inequality, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when i≥1, the variable value is extracted from the running state, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when the variable value cannot be obtained, the robustness value is -T, where T is the maximum robustness value; If the mixed-signal sequential logic formula is composed of the logic combination operators, then the robustness value of the AND operator = the minimum robustness value of the two sub-formulas; the robustness value of the OR operator = the maximum robustness value of the two sub-formulas; the robustness value of the NOT operator = - the robustness value of the corresponding sub-formula. If the mixed-signal timing logic formula is composed of the timing operators, then the robustness value of the next event operator is equal to the robustness value of the sub-formula corresponding to the next valid point of the time-series point (t1, i), and is -T if there is no next valid point; the robustness value of the global always operator is equal to the minimum of the robustness values ​​of the sub-formulas corresponding to all time-series points greater than or equal to (t1, i); the robustness value of the bounded until operator is equal to the maximum of the target minimum values ​​corresponding to the time-series points that satisfy the subsequent sub-formula within the time constraint interval; the target minimum is the minimum of the robustness value of the subsequent sub-formula and the minimum of the robustness value of the preceding sub-formula within the interval. A robustness value ≥ 0 indicates that the hybrid operating signal satisfies the hybrid signal timing logic formula, and the larger the value, the higher the degree of satisfaction. A robustness value less than 0 or equal to -T indicates a violation; the smaller the value, the more severe the violation.

[0009] In conjunction with the second possible implementation of the first aspect, this application provides a fourth possible implementation of the first aspect, wherein the step of using Boolean semantics to determine whether the mixed running signal satisfies the mixed signal timing logic formula at the time-series point (t1, i) includes: If the mixed-signal timing logic formula contains variable inequalities in the basic atomic formula, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When i≥1, the variable value is extracted from the running state. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When the variable value cannot be obtained, it is directly determined to be not satisfied. If the mixed-signal timing logic formula is composed of logical combination operators, then when the logical combination operator is an AND operator, it is satisfied only if both sub-formulas are determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is an OR operator, it is satisfied only if at least one sub-formula is determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is a NOT operator, it is satisfied only if the corresponding sub-formula is determined to be not satisfied, otherwise it is not satisfied. If the mixed-signal timing logic formula is composed of timing operators, then when the timing operator is the next event operator, the sub-formula corresponding to the next valid point is considered satisfied if it meets the requirements, otherwise it is not satisfied; when the timing operator is the global always operator, it is considered satisfied only if all sub-formulas corresponding to time-series points greater than or equal to (t1, i) meet the requirements, otherwise it is not satisfied; when the timing operator is the bounded until operator under time constraints, it is considered satisfied if there exists a time-series point within the time constraint interval that satisfies the subsequent sub-formula, and all time-series points within the interval between (t1, i) and that point satisfy the preceding sub-formula, otherwise it is not satisfied.

[0010] Secondly, embodiments of this application also provide a behavior verification device for a cyber-physical system, comprising: The first acquisition module is used to acquire, for the cyber-physical system to be verified, a mixed operational signal generated by the cyber-physical system to be verified during operation that is related to the function to be verified; the mixed operational signal is composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time; the continuous signal array is used to describe the smooth change of variables within a continuous time interval, and the discrete signal array is used to describe instantaneous events occurring at a specific moment; the variables and the instantaneous events are related to the function to be verified; The second acquisition module is used to acquire the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. The calling module is used to call a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified. The calculation module is used to determine whether the mixed running signal satisfies the mixed signal timing logic formula at the time-series point (t1, i) using Boolean semantics; and / or to calculate the robustness value of the mixed signal timing logic formula at the time-series point (t1, i) using robust semantics, so as to quantify the degree to which the mixed signal timing logic formula is satisfied or violated. The determination module is used to determine whether the function to be verified has passed verification based on the judgment result of the Boolean semantics or the robustness value.

[0011] In conjunction with the second aspect, this application provides a first possible implementation of the second aspect, wherein the continuous signal array is represented as (t2, Δt, f), where t2 is the start time, Δt is the duration, and f is a continuous function describing the change of the variable with time over a continuous time interval; The discrete signal array is represented as (t3, a, s), where t3 is the time of occurrence of the instantaneous event, a is the action information that triggers the instantaneous event, and s is the operating state of the cyber-physical system after the instantaneous event occurs.

[0012] In conjunction with the first possible implementation of the second aspect, this application provides a second possible implementation of the second aspect, wherein the mixed-signal timing logic formula includes at least one of basic atomic formulas, logical combination operators, and timing operators; The basic atomic formula includes variable inequalities; the variable inequalities include variable expressions, comparison operators, and thresholds; the variable expressions reference variables defined in the continuous signal array or operating states defined in the discrete signal array; the comparison operators include greater than, less than, equal to, greater than or equal to, and less than or equal to; the variable inequalities are used to determine whether the values ​​of variables or operating states satisfy the conditions. The logical combination operators include: AND operator, OR operator, and NOT operator; The timing operators include: the next event operator, the global always operator, and the bounded until operator under time constraints.

[0013] Thirdly, embodiments of this application also provide an electronic device, including: a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the memory via the bus, and when the machine-readable instructions are executed by the processor, the steps in any of the possible implementations of the first aspect described above are performed.

[0014] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps in any of the possible implementations of the first aspect described above.

[0015] This application provides a method, apparatus, electronic device, and medium for verifying the behavior of a cyber-physical system. The method directly verifies mixed operating signals composed of interwoven continuous and discrete signal arrays, overcoming the limitation of traditional methods that can only handle purely continuous signals. It can simultaneously analyze the continuous evolution behavior and discrete event-triggered behavior of the system within a unified framework, thereby more realistically and completely reflecting the actual operation of the cyber-physical system and significantly improving the verification method's descriptive ability and applicability to complex systems.

[0016] Furthermore, by introducing the concept of a time-series point (t1, i), it is possible to clearly distinguish between continuous states and multiple discrete events at the same time point. Here, the sequence index i=0 is specifically used to point to the continuous signal at that time, while i≥1 is used to sequentially identify the i-th discrete event occurring at that time. This design allows the verification logic to precisely align with specific "time-event" points in the signal trajectory, avoiding the ambiguity of traditional methods when dealing with multiple events at the same time, and greatly improving the accuracy and granularity of the verification.

[0017] Furthermore, this method supports not only qualitative judgments based on Boolean semantics (i.e., "satisfied" or "not satisfied"), but also quantitative calculations based on robustness semantics to derive robustness values. These robustness values ​​quantify the degree to which system behavior satisfies or violates predetermined functional properties. This dual verification mechanism of "qualitative + quantitative" not only provides a conclusion on whether the verification passed, but also assesses the "safety margin" or "severity of violation" of the system behavior, providing richer and more valuable decision-making basis for system optimization, parameter adjustment, and risk classification.

[0018] As can be seen, this embodiment, by acquiring mixed operating signals, invoking formally described mixed-signal timing logic formulas, and performing semantic calculations at specified time-series points, ultimately provides a clear conclusion on whether the function has passed verification. This invention forms a complete, systematic, and highly targeted CPS functional verification process. This method can effectively address the verification challenges of systems containing mixed dynamic characteristics, helps to discover potential defects in the early stages of system design, and improves the overall security and reliability of CPS.

[0019] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart of a behavior verification method for a cyber-physical system provided in an embodiment of this application is shown; Figure 2 A schematic diagram of a hybrid operating signal provided in an embodiment of this application is shown; Figure 3 This illustration shows a structural schematic diagram of a behavior verification device for a cyber-physical system provided in an embodiment of this application; Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0023] Given the urgent need in the prior art for a new method capable of effectively processing mixed signals and accurately verifying system functions, this application provides a behavioral verification method, apparatus, electronic device, and medium for cyber-physical systems, which are described below through embodiments.

[0024] To facilitate understanding of this embodiment, a behavioral verification method for a cyber-physical system disclosed in this application will first be described in detail. For example... Figure 1 As shown, the process includes the following steps S101-S105: S101: For the function to be verified in the cyber-physical system, acquire the mixed operating signals generated by the cyber-physical system during operation that are related to the function to be verified; the mixed operating signals are composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time; the continuous signal array is used to describe the smooth changes of variables in a continuous time interval, and the discrete signal array is used to describe the instantaneous events that occur at a specific moment; the variables and instantaneous events are related to the function to be verified; S102: Obtain the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. S103: Call a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified. S104: Use Boolean semantics to determine whether the mixed-signal timing logic formula is satisfied at time-series point (t1, i); and / or use robust semantics to calculate the robustness value of the mixed-signal timing logic formula at time-series point (t1, i) to quantify the degree to which the mixed-signal timing logic formula is satisfied or violated. S105: Determine whether the function to be verified has passed verification based on the Boolean semantic judgment result or robustness value.

[0025] In step S101, the aim is to prepare core data input for the subsequent verification process, namely, to collect or generate hybrid operational signals related to the specific function (the function to be verified) of the cyber-physical system (CPS) to be verified. This signal is a complete record of the system's runtime sequential behavior, which naturally integrates two dynamic modes: continuous evolution and discrete jumps.

[0026] The mixed-signal operation, denoted as W, is a sequence arranged in strictly increasing time order. This sequence consists of two basic types of elements: an array of continuous signals and an array of discrete signals. For example... Figure 2 As shown, Figure 2 It clearly shows that W is composed of a continuous array of signals ( Figure 2 In the diagram, continuous line segments (e.g., AB, CD, EF) and discrete signal arrays (...) Figure 2 The symbols are represented by dots (e.g., G, H, I, J, K, L, M, N) and are arranged in a strict increasing order over time to form a unified sequence.

[0027] Continuous signal arrays are used to characterize the smooth evolution of one or more system variables over a continuous time interval. For example, Figure 2Line segment AB in the diagram represents the continuous change of a variable (such as the speed of an autonomous vehicle or the voltage of an energy storage system) from the time corresponding to point A to the time corresponding to point B. Similarly, line segments CD and EF represent subsequent different stages of continuous evolution.

[0028] Discrete signal arrays are used to record events that occur at a specific instant and cause a momentary change in the system state. As shown by points G, H, I in the attached diagram, each point represents an event that occurs at a precise moment, such as the sending of control commands, the triggering of sensor thresholds, or the reception of communication messages.

[0029] Each signal array contains timestamps and status information, and their order strictly follows the chronological relationship of their timestamps, thus forming a coherent time trajectory W.

[0030] An array of continuous signals characterizes the continuous behavior of a system starting from a certain moment and lasting for a period of time. It can be represented by a triplet structure (t2, Δt, f), where t2 is the starting time, corresponding to... Figure 2 The x-coordinates of points A, C, and E are given. Δt represents the duration, and Δt > 0. The end time of this time interval is tend = t² + Δt (corresponding to...). Figure 2 (x-coordinates of points B, D, and F).

[0031] f is a continuous function describing how a variable changes with time over a continuous time interval; it maps time to the state of the system. For any time τ∈[t2, tend], f(τ) gives the set of values ​​for all relevant variables at that moment (i.e., the system state). This function describes how the variable changes continuously with time over this interval, such as linearly, exponentially, or polynomially.

[0032] For example, in a battery management system, a continuous signal array such as segment AB might record the process of the battery voltage V linearly decreasing from 4.2V to 3.8V from t=0s to t=10s, i.e., (0, 10, f(τ)=4.2) / (t=10). 0.04τ).

[0033] A discrete signal array (such as point G) represents an instantaneous event that occurs in the system at a precise moment. It can be represented by a triplet structure: (t3, a, s), where t3 is the time of the instantaneous event (corresponding to the x-coordinate of points G, H, I, etc. in the graph), and the event itself does not occupy a time interval (its duration is zero). 'a' represents the action information that triggered the instantaneous event, which can be an internal state transition (using a null action). The variable name can be a symbol (e.g., variable name), or a specific communication behavior (e.g., sender, receiver, channel identifier). 's' represents the operational state of the cyber-physical system after the instantaneous event, and also the new state the system immediately enters after the event. This state is a mapping from variable name to specific value, reflecting the instantaneous result caused by the event.

[0034] For example, in the same battery management system, when the voltage drops to 3.7V, the protection circuit is triggered. This might correspond to a discrete signal array such as point J: (15.0,"protection_triggered",{status:"shutdown"}) indicates that at the instant t3=15.0s, the system state changes from running to shut down.

[0035] like Figure 2 As shown, all continuous and discrete signal arrays are sorted according to their time attributes (the end time of the continuous array, tend, or the occurrence time of the discrete array, t3), forming a mixed running signal W. For example, after line segment AB ends, a discrete event G may follow immediately, and then a new continuous segment CD may begin, interspersed with discrete events H, I, etc. This representation method based on a unified time axis is intuitive and fundamentally avoids the time synchronization misalignment problem that may occur when storing continuous signals and discrete events separately in traditional methods, ensuring the time consistency of the entire behavior record.

[0036] In step S101, the acquired hybrid operating signal W must be closely related to the function to be verified. This means that the variables and events recorded in W are the core behavioral elements that the function focuses on. For example, to verify the "automatic deceleration for overspeed" function, W must contain continuous speed change signals such as segments AB and CD, as well as discrete event signals related to deceleration commands such as points G and J. By analyzing this real and complete hybrid operating signal W, it can be determined whether the actual operating behavior of the cyber-physical system meets the functional expectations.

[0037] In step S102, after obtaining the hybrid operation signal W that characterizes the complete behavior of the cyber-physical system, the core of this step (S102) is to accurately locate the "observation point" for verification, namely the time-series point, denoted as (t1, i).

[0038] Here, the time-series point is a tuple: t1 represents the selected time point to be verified, and i represents the sequence index at that time point t1.

[0039] The design of this binary tuple aims to solve a key problem: at the same physical moment, a system may simultaneously exist in a continuously evolving state and several discretely occurring events. How can we precisely pinpoint one of these for verification? The sequence index i provides this fine-grained distinguishing capability. In other words, the time-series point is used to differentiate between a continuous signal array and multiple discrete signal arrays at the same time point.

[0040] When i=0, it indicates that the focus is on the continuous signal at time t1. It refers to the continuous evolution process that is in progress or has just ended at time t1. For example, Figure 2 In the equation, if t1 is located on line segment CD, then (t1, 0) points to the state of the line segment at that moment.

[0041] When i ≥ 1, it indicates that the focus is on the i-th discrete signal array (event) occurring at time t1. This allows for the sorting and separate access to multiple discrete events occurring at the same time. For example, Figure 2 At a certain moment, points H and I may exist simultaneously. Then (t1, 1) may point to H and (t1, 2) may point to I.

[0042] The acquisition of time-series points (t1, i) is typically based on the requirements of the function to be verified. Specifically: Determining time t1: t1 is usually a specific moment of interest in the functional specification, such as the time when a function is triggered, a periodic checkpoint, or the expected time of a critical event. It can also be a time point selected for focused examination after analyzing signal W.

[0043] Determining the index i: To verify whether the continuous state of the system at a certain moment satisfies the property (e.g., "the vehicle speed must be below 60 km / h before the braking command is issued"), i is set to 0. To verify a specific discrete event and its effect (e.g., "the received 'emergency stop' command must cause the braking state to activate"), the index i needs to be determined according to the order of occurrence of the events at time t1. For example, if event G (index 1) occurs first at time t1, followed by event H (index 2), then (t1, 2) is used to verify event H.

[0044] A time-series point (t1, i) must have a clear semantic correspondence in a given mixed running signal W to be valid.

[0045] For (t1, 0), the signal W is required to contain a continuous array of signals whose time interval covers time t1 (i.e., t1 is located on or at the endpoint of a line segment such as AB, CD or EF).

[0046] For (t1, i) (where i ≥ 1), it is required that there exist at least i discrete signal arrays in signal W at time t1 (i.e., Figure 2 There are at least i points in the vertical direction of t1, such as H and I.

[0047] By introducing time-series points, this embodiment achieves finer verification granularity, enabling precise targeting of any continuous instantaneous state or any discrete event instance in the system's operational trajectory, laying the foundation for subsequent accurate verification based on formal formulas.

[0048] In step S103, after identifying the observation point to be analyzed, "time-series point (t1, i)," ​​this step (S103) serves as the linchpin connecting specific system behavior data with abstract functional specifications. Its core lies in invoking a predefined mixed-signal timing logic formula. This formula is a logical expression pre-designed and written using a formal language based on the precise requirements of the function to be verified. Its purpose is to transform functional natural language descriptions (such as "when the distance is less than 5 meters, brake immediately") into rigorous mathematical logic rules that can be automatically processed and calculated by a computer.

[0049] Mixed-signal sequential logic formulas, as a formal specification, fundamentally serve to formally describe the functionality to be verified. They provide clear and unambiguous criteria for judging the expected behavior of a system at specific time-series points. Compared to traditional sequential logic, which can only handle continuous signals, the formulas used in this embodiment are extensions specifically designed for mixed signals. They can uniformly express the constraints on the evolution of continuous variables and the logic of discrete event occurrence, thereby comprehensively characterizing the hybrid dynamic characteristics of cyber-physical systems.

[0050] In one possible implementation, the invoked mixed-signal timing logic formula is constructed by recursively combining basic components, mainly including the following three types of elements: 1. Basic atomic formula: The basic unit that constitutes a logical assertion.

[0051] Variable inequalities: These are the most basic atomic formulas. They consist of a variable expression (referencing a variable in a continuous signal array or the system's operating state after a discrete signal array), a comparison operator (such as ≥, <, etc.), and a threshold (constant). For example, speed ≥ 0 or braking state = 1. Its semantics directly determine whether the values ​​of the corresponding variables at a given time-series point satisfy the inequality relationship.

[0052] 2. Logical combination operators: used to construct complex logical relationships.

[0053] The AND operator (∧), OR operator (∨), and NOT operator (¬) are used to connect sub-formulas to express logical relationships such as "both satisfy", "at least one satisfies", and "not satisfied". For example, (distance less than or equal to 5) ∧ (brake state = 0) means "the distance is less than or equal to 5 meters and the brakes have not yet been activated".

[0054] 3. Timing Operator: Describes the logical relationship of property evolution over time, and is the core of this embodiment.

[0055] Next event operator ( ): Asserts that the sub-formula must be true at the next valid point (defined by the Next_Event function) of the current time-series point.

[0056] Global Always operator (□): Asserts that, starting from the current time-series point, its sub-formulas must be true at all future valid points.

[0057] Bounded until operator (U[a,b]) under time constraints: asserts that in the future time interval [t1+a, t1+b] relative to the current time t1, there exists a point in time such that the consequent sub-formula ψ is true, and the antecedent sub-formula φ must be true at all points in time before this point.

[0058] In step S103, "calling" means binding the predefined mixed-signal timing logic formula, the specific mixed-run signal W obtained in step S101, and the starting verification observation point "time-series point (t1,i)" specified in step S102. All variable names and event identifiers appearing in the formula must have explicit definitions and corresponding data sources in signal W. This binding operation establishes a complete and executable verification task instance, preparing for the next step of semantic computation.

[0059] Step S104 is the computational core of the verification process. Based on the verification instance established in step S103, the mixed-signal timing logic formula is interpreted and evaluated. This embodiment provides two parallel semantic computation methods: Boolean semantics for qualitative judgment and robust semantics for quantitative evaluation.

[0060] In this context, Boolean semantics assigns a truth value (true or false) to each formula within the given context of (W, t1, i), directly answering the question of "whether it is satisfied". Its computation rules are recursively defined: 1. Atomic Formula (Variable Inequality): Based on the value of i, retrieve the corresponding variable value from the signal W at time t1 (when i=0, calculate from the continuous segment function f covering t1; when i≥1, take the value from the state s of the i-th discrete event), and determine whether the value satisfies the inequality. If a value cannot be obtained, directly determine it as false.

[0061] 2. Logical combination: φ∧ψ is true if and only if both φ and ψ are true; φ∨ψ is true if and only if at least one is true; ¬φ is true if and only if φ is false.

[0062] 3. Timing operations: Their truth value depends on the truth value of the sub-formula at a future time point.

[0063] φ is true if and only if it is true at the next valid point of (t1, i).

[0064] □φ is true if and only if φ is true at (t1, i) and all subsequent valid points.

[0065] φU[a,b]ψ is true if and only if there exists a point in the time interval [t1+a,t1+b] such that ψ is true, and φ is true at all points before that point (starting from (t1,i)).

[0066] Robust semantics calculates a real value (robustness value ρ) for each formula, which not only indicates whether the condition is met (ρ≥0 indicates satisfaction), but also quantifies the degree of satisfaction or violation. Its calculation rule is recursively defined: 1. Atomic Formula (Variable Inequality): The robustness value equals the symbolic distance between the actual value of the variable and the threshold. For example, for x>=c, ρ=(actual value of x)-c. The more positive the value, the more satisfied the condition; a negative value indicates a violation, and the larger the absolute value, the more severe the violation. If no value can be taken, a minimum value -T representing "complete violation" is assigned.

[0067] 2. Logical combination: The robustness value of φ∧ψ is the minimum value between ρ(φ) and ρ(ψ) (the barrel principle).

[0068] The robustness value of φ∨ψ takes the maximum value between ρ(φ) and ρ(ψ).

[0069] The robustness value of ¬φ is -ρ(φ).

[0070] 3. Timing operation: The robustness value reflects the comprehensive degree to which the sub-formulas are satisfied within the entire relevant time interval.

[0071] The robustness value of φ is equal to the robustness value of φ at the next valid point, or -T if there is no next point.

[0072] The robustness value of □φ is equal to the minimum robustness value of φ at all future effective points (i.e., the strength of the weakest link).

[0073] The robustness value of φU_[a,b]ψ is relatively complex to calculate. Its core idea is to find an optimal balance point within the time interval [t1+a, t1+b] that maximizes both the robustness value of the consequent ψ and the minimum robustness value of φ at all points before this point. This balance value is the robustness value of the entire formula.

[0074] Step S105 is the end point of the verification process, which aims to make a clear and actionable conclusion on whether the function to be verified has passed the verification based on the calculation results of step S104.

[0075] If Boolean semantics are used for verification, the conclusion is direct and binary: Validation passed: If the Boolean semantics of the formula evaluates to true at the specified start time-sequence point (t1, i).

[0076] Validation failed: If the Boolean semantics of the formula evaluate to false at the specified start time-sequence point (t1, i).

[0077] This approach is suitable for scenarios where functional specifications require strict "yes / no" judgments, such as compliance checks of safety-critical attributes.

[0078] If robust semantics are used for verification, the conclusions will contain degree information and be more instructive: Verification passed and with safety / performance margin: If the calculated robustness value ρ is greater than or equal to 0. The larger the value, the more the system behavior exceeds the minimum standard of functional requirements, and the more sufficient the safety margin or performance margin.

[0079] Verification fails and the degree of violation is quantified: if the calculated robustness value ρ is less than 0. The smaller the value (the more negative), the more serious the deviation of the system behavior from the functional requirements.

[0080] Complete violation: If the robustness value is -T (the theoretical minimum), it indicates that the signal cannot provide the basic data required for verification at that point, or the system's behavior has completely deviated from functional expectations.

[0081] This approach not only provides a pass / fail conclusion, but also offers quantitative data for system debugging, parameter optimization, and risk assessment. For example, a positive threshold (such as ρ>0.5) can be set as a more stringent pass / fail standard.

[0082] In practical applications, both semantics can be used in parallel, or one can be selected based on functional characteristics. The final conclusion will serve as a key basis for guiding system design iterations, confirming system deployment eligibility, or triggering runtime monitoring alarms. Through the complete process of steps S101 to S105, a systematic, automated, and quantifiable formal verification of the complex hybrid behavior of cyber-physical systems is achieved.

[0083] Based on the same technical concept, embodiments of this application also provide a behavior verification device for a cyber-physical system, such as... Figure 3 As shown, the device includes: The first acquisition module 301 is used to acquire, for the cyber-physical system to be verified, a mixed operating signal generated during the operation of the cyber-physical system to be verified that is related to the function to be verified; the mixed operating signal is composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time; the continuous signal array is used to describe the smooth change of variables in a continuous time interval, and the discrete signal array is used to describe instantaneous events occurring at a specific moment; the variables and the instantaneous events are related to the function to be verified; The second acquisition module 302 is used to acquire the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. Module 303 is invoked to call a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified. The calculation module 304 is used to determine whether the mixed running signal satisfies the mixed signal timing logic formula at the time-series point (t1, i) using Boolean semantics; and / or to calculate the robustness value of the mixed signal timing logic formula at the time-series point (t1, i) using robust semantics, so as to quantify the degree to which the mixed signal timing logic formula is satisfied or violated. The determination module 305 is used to determine whether the function to be verified has passed verification based on the judgment result of the Boolean semantics or the robustness value.

[0084] Optionally, the continuous signal array is represented as (t2, Δt, f), where t2 is the start time, Δt is the duration, and f is a continuous function describing the change of the variable with time over a continuous time interval; The discrete signal array is represented as (t3, a, s), where t3 is the time of occurrence of the instantaneous event, a is the action information that triggers the instantaneous event, and s is the operating state of the cyber-physical system after the instantaneous event occurs.

[0085] Optionally, the mixed-signal timing logic formula includes at least one of basic atomic formulas, logical combination operators, and timing operators; The basic atomic formula includes variable inequalities; the variable inequalities include variable expressions, comparison operators, and thresholds; the variable expressions reference variables defined in the continuous signal array or operating states defined in the discrete signal array; the comparison operators include greater than, less than, equal to, greater than or equal to, and less than or equal to; the variable inequalities are used to determine whether the values ​​of variables or operating states satisfy the conditions. The logical combination operators include: AND operator, OR operator, and NOT operator; The timing operators include: the next event operator, the global always operator, and the bounded until operator under time constraints.

[0086] Optionally, when the calculation module 304 is used to calculate the robustness value of the mixed-signal timing logic formula at the time-series point (t1, i) using robust semantics, in order to quantify the degree to which the mixed-signal timing logic formula is satisfied or violated, it is specifically used to: If the mixed-signal timing logic formula is the variable inequality, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when i≥1, the variable value is extracted from the running state, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when the variable value cannot be obtained, the robustness value is -T, where T is the maximum robustness value; If the mixed-signal sequential logic formula is composed of the logic combination operators, then the robustness value of the AND operator = the minimum robustness value of the two sub-formulas; the robustness value of the OR operator = the maximum robustness value of the two sub-formulas; the robustness value of the NOT operator = - the robustness value of the corresponding sub-formula. If the mixed-signal timing logic formula is composed of the timing operators, then the robustness value of the next event operator is equal to the robustness value of the sub-formula corresponding to the next valid point of the time-series point (t1, i), and is -T if there is no next valid point; the robustness value of the global always operator is equal to the minimum of the robustness values ​​of the sub-formulas corresponding to all time-series points greater than or equal to (t1, i); the robustness value of the bounded until operator is equal to the maximum of the target minimum values ​​corresponding to the time-series points that satisfy the subsequent sub-formula within the time constraint interval; the target minimum is the minimum of the robustness value of the subsequent sub-formula and the minimum of the robustness value of the preceding sub-formula within the interval. A robustness value ≥ 0 indicates that the hybrid operating signal satisfies the hybrid signal timing logic formula, and the larger the value, the higher the degree of satisfaction. A robustness value less than 0 or equal to -T indicates a violation; the smaller the value, the more severe the violation.

[0087] Optionally, when the calculation module 304 uses Boolean semantics to determine whether the mixed running signal satisfies the mixed signal timing logic formula at the time-series point (t1, i), it is specifically used for: If the mixed-signal timing logic formula contains variable inequalities in the basic atomic formula, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When i≥1, the variable value is extracted from the running state. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When the variable value cannot be obtained, it is directly determined to be not satisfied. If the mixed-signal timing logic formula is composed of logical combination operators, then when the logical combination operator is an AND operator, it is satisfied only if both sub-formulas are determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is an OR operator, it is satisfied only if at least one sub-formula is determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is a NOT operator, it is satisfied only if the corresponding sub-formula is determined to be not satisfied, otherwise it is not satisfied. If the mixed-signal timing logic formula is composed of timing operators, then when the timing operator is the next event operator, the sub-formula corresponding to the next valid point is considered satisfied if it meets the requirements, otherwise it is not satisfied; when the timing operator is the global always operator, it is considered satisfied only if all sub-formulas corresponding to time-series points greater than or equal to (t1, i) meet the requirements, otherwise it is not satisfied; when the timing operator is the bounded until operator under time constraints, it is considered satisfied if there exists a time-series point within the time constraint interval that satisfies the subsequent sub-formula, and all time-series points within the interval between (t1, i) and that point satisfy the preceding sub-formula, otherwise it is not satisfied.

[0088] Figure 4 A schematic diagram of an electronic device provided in this application embodiment includes: a processor 401, a memory 402, and a bus 403. The memory 402 stores machine-readable instructions executable by the processor 401. When the electronic device runs the above-described information processing method, the processor 401 and the memory 402 communicate through the bus 403. The processor 401 executes the machine-readable instructions to perform the steps of the method described in Embodiment 1.

[0089] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps described in Embodiment 1.

[0090] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, electronic devices, and computer-readable storage media described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0091] In the several embodiments provided in this application, it should be understood that the disclosed methods, apparatuses, electronic devices, and computer-readable storage media can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or modules may be electrical, mechanical, or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0094] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0095] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of protection of the claims.

Claims

1. A method for verifying the behavior of a cyber-physical system, characterized in that, include: For the function to be verified in the cyber-physical system, a mixed operational signal related to the function to be verified is acquired during the operation of the cyber-physical system. The mixed operational signal is composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time. The continuous signal array is used to describe the smooth change of variables over a continuous time interval, and the discrete signal array is used to describe instantaneous events occurring at a specific moment. The variables and the instantaneous events are related to the function to be verified. Obtain the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. Invoke a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified; Boolean semantics are used to determine whether the mixed-signal timing logic formula is satisfied at the time-series point (t1, i); and / or, robustness semantics are used to calculate the robustness value of the mixed-signal timing logic formula at the time-series point (t1, i) to quantify the degree to which the mixed-signal timing logic formula is satisfied or violated. Based on the Boolean semantics judgment result or the robustness value, determine whether the function to be verified has passed verification.

2. The method according to claim 1, characterized in that, The continuous signal array is represented as (t2, Δt, f), where t2 is the start time, Δt is the duration, and f is a continuous function describing the change of the variable with time over a continuous time interval. The discrete signal array is represented as (t3, a, s), where t3 is the time of occurrence of the instantaneous event, a is the action information that triggers the instantaneous event, and s is the operating state of the cyber-physical system after the instantaneous event occurs.

3. The method according to claim 2, characterized in that, The mixed-signal timing logic formula includes at least one of the following: basic atomic formula, logical combination operator, and timing operator; The basic atomic formula includes variable inequalities; the variable inequalities include variable expressions, comparison operators, and thresholds; the variable expressions reference variables defined in the continuous signal array or operating states defined in the discrete signal array; the comparison operators include greater than, less than, equal to, greater than or equal to, and less than or equal to. The variable inequality is used to determine whether the value of a variable or operating state satisfies the condition; The logical combination operators include: AND operator, OR operator, and NOT operator; The timing operators include: the next event operator, the global always operator, and the bounded until operator under time constraints.

4. The method according to claim 3, characterized in that, The step of calculating the robustness value of the mixed-signal time-series logic formula at the time-series point (t1, i) using robust semantics to quantify the degree to which the mixed-signal time-series logic formula is satisfied or violated includes: If the mixed-signal timing logic formula is the variable inequality, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when i≥1, the variable value is extracted from the running state, and the robustness value is the result derived by comparing the variable value with the threshold using the comparison operator; when the variable value cannot be obtained, the robustness value is -T, where T is the maximum robustness value; If the mixed-signal sequential logic formula is composed of the logic combination operators, then the robustness value of the AND operator = the minimum robustness value of the two sub-formulas; the robustness value of the OR operator = the maximum robustness value of the two sub-formulas; the robustness value of the NOT operator = - the robustness value of the corresponding sub-formula. If the mixed-signal timing logic formula is composed of the timing operators, then the robustness value of the next event operator is equal to the robustness value of the sub-formula corresponding to the next valid point of the time-series point (t1, i), and is -T if there is no next valid point; the robustness value of the global always operator is equal to the minimum of the robustness values ​​of the sub-formulas corresponding to all time-series points greater than or equal to (t1, i); the robustness value of the bounded until operator is equal to the maximum of the target minimum values ​​corresponding to the time-series points that satisfy the subsequent sub-formula within the time constraint interval; the target minimum is the minimum of the robustness value of the subsequent sub-formula and the minimum of the robustness value of the preceding sub-formula within the interval. A robustness value ≥ 0 indicates that the hybrid operating signal satisfies the hybrid signal timing logic formula, and the larger the value, the higher the degree of satisfaction. A robustness value < 0 or = -T indicates a violation; the smaller the value, the more severe the violation.

5. The method according to claim 3, characterized in that, The step of using Boolean semantics to determine whether the hybrid operating signal satisfies the hybrid signal timing logic formula at the time-series point (t1, i) includes: If the mixed-signal timing logic formula contains variable inequalities in the basic atomic formula, then when i=0, the variable value corresponding to time t1 is calculated through the continuous function f. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When i≥1, the variable value is extracted from the running state. If the variable value satisfies the combination relationship between the comparison operator and the threshold, it is determined to be satisfied; otherwise, it is not satisfied. When the variable value cannot be obtained, it is directly determined to be not satisfied. If the mixed-signal timing logic formula is composed of logical combination operators, then when the logical combination operator is an AND operator, it is satisfied only if both sub-formulas are determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is an OR operator, it is satisfied only if at least one sub-formula is determined to be satisfied, otherwise it is not satisfied; when the logical combination operator is a NOT operator, it is satisfied only if the corresponding sub-formula is determined to be not satisfied, otherwise it is not satisfied. If the mixed-signal timing logic formula is composed of timing operators, then when the timing operator is the next event operator, the sub-formula corresponding to the next valid point is considered satisfied if it meets the requirements, otherwise it is not satisfied; when the timing operator is the global always operator, it is considered satisfied only if all sub-formulas corresponding to time-series points greater than or equal to (t1, i) meet the requirements, otherwise it is not satisfied; when the timing operator is the bounded until operator under time constraints, it is considered satisfied if there exists a time-series point within the time constraint interval that satisfies the subsequent sub-formula, and all time-series points within the interval between (t1, i) and that point satisfy the preceding sub-formula, otherwise it is not satisfied.

6. A behavior verification device for a cyber-physical system, characterized in that, include: The first acquisition module is used to acquire, for the cyber-physical system to be verified, a mixed operational signal generated by the cyber-physical system to be verified during operation that is related to the function to be verified; the mixed operational signal is composed of at least one continuous signal array and / or at least one discrete signal array arranged in ascending order of time; the continuous signal array is used to describe the smooth change of variables within a continuous time interval, and the discrete signal array is used to describe instantaneous events occurring at a specific moment; the variables and the instantaneous events are related to the function to be verified; The second acquisition module is used to acquire the time-series point (t1, i) to be verified, where t1 is time and i is the sequence index; when i=0, it represents the continuous signal array corresponding to time t1; when i≥1, it represents the i-th discrete signal array corresponding to time t1. The calling module is used to call a predefined mixed-signal timing logic formula; the mixed-signal timing logic formula is used to formally describe the function to be verified. The calculation module is used to determine whether the mixed running signal satisfies the mixed signal timing logic formula at the time-series point (t1, i) using Boolean semantics; and / or to calculate the robustness value of the mixed signal timing logic formula at the time-series point (t1, i) using robust semantics, so as to quantify the degree to which the mixed signal timing logic formula is satisfied or violated. The determination module is used to determine whether the function to be verified has passed verification based on the judgment result of the Boolean semantics or the robustness value.

7. The apparatus according to claim 6, characterized in that, The continuous signal array is represented as (t2, Δt, f), where t2 is the start time, Δt is the duration, and f is a continuous function describing the change of the variable with time over a continuous time interval. The discrete signal array is represented as (t3, a, s), where t3 is the time of occurrence of the instantaneous event, a is the action information that triggers the instantaneous event, and s is the operating state of the cyber-physical system after the instantaneous event occurs.

8. The apparatus according to claim 7, characterized in that, The mixed-signal timing logic formula includes at least one of the following: basic atomic formula, logical combination operator, and timing operator; The basic atomic formula includes variable inequalities; the variable inequalities include variable expressions, comparison operators, and thresholds; the variable expressions reference variables defined in the continuous signal array or operating states defined in the discrete signal array; the comparison operators include greater than, less than, equal to, greater than or equal to, and less than or equal to. The variable inequality is used to determine whether the value of a variable or operating state satisfies the condition; The logical combination operators include: AND operator, OR operator, and NOT operator; The timing operators include: the next event operator, the global always operator, and the bounded until operator under time constraints.

9. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is in operation, the processor communicates with the memory via the bus, and the machine-readable instructions, when executed by the processor, perform the steps of the method as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the method as described in any one of claims 1 to 5.

Images