Aviation safety-oriented evidence-driven large language model MISRA C rule review method and system

Abstract

The invention provides an evidence-driven large language model MISRA C rule review method and system for aviation safety. According to the method, formalized feature extraction is carried out from four aspects of grammar structure features, semantic structure features, logic analysis features and preprocessing behavior features for target codes according to various rules of MISRA C forcing class rules, and diagnosis information is diagnosed in combination with an industrial-grade compiler; generating a structured evidence set comprising abstract syntax tree node statistical features, code context structure features, control flow graph features, function internal data flow analysis features, symbol and type table features and macro definition analysis features; and based on the structured evidence set and the large language model, executing evidence tracing, rule matching and logical reasoning according to a preset thinking chain process, and outputting a structured judgment result containing illegal rule numbers, evidence description and code positions. According to the method, the false alarm rate can be remarkably reduced while the high rule coverage rate and the detection accuracy are kept.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of aviation software safety code review, and mainly relates to compliance detection of C language code in aviation embedded systems. BACKGROUND

[0002] In safety-critical embedded systems such as aviation engine control and flight control systems, the reliability and compliance of software code are directly related to flight safety and airworthiness certification. MISRA C:2012, as an industry-adopted coding standard, its compliance with mandatory rules is the cornerstone to meet the requirements of DO-178C and other highest safety levels. However, the current rule review technology in this field faces severe efficiency and accuracy bottlenecks: commercial static analysis tools with comprehensive functionality cannot be integrated into the developer's daily "coding-review" immediate feedback loop due to their long analysis time, resulting in serious lag in error correction; while lightweight open-source tools (such as Cppcheck) that can respond quickly are limited by their insufficient rule coverage and lack of detection depth, resulting in a large number of false negatives and failing to provide sufficient safety assurance for high-reliability software development.

[0003] Researchers have tried various ways to improve the flexibility and automation level of review. Early researchers such as Marpons et al. built a customizable rule checking framework based on the Prolog logic language, and Volanschi designed a meta-language that can define violation patterns on the GCC intermediate representation. These methods have made some progress in flexibility, but their formal description is costly and difficult to meet engineering-level requirements in terms of coverage and practicality.

[0004] In recent years, the rise of large language models has revolutionized code understanding and generation tasks, and models such as CodeReviewer and LLaMA-Reviewer have emerged that focus on automated code review. They have shown the potential to understand code context through pre-training and fine-tuning, but there are still fundamental challenges in applying them directly to aviation safety and other fields: the inherent probabilistic generation characteristics and "black box" decision-making process of LLMs make them produce unacceptable false positives when faced with unstructured raw code, and their judgment results lack structured evidence to support traceability, which is contrary to the determinism and verifiability required in safety-critical fields.

[0005] Therefore, the existing technical system has not yet provided a MISRA C rule review scheme that has high detection efficiency and coverage, and can guarantee low false positive rate and high reliability. In this context, the industry urgently needs an innovative method that can integrate the powerful semantic reasoning capabilities of large language models with multi-dimensional deterministic code evidence from compilers, abstract syntax trees, and control data flows, thereby building an efficient, reliable, and interpretable development companion review tool. Summary of the Invention

[0006] Purpose of the invention: To address the difficulty in balancing detection efficiency, rule coverage, and false alarm rate in existing MISRA C rule review tools, this invention aims to provide an evidence-driven large language model MISRAC rule review method and system for aviation safety. This method and system maintains high rule coverage and detection accuracy while reducing false alarm rate, thereby improving the efficiency, interpretability, and credibility of automated MISRA C rule review in the aviation safety field.

[0007] Technical Solution: To achieve the above objectives, this invention provides an evidence-driven large language model MISRA C rule review method for aviation safety, comprising the following steps:

[0008] For the target code, formal features are extracted from four perspectives: syntax structure features, semantic structure features, logical analysis features, and preprocessing behavior features, in accordance with the various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, a structured evidence set is generated, which includes statistical features of abstract syntax tree nodes, code context structure features, control flow graph features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features.

[0009] The structured evidence set and the MISRA C mandatory rules are input into a large language model with programming language reasoning capabilities. The model is guided to perform evidence tracing, rule matching, logical induction and violation judgment generation in sequence by using the prompt word template and the thought chain prompt engineering in the prompt word template. The review results are output in a structured format, including the violation rule number, the corresponding evidence content and the location of occurrence.

[0010] As a preferred approach, MISRA C's mandatory class rules are categorized into seven main types: core language behavior and pitfalls; static code structure and reachability; scope, linking, and visibility; type safety and data conversion; function usage; restrictions on standard library usage; and lexical, macro, and syntactic details.

[0011] As a preferred approach, the extraction of syntactic structural features for each type of rule is divided into three levels: the first level is the design of a basic syntactic profile, the second level is rule-oriented context analysis, and the third level is rule-oriented semantic extraction. In the first-level feature extraction stage, a basic and quantitative syntactic information is established for each target code, including the number of nodes, comment information, and literal usage. In the second-level feature extraction stage, context information is extracted during the traversal process to identify and quantify code patterns related to specific mandatory rule classes. In the third-level feature extraction stage, we delve into the semantic level and detect semantic problems that may lead to undefined behavior or violations of coding standards during the traversal process.

[0012] As a preferred approach, the logical analysis feature extraction for each type of rule involves constructing a control flow graph related to the MISRA C mandatory rule. By analyzing the control flow structure, the integrity of the control flow is identified, providing valid evidence to verify whether the control flow conforms to the integrity specifications in the MISRA C rule. Combined with data flow analysis, the usage of uninitialized variables and unused function return values ​​are identified on the control flow path, and this information is recorded in the form of a data flow summary, providing valid evidence to review whether the code violates the rules.

[0013] As a preferred approach, the semantic structure feature extraction for each type of rule includes: constructing a symbol table by scope tracking, symbol information extraction, and type stringification to record all identifiers defined in the source file; focusing on explicit type conversions in the code according to the rule specification, and recording all analyzed type conversions in a list through two steps: caching declaration information and capturing and analyzing conversions.

[0014] As a preferred approach, the preprocessing behavior feature extraction for each type of rule includes: macro definition extraction and recombination, extracting macro definitions through a line-by-line scanning procedure and storing each complete macro definition in association with its starting line number; macro rule violation detection, iteratively checking each macro to see if any violations involved in the rule occur.

[0015] As a preferred method, the compilation information of the target code is extracted by enabling strict compilation options in an industrial-grade C compiler to capture all compilation warnings and error messages in the target code and associate the information with specific code line numbers.

[0016] As a preferred approach, in the design of prompt words for inputting the structured evidence set and MISRA C mandatory rules into the large model for judgment, the Mind Chain prompting project sets the role of the large language model as a code auditing expert for MISRA C mandatory rules. It requires the model to analyze the structured evidence sequentially during the reasoning process and match each piece of evidence to the relevant rules, while generating a logical chain of reasons for violations. After the reasoning is completed, the final review result is output in JSON format.

[0017] This invention provides an evidence-driven large language model MISRA C rule review system for aviation safety, used to implement the aforementioned review method, comprising:

[0018] The multimodal static feature extraction module is used to extract formal features from four perspectives—syntactic structure features, semantic structure features, logical analysis features, and preprocessing behavior features—for target code according to various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, it generates a structured evidence set that includes statistical features of abstract syntax tree nodes, code context structure features, control flow graph features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features.

[0019] The evidence-based large language model reasoning and decision module is used to input the structured evidence set and MISRA C mandatory rules into a large language model with programming language reasoning capabilities. The prompt word template uses mind chain prompting engineering to guide the model to perform evidence tracing, rule matching, logical induction and violation judgment generation in sequence, and output the review results in a structured format, including the violation rule number, corresponding evidence content and occurrence location.

[0020] The present invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the aforementioned evidence-driven large language model MISRA C rule review method for aviation safety.

[0021] Beneficial Effects: Compared with existing MISRA C rule review methods, the evidence-driven large language model review method provided by this invention addresses the problems of excessively long analysis time of existing commercial tools leading to review delays, serious underreporting due to low coverage of open source tools, high false positive rate when directly reviewing code with large language models, and untraceable decision-making process. It innovatively constructs a multi-dimensional evidence system that includes syntactic structure, logical flow, semantic information, macro instructions, and compiler diagnostics, transforming unstructured code into verifiable structured features. As a result, while maintaining a high detection rate of 82.24%, the false positive rate is significantly reduced to 5%, effectively solving the technical problem of existing methods struggling to balance detection efficiency, coverage, and reliability. Attached Figure Description

[0022] Figure 1 This is a flowchart of the evidence-driven large language model MISRA C rule review method for aviation safety provided in an embodiment of the present invention.

[0023] Figure 2 This is a flowchart illustrating the effectiveness of the verification method provided in this embodiment of the invention. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0025] like Figure 1 As shown in the figure, the evidence-driven large language model MISRA C rule review method for aviation safety provided by this invention mainly includes:

[0026] For the target code (i.e., the source code to be reviewed), formal features are extracted from four perspectives—syntactic structure features, semantic structure features, logical analysis features, and preprocessing behavior features—according to various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, a structured evidence set is generated, which includes statistical features of abstract syntax tree (AST) nodes, code context structure features, control flow graph (CFG) features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features.

[0027] The structured evidence set and MISRA C:2012 mandatory rules are input into a large language model with programming language reasoning capabilities. A thought chain prompting process is used in the prompt word template to guide the model sequentially through evidence tracing, rule matching, logical induction, and violation judgment generation. The review results, including the violation rule number, corresponding evidence content, and location of occurrence, are output in a structured format. In this embodiment, the 114 MISRA C:2012 mandatory rules are divided into seven categories: core language behavior and pitfalls; static code structure and reachability; scope, linking, and visibility; type safety and data conversion; function usage; standard library usage restrictions; and lexical, macro, and syntactic details. For each of the seven categories of MISRA C:2012 mandatory rules, the rules are formalized from four perspectives: syntactic structure, semantic structure, logical analysis features, and preprocessing behavior features. Finally, industrial-grade compiler diagnostic information is incorporated to enrich the judgment evidence information.

[0028] In this embodiment, a multimodal static analysis evidence set for the target code is constructed, and the extracted feature information of the target code is serialized and formatted. The structured evidence set and MISRA C:2012 mandatory class rules are then input into a large language model with programming language reasoning capabilities. To ensure the logical consistency of the model's reasoning, a thought chain technique is incorporated into the prompt word template design, allowing the large language model to perform step-by-step reasoning according to a preset thought chain prompt process, including evidence tracing, rule matching, logical induction, and violation judgment generation. The output structured violation judgment result includes the violation rule number, the corresponding evidence content, and the location of occurrence, thereby achieving high coverage and low false alarm detection for embedded C code in aviation safety.

[0029] In this embodiment, the extraction of syntactic structural features for the seven rule categories is divided into three levels: Level L1 is the basic syntactic profile design, Level L2 is rule-oriented context analysis, and Level L3 is rule-oriented semantic extraction. This segmented design effectively distinguishes the general structural attributes of code from the types of rule violations, enabling the extraction of deeper syntactic structural features. In the Level L1 feature extraction stage, a basic, quantitative syntactic information is established for each target code. In the Level L2 feature extraction stage, complex code patterns related to specific mandatory rule classes are identified and quantified by extracting context information during traversal. Rule-oriented inspection logic is embedded in Level L2, requiring the traverser to not only observe the node itself when visiting nodes, but also identify its position in the AST, its parent node, and the state of previously visited nodes. Different extraction functions are designed in Level L2 for different rules to improve the coverage of information extraction. In the Level L3 feature extraction stage, the process delves into a more granular semantic level, detecting complex semantic problems that may lead to undefined behavior or violations of deep coding specifications during traversal.

[0030] The logical analysis feature extraction for the seven rule categories involves constructing a control flow graph related to the mandatory MISRA C rules. The analysis of the control flow graph includes identifying leader nodes and dividing the code into basic blocks. Function statement flows are constructed into non-overlapping basic blocks, and the directed jump relationships between these basic blocks are determined to generate a complete control flow graph structure. By analyzing the control flow structure, the integrity of the control flow is identified, providing valid evidence to verify whether the control flow conforms to MISRA C rules 2.x, 15.x, 16.x, etc. Combined with data flow analysis, the use of uninitialized variables and unused function return values ​​are identified along the control flow path, and this information is recorded in the form of a data flow summary. This ensures that the information extracted from the control flow graph can serve as valid evidence to accurately review whether the code violates rules 14.x, 15.x, etc.

[0031] The semantic structure feature extraction for the seven rule categories is divided into two stages. The first stage involves the construction of a symbol table and scope management. A comprehensive symbol table is built through scope tracking, symbol information extraction, and type stringification, recording all important identifiers defined in the source file. The second stage is in-depth analysis of type conversions. Based on the rule specifications, explicit type conversions in the code are examined, as these are common sources of potential type safety issues, especially when removing type qualifiers. All analyzed type conversions are recorded in a list through two steps: caching declaration information and capturing and analyzing conversions.

[0032] For the preprocessing behavior feature extraction of the seven rule categories, the 20.x part of the mandatory rules in MISRA C is directly formalized. This part of the rules directly specifies the restrictions on the use of macros. To achieve accurate capture of macro definition behavior, information extraction is performed in two stages: First, macro definition extraction and recombination, which extracts macro definitions through a line-by-line scanning procedure and stores each complete macro definition associated with its starting line number. Then, macro rule violation detection, which iteratively checks each macro for violations of rule 20.x.

[0033] The extraction of compilation information from the target code is achieved by enabling strict compilation options in an industrial-grade C compiler to capture all compilation warnings and error messages in the target code, associating this information with specific line numbers, and finally serializing and structuring it with the extracted code feature information from the target code.

[0034] In the design of prompts for inputting structured evidence sets and MISRA C:2012 mandatory rules into a large model for judgment, the Mind Chain Prompt Engineering sets the role of the large language model as a "MISRA C:2012 mandatory rule code audit expert." This requires the model to sequentially analyze structured evidence during reasoning, match each piece of evidence to the relevant rules, generate a logical chain of reasons for violations, and output the final review result in JSON format after reasoning is complete. Specifically, evidence-based large model violation judgment can include: first, role positioning, requiring the model to act as a MISRA C code audit expert; then, evidence tracing analysis, requiring the model to analyze each part of the evidence file, including compilation information, syntactic structure features, control flow graphs, symbol tables, macro information, etc., and clearly indicating the correlation between this evidence and specific MISRA C rules; next, logical deduction, requiring the model to explain the complete reasoning chain from evidence to suspected violation; and finally, generating a structured judgment, requiring the model to output the judgment result in strict JSON format after completing step-by-step reasoning, which must include a list of rule violations based on evidence and their supporting evidence.

[0035] The evidence-driven MISRA C rule review method for aviation safety provided in this embodiment performs structured analysis of source code from five orthogonal dimensions in terms of multimodal code static feature extraction and evidence construction: At the syntactic structure level, it implements three-level feature extraction based on an abstract syntax tree. The first level counts the number of basic syntax nodes, comment information, and literal usage; the second level embeds rule-oriented inspection logic to identify specific violation patterns; and the third level delves into the semantic level to detect undefined behavior clues and expression side effects. At the logical analysis level, it reveals the code execution path topology by constructing a control flow graph and tracks variable lifecycles by combining data flow analysis to identify potential problems such as uninitialized usage and unprocessed return values. At the semantic structure level, it records the scope, type signature, and storage category of identifiers by constructing a symbol table system, paying particular attention to the risk of removing type qualifiers during type conversion operations. At the macro instruction level, it directly detects violations of MISRA C macro usage rules through scanning and parsing. At the compilation information level, it uses compiler diagnostic information as an external evidence source by calling an industrial-grade compiler and enabling the most stringent inspection options. The analysis results from these five dimensions are ultimately integrated into a structured evidence archive. In evidence-based large model violation adjudication, a carefully designed cueing engineering approach constrains the large language model into a rigorous code auditing expert, requiring it to perform an explicit thought chain reasoning process. This process-oriented approach transforms the probabilistic output of the large language model into traceable, deterministic analytical results.

[0036] The following specific experiments verify the effectiveness and advantages of the evidence-driven large language model MISRA C rule review method for aviation safety provided in this invention. For example... Figure 2 As shown, the implementation process of this experimental embodiment mainly includes generating a violation corpus, extracting code features, and determining evidence. The specific implementation of each step is as follows:

[0037] Step S1: Generating a Corpus of Violations

[0038] Step S1.1: Classify the 114 MISRA C rules, design five different categories of prompt word styles, and use the UCB1 algorithm to find the optimal prompt engineering strategy for each category of rules.

[0039] This embodiment designs five different categories of style templates. Specific strategy explanations are shown in Table 1:

[0040] Table 1. Prompt Word Strategy Design Table

[0041]

[0042] The Upper Confidence Bound (UCB1) algorithm is used to find the optimal cue word strategy for each rule class. The UCB1 algorithm can make an optimal balance between "exploration" (trying new or less used cue strategies to explore their potential) and "exploitation" (choosing the strategy with the highest known average reward to obtain stable income).

[0043] Step S1.2: Generate a violation program based on the optimal prompt word strategy for each type of rule, and verify the generated program to determine whether it meets the expected violation criteria.

[0044] After obtaining the optimal hint engineering strategy for each type of rule, the next step is to generate a large-scale, high-quality corpus of violating codes. The goal of this stage is to generate 50 violating programs for each mandatory rule. To achieve this goal, this embodiment designs a workflow that includes chain-of-thought enhanced generation and a two-step hybrid verification process.

[0045] For each mandatory rule, this embodiment no longer uses static hints, but dynamically constructs a composite hint integrated with CoT guidance based on the style of its hint words. This hint will explicitly require DeepSeek-Coder to output its "thought process" before generating the final code.

[0046] For each generated program, it is submitted to ChatGPT for verification. Before being input into ChatGPT, comments and code violation information are removed, and the code is asked whether it violates the corresponding rules. If the ChatGPT output matches the annotation, the program is stored in the violation corpus; otherwise, it undergoes a second human review. This process ensures the accuracy of the violation corpus.

[0047] Step S2: Code Feature Extraction

[0048] This step aims to transform the raw C source code to be reviewed into a rich, structured, and machine-readable evidence archive, laying the data foundation for reliable inference by the large language model. This process no longer relies on the fuzzy, probabilistic overall judgment of the large language model; instead, it first transforms the code into structured evidence features, allowing violation detection to be based on interpretable, strongly constrained rules, thereby improving the reliability of the analysis and reducing the false positive rate. This enables the large language model code review solution to be used in the field of aviation safety.

[0049] At the level of syntactic structure feature extraction, this embodiment designs and implements a hierarchical automated feature extractor based on an abstract syntax tree. This extractor systematically collects multi-level information, from basic syntactic statistics to deep semantic clues, by deeply traversing AST nodes. L1-level features focus on basic syntactic profiling, quantitatively counting the frequency of various syntactic nodes such as function definitions, control flow statements, and operations, while also recording comment patterns and literal usage to characterize the overall structure and complexity of the code. L2-level features advance to rule-oriented contextual analysis, embedding check logic for specific MISRA C rules during the traversal process. When accessing a node, the traverser not only observes the node itself but also identifies its position in the AST, its parent node, and the state of previously visited nodes. For example, for rule 15.6: control flow must be a compound statement, the extractor checks the type of the sub-statement in methods such as `visit_While` and `visit_DoWhile`. By judging variable information, it can accurately identify cases where loop bodies or branch bodies are not enclosed in curly braces "{}". Each instance is incremented by a counter. Different extraction functions are designed at the L2 level for different rules to improve the coverage of information extraction. L3 features delve deeper into the semantic level, aiming to discover complex problems that may lead to undefined behavior or violations of deep rules. L3 implements cross-node semantic relationship analysis. For example, for rule 13.2: side effects in expressions, the extractor maintains a side effect status table. By analyzing the read-write dependencies and modification order of operands, it can accurately identify and record multiple modifications to the same variable within the same expression.

[0050] At the level of logical analysis and feature extraction, this embodiment captures the dynamic execution characteristics of code by constructing a control flow graph and performing data flow analysis. The construction of the control flow graph consists of three stages: Stage 1: Leader identification and basic block partitioning. The code first obtains a set containing all leader statements. Then, the analyzer traverses all statements of the function: once a statement marked as a leader is encountered, a new BasicBlock instance is created, and all consecutive statements from that leader to the next leader are included in this block. In this way, the entire statement flow of the function is precisely divided into a series of non-overlapping basic blocks. During this process, two hash maps, stmt_to_block and label_to_block, are maintained simultaneously for quickly locating the basic block corresponding to any statement or label in subsequent stages. Stage 2: Edge connection and feature generation between basic blocks. After all basic blocks are created, each block is traversed, and its successor block is determined by checking its last statement, and directed edges are established. Stage 3: Intra-procedural data flow analysis. After the control flow is revealed by CFG, an intra-procedural data flow analysis is performed using a custom DataFlowVisitor to uncover defects related to variable states.

[0051] At the semantic structure feature extraction level, this embodiment focuses on constructing a symbol table and parsing the type system to give code elements a clear semantic identity. This is divided into two stages: Stage 1: Symbol table construction and scope management. First, SymbolVisitor constructs a comprehensive symbol table through scope tracking, symbol information extraction, and type stringification, recording all important identifiers defined in the source file. Finally, `self.symbol_table` contains a series of JSON objects, each providing a detailed description of all semantic information for a symbol. Stage 2: In-depth analysis of type conversions. Beyond identifying symbols, SymbolVisitor pays special attention to explicit type conversions in the code, a common source of violations of MISRA C mandatory class rules, especially when type qualifiers are removed. Through caching declaration information and capturing and analyzing conversions, all analyzed type conversions are recorded in a list. Each record includes the location of the conversion, the source type, the target type, and whether a boolean flag indicating whether `const` or `volatile` was removed.

[0052] At the macro instruction feature extraction level, due to the relatively small number of relevant rules, this embodiment focuses on the analysis and review of macro definitions during the C language preprocessing stage. First, macro definitions are extracted through a line-by-line scanning procedure. Upon encountering a macro starting with `#define`, recording logic is initiated, and macro definition fragments spanning multiple lines are concatenated. Finally, each complete macro definition is associated with its starting line number and stored, thus extracting macro information. After obtaining all macro definitions and their location information, `Macro_analysis` iterates through each macro, checking for violations of rule 20.x.

[0053] At the compiler information extraction level, this embodiment introduces diagnostic information from an industrial-grade compiler as authoritative external verification evidence. By configuring the most stringent compiler check options and treating all warnings as errors, all diagnostic information generated during the compilation process is forcibly captured. These warnings and error messages from the compiler are themselves highly credible judgments of code compliance and quality, providing strong external support for the entire evidence system.

[0054] Step S3, Evidence Judgment

[0055] First, the model's expert identity is clearly defined through role-setting instructions, requiring it to analyze from the perspective of a MISRA C code auditing expert. Then, the core step of evidence tracing begins, where the model is forced to analyze each component of the evidence file step-by-step, including compilation diagnostic information, AST characteristics at each level, control flow graph structure, symbol table data, and macro parsing results. It must also clearly indicate which specific MISRA C rule clause these pieces of evidence potentially relate to.

[0056] After tracing the evidence, the model must perform in-depth logical deduction, detailing the complete reasoning chain from specific evidence to deduce the suspected rule violation. This process externalizes the model's internal "black box" thinking process into a traceable analytical path, greatly enhancing the transparency and credibility of the judgment process. Finally, after completing all step-by-step reasoning, the model is allowed to output a structured judgment result strictly following the JSON format, which must list the violated rule number and its corresponding evidentiary basis.

[0057] Experimental Program Set: To ensure the completeness and standardization of the experiment, the experimental program set mainly includes two program libraries: the first is a violation corpus generated in the first phase, containing 4425 programs; the second program library contains 60 safe programs extracted from the source code of real aero-engine embedded systems, which have been confirmed by experts to be fully compliant. The function of this program set is to simulate real development scenarios and directly reflect the results of developers using this embodiment in their daily work.

[0058] Test environment and parameter settings: The experiment was conducted in a Linux environment with 32GB of memory and Ubuntu 22.04 operating system. The large language model used in this embodiment is DeepSeek-Coder-V3, which is an open-source large language model with code generation capabilities.

[0059] Comparison Method: In the comparative experiment, this embodiment was compared with the state-of-the-art open-source tool Cppcheck-v2.18. Cppcheck is an open-source static code analysis tool specifically designed to detect potential errors in C / C++ code, and it includes a plugin specifically for checking MISRA C rules.

[0060] Experimental results:

[0061] Table 2 Comparison of Experimental Results

[0062]

[0063] This implementation (AeroGuardLLM) achieved a detection rate of 82.24% out of 4425 violations, a 56.5% improvement over Cppcheck-v2.18. Furthermore, it detected only 3 false positives out of 60 safe procedures, a 50% reduction in false positives compared to Cppcheck-v2.18. The detection time for each procedure is less than 10 seconds. Compared to commercial tools, this implementation can be embedded into the development process, allowing developers to instantly check completed code and fix violations. This development companion-style detection tool can significantly reduce software development time in the aviation safety field.

[0064] Based on the same inventive concept, embodiments of the present invention also provide an evidence-driven large language model MISRA C rule review system for aviation safety, comprising:

[0065] The multimodal static feature extraction module is used to extract formal features from four perspectives—syntactic structure features, semantic structure features, logical analysis features, and preprocessing behavior features—for target code according to various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, it generates a structured evidence set that includes statistical features of abstract syntax tree nodes, code context structure features, control flow graph features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features.

[0066] The evidence-based large language model reasoning and decision module is used to input the structured evidence set and MISRA C:2012 mandatory rules into a large language model with programming language reasoning capabilities. A thought chain prompting engineering method is used in the prompt word template to guide the model to sequentially perform evidence tracing, rule matching, logical induction, and violation judgment generation. The review results, including the violation rule number, corresponding evidence content, and location of occurrence, are output in structured format (JSON), thereby achieving high coverage and low false alarm violation detection of embedded C code for aviation safety. The specific implementation details and effects of this system embodiment are consistent with the aforementioned method embodiments and will not be repeated here.

[0067] This invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the evidence-driven large language model MISRA C rule review method for aviation safety. The program / instruction code for implementing the method of this invention can be written in any combination of one or more programming languages. This program / instruction code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the program / instruction code causes the steps of the method of this invention to be implemented. The program / instruction code can be executed entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server. All aspects not detailed in this invention are well-known to those skilled in the art.

[0068] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for reviewing MISRA C rules in an evidence-driven large language model for aviation safety, characterized in that: Includes the following steps: For the target code, formal features are extracted from four perspectives: syntax structure features, semantic structure features, logical analysis features, and preprocessing behavior features, in accordance with the various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, a structured evidence set is generated, which includes statistical features of abstract syntax tree nodes, code context structure features, control flow graph features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features. The structured evidence set and the MISRA C mandatory rules are input into a large language model with programming language reasoning capabilities. The model is guided to perform evidence tracing, rule matching, logical induction and violation judgment generation in sequence by using the prompt word template and the thought chain prompt engineering in the prompt word template. The review results are output in a structured format, including the violation rule number, the corresponding evidence content and the location of occurrence.

2. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, Based on the different types of MISRA C enforcement rules, they are divided into seven categories: core language behavior and pitfalls; static code structure and reachability; scope, linking, and visibility; type safety and data conversion; function usage; restrictions on the use of the standard library; and lexical, macro, and syntactic details.

3. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, The extraction of syntactic structural features for each type of rule is divided into three levels: the first level is the design of a basic syntactic profile, the second level is rule-oriented context analysis, and the third level is rule-oriented semantic extraction. In the first-level feature extraction stage, a basic and quantitative syntactic information is established for each target code, including the number of nodes, comment information, and literal usage. In the second-level feature extraction stage, context information is extracted during the traversal process to identify and quantify code patterns related to specific mandatory rule classes. In the third-level feature extraction stage, we delve into the semantic level and detect semantic problems that may lead to undefined behavior or violations of coding standards during the traversal process.

4. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, For each type of rule, the logical analysis feature extraction involves constructing a control flow graph related to the MISRA C mandatory rule. By analyzing the control flow structure, the integrity of the control flow is identified, and valid evidence is provided to verify whether the control flow conforms to the integrity specification in the MISRA C rule. By combining data flow analysis, the use of uninitialized variables and unused function return values ​​are identified along the control flow path. This information is recorded in the form of a data flow summary, providing valid evidence to review whether the code violates the rules.

5. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, The semantic structure feature extraction for each type of rule includes: constructing a symbol table by scope tracking, symbol information extraction, and type stringification to record all identifiers defined in the source file; focusing on explicit type conversions in the code according to the rule specification, and recording all analyzed type conversions in a list through two steps: caching declaration information and capturing and analyzing conversions.

6. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, The preprocessing behavior feature extraction for each type of rule includes: macro definition extraction and recombination, which extracts macro definitions through a line-by-line scanning procedure and stores each complete macro definition in association with its starting line number; macro rule violation detection, which iteratively checks each macro to see if any violations of the rules apply.

7. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, The compilation information extraction of the target code is achieved by enabling strict compilation options in an industrial-grade C compiler to capture all compilation warnings and error messages in the target code and associate the information with specific line numbers.

8. The evidence-driven large language model MISRA C rule review method for aviation safety according to claim 1, characterized in that, In the design of prompts that input the structured evidence set and the MISRA C mandatory rules into the large model for judgment, the Mind Chain prompting project sets the role of the large language model as a code auditing expert for the MISRA C mandatory rules. It requires the model to analyze the structured evidence in sequence during the reasoning process and match each piece of evidence to the relevant rules. At the same time, it generates a logical chain of reasons for violations and outputs the final review results in JSON format after the reasoning is completed.

9. An evidence-driven large language model MISRA C rule review system for aviation safety, used to implement the method according to any one of claims 1-8, characterized in that, include: The multimodal static feature extraction module is used to extract formal features from four perspectives—syntactic structure features, semantic structure features, logical analysis features, and preprocessing behavior features—for target code according to various rules of the MISRA C mandatory class rules. Combined with industrial-grade compiler diagnostic information, it generates a structured evidence set that includes statistical features of abstract syntax tree nodes, code context structure features, control flow graph features, data flow analysis features within functions, symbol and type table features, and macro definition analysis features. The evidence-based large language model reasoning and decision module is used to input the structured evidence set and MISRA C mandatory rules into a large language model with programming language reasoning capabilities. The prompt word template uses mind chain prompting engineering to guide the model to perform evidence tracing, rule matching, logical induction and violation judgment generation in sequence, and output the review results in a structured format, including the violation rule number, corresponding evidence content and occurrence location.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the evidence-driven large language model MISRA C rule review method for aviation safety as described in any one of claims 1-8.

Images