A complex program verification method based on local search solution of nonlinear constraints

Abstract

This invention discloses a method for verifying complex programs based on local search with nonlinear constraints, belonging to the field of computer program verification technology. The method includes: generating an SMT-NRA formula for the program to be verified based on the verification target; constructing a system of linear equations based on the linear equality constraints in the formula, and obtaining a simplified formula by replacing non-free variables with free variables through solving the system of equations; performing heuristic initialization of the simplified formula based on a divide-and-conquer strategy: obtaining initial values ​​through standard random initialization and short-time search, or by dividing the formula into sub-formulas and performing local search solutions respectively; iteratively searching the initial values ​​based on multi-path parallelism and adaptive neighborhood constraints: maintaining a multi-path list, adaptively determining candidate movement directions in each round and assigning them to each path to update the values; determining the properties of the program to be verified based on the final result of the iterative search and outputting the conclusion. This invention achieves efficient verification of key program modules containing complex nonlinear logic.

Description

Technical Field

[0001] This invention belongs to the field of computer program verification technology, specifically relating to a method for verifying complex programs based on local search solutions with nonlinear constraints. Background Technology

[0002] Satisfiability Modulo Theories (SMT) are an automated reasoning technique at the intersection of computer science and mathematical logic. They aim to determine whether a set of constraints, consisting of first-order logic formulas, is satisfiable under a specific background theory (such as integers, real numbers, arrays, bit vectors, etc.). Among these, SMT-NRA formula solving, which involves nonlinear real arithmetic (NRA), has become a core supporting technology in the field of formal verification due to its strong expressive power, allowing for nonlinear operations such as multiplication and higher powers between variables.

[0003] In the fields of software engineering and program verification, with the increasing prevalence of software systems in critical scenarios such as aerospace, financial transactions, and low-level drivers, ensuring program termination and security is crucial. However, modern software involves numerous complex nonlinear arithmetic operations (such as modular exponentiation in encryption algorithms, distance formulas in geometric calculations, and polynomial fitting in signal processing), rendering traditional linear analysis techniques ineffective. Specifically:

[0004] Program Termination Analysis: To prove that a program containing complex loops or recursion can terminate in finite time (e.g., the zankl benchmark set in the SMT-LIB library), verification tools (such as AProVE) typically need to synthesize a polynomial rank function. This function must be strictly decreasing and lower bounded at every state transition of the program. The process of finding the coefficients of this function is essentially equivalent to solving a set of high-dimensional nonlinear real arithmetic inequalities.

[0005] Program security verification: In path analysis-based or symbolic execution-based verification (e.g., the UltimateAutomizer benchmark set in the SMT-LIB library), the verifier needs to determine whether the program has a feasible path that can trigger an error state (such as assertion failure or buffer overflow). When the path conditions involve nonlinear operations, determining the feasibility of the path is transformed into determining whether the corresponding nonlinear logic formula can be satisfied.

[0006] Furthermore, in the field of Cyber-Physical Systems (CPS), SMT-NRA solvers are also used to verify the safety of hybrid models that incorporate continuous physical dynamics (such as vehicle braking distance) and discrete control logic (such as control mode switching). Verification tools combine the system's state transition logic with nonlinear polynomial constraints of physical evolution to generate large-scale SMT-NRA formulas. Solving these formulas is equivalent to finding counterexample trajectories that violate safety properties. Therefore, the solving efficiency of the SMT-NRA solver directly determines whether the safety verification of complex engineering systems can be completed within a finite timeframe.

[0007] However, the core problem in solving SMT-NRA is determining whether a set of nonlinear polynomial constraints composed of Boolean logic combinations exists as a set of real solutions. This is a typical NP-hard symbolic computation and numerical optimization problem. The goal of SMT-NRA is to find variable assignments that satisfy all logical clauses and arithmetic inequalities in a high-dimensional, continuous real space. Due to the presence of nonlinear constraints, the solution space often exhibits a complex topological structure and contains a large number of local extrema, making it difficult for the solution algorithm to perform effective pruning or easily getting trapped in local feasible regions, thus hindering the exploration of the global space and significantly reducing the solution efficiency.

[0008] Traditional SMT-NRA solutions typically employ the CDCL(T) or MCSAT framework, interacting with a dedicated theoretical solver via a Boolean satisfiability (SAT) solver. The theoretical solver itself primarily relies on comprehensive algorithms such as cylindrical algebraic decomposition (CAD). While methods like MCSAT optimize the search mechanism to some extent, their underlying core operations are still limited by double exponential time complexity. This makes them highly susceptible to computational bottlenecks when dealing with large-scale industrial-grade solutions with numerous variables, hindering the ability to deliver results within an acceptable timeframe.

[0009] Unlike the traditional solution frameworks mentioned above, local search algorithms are a class of heuristic solution methods that gradually approximate feasible solutions that satisfy all constraints by continuously making small neighborhood perturbations on the current candidate solutions in the solution space. They exhibit good scalability and (on satisfiable instances) solution efficiency. The paper titled "Local search for solving satisfiability of polynomial formulas" was the first to introduce the idea of ​​local search into solving nonlinear real number theory, demonstrating solution capabilities comparable to mainstream state-of-the-art solvers and even higher solution efficiency. However, this method still faces many challenges when applied to complex program verification tasks:

[0010] (1) Weak initialization strategy: Existing algorithms use pure random or fixed values ​​to generate initial solutions, which often results in the search starting point being far from the feasible region (e.g. far from the coefficient space that satisfies the rank function property), increasing the convergence difficulty and time cost of subsequent iterations.

[0011] (2) Prone to getting trapped in local optima: The nonlinear constraints generated by the program verification problem often have complex solution spaces. When faced with these complex constraints, greedy or hill-climbing strategies using a single path are prone to getting trapped in local optima and unable to escape, causing the search process to stagnate. In the aforementioned literature, when the search gets trapped in a local optimum, the entire search process is restarted to try to avoid this local optimum in the next search. This method is relatively inefficient, as all the search and computation in this attempt are wasted.

[0012] (3) High search complexity: For formulas containing a large number of program variables, existing neighborhood evaluation mechanisms often require calculating the gain of all potential movement directions, resulting in huge computational overhead for single-step iteration. A paper titled "Efficient localsearch for nonlinear real arithmetic" proposes an incremental score calculation method, allowing the algorithm to update only the scores of clauses affected by the current movement, thus saving some score calculation overhead. Furthermore, the code implementation of this method limits the number of directions to be explored, avoiding the time cost of traversing all directions each time. However, the upper limit of the number of directions to be explored in this method cannot be dynamically adjusted with the search process, and there may be a dilemma where none of the explored directions can improve the score.

[0013] (4) Ignoring structural features: Existing methods often treat all constraints as black boxes of equal difficulty, and fail to use part of the program to verify the linear structure in the formula (such as the linear condition of control flow jump) for dimensionality reduction simplification, resulting in limited solution efficiency.

[0014] Therefore, how to improve existing local search algorithms, address their shortcomings in solving complex SMT-NRA problems, and further enhance their solution capabilities and efficiency in large-scale instances is a pressing technical problem that needs to be solved. Summary of the Invention

[0015] In view of the above, the purpose of this invention is to provide a method for verifying complex programs based on local search for nonlinear constraints. This method reduces search complexity by utilizing the linear structural features in the program constraints for preprocessing and dimensionality reduction; it also generates high-quality initial solutions through a divide-and-conquer heuristic initialization mechanism, accelerating the convergence of searches for rank function coefficients or erroneous paths; furthermore, it employs a multi-path parallelism and adaptive neighborhood constraint strategy to balance global exploration and local development, improving the success rate of verifying complex nonlinear programs; and finally, it achieves efficient verification of key program modules containing complex nonlinear logic.

[0016] To achieve the above-mentioned objectives, the present invention provides the following technical solution:

[0017] In a first aspect, the present invention provides a method for verifying complex programs based on local search solutions of nonlinear constraints, comprising the following steps:

[0018] The nonlinear real arithmetic SMT-NRA formula for the program to be verified is generated based on the verification target.

[0019] A system of linear equations is constructed based on the linear equality constraints in the SMT-NRA formula. By solving the system of linear equations, non-free variables are replaced with free variables, and a simplified formula is obtained.

[0020] The simplified formula is heuristically initialized based on the divide-and-conquer strategy: the initial values ​​are obtained by standard random initialization and short-time search solution, or by dividing the formula into sub-formulas and performing local search solutions separately.

[0021] The initial assignment is iteratively searched based on multi-path parallelism and adaptive neighborhood constraints: a multi-path list is maintained, and candidate movement directions are adaptively determined and assigned to each path in each round to update the assignment;

[0022] Based on the final result of the iterative search, determine the properties of the program to be verified and output the verification conclusion.

[0023] Preferably, the step of generating the nonlinear real-number arithmetic SMT-NRA formula for the program to be verified based on the verification target includes:

[0024] To achieve the program termination verification objective, based on the set polynomial rank function template and its decreasing requirement, a set of nonlinear constraints on the rank function coefficients is generated, resulting in the SMT-NRA formula.

[0025] To achieve the goal of program security verification, the path from the program entry point to the error state is extracted, and the nonlinear branch conditions and assignment statements on the path are transformed into logical constraint conjunctions to obtain the SMT-NRA formula.

[0026] Preferably, the construction of a system of linear equations based on the linear equality constraints in the SMT-NRA formula, and the substitution of non-free variables for free variables by solving the system of linear equations to obtain a simplified formula, includes:

[0027] Extract all unit clauses containing linear equality constraints from the SMT-NRA formula to form a linear core set;

[0028] Solve the system of linear equations consisting of the linear core set. If the system of linear equations has no solution, the original SMT-NRA formula is deemed unsatisfactory. If the system of linear equations has a solution, the non-free variables in the SMT-NRA formula are expressed as linear combinations of free variables.

[0029] By substituting the variable substitution relations into the nonlinear clauses and inequality constraints in the original SMT-NRA formula, non-free variables are eliminated, resulting in a simplified formula containing only free variables.

[0030] Preferably, the step of obtaining the initial assignment through standard random initialization and short-time search solution, or by dividing the formula into sub-formulas and performing local search solutions respectively, includes:

[0031] First, perform standard random initialization and short-time search on the simplified formula. If a solution is found, output the solution directly as the initial value; if no solution is found, proceed with the following steps.

[0032] The simplified formula is divided into multiple sub-formulas, and a local search is performed on each sub-formula to obtain candidate initial values. All candidate initial values ​​are then merged to generate initial assignments for subsequent iterations.

[0033] Preferably, the maintenance of the multi-path list, adaptively determining candidate movement directions and assigning them to each path in each round to update the assignment, includes:

[0034] Based on the unsatisfied clauses and their conflict variables under the current assignment, an adaptive set of candidate movement directions is generated;

[0035] The candidate movement directions are scored based on the number or weight of unsatisfied clauses that can be reduced after moving in that direction.

[0036] Based on the scoring results, the optimal and suboptimal directions are assigned to different parallel search paths using a probability-weighted sampling strategy to update the variable assignments of each path until any path finds a solution that satisfies all constraints or reaches a preset termination condition.

[0037] Preferably, the step of adaptively generating a set of candidate movement directions based on unsatisfied clauses and their conflict variables under the current assignment includes:

[0038] Identify all unsatisfied clauses under the current assignment and construct a set of association pairs containing conflicting variables and their corresponding unsatisfied clauses;

[0039] Randomly sample association pairs from the set of association pairs and use the real root isolation technique to find the roots of the single variable polynomials corresponding to the clauses in the association pairs;

[0040] Calculate the variable shift step size that satisfies the clauses in the association pair based on the distribution of the roots, and form the assignment correction vector accordingly.

[0041] The assignment correction vectors generated from all sampled association pairs are aggregated into a candidate movement direction set.

[0042] Preferably, determining the nature of the program to be verified and outputting the verification conclusion based on the final result of the iterative search includes:

[0043] If a solution satisfying all constraints is found, then for program termination verification, the conclusion that the program is terminated and the solution vector are output; for program security verification, the conclusion that the program has security vulnerabilities and the counterexample paths and data are output.

[0044] If the search times out or returns an unknown value, output the conclusion that the verification timed out or the nature of the program is uncertain.

[0045] Secondly, embodiments of the present invention also provide a complex program verification device based on nonlinear constraint local search solution, which is implemented using the above-mentioned complex program verification method based on nonlinear constraint local search solution, including: a formula extraction module, a formula simplification module, an initial search module, an iterative search module, and a result determination module;

[0046] The formula extraction module is used to generate the nonlinear real number arithmetic SMT-NRA formula for the program to be verified based on the verification target;

[0047] The formula simplification module is used to construct a system of linear equations based on the linear equality constraints in the SMT-NRA formula. By solving the system of linear equations, non-free variables are replaced with free variables to obtain a simplified formula.

[0048] The initial search module is used to perform heuristic initialization of the simplified formula based on the divide-and-conquer strategy: the initial values ​​are obtained by standard random initialization and short-time search solution, or by dividing the formula into sub-formulas and performing local search solutions respectively.

[0049] The iterative search module is used to perform iterative search on the initial assignment based on multi-path parallelism and adaptive neighborhood constraints: maintain a multi-path list, adaptively determine candidate movement directions in each round and assign them to each path to update the assignment;

[0050] The result determination module is used to determine the nature of the program to be verified and output the verification conclusion based on the final result of the iterative search.

[0051] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and one or more processors, wherein the memory is used to store a computer program, and the processor is used to implement the above-described complex program verification method based on nonlinear constraint local search solution when the computer program is executed.

[0052] Fourthly, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the aforementioned complex program verification method based on nonlinear constraint local search solution.

[0053] Compared with the prior art, the beneficial effects of the present invention include at least the following:

[0054] (1) The linear structure significantly reduces the dimensionality and complexity of the search space: This invention addresses the characteristic of the SMT-NRA formula, which often contains a mixture of linear and nonlinear constraints. By extracting the linear core and performing variable substitution through a preprocessing step, the original high-dimensional search space is mapped to a low-dimensional free variable space. This dimensionality reduction process allows subsequent local searches to no longer be limited by a large number of simple linear equation constraints, enabling the concentration of computing power to overcome the core nonlinear constraints. As a result, when dealing with large-scale industrial-grade program verification instances, the convergence speed and solution efficiency of the algorithm are significantly improved.

[0055] (2) The problem of blind initialization of random initial values ​​is solved by using divide-and-conquer heuristic initialization, which improves the success rate of solving the problem: This invention abandons the traditional pure random initialization strategy and adopts a constructive initialization method based on the divide-and-conquer idea. It synthesizes the global initial value by fusing the local solutions of the sub-formulas, making the starting point of the search geometrically closer to the feasible region. This strategy effectively reduces the number of invalid iterations in the early stage of the search in order to get closer to the solution space, significantly improves the "cold start" performance of the algorithm when facing deep logical nesting and complex arithmetic constraints, and thus improves the success rate of solving the problem.

[0056] (3) By employing a multi-path parallelism and adaptive neighborhood constraint mechanism, an optimal balance between global exploration capability and single-step computational overhead is achieved: This invention utilizes a multi-path parallelism mechanism to maintain diverse exploration directions in the solution space through probability-weighted sampling, effectively overcoming the shortcomings of traditional single-path search, which is prone to getting trapped in local optima and is difficult to escape. Simultaneously, the adaptive candidate direction generation strategy avoids the high computational cost of evaluating the entire neighborhood in a large-scale variable environment, dynamically adjusting the exploration breadth according to the search stage. This mechanism enables this invention to significantly improve the iteration throughput per unit time while ensuring the ability to escape local optima, thereby achieving rapid solution of the complex SMT-NRA formula.

[0057] (4) Improved success rate of nonlinear program termination and security verification: This invention can effectively handle high-dimensional variables and complex constraint structures commonly found in program verification. In particular, when dealing with industrial-grade benchmark tests such as program termination verification (e.g., the Zankl problem) and security verification (e.g., the Ultimate Automizer problem), it can solve highly difficult cases that traditional local search cannot handle. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart illustrating the complex program verification method based on local search for nonlinear constraints provided in an embodiment of the present invention.

[0060] Figure 2 This is a schematic diagram of the framework of a complex program verification method based on local search for nonlinear constraints provided in an embodiment of the present invention;

[0061] Figure 3 This is a detailed flowchart illustrating the heuristic initialization steps based on the divide-and-conquer strategy provided in an embodiment of the present invention.

[0062] Figure 4 This is a flowchart illustrating the specific implementation of the iterative search steps based on multi-path parallelism and adaptive neighborhood constraints provided in this embodiment of the invention.

[0063] Figure 5 This is a schematic diagram of the structure of a complex program verification device based on nonlinear constraint local search solution provided in an embodiment of the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and do not limit the scope of protection of this invention.

[0065] The inventive concept of this invention is as follows: Addressing the problems of blind initialization, susceptibility to local optima, high computational overhead, and neglect of structural features in existing local search algorithms when processing SMT-NRA formulas generated for program verification, this invention provides a complex program verification method based on nonlinear constraint local search. First, the program to be verified is transformed into mathematical constraints. Linear preprocessing effectively reduces the dimensionality of the complex formulas generated for program verification. Then, a divide-and-conquer initialization strategy is used to assist in exploring better initial values. Finally, a multi-path search mechanism combining real root isolation is used to achieve efficient exploration of the nonlinear space. This enables the provision of definite program termination or safety verification conclusions within a finite time, significantly improving the formal verification capability and efficiency for complex programs.

[0066] like Figure 1 As shown in the embodiment, a method for verifying complex programs based on local search solutions of nonlinear constraints is provided, including the following steps:

[0067] S1, generates the nonlinear real arithmetic SMT-NRA formula for the program to be verified based on the verification target.

[0068] In this embodiment, this step aims to transform the actual engineering problem into a mathematical problem to be solved, and specifically includes the following sub-steps.

[0069] S1.1, Input reception:

[0070] Lexical and syntactic analysis is performed on the source code of the program to be verified to construct a control flow graph (CFG) and identify program semantics containing program variables and transition relationships between basic blocks.

[0071] S1.2, Constraint Generation:

[0072] The verification tool transforms program semantics into nonlinear real arithmetic SMT-NRA formulas based on preset verification objectives (termination or security). These formulas typically contain nonlinear polynomial equations and inequalities connected by Boolean logic.

[0073] (1) For program termination verification (such as zankl (rank function synthesis verification) type problems): set a polynomial rank function template. (For example According to the strict decreasing property requirement of the rank function ( ,in (for the states before and after the loop), generate information about the coefficients. ( The nonlinear constraint set is then used to eliminate quantifiers through the Farkas Lemma quantifier elimination method, resulting in the quantifier-free basic SMT-NRA formula.

[0074] (2) For program security verification (such as UltimateAutomizer (path feasibility verification) type problems): search for potential paths from the entry point to the error state (such as assert(false), assert(false)), and define the non-linear branch conditions on the path (such as... ) and assignment statements (such as The expression is transformed into a logical constraint conjunction, and the SMT-NRA formula corresponding to the constraint is obtained through the conjunction operation.

[0075] S1.3, Format Conversion: Encode the constraint set generated in step S1.1 or S1.2 into the SMT-NRA standard format and use it as input for the subsequent solver.

[0076] S2. Based on the linear equality constraints in the SMT-NRA formula, a system of linear equations is constructed. By solving the system of linear equations, non-free variables are replaced with free variables, resulting in a simplified formula.

[0077] In the embodiments, such as Figure 2 As shown on the left, this step aims to reduce the dimensionality of the problem and includes the following sub-steps.

[0078] S2.1, Extract the linear core unit clause:

[0079] The processor first receives the input SMT-NRA formula. Iterate through all clauses in the formula and extract all clauses that simultaneously satisfy the following two conditions as the linear core set: (a) the clause is a unit clause; (b) the arithmetic constraint corresponding to the clause is a linear equation of the form: ,in , It is a constant. As variables, The total number of variables. For example, the clause. It will be extracted.

[0080] S2.2, Solve the system of linear equations:

[0081] All the extracted linear equations form a system of equations. The system of equations is solved using methods such as Gaussian elimination. If the system of equations has no solution, the original formula is directly determined. If the solution is not satisfied (UNSAT), the process terminates. If the system of equations has a solution, the free and non-free variables are identified, and the non-free variables are expressed as a linear combination of the free variables.

[0082] S2.3, Variable substitution generates simplified formulas :

[0083] Substitute the linear relationship obtained from S2.2 into the original formula. In the remaining nonlinear clauses and inequality constraints, eliminating non-free variables yields a simplified formula containing only free variables. Subsequent search steps are all based on the simplified formula. This reduces the dimensionality of the subsequent search space.

[0084] S3. Perform heuristic initialization of the simplified formula based on the divide-and-conquer strategy: obtain the initial assignment by standard random initialization and short-time search solution, or by dividing the formula into sub-formulas and performing local search solutions respectively.

[0085] In the embodiments, such as Figure 2 Middle part and Figure 3 As shown, this step aims to generate a high-quality initial solution and includes the following sub-steps.

[0086] S3.1, Standard Random Initialization and Short-Time Search:

[0087] First, let's simplify the formula. Perform global random sampling and run local search within a preset short time limit (e.g., 1-2 minutes or 10,000-20,000 iterations).

[0088] If a solution satisfying all constraints is found directly in a short-time search ( Figure 2 If the branch marked "①" is true, then no further complex search is needed; return "Satisfiable (SAT)" and the corresponding solution, and proceed to step S4. When returning the solution, it is necessary to combine the linear relationship from step S1 to reconstruct the original formula. A complete solution. If no solution is found ( Figure 2 If the branch is marked "① No", then a divide-and-conquer strategy is adopted.

[0089] S3.2, Divide-and-conquer strategy and substructure decomposition fusion (see details) Figure 2 ):

[0090] (1) Formula division: simplify the formula The set of clauses is divided into two non-empty subsets of equal size. and The partitioning is based on the number of clauses in each subset, aiming to balance them as much as possible.

[0091] (2) Solve separately: For and Perform local searches separately. If the sub-formula... If the condition is met, save the solution; otherwise, save the value assigned when the search terminated, and record it as the first candidate initial value. Similarly, for sub-formulas... Run the local search algorithm to obtain the second candidate initial value. Because subformulas have fewer constraints, it is easier to find satisfactory solutions or high-quality approximate solutions.

[0092] (3) Defusion: Calculation and The arithmetic or weighted average is used as the final heuristic initial assignment that incorporates substructure information. This initial value is then assigned to all paths in subsequent iterations of the search. This initial value incorporates features from both substructures and is closer to the feasible region than a purely random value.

[0093] S4, based on multi-path parallelism and adaptive neighborhood constraints, iteratively searches for the initial assignment: maintains a multi-path list, adaptively determines candidate movement directions in each round and assigns them to each path to update the assignment.

[0094] In the embodiments, such as Figure 2 right side and Figure 4 As shown, this step performs an iterative search based on the initial assignment to determine the final solution, and specifically includes the following sub-steps.

[0095] S4.1, Multi-path parallel state maintenance:

[0096] Initialize path list ,in The number of parallel paths (e.g.) Initially, all path variables are assigned values ​​based on those generated in step S2. .

[0097] S4.2, generating candidate directions based on real root isolation (see details) Figure 4 ):

[0098] (1) Conflict identification and sampling: At the beginning of each iteration, determine the upper limit of the number of candidate directions that can be explored in this iteration. and the lower limit of the expected number of high-quality directions Identify the current assignment. Sampling is performed on all unsatisfied clauses, and the variables involved in the unsatisfied clauses are sampled. A "variable-clause" pair .

[0099] (2) Construction of a single-variable polynomial: For a selected pair , bring in Except The assignment of values ​​to other variables transforms the multivariate polynomial constraints into constraints about... Single variable polynomial constraints ( represent (e.g., relationships).

[0100] (3) Real root isolation: Obtained using the real root isolation algorithm. The open interval containing all real roots is used to determine the clause. Established The range of values ​​for .

[0101] (4) Step size calculation: Calculate the variable The precise distance (step size) from the current value to the target interval. (Including two directions, increasing and decreasing the variable), as candidate directions of movement.

[0102] S4.3, Adaptive Scoring and Probability Sampling:

[0103] (1) Calculate the score for each candidate move direction, based on the number or weight of unsatisfied clauses that can be reduced after moving in that direction. If the number of "high-quality directions" with scores higher than the score before moving is insufficient... Then continue sampling and evaluating from the conflicting variables until the quantity requirement is met or all possible directions have been traversed; and The values ​​are dynamically adjusted according to the search process. Larger values ​​are used in the early stages of the search to enhance exploration, while smaller values ​​are used in the later stages to accelerate convergence.

[0104] (2) Multi-path allocation strategy (e.g.) Figure 4 (As shown at the bottom): This summarizes the scores of all candidate movement directions, with the highest-scoring direction being the "best direction". The main path in the task list is selected directly (e.g., ...). ), to ensure the convergence performance of the greedy algorithm; for the rest Path ( The path is assigned based on a probability-weighted sampling method using the score (the higher the score, the greater the probability of being selected), in order to maintain path diversity and prevent getting stuck in local optima.

[0105] S4.4 Termination Judgment and Iteration:

[0106] (1) Constraint satisfaction judgment: Check whether any path after the update satisfies the constraint. If the following conditions are met ( Figure 2 If "② is" is the branch, then return "Satisfiable (SAT)". Similar to step S3, this time it's necessary to combine the variable substitution linear relationship from step S2 to reconstruct the original formula. The complete solution.

[0107] (2) Timeout or maximum number of steps reached judgment: If not satisfied ( Figure 2 (The branch indicating "② No") checks if the resource limit has been reached. If it has been reached ( Figure 2 If "③ is" is a branch, return "Unknown"; if not reached ( Figure 2 If the branch is "③ No", then proceed to the next round of "multi-path parallel state maintenance" and continue iterating.

[0108] S5. Based on the final result of the iterative search, determine the properties of the program to be verified and output the verification conclusion.

[0109] In this embodiment, this step maps the mathematical solution back to the original engineering problem, specifically including the following sub-steps.

[0110] S5.1, Result Restoration:

[0111] If a satisfactory solution is found in step S4, first combine it with the linear relationship from step S1 to reconstruct the original formula. The complete solution vector.

[0112] S5.2, Conclusion Output:

[0113] If step S3 or S4 returns "Satisfiable (SAT)" and the corresponding solution vector, output the corresponding verification conclusion. For termination verification: reconstruct the specific coefficients of the polynomial rank function from the solution vector, and output "Program termination verified" and the rank function expression. For security verification: indicate that there is a feasible path to the error state, output "Program has a security vulnerability" and counterexample input data.

[0114] If step S4 returns an unknown or timeout, output "Unable to verify" or "Timeout" message.

[0115] Furthermore, to verify the practical effectiveness of the method of this invention, industrial-grade verification examples from a subset of SMT-LIB's zankl and UltimateAutomizer were collected for experimental verification. Experimental results show that the method proposed in this invention successfully found solutions in several challenging nonlinear instances, which is difficult for existing local search methods before improvement. In 49 instances of zankl, the improved local search algorithm of this invention solved 49, outperforming the 46 solved by the original local search algorithm; in 48 instances of UltimateAutomizer, the improved local search algorithm of this invention solved 37, outperforming the 27 solved by the original local search algorithm. In comparison with mainstream complete solvers (such as Z3 and CVC5), this invention exhibits significant complementary advantages in specific types of nonlinear constraints (such as the generation of high-order polynomial rank functions). Further analysis revealed that in these instances, this invention can converge to feasible solutions in a shorter time, fully demonstrating its performance advantages in complex program verification scenarios and reflecting the great potential of this method in ensuring system security and reliability in real software engineering scenarios.

[0116] Based on the same inventive concept, such as Figure 5 As shown, this embodiment of the invention also provides a complex program verification device 500 based on nonlinear constraint local search solution, including: a formula extraction module 510, a formula simplification module 520, an initial search module 530, an iterative search module 540, and a result determination module 550.

[0117] The formula extraction module 510 is used to generate nonlinear real number arithmetic SMT-NRA formulas for the program to be verified based on the verification target.

[0118] The formula simplification module 520 is used to construct a system of linear equations based on the linear equality constraints in the SMT-NRA formula. By solving the system of linear equations, non-free variables are replaced with free variables to obtain a simplified formula.

[0119] The initial search module 530 is used to perform heuristic initialization of the simplified formula based on the divide-and-conquer strategy: the initial values ​​are obtained by standard random initialization and short-time search solution, or by dividing the formula into sub-formulas and performing local search solutions respectively.

[0120] The iterative search module 540 is used to perform iterative search on the initial assignment based on multi-path parallelism and adaptive neighborhood constraints: it maintains a multi-path list, adaptively determines candidate movement directions in each round and assigns them to each path to update the assignment.

[0121] The result determination module 550 is used to determine the nature of the program to be verified and output the verification conclusion based on the final result of the iterative search.

[0122] Based on the same inventive concept, embodiments of the present invention also provide an electronic device, including a memory and one or more processors, wherein the memory is used to store a computer program, and the processor is used to implement the above-described complex program verification method based on nonlinear constraint local search solution when executing the computer program.

[0123] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium storing a computer program. When the computer program is executed by a computer, the above-described complex program verification method based on nonlinear constraint local search solution is implemented.

[0124] It should be noted that the complex program verification device, electronic device, and computer-readable storage medium based on nonlinear constraint local search solution provided in the above embodiments all belong to the same inventive concept as the complex program verification method based on nonlinear constraint local search solution. For details of their specific implementation process, please refer to the embodiments of the complex program verification method based on nonlinear constraint local search solution, which will not be repeated here.

[0125] The specific embodiments described above illustrate the technical solution and beneficial effects of the present invention in detail. It should be understood that the above description is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A complex program verification method based on nonlinear constraint local search solution, characterized in that, Includes the following steps: The nonlinear real arithmetic SMT-NRA formula for the program to be verified is generated based on the verification target. A system of linear equations is constructed based on the linear equality constraints in the SMT-NRA formula. By solving the system of linear equations, non-free variables are replaced with free variables, and a simplified formula is obtained. The simplified formula is heuristically initialized using a divide-and-conquer strategy: initial values ​​are obtained by standard random initialization and short-time search, or by dividing the formula into sub-formulas and performing local search on each sub-formula. This includes: first, standard random initialization and short-time search are performed on the simplified formula. If a solution is found, the solution is directly output as the initial value. If no solution is found, the following steps are performed: the simplified formula is divided into multiple sub-formulas, and local search is performed on each sub-formula to obtain candidate initial values. All candidate initial values ​​are then merged to generate initial values ​​for subsequent iterations. The initial assignment is iteratively searched based on multi-path parallelism and adaptive neighborhood constraints: a multi-path list is maintained, and candidate movement directions are adaptively determined and assigned to each path in each round to update the assignment; Based on the final result of the iterative search, determine the properties of the program to be verified and output the verification conclusion.

2. The complex program verification method based on nonlinear constraint local search solution according to claim 1, characterized in that, The nonlinear real-number arithmetic SMT-NRA formula for generating the program to be verified based on the verification target includes: To achieve the program termination verification objective, based on the set polynomial rank function template and its decreasing requirement, a set of nonlinear constraints on the rank function coefficients is generated, resulting in the SMT-NRA formula. To achieve the goal of program security verification, the path from the program entry point to the error state is extracted, and the nonlinear branch conditions and assignment statements on the path are transformed into logical constraint conjunctions to obtain the SMT-NRA formula.

3. The complex program verification method based on nonlinear constraint local search solution according to claim 1, characterized in that, The linear equation system is constructed based on the linear equality constraints in the SMT-NRA formula. By solving the linear equation system and replacing non-free variables with free variables, a simplified formula is obtained, including: Extract all unit clauses containing linear equality constraints from the SMT-NRA formula to form a linear core set; Solve the system of linear equations consisting of the linear core set. If the system of linear equations has no solution, the original SMT-NRA formula is deemed unsatisfactory. If the system of linear equations has a solution, the non-free variables in the SMT-NRA formula are expressed as linear combinations of free variables. By substituting the variable substitution relations into the nonlinear clauses and inequality constraints in the original SMT-NRA formula, non-free variables are eliminated, resulting in a simplified formula containing only free variables.

4. The complex program verification method based on nonlinear constraint local search solution according to claim 1, characterized in that, The maintenance of the multi-path list, adaptively determining candidate movement directions and assigning them to each path in each round to update the assignment, includes: Based on the unsatisfied clauses and their conflict variables under the current assignment, an adaptive set of candidate movement directions is generated; The candidate movement directions are scored based on the number or weight of unsatisfied clauses that can be reduced after moving in that direction. Based on the scoring results, the optimal and suboptimal directions are assigned to different parallel search paths using a probability-weighted sampling strategy to update the variable assignments of each path until any path finds a solution that satisfies all constraints or reaches a preset termination condition.

5. The complex program verification method based on nonlinear constraint local search solution according to claim 4, characterized in that, The adaptive generation of a set of candidate movement directions based on unsatisfied clauses and their conflict variables under the current assignment includes: Identify all unsatisfied clauses under the current assignment and construct a set of association pairs containing conflicting variables and their corresponding unsatisfied clauses; Randomly sample association pairs from the set of association pairs and use the real root isolation technique to find the roots of the single variable polynomials corresponding to the clauses in the association pairs; Calculate the variable shift step size that satisfies the clauses in the association pair based on the distribution of the roots, and form the assignment correction vector accordingly. The assignment correction vectors generated from all sampled association pairs are aggregated into a candidate movement direction set.

6. The complex program verification method based on nonlinear constraint local search solution according to claim 1, characterized in that, The step of determining the nature of the program to be verified and outputting the verification conclusion based on the final result of the iterative search includes: If a solution satisfying all constraints is found, then for program termination verification, the conclusion that the program is terminated and the solution vector are output; for program security verification, the conclusion that the program has security vulnerabilities and the counterexample paths and data are output. If the search times out or returns an unknown value, output the conclusion that the verification timed out or the nature of the program is uncertain.

7. A complex program verification device based on nonlinear constraint local search solution, implemented using the complex program verification method based on nonlinear constraint local search solution as described in any one of claims 1 to 6, characterized in that, include: The module includes a formula extraction module, a formula simplification module, an initial search module, an iterative search module, and a result determination module. The formula extraction module is used to generate the nonlinear real number arithmetic SMT-NRA formula for the program to be verified based on the verification target; The formula simplification module is used to construct a system of linear equations based on the linear equality constraints in the SMT-NRA formula. By solving the system of linear equations, non-free variables are replaced with free variables to obtain a simplified formula. The initial search module is used to perform heuristic initialization of the simplified formula based on a divide-and-conquer strategy: initial values ​​are obtained by standard random initialization and short-time search, or by dividing the formula into sub-formulas and performing local search solutions for each sub-formula. This includes: firstly, standard random initialization and short-time search are performed on the simplified formula. If a solution is found, the solution is directly output as the initial value. If no solution is found, the following steps are performed: the simplified formula is divided into multiple sub-formulas, and local search is performed on each sub-formula to obtain candidate initial values. All candidate initial values ​​are then merged to generate initial values ​​for subsequent iterations. The iterative search module is used to perform iterative search on the initial assignment based on multi-path parallelism and adaptive neighborhood constraints: maintain a multi-path list, adaptively determine candidate movement directions in each round and assign them to each path to update the assignment; The result determination module is used to determine the nature of the program to be verified and output the verification conclusion based on the final result of the iterative search.

8. An electronic device comprising a memory and one or more processors, the memory being used to store a computer program, characterized in that, The processor is used to implement the complex program verification method based on nonlinear constraint local search solution as described in any one of claims 1 to 6 when executing a computer program.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by a computer, it implements the complex program verification method based on nonlinear constraint local search solution as described in any one of claims 1 to 6.

Images