Index consistency verification method and system based on dynamic simulation coupling

Abstract

This invention relates to the field of control system simulation verification technology, and discloses a method and system for verifying index consistency based on dynamic simulation coupling. Key features include: obtaining a pre-verification information set through demand table parsing and temporal semantic discretization, extraction of the original nonlinear model, generation of benchmark simulation trajectories, and extraction of linearized auxiliary models; obtaining a verification decomposition and scheduling information set through reverse dependency graph construction, sub-problem decomposition, and hot-start instantiation; obtaining potential counterexamples through simulation-guided priority ranking, integrity checks, and consistency checks; and obtaining hierarchical verification conclusions and a traceable evidence chain through counterexample set clustering and structural invariant induction, bidirectional mapping and iterative joint reasoning of simulation verification, multi-method collaboration, and confidence labeling. This invention, through hierarchical verification scheduling and bidirectional coupling of simulation, achieves automated consistency verification of demands and models, improving the efficiency, completeness, and reliability of verification results for complex nonlinear systems.

Description

Technical Field

[0001] This invention relates to the field of control system simulation verification technology, specifically to a method and system for verifying the consistency of indicators based on dynamic simulation coupling. Background Technology

[0002] In model-based design practice, Simulink, as a mainstream modeling and simulation environment, is widely used in the development process of complex control systems. Requirements specification is a core part of system design, and its quality directly affects the correctness and reliability of the final product. To improve the verifiability of requirements, Simulink provides a Requirements Table module, allowing engineers to write executable requirements specifications in an "if-then" paradigm. These specifications can act as test qualifiers during the design phase to verify whether the implementation meets expected behavior. The completeness and consistency of requirements are core quality attributes pursued in requirements engineering; checking for these two types of defects can effectively reduce rework and testing costs later. Since R2022a, Simulink has supported automated checks on the completeness and consistency of requirements tables, but this functionality only applies to stateless requirements that do not contain constraints on time-evolving behavior. However, requirements in real-world engineering often involve references to previous states or constraints on duration conditions. These stateful requirements describe the temporal evolution of the system, and their completeness and consistency checks face more complex semantic challenges. Furthermore, industrial-grade Simulink models generally include nonlinear operation modules such as multiplication, division, trigonometric functions, and lookup table interpolation. When performing formal verification of systems containing such nonlinear dynamics, how to construct a decisionable verification problem without losing the accuracy of the original model constitutes another technical obstacle, thus existing technologies have shortcomings. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention aims to provide a method and system for verifying index consistency based on dynamic simulation coupling. By parsing the requirement table and discretizing temporal semantics, stateful requirements containing the `prev` and `dur` operators are transformed into decisionable logical formulas on discrete trajectories. Simultaneously, the original nonlinear model encoding is extracted to preserve the system's dynamic integrity and generate a benchmark simulation trajectory. Based on this, a reverse dependency graph and a hot-start instantiation pool are constructed to decouple and accelerate the solution of the verification problem. Then, using the benchmark simulation trajectory as a reference, simulation-guided priority sorting and integrity checks are used for rapid defect detection. Finally, consistency checks are used to discover potential... Counterexamples are used to extract necessary conditions for contradictions by clustering counterexample sets and inductively summarizing structural invariants based on potential counterexamples. Simulation verification, bidirectional mapping, and iterative joint reasoning are combined to filter out false counterexamples. Finally, through multi-method collaboration and confidence labeling, hierarchical verification conclusions and traceable evidence chains are output. This solves the problem of requirement consistency in stateful and nonlinear models containing temporal evolution behaviors, which is difficult to automate with existing technologies. At the same time, it alleviates the engineering application obstacles caused by the undecidability of formal verification in general cases. It realizes high-confidence automated verification of requirement consistency in complex nonlinear control systems, effectively improving the completeness of verification, solution efficiency, and result credibility.

[0004] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for verifying index consistency based on dynamic simulation coupling, comprising: Based on the Simulink model file and requirement table module, the verification pre-information set is obtained through requirement table parsing and temporal semantic discretization, original nonlinear model extraction, benchmark simulation trajectory generation and linearized auxiliary model extraction. Based on the aforementioned verification pre-information set, a verification decomposition and scheduling information set is obtained through reverse dependency graph construction, sub-problem decomposition, and hot start instantiation. Based on the aforementioned verification decomposition and scheduling information set, potential counterexamples are obtained through simulation-guided priority sorting, integrity checks, and consistency checks. Based on the potential counterexamples, hierarchical verification conclusions and traceable evidence chains are obtained through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

[0005] Furthermore, the pre-verification information set includes a complete formal requirement specification model, the original nonlinear model encoding, the baseline simulation trajectory, and a linearized auxiliary model. The acquisition method of the pre-verification information set includes: Based on the Simulink model file and requirement table module, a complete formal requirement specification model is obtained by parsing requirement records, categorical variables, identifying temporal operators, and generating discretization expansion rules. Based on the Simulink model file, the original nonlinear model code is obtained by extracting the dynamic equations, discretizing the recursion, and encoding them into nonlinear arithmetic terms. Based on the Simulink model file, the baseline simulation trajectory is obtained by running typical simulations and checking the requirement satisfaction. Based on the baseline simulation trajectory, a linearized auxiliary model is obtained by selecting a linearized operating point, extracting the state space matrix, and limiting its application range.

[0006] Furthermore, the Simulink model file and requirement table module, by parsing requirement records, categorical variables, identifying temporal operators, and generating discretization expansion rules, obtains a complete formal requirement specification model, including: Based on the Simulink model file and requirement table module, the basic structure of the requirement record is obtained by parsing the record identifier and precondition expressions line by line; Based on the basic structure of the aforementioned requirement record, the variable classification result is obtained by scanning the signal lines and distinguishing them into sets of input and output variables; Based on the variable classification results, the prev and dur operators are identified by an abstract syntax tree and discretization decision rules are defined to obtain the temporal expansion rules; Based on the aforementioned temporal expansion rules, a complete formalized requirement specification model is obtained by recursively replacing temporal operators and extracting the physical value range.

[0007] Furthermore, the verification decomposition and scheduling information set includes a reverse dependency graph structure, sub-problem scheduling order, and a hot-start instantiation pool. The methods for obtaining the verification decomposition and scheduling information set include: Based on the complete formal requirement reduction model in the aforementioned pre-verification information set, the reverse dependency graph structure and the sub-problem scheduling order are obtained by extracting constraint boundaries, tracing dependencies in reverse, and decomposing sub-problems. Based on the complete formalized requirement specification model and linearized auxiliary model in the aforementioned verification pre-information set, a hot-start instantiation pool is obtained by constructing a requirement topology graph, identifying potential conflicting pairs, and estimating boundary values.

[0008] Furthermore, the complete formal requirement reduction model based on the aforementioned pre-verification information set, through extracting constraint boundaries, reverse-tracking dependencies, and decomposing sub-problems, yields the reverse dependency graph structure and the sub-problem scheduling order, including: Based on the complete formal requirement specification model, the constraint boundaries at each position are obtained by extracting the instantiation postcondition constraints of each output variable at each trajectory position. Based on the constraint boundary, the reverse dependency graph structure is obtained by tracing the values ​​of the preconditions and the input variables they depend on from the set of allowed values. Based on the aforementioned reverse dependency graph structure, by dividing the subproblems according to connected components and pruning irrelevant variables, a simplified set of subproblem variables is obtained. Based on the simplified set of subproblem variables, the subproblem scheduling order is obtained by weighting and sorting by the number of variables and the dependency depth.

[0009] Further, the step of obtaining the hot-start instantiation pool by constructing a requirement topology graph, identifying potential conflicting pairs, and estimating boundary values ​​based on the complete formal requirement specification model and linearized auxiliary model in the verification pre-information set includes: Based on the complete formal requirement specification model, the relationship topology between requirements and conditions is obtained by constructing a requirement topology graph containing requirement nodes and atomic condition nodes. Based on the aforementioned association topology, a set of potential conflicting pairs is obtained by detecting demand pairs that share precondition atoms but have disjoint postconditions; Based on the set of potential contradictions and the linearization auxiliary model, a hot-start instantiation pool is obtained by quickly estimating the boundary value instances of shared atomic conditions.

[0010] Furthermore, based on the verification decomposition and scheduling information set, potential counterexamples are obtained through simulation-guided priority sorting, integrity checks, and consistency checks, including: Based on the baseline simulation trajectory, the instantiation priority ranking result is obtained by defining a weighted distance metric and arranging the exploration order; Based on the instantiation priority ranking result and the complete formal requirement specification model, the integrity check result is obtained by constructing an integrity counterexample search formula and solving it using a satisfiability module theory solver. Based on the integrity check results and the verification decomposition and scheduling information set, potential counterexamples are obtained by constructing a consistency counterexample search formula and solving it using a δ-complete satisfiability modulus solver.

[0011] Furthermore, based on the potential counterexamples, the hierarchical verification conclusions and traceable evidence chains are obtained through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling, including: Based on the potential counterexamples and the reverse dependency graph structure, a knowledge base of structural invariants is obtained by calculating the intersection of counterexample clustering and the kernel variable set. Based on the potential counterexamples and the benchmark simulation trajectory, through the iterative closed loop of forward focusing mapping and reverse simulation configuration, the simulation verification conclusions and counterexample markers are obtained. Based on the aforementioned structural invariant knowledge base, simulation verification conclusions, and reverse dependency graph structure, hierarchical verification conclusions are obtained by using multiple methods to collaboratively close the loop and labeling them according to confidence level. Based on the aforementioned hierarchical verification conclusions and counterexample markers, a traceable chain of evidence is obtained through report generation, requirement tracing, and defect repair.

[0012] Furthermore, the structural invariant knowledge base obtained based on the potential counterexamples and reverse dependency graph structure, through counterexample clustering and the intersection of the kernel variable set, includes: Based on the potential counterexamples, by storing each potential counterexample in the counterexample set and recording its discovery boundary, conflict requirement pair, contradiction triggering location and contradiction time span, a cumulative counterexample set and its metadata are obtained; Based on the accumulated negative example set and its metadata, and the reverse dependency graph structure, the clustering results are obtained by performing first-level clustering according to conflict requirements and second-level clustering according to the similarity of the kernel variable set. Based on the clustering results, structural invariants are obtained by calculating the intersection of the kernel variable sets of all counterexamples in each category containing multiple counterexamples; Based on the structural invariants, a knowledge base of structural invariants and a boundary priority ranking are obtained by constructing prediction formulas and solving them preferentially for unsearched boundaries, combined with incremental updates and evaluation of prediction accuracy.

[0013] Secondly, the present invention provides an index consistency verification system based on dynamic simulation coupling, comprising: Information generation module: Based on the Simulink model file and requirement table module, it obtains the verification pre-processing information set through requirement table parsing and temporal semantic discretization, extraction of the original nonlinear model, generation of benchmark simulation trajectory and extraction of linearized auxiliary model; Decomposition and scheduling module: used to obtain the verification decomposition and scheduling information set based on the verification pre-information set through reverse dependency graph construction, sub-problem decomposition and hot start instantiation; Counterexample generation module: used to obtain potential counterexamples based on the verification decomposition and scheduling information set through simulation-guided priority sorting, integrity checks and consistency checks; The verification closed-loop module is used to obtain hierarchical verification conclusions and traceable evidence chains based on the potential counterexamples through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

[0014] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: This invention obtains a pre-verification information set through demand table parsing and temporal semantic discretization, extraction of the original nonlinear model, generation of benchmark simulation trajectory, and extraction of linearized auxiliary model. It then obtains a verification decomposition and scheduling information set based on reverse dependency graph construction, sub-problem decomposition, and hot-start instantiation. Potential counterexamples are obtained according to simulation guidance priority ranking, integrity checks, and consistency checks. Hierarchical verification conclusions and traceable evidence chains are obtained through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration, and confidence labeling. This achieves automated consistency verification between the Simulink model and the demand table, solving the problems of limited verification coverage, low solution efficiency, disconnect between formal verification and actual simulation, and lack of contradiction pattern induction and prediction mechanisms in traditional methods. It improves the completeness, operational efficiency, and result credibility of verification for complex nonlinear systems. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the steps of the indicator consistency verification method based on dynamic simulation coupling of the present invention. Figure 2 A flowchart outlining the steps to obtain the pre-verification information set; Figure 3 A flowchart outlining the steps to obtain the verification decomposition and scheduling information set; Figure 4 Flowchart of steps to obtain potential counterexamples; Figure 5 Flowchart of steps to obtain graded verification conclusions and a traceable chain of evidence; Figure 6 This is a schematic diagram of the index consistency verification system based on dynamic simulation coupling of the present invention. Detailed Implementation

[0016] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof.

[0017] Example 1 like Figure 1 As shown, this embodiment provides a method for verifying index consistency based on dynamic simulation coupling, including: Based on the Simulink model file and requirement table module, the verification pre-information set is obtained through requirement table parsing and temporal semantic discretization, original nonlinear model extraction, benchmark simulation trajectory generation and linearized auxiliary model extraction. Based on the verification pre-information set, the verification decomposition and scheduling information set is obtained through reverse dependency graph construction, sub-problem decomposition, and hot start instantiation; Based on the verification decomposition and scheduling information set, potential counterexamples are obtained through simulation-guided priority sorting, integrity checks, and consistency checks. Based on potential counterexamples, hierarchical verification conclusions and traceable evidence chains are obtained through counterexample set clustering and structural invariant induction, simulation verification of bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

[0018] The process involves several key steps: First, requirement table parsing involves parsing the identifiers, preconditions, and postconditions of each requirement record line by line using the requirement table module in the Simulink model. This extracts the basic structure of the requirement records and categorizes input and output variables, converting unstructured requirement text into structured requirement entries that can be formally processed. Second, temporal semantic discretization involves identifying the `prev` history operator and `dur` duration operator in the preconditions and postconditions using an abstract syntax tree based on the structured requirement entries. Discretization rules are defined according to a fixed simulation step size and recursively expanded into specific logical expressions at position indices, converting requirement constraints containing temporal semantics into decidable logical formulas on discrete trajectories. Third, the extraction of the original nonlinear model involves extracting the complete continuous-time dynamic equations containing nonlinear operations such as multiplication, division, trigonometric functions, and table lookup interpolation from the Simulink model file. These equations are then discretized into a recursive form using a fixed step size and encoded as nonlinear arithmetic terms recognizable by the SMT solver, retaining all nonlinear behavior without any linearization approximations. This process is used for subsequent consistency verification. The verification process provides an accurate original system dynamics model. The baseline simulation trajectory generation involves running the original model in the Simulink environment using typical input stimuli such as step signals, sinusoidal scans, or typical operating condition sequences. It records the complete input trajectory, state trajectory, and output trajectory, and verifies the fulfillment of all requirements at each location. If a contradiction is found in the baseline simulation trajectory, a conclusion is directly output and the subsequent process is terminated. This provides a working point for subsequent linearization extraction and a similarity reference for instantiation priority ranking. The linearization auxiliary model extraction involves selecting the endpoint of the baseline simulation trajectory as the linearization working point, extracting the linearized state space matrix at that working point, and converting it to discrete affine form. This matrix is ​​limited to boundary value estimation for hot-start instantiation and input trajectory distance calculation for simulation guidance, and is prohibited from participating in formal consistency verification calculations. This provides auxiliary guidance for the subsequent solution process. The verification pre-process information set is a unified data set output from the above steps, including the complete formal requirement specification model, the original nonlinear model encoding, the baseline simulation trajectory, and the linearization auxiliary model. This serves as the common data foundation for subsequent verification decomposition, solution, and closed-loop feedback.

[0019] The reverse dependency graph is constructed based on a complete formal requirement specification model. It extracts the constraint boundaries of each output variable at each trajectory position and converts them into a set of permissible values. Starting from the output constraints, it traces the influence path of the input variable values ​​backward along the requirement dependencies, constructing a directed bipartite graph structure from output constraints to input dependencies to characterize the spatiotemporal dependency between requirement constraints and input variables. Subproblems are decomposed into independent, uncoupled subproblems based on the connected components of the reverse dependency graph. Irrelevant variables that do not affect the satisfaction of subproblems are removed through reverse reachability pruning. Subproblems are then sorted by a weighted sum of the number of variables and dependency depth, from smallest to largest. The dependency depth is the minimum dependency depth of all output constraints in the subproblems. The maximum distance between the earliest input position and the current position is used to reduce the overall solution complexity and clarify the solution order of subproblems. The hot start instantiation is a process of constructing a requirement topology graph based on a complete formal requirement specification model, identifying potential contradictory requirement pairs that share at least one precondition atom but have disjoint postconditions, and combining it with a linearization auxiliary model to estimate boundary value instances and construct an initial search anchor point set. This process guides the SMT solver to prioritize exploring high-value search regions and accelerate the discovery of counterexamples. The verification decomposition and scheduling information set is a set of scheduling information output from the above steps, including the reverse dependency graph structure, subproblem scheduling order, and hot start instantiation pool. This information guides the solution order and initial search direction of each subproblem in the subsequent verification solution process.

[0020] Simulation-guided priority sorting uses a weighted distance metric defined between input trajectories based on the baseline simulation trajectory. The exploration order of the input space is arranged from smallest to largest distance from the baseline simulation trajectory, prioritizing inputs closer to the baseline. This process serves as a search heuristic to improve solution efficiency without discarding any input regions. Integrity checking involves constructing a completeness counterexample search formula, encoding the proposition "there exists an output variable at a certain trajectory position where all preconditions of related requirements are false." This formula guides the solver to solve the problem according to instantiation priority, verifying the completeness of the requirement set coverage. If incompleteness is found, a conclusion is directly output and the subsequent verification process is terminated. Consistency... The check involves constructing a consistent counterexample search formula, replacing the output variable in the postcondition with the output function of the original nonlinear model, and encoding the proposition that "there exists an input trajectory and initial state that makes the system follow the original nonlinear dynamics, all inputs are within the physical range, and at least one requirement is violated." This process guides the delta-complete satisfiability model solver to solve the problem according to the subproblem scheduling order and instantiation priority. This process is used to detect instances where the system dynamics and input constraints are satisfied but the requirement is violated. Potential counterexamples are combinations of input trajectories and initial states that satisfy the original nonlinear dynamics and input physical range constraints, but violate at least one requirement constraint. These combinations serve as the raw material for subsequent counterexample induction and loop closure confirmation.

[0021] The counterexample clustering process involves accumulating all discovered potential counterexamples and their metadata. It performs primary clustering based on conflict requirements, followed by secondary clustering based on the Jaccard similarity of the kernel variable sets. This process categorizes counterexamples into classes reflecting different conflict patterns, distinguishing different types of conflicting needs and providing a classification basis for structural invariant extraction. Structural invariant induction involves calculating the intersection of the kernel variable sets of all counterexamples within each class containing multiple counterexamples and the intersection of the activation precondition set. This constructs a necessary condition formula for triggering this type of conflict, and a prediction formula is built based on the invariants. The process of prioritizing unsearched boundaries is used to predict the conflict probability of unknown boundaries from known contradiction patterns, optimizing the global search scheduling. The simulation verification bidirectional mapping defines the forward mapping from simulation trajectories to SMT formulas and the reverse mapping from SMT counterexamples to simulation parameters, realizing the mutual conversion between the formal verification space and the simulation execution space, and establishing a coupling channel between formal verification and physical simulation. Iterative joint reasoning is a closed-loop process of iteratively executing forward focused search, obtaining counterexamples through SMT solving, and configuring simulation verification through reverse mapping, reproducing contradictions in the simulation. The process of identifying genuine defects and marking them as false counterexamples if they are not reproduced is used to filter false counterexamples in the formal solution, thereby improving the credibility of the verification results. A multi-faceted collaborative approach involves constructing a multi-level verification framework where reverse dependency graph decomposition, structural invariant prediction, and simulation verification provide mutually reinforcing closed-loop verification. The reverse dependency graph provides the basis for kernel variable set calculations for invariant calculations, structural invariants provide high-priority boundary predictions for simulation focusing, and simulation verification provides continuous feedback labels for invariant optimization, achieving synergistic gains across each verification stage. Confidence labeling is based on the solution results... The verification conclusions are categorized and labeled, with δ-unsatisfiable being marked as high-confidence pass, δ-satisfiable and confirmed by simulation as defect discovery, and timeout unsatisfiable as low-confidence reference. This process is used to output verification results that differentiate between levels of reliability. The tiered verification conclusions include high-confidence pass, defect discovery, and low-confidence reference, which can intuitively reflect the reliability of the verification conclusions. The traceable evidence chain includes verification reports, requirement form quality acceptance reports, and a structured counterexample knowledge base, which supports defect location, requirement traceability, and iterative repair.The structured counterexample knowledge base is constructed as follows: all potential counterexamples discovered during the verification process and their metadata are stored in a counterexample set, the metadata including discovery boundaries, conflict requirement pairs, contradiction triggering locations, and contradiction time spans; based on the reverse dependency graph structure, first-level clustering is performed according to conflict requirement pairs, and second-level clustering is performed according to the similarity of kernel variable sets; for each category containing multiple counterexamples, the intersection of kernel variable sets and the intersection of activation precondition sets are calculated to obtain structural invariants; prediction formulas are constructed based on structural invariants, and the unsearched boundaries are prioritized; combined with simulation to confirm the verification conclusions, counterexamples are marked as confirmed or excluded; the prediction accuracy, confidence level, and verification metadata of each category are recorded to form a structured counterexample knowledge base.

[0022] This embodiment constructs a unified verification data foundation through demand temporal semantic discretization and precise encoding of nonlinear models. It optimizes the verification solution scheduling through reverse dependency graph decomposition and hot-start instantiation. It guides the search from known contradictory patterns to unknown regions through structural invariant inductive prediction. It filters false counterexamples through iterative closed-loop filtering of bidirectional mapping between simulation and formal verification. This achieves automated verification of the consistency of indicators between the Simulink model and the demand table, effectively improving the completeness, solution efficiency and result credibility of the verification. It is suitable for demand consistency verification scenarios of complex nonlinear control systems.

[0023] Furthermore, this embodiment provides a step-by-step approach based on a Simulink model file and a requirement table module. This involves requirement table parsing and temporal semantic discretization, extraction of the original nonlinear model, generation of the baseline simulation trajectory, and extraction of the linearized auxiliary model to obtain the pre-verification information set. The steps include: Based on the Simulink model file and requirement table module, a complete formal requirement specification model is obtained by parsing requirement records, categorical variables, identifying temporal operators, and generating discretization expansion rules; specifically including: Based on the Simulink model file and the requirement table module, the basic structure of the requirement record is obtained by parsing the record identifier and precondition expressions line by line. Based on the basic structure of the requirement record, the variable classification results are obtained by scanning the signal lines and distinguishing them into sets of input and output variables. Based on the variable classification results, the prev and dur operators are identified by abstract syntax trees and discretization decision rules are defined to obtain the temporal expansion rules. Based on the temporal expansion rules, the complete formal requirement specification model is obtained by recursively replacing the temporal operators and extracting the physical value range. Based on the Simulink model file, the original nonlinear model code is obtained by extracting the dynamic equations, discretizing the recursion, and encoding them into nonlinear arithmetic terms. Based on the Simulink model file, the baseline simulation trajectory is obtained by running typical simulations and checking the requirement satisfaction. Based on the baseline simulation trajectory, a linearized auxiliary model is obtained by selecting linearized operating points, extracting the state space matrix, and limiting its application range.

[0024] The Simulink model file is a simulation project file that carries the dynamic logic and module connection relationships of the controlled object, and is built using the Simulink visual modeling environment. The requirement table module is a requirement management table unit embedded in the Simulink model, which is obtained by adding a Requirements Table module to the model and entering requirement items. Parsing requirement records is a process of extracting the text items in the requirement table into a structured form, which is used to convert unstructured requirement text into structured elements that can be logically operated. Categorical variables are a process of classifying model interface signals according to signal flow and constraint attributes, which is used to distinguish between external excitation signals and constrained output signals. Identifying temporal operators is a process of extracting time-related semantic operators from the requirement logic expression, which is used to locate the time constraint logic in the requirement. Generating discretization expansion rules is a process of mapping continuous time temporal semantics to discrete trajectory position logic, which is used to establish the correspondence between temporal operators and discrete lengths. The complete formal requirement specification model is a set of requirement logic after structured processing and temporal discretization, which serves as the basis for subsequent verification and solution.

[0025] The record identifier is a unique number for each requirement, used to locate and trace specific requirement items; the precondition and postcondition expressions are logical texts describing the triggering conditions and constraints of the requirement, used to carry the activation conditions and output constraints of the requirement; the basic structure of the requirement record is a triplet structure consisting of a unique number, precondition text, and postcondition text, used to store the complete information of a single requirement; the scan signal line is the process of traversing the model interface ports and connections and extracting signal attributes, used to enumerate all interactive signals of the model; the input and output variable sets are two types of signal sets divided according to the signal flow direction. The input variable set contains signals driven only by external stimuli, and the output variable set contains signals whose values ​​are constrained in the postconditions, used to clarify the range of independent and dependent variables in the verification; the variable classification result is the set partitioning result after completing the signal classification, serving as the variable basis for subsequent temporal analysis and dependency analysis; the abstract syntax tree is a tree-shaped data structure generated by parsing logical expressions according to syntax rules, which can clearly express the operation hierarchy and parameter relationships of the expression, used to identify the operator types and parameter structures in the expression. The structure includes: The `prev` and `dur` operators are two typical temporal semantic operators in the requirements description. The `prev` operator represents the value of a reference variable at the previous simulation time, and the `dur` operator represents that a logical expression remains true for at least a given threshold physical time, used to express time-related constraints in the requirements; Discretization decision rules are rules for converting continuous temporal semantics into discrete position decisions based on a fixed simulation step size, used to clarify the calculation method of temporal operators on discrete trajectories; Temporal expansion rules are a set of rules including discretization decision rules for `prev` and `dur` operators, used to guide the recursive expansion of temporal expressions; Recursion is an iterative processing method that replaces nested temporal expressions with position index expressions layer by layer from the outermost temporal operator, used to expand nested temporal expressions into pure positional logic; Replacement of temporal operators is the process of replacing the `prev` and `dur` operators in an expression with corresponding positional logic expressions, used to obtain instantiated logical formulas without temporal operators; Physical value range refers to the upper and lower bounds of the input variables that can be reached in actual engineering, used to limit the search space of input variables during the verification process.

[0026] Extracting the dynamic equations involves deriving the continuous-time state transition and output relationships from the Simulink module connection relationships, used to obtain the original dynamic mathematical description of the system. Discretization recursion involves converting the continuous-time differential equations into discrete-time recursive equations using a fixed simulation step size, used to adapt the continuous dynamics to the discrete trajectory verification framework. Encoding into nonlinear arithmetic terms involves converting the nonlinear operations in the discrete recursion into a format recognizable by the satisfiability modular theory solver, used to encode the system dynamics into constraint terms in the verification formula. The verification formula is the counterexample search logic formula constructed in subsequent integrity and consistency checks, including the integrity counterexample search formula for the requirement coverage completeness judgment proposition and the consistency counterexample search formula for the requirement consistency judgment proposition, wherein the system dynamics are used as constraint terms in the consistency counterexample search formula. The original nonlinear model encoding is a discrete system dynamics encoding result that retains all nonlinear characteristics, used as the system dynamics basis for consistency verification; running typical simulations is a simulation execution process that uses commonly used engineering input excitations to drive the model, used to generate system operating trajectories representing conventional operating conditions; checking requirement satisfaction is a verification process that checks whether each requirement is valid at each position on the simulation trajectory, used to quickly identify requirement conflicts under the baseline operating condition; the baseline simulation trajectory is a complete time series of inputs, states, and outputs obtained under typical excitations, used as a reference benchmark for selecting linearization operating points and prioritizing instantiation; selecting linearization operating points involves selecting specific states on the baseline simulation trajectory for linearization approximation. The process of processing the state and input points is used to determine the expansion position of the linearization auxiliary model; extracting the state space matrix is ​​the process of linearizing the nonlinear model at the selected operating point to obtain linear state space parameters, which is used to generate the linearization auxiliary model; limiting the scope of use is to clearly define the allowed and prohibited application scenarios of the linearization auxiliary model, in order to avoid linearization errors from being introduced into the formal verification results; the limitation includes that the model is only used for two auxiliary links: hot start instantiation boundary value estimation and simulation guidance distance calculation, and it is prohibited from participating in the coding of consistency verification formulas; the linearization auxiliary model is a linearized discrete state space model at the operating point, which is only used to assist in solution guidance and does not participate in formal verification calculations. The linearization auxiliary model is extracted as follows: the endpoint of the benchmark simulation trajectory is selected as the linearization operating point, and the state space matrix at the linearization operating point is extracted using Simulink's built-in linearization tool (or numerical perturbation method), including the state transition matrix, input matrix, output matrix, and feedforward matrix; it is then converted into discrete affine form. This model is a single-layer discrete state-space model with no training process. It is obtained only through analytical linearization. Its inputs are the external stimuli and initial state values ​​of the system, and its outputs are the system state and output variables. It is only used to guide the solution and does not participate in the formal verification calculation.

[0027] Specifically, such as Figure 2 As shown, the complete formal requirement specification model is first constructed. Based on the Simulink model file and the requirement table module, each line of the requirement table is read line by line, and the unique record identifier, precondition expression text, and postcondition expression text of each requirement are extracted to form the basic structure of the requirement record corresponding to each requirement. This structure uses the record identifier as an index to store the original text of the precondition and postcondition of the corresponding requirement, ensuring that each requirement can be uniquely traced through the identifier. Based on the basic structure of the requirement record, the Simulink model interface signal lines associated with the requirement table are scanned, and all signals that have data association with the requirement table are enumerated. The signals are classified according to their driving source and constraint attributes. Signals driven only by external input ports and not affected by the internal state of the model are classified into the input variable set, and signals whose values ​​are constrained in the postcondition expression and determined by the internal state of the model and the input are classified into the output variable set, thus obtaining the variable classification result. Based on the variable classification results, an abstract syntax tree is constructed for the precondition and postcondition expressions of each requirement. By traversing the nodes of the abstract syntax tree, the `prev` history operator and the `dur` duration operator are identified, and the target object and parameters of each operator are recorded. Discretization judgment rules for the two types of operators are defined according to the fixed simulation step size, and the temporal expansion rules are obtained. The fixed simulation step size is determined by the system simulation sampling period, specifically: the fixed simulation step size is equal to the system simulation sampling period, or is an integer multiple of the system simulation sampling period. For example, when the system simulation sampling period is 0.01 seconds, the fixed simulation step size is 0.01 seconds (i.e., equal to the sampling period), or 0.02 seconds (i.e., twice the sampling period). The discretization rule for the `prev` operator is to take the initial value of the variable at the starting position of the trajectory, and then take the value of the variable at the previous trajectory position at other positions. The discretization rule for the `dur` operator is to divide the duration constraint threshold by the fixed simulation step size and round up to obtain the sliding window length, and then determine whether the logical expressions corresponding to all positions within the window are true at the current trajectory position. The duration constraint threshold is set according to the temporal performance constraints of the requirement, determined by the minimum duration of the logical expression specified in the corresponding requirement item, with a value range of 0.1 seconds to 20 seconds, and a value of 0.5 seconds in this embodiment. Based on the temporal expansion rule, a recursive expansion method is used to process the expression layer by layer from the outermost layer inward, replacing all `prev` and `dur` temporal operators with the specific logical expressions at the corresponding trajectory position indices, resulting in instantiation precondition expressions and instantiation postcondition expressions without temporal operators. At the same time, the physical lower bound and physical upper bound of each input variable are extracted from the signal attributes of the Simulink model. The instantiation requirement logic, input and output variable classification, and input physical value range are integrated to obtain a complete formal requirement reduction model.

[0028] Then, the original nonlinear model encoding is constructed. The mathematical logic and connections of each module are parsed from the Simulink model file, deriving the continuous-time state transition equation and output equation containing all nonlinear operations, which serve as the original continuous-time dynamic equation. The nonlinear operations include multiplication, division, trigonometric functions, exponential functions, logarithmic functions, lookup table interpolation, etc. The continuous-time dynamic equation is discretized using a fixed simulation step size. The continuous differential equation is converted into a discrete-time recursive form using numerical integration, yielding the original nonlinear discrete state transition function and the original nonlinear model output function. All nonlinear operations in the discrete recursive relation are directly encoded into nonlinear arithmetic terms recognizable by the δ-complete satisfiable modular theory solver. The δ-complete satisfiable modular theory solver is a formal verification and solution tool that supports nonlinear real arithmetic and has controllable numerical error. The encoding process preserves the complete nonlinear behavior without any linearization approximation, resulting in the original nonlinear model encoding. After encoding, the encoded calculation results are numerically compared with the Simulink simulation output at the corresponding positions of the baseline simulation trajectory to obtain the relative error. If the relative error is greater than a preset error threshold, the extraction and encoding results are corrected. The preset error threshold is determined by balancing numerical accuracy requirements and computational efficiency, and its value ranges from 10. -7 Up to 10 -5 For example, the value is 10. -6 .

[0029] Then, the baseline simulation trajectory is generated. The original model is run once in the Simulink environment, using typical input stimuli as the external drivers of the model. These typical input stimuli include step signals, sinusoidal sweep signals, or user-specified typical operating condition sequences. During the simulation, the complete input trajectory, state trajectory, and output trajectory are recorded synchronously to form the baseline simulation trajectory. At each position of the baseline simulation trajectory, the satisfaction of all requirements is checked one by one. If a requirement violation is found at any position, a requirement conflict conclusion is directly output and all subsequent verification processes are terminated. If all requirements on the baseline simulation trajectory are satisfied, the baseline simulation trajectory is used as the reference benchmark for subsequent linearization extraction and instantiation priority ranking. Further, the linearization auxiliary model is constructed. The endpoint state and corresponding input of the baseline simulation trajectory are selected as the linearization operating point. The linearized state space matrix at this operating point is extracted using Simulink's built-in linearization tools, including the state transition matrix, input matrix, output matrix, and feedforward matrix. This matrix is ​​then converted into discrete affine form to obtain the linearized state space model. The application of this linearized state-space model is strictly limited. It is only permitted for two auxiliary stages: boundary value estimation of shared atomic conditions during hot-start instantiation and calculation of input trajectory distance during simulation guidance. Substituting it into the encoding calculations of subsequent consistency verification formulas is strictly prohibited to avoid linearization errors affecting the accuracy of verification results, ultimately resulting in a linearized auxiliary model. In this embodiment, the values ​​of parameters such as the fixed simulation step size and preset error threshold are merely examples. Those skilled in the art can set these values ​​according to actual engineering scenarios and accuracy requirements; this embodiment does not impose any restrictions on them.

[0030] This embodiment achieves automatic conversion from natural language requirements to formal verification models through demand structured analysis and temporal semantic discretization. It ensures the accuracy of verification dynamics through complete nonlinear model encoding, constructs a reference benchmark for the verification process through baseline simulation trajectories, and provides solution guidance through a linearized auxiliary model with limited usage scope without affecting verification accuracy. This realizes the standardization and automated construction of pre-verification information, effectively improving the accuracy and efficiency of subsequent verification solutions.

[0031] Furthermore, this embodiment provides a step for obtaining a verification decomposition and scheduling information set based on the verification pre-information set through reverse dependency graph construction, sub-problem decomposition, and warm-start instantiation, including: Based on the complete formal requirement specification model in the pre-verification information set, the reverse dependency graph structure and the sub-problem scheduling order are obtained by extracting constraint boundaries, tracing dependencies in reverse, and decomposing sub-problems; specifically including: Based on the complete formal requirement specification model, the constraint boundaries at each trajectory position are obtained by extracting the instantiated postcondition constraints of each output variable. Based on the constraint boundaries, the reverse dependency graph structure is obtained by tracing the values ​​of the preconditions and their dependent input variables from the set of allowed values. Based on the reverse dependency graph structure, the simplified subproblem variable set is obtained by dividing the subproblems into subproblems according to connected components and pruning irrelevant variables. Based on the simplified subproblem variable set, the subproblem scheduling order is obtained by weighting and sorting by the number of variables and dependency depth. Based on the complete formal requirement specification model and linear auxiliary model in the pre-verification information set, a hot-start instantiation pool is obtained by constructing a requirement topology graph, identifying potential conflicting pairs, and estimating boundary values; specifically including: Based on the complete formal requirement specification model, a requirement topology containing requirement nodes and atomic condition nodes is constructed to obtain the association topology between requirements and conditions. Based on the association topology, a set of potential conflicting pairs is obtained by detecting requirement pairs that share precondition atoms but have disjoint postconditions. Based on the set of potential conflicting pairs and the linearization auxiliary model, a hot-start instantiation pool is obtained by quickly estimating the boundary value instances of shared atomic conditions.

[0032] The process of extracting constraint boundaries involves extracting the constraint ranges corresponding to each output variable at each trajectory position from the complete formal requirement specification model. This process clarifies the allowable value ranges of the output variables at each position. Output variables are signals whose values ​​are constrained in the requirement postconditions and are determined by the model's internal state and input; these have already been categorized in the complete formal requirement specification model. Trajectory positions are time sampling points on the discrete simulation trajectory, corresponding to integer multiples of the fixed simulation step size. Instantiated postcondition constraints are postcondition logic expressions after temporal discretization, used to characterize the value constraints of the output variables at the corresponding positions. The constraint boundaries are the constraints on each output variable at each trajectory position. The corresponding allowed value range serves as the starting point for reverse dependency tracing. Reverse dependency tracing is an analytical process that traces influencing factors backward from the output constraints along the demand logic chain, used to establish the spatiotemporal relationship between output constraints and input variables. The allowed value set is the range of values ​​that output variables are allowed to take under the current state and input conditions, obtained by instantiating postcondition constraints. Reverse precondition tracing is the process of identifying the set of preconditions that trigger output constraints along the demand logic, used to locate the source of activation conditions for output constraints. The input variable value is the value of the input variable at an earlier time on which the precondition depends, used to characterize the input influence source of the output constraints.

[0033] The reverse dependency graph structure is a directed bipartite graph structure that depicts the spatiotemporal dependency between output constraints and input variables. It consists of output location nodes, input location nodes, and dependency edges, serving as the structural basis for subproblem decomposition. Subproblem decomposition is the process of breaking down the original verification problem into multiple independent subproblems based on the connectivity of the reverse dependency graph, thereby reducing the overall solution complexity. Connected components are subgraphs formed by interconnected nodes in the reverse dependency graph; nodes within the same connected component have dependency relationships, while different connected components are not coupled. Subproblems are independent verification problems corresponding to a single connected component in the reverse dependency graph. The subproblems are decoupled and can be solved independently; irrelevant variable pruning is the process of removing input variables that do not affect the satisfaction of subproblems through reverse reachability determination, which is used to further reduce the variable size of subproblems; the reduced subproblem variable set is the set of variables corresponding to each subproblem after irrelevant variable pruning, retaining only the variables that affect the satisfaction of subproblems; the number of variables is the number of elements in the reduced subproblem variable set corresponding to the subproblem, which is used to measure the size of the subproblem; the subproblem scheduling order is the order in which the subproblems are solved, which is obtained by sorting the subproblems in ascending order of complexity, and is used to guide the solution scheduling of subsequent verification.

[0034] Constructing a requirement topology graph is a process of building a bipartite graph structure representing the relationships between requirements and atomic conditions, used to identify condition-sharing relationships between requirements. Requirement nodes are nodes representing individual requirements in the requirement topology graph, corresponding to each requirement in the complete formal requirement specification model. Atomic condition nodes are nodes representing indivisible comparison expressions in the requirement topology graph. The relationship topology between requirements and conditions is a bipartite graph structure containing requirement nodes, atomic condition nodes, and their associated edges, used to characterize the dependency relationships between requirements and their preconditions and postconditions. Shared precondition atoms occur when the preconditions of two different requirements contain the same atomic condition, used to determine the overlap of activation conditions for requirements. Disjoint postconditions occur when the postcondition constraints of two requirements do not intersect, used to determine the mutual exclusivity of output constraints for requirements. Requirement pairs are pairs of requirement entries used for pairing and detecting potential conflicts. Identifying potential conflict pairs is based on... The process of detecting potentially conflicting demand combinations using the demand topology graph is used to locate demand pairs with a high probability of conflict. The potential conflict pair set is a collection of all demand pairs that satisfy shared precondition atoms and have non-overlapping postconditions, serving as the object of boundary value estimation. The boundary value estimation process is a process of calculating boundary value instances of potential conflict pairs based on a linearized auxiliary model, used to generate the initial search anchor points for the solver. Fast estimation is an efficient solution method that uses a linearized auxiliary model for approximate calculations, without calling the complete nonlinear model, to improve the efficiency of initial instance generation. Boundary value instances of atomic conditions are specific numerical instances of the critical values ​​of the corresponding atomic conditions. For conditions greater than or less than, values ​​near the threshold are taken; for interval conditions, values ​​at the endpoints and midpoints are taken. The hot-start instantiation pool is an initial search anchor point set composed of all boundary value instances, used to inject the solver before each solution to guide the priority exploration of high-value search areas.

[0035] Specifically, such as Figure 3As shown, the process first involves constructing a reverse dependency graph and scheduling subproblems. Based on the complete formal requirement specification model in the verification pre-confirmation information set, it iterates through all output variables and all trajectory positions, extracting the instantiated post-constraints of each output variable at its corresponding trajectory position. These constraints are then converted into a set of allowed values ​​for the corresponding output variable at that position, resulting in the constraint boundaries for each output variable at each position. For each output constraint boundary at each position, starting from the corresponding set of allowed values, the process traces backward along the logical dependencies of the requirements. First, it identifies the set of pre-constraints that allow the output variable to fall within the corresponding constraint range. Then, it continues to trace the input variable values ​​at earlier trajectory positions upon which these pre-constraints depend, establishing a dependency relationship from the output position to the input position. All output position nodes, input position nodes, and corresponding dependency edges together constitute the reverse dependency graph structure. Based on the aforementioned reverse dependency graph structure, all connected components in the graph are identified, with each component corresponding to an independent subproblem. The original verification problem is thus decomposed into a set of uncoupled subproblems. For each subproblem, it is checked whether all input variables appear on the reverse path reachable from the output node of that subproblem. If an input variable is not on any reachable path, it is determined that the variable does not affect the satisfaction of the subproblem, and it is removed from the subproblem variable set, completing irrelevant variable pruning and obtaining a simplified subproblem variable set. For each simplified subproblem, the weighted sum of the number of variables and dependency depth is calculated as a complexity measure. All subproblems are sorted in ascending order of complexity measure to obtain the subproblem scheduling order. The variable quantity weight and dependency depth weight are determined by configuring the scale priority and time priority of the solution scenario. Specifically, the scale priority and time priority are normalized parameters set according to the requirements of the solution scenario. The higher the scale priority, the greater the variable quantity weight; the higher the time priority, the greater the dependency depth weight. Variable quantity weight = scale priority / (scale priority + time priority), dependency depth weight = time priority / (scale priority + time priority), and the sum of the two is 1. The value range of both the variable quantity weight and dependency depth weight is 0.3 to 0.7, and for example, the value is 0.5.

[0036] Then, a hot-start instantiation pool is constructed. Based on the complete formal requirement specification model in the verification pre-information set, a bipartite topology graph containing requirement nodes and atomic condition nodes is built. Each requirement node corresponds to a requirement, and each atomic condition node corresponds to an indivisible comparative logic unit. Requirement nodes are connected to their contained pre-condition atomic nodes via pre-association edges, and requirement nodes are connected to their contained post-condition atomic nodes via post-association edges, thus obtaining the association topology between requirements and conditions. Based on this association topology, all pairwise requirement pairs are traversed. It is checked whether two requirements share at least one pre-condition atomic node, and whether the post-condition atomic nodes of the two requirements have no intersection. If both conditions are met, the requirement pair is determined to be a potential conflict pair. All requirement pairs that meet the conditions together constitute a set of potential conflict pairs. For each pair of requirements in the set of potential contradictions, a linearized auxiliary model from the pre-verification information set is used to quickly estimate the boundary values ​​of the shared pre-existing atomic conditions. For atomic conditions of the type greater than or less than, the values ​​near their atomic condition critical thresholds are taken as boundary instances. The atomic condition critical thresholds are set according to the critical constraints of the requirement indicators and are determined by the boundary values ​​of the output variables or state variables in the corresponding requirement entries. In this embodiment, each atomic condition takes the critical value of its corresponding requirement indicator. For atomic conditions of the interval type, the two endpoints and the midpoint of the interval are taken as boundary instances. All boundary value instances are deduplicated and together constitute a hot-start instantiation pool. The upper limit of the size of the hot-start instantiation pool is determined by a trade-off between available computing resources and solution efficiency, and the value ranges from 500 to 2000. An exemplary value of 1000 is used. When the upper limit is exceeded, the pool is truncated after sorting by the contradiction probability of the boundary values. In this embodiment, the values ​​of parameters such as variable number weight, dependency depth weight, and hot-start instantiation pool size upper limit are only examples. Those skilled in the art can set them according to actual conditions. This embodiment does not impose any restrictions on these parameters.

[0037] This embodiment decouples and splits the verification problem by constructing a reverse dependency graph and decomposing connected components. It simplifies the scale of solution variables by pruning reverse reachability and identifies potential contradictory pairs by demand topology analysis and generates a hot-start instantiation pool. This achieves reasonable scheduling of verification tasks and efficient guidance of the solution direction, effectively reducing the overall verification solution complexity and improving the convergence speed and running efficiency of the counterexample search.

[0038] Furthermore, this embodiment provides a step-by-step approach to obtain potential counterexamples based on verification decomposition and scheduling information sets, through simulation-guided priority sorting, integrity checks, and consistency checks, including: Based on the baseline simulation trajectory, the instantiation priority ranking result is obtained by defining a weighted distance metric and arranging the exploration order; Based on the instantiation priority ranking results and the complete formal requirement specification model, the integrity check results are obtained by constructing an integrity counterexample search formula and solving it using a satisfiability module theory solver. Based on the integrity check results and the verification decomposition and scheduling information set, potential counterexamples are obtained by constructing a consistency counterexample search formula and solving it using the δ-complete satisfiability modulus theory solver.

[0039] Among them, the weighted distance metric is a quantitative indicator that measures the similarity between any input trajectory and the benchmark simulation trajectory. It is obtained by calculating the weighted sum of the deviations of all input variables at each trajectory position, and is used to quantify the degree of deviation between the input trajectory and the benchmark condition, providing a basis for the search order ranking; the exploration order arrangement is the process of sorting the search order of the input space according to the weighted distance from smallest to largest, which is used to guide the solver to prioritize the exploration of input regions closer to the benchmark condition; the instantiation priority ranking result is the set of exploration order of each region in the input space, which serves as the guide for the instantiation order of the solver in the subsequent solving process; the integrity counterexample search formula is a logical formula for judging the completeness of the coding requirement coverage proposition, which is used to check whether there is a situation where all the preconditions of the relevant requirements of the output variable at a certain trajectory position are not met; the satisfiability modular theory solver is a formal solution tool for judging the satisfiability of logical propositions based on Boolean satisfiability theory, which is used to solve the integrity counterexample search formula and output the judgment result; integrity check result. The system covers the completeness determination results of the requirement set, including both complete and incomplete counterexamples, to determine whether to proceed to the subsequent consistency check stage. The scheduling information set, namely the verification decomposition and scheduling information set, includes the reverse dependency graph structure, subproblem scheduling order, and hot-start instantiation pool, to guide the solution scheduling and initial search direction of the consistency check process. The consistency counterexample search formula is a logical formula that encodes the requirement consistency determination proposition, replacing the output variable in the postcondition with the original nonlinear model output function, to check whether there is an input trajectory that satisfies the system dynamics constraints and input range constraints but violates the requirements. The δ-complete satisfiability modulus solver is a formal verification solution tool that supports nonlinear real number arithmetic and has controllable numerical error characteristics, used to solve the consistency counterexample search formula and ensure the numerical accuracy of the solution. Potential counterexamples are combinations of input trajectories and initial states that satisfy the original nonlinear dynamics and input physical range constraints of the system, but violate at least one requirement constraint, serving as the original material for subsequent counterexample induction and loop closure confirmation.

[0040] Specifically, such as Figure 4As shown, the instantiation priority sorting is first performed. Based on the benchmark simulation trajectory, a weighted distance metric is defined between the input trajectory and the benchmark simulation trajectory. For any input trajectory, all trajectory positions and all input variables are traversed. The absolute value of the deviation between the value of each input variable at the corresponding position and the corresponding value of the benchmark simulation trajectory is calculated. This value is then multiplied by the distance weight corresponding to that input variable and accumulated. During the accumulation process, the deviation is normalized by the sum of the physical value range of the input variables and the solver error radius to eliminate the influence of differences in the dimensions of different variables. The distance weights are set based on the degree of influence of each input variable on the system output performance, according to engineering experience. The greater the influence, the higher the weight value. The sum of the distance weights of all input variables is 1, and the value of each distance weight ranges from 0 to 1. For example, if an input variable has the greatest influence on the system output performance, its distance weight is 1; if the influence is the least, its distance weight is 0.1. The remaining variables take values ​​between 0 and 1 according to their degree of influence. The solver error radius is determined by a trade-off between numerical accuracy requirements and computational efficiency, and its value range is 10. -7 Up to 10 -5 For example, the value is 10. -6 Using weighted distance as a similarity metric, all regions to be explored in the input space are arranged in ascending order of weighted distance, with regions closer to the baseline simulation trajectory being explored first, resulting in an instantiation priority ranking. This ranking is only used as a search heuristic strategy to improve the solver's search efficiency, without discarding any input regions, thus ensuring the completeness of the verification process.

[0041] Then, an integrity check is performed. Based on the instantiation priority ranking result and the complete formal requirement specification model, an integrity counterexample search formula is constructed. The proposition encoded by the formula is: there exists an output variable at a certain trajectory position where all preconditions of the requirements constraining that output variable are false. After construction, the formula is solved using a satisfiability module theory solver. During the solution process, the instantiation order of the solver is guided by the instantiation priority ranking result, prioritizing the search of regions close to the baseline simulation trajectory. If the solution result is satisfiable, it is determined that the requirement set has coverage gaps, and the incomplete conclusion and corresponding counterexample positions are directly output, terminating all subsequent verification processes. If the solution result is unsatisfiable, it is determined that the requirement set has complete coverage, the integrity check passes, and it is allowed to proceed to the subsequent consistency check step to obtain the integrity check result. Finally, a consistency check is performed. Based on the results of the integrity check and the verification decomposition and scheduling information set, a consistency counterexample search formula is constructed. All output variables in the postconditions of the requirements are replaced with the output functions of the original nonlinear model. The proposition encoded by the formula is: there exists an input trajectory and an initial state such that the system follows the original nonlinear dynamic evolution, all input variables are within the physical range, and at least one requirement is violated. After construction, a delta-complete satisfiability model solver is used. The solution process solves each independent subproblem sequentially according to the subproblem scheduling order in the verification decomposition and scheduling information set. During the solution of each subproblem, the instantiation order is guided by the instantiation priority ranking result. Boundary value instances from the hot-start instantiation pool are injected into the solver as initial search anchors to guide the solver to prioritize exploring high-value search regions. If a subproblem returns delta-satisfiable, the corresponding potential counterexample and its complete trajectory are obtained; if all subproblems return delta-unsatisfiable, the requirement consistency is determined to be high-confidence under the current trajectory boundary, and all potential counterexamples are finally obtained. In this embodiment, the values ​​of parameters such as distance weight and solver error radius are only examples. Those skilled in the art can set them according to actual engineering scenarios and accuracy requirements. This embodiment does not impose any restrictions on them.

[0042] This embodiment achieves heuristic priority exploration of the solution space through simulation-guided weighted distance sorting, identifies requirement coverage defects in advance and avoids invalid subsequent calculations through pre-completeness checks, and achieves efficient and accurate solution of consistency problems through δ-complete nonlinear solution combining subproblem decomposition scheduling and hot-start anchoring. It realizes hierarchical progressive verification of requirement completeness and consistency, effectively improving the convergence speed of counterexample search and the numerical accuracy of verification results.

[0043] Furthermore, this embodiment provides a step-by-step approach to obtain hierarchical verification conclusions and traceable evidence chains based on potential counterexamples, through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling, including: Based on the potential counterexamples and reverse dependency graph structure, a structural invariant knowledge base is obtained through counterexample clustering and kernel variable set intersection calculation; specifically including: Based on potential counterexamples, a cumulative counterexample set and its metadata are obtained by storing each potential counterexample in a counterexample set and recording its discovery boundary, conflict demand pair, contradiction triggering location, and contradiction time span. Based on the cumulative counterexample set and its metadata, and the reverse dependency graph structure, a first-level clustering is performed by conflict demand pairs, followed by a second-level clustering by the similarity of the kernel variable sets, to obtain the clustering results. Based on the clustering results, the intersection of all kernel variable sets of counterexamples in each category containing multiple counterexamples is calculated to obtain structural invariants. Based on the structural invariants, a prediction formula is constructed and solved preferentially for unsearched boundaries. Combined with incremental updates and evaluation of prediction accuracy, a structural invariant knowledge base and boundary priority ranking are obtained. Based on potential counterexamples and benchmark simulation trajectories, simulation verification conclusions and counterexample markers are obtained through iterative closed-loop processing of forward focusing mapping and reverse simulation configuration. Based on the structural invariant knowledge base, simulation verification conclusions, and reverse dependency graph structure, a hierarchical verification conclusion is obtained by using multiple methods to collaboratively close the loop and labeling according to confidence level. Based on the tiered verification conclusions and counterexample markings, a traceable chain of evidence is obtained through report generation, requirement tracing, and defect repair.

[0044] The process includes: Counterexample clustering, which groups accumulated potential counterexamples according to conflict patterns to distinguish different conflict types and provide a classification basis for structural invariant extraction; Kernel variable set intersection calculation, which calculates the intersection of the kernel variable sets of counterexamples of the same type to extract the necessary variable conditions that trigger such conflicts; Structural invariant knowledge base, which stores the structural invariants, prediction formulas, and prediction accuracy corresponding to various conflicts, used to predict the conflict probability of unknown boundaries; Counterexample set, which stores all discovered potential counterexamples and their corresponding metadata, and is composed of all input trajectories that violate requirements and initial state combinations obtained through consistency checks; Discovery boundary, which is the trajectory length boundary value corresponding to the counterexample, i.e., the trajectory length when the counterexample is first discovered; Conflicting requirement pair, which is the combination of two requirements that are violated simultaneously in the counterexample, and is the core identifier for determining the conflict type; Conflict triggering position, which is the trajectory position index where the requirement is first violated in the counterexample; Conflict time span, which is the distance between the conflict triggering position and the earliest input position it depends on, used to characterize the time dependency span of the conflict; and Accumulated counterexample set, which is formed by continuously accumulating all discovered potential counterexamples. The set of data is dynamically updated during the verification process; metadata consists of additional information describing the attributes of counterexamples, including discovery boundaries, conflicting demand pairs, conflict triggering locations, and conflict time spans; first-level clustering of conflicting demand pairs is a process of grouping counterexamples based on whether their corresponding conflicting demand pairs are identical, used to distinguish the types of conflicts caused by different demand pairs; second-level clustering based on the similarity of the kernel variable sets is a process of further subdividing within the same category of the first-level cluster based on the similarity of the counterexample kernel variable sets, used to identify different conflict patterns under the same demand pair; the clustering result is the counterexample category division result obtained after two levels of clustering, with each category corresponding to a specific conflict pattern; a category containing multiple counterexamples is a clustering category with more than or equal to 2 counterexamples, possessing the data foundation for inductive structural invariants; the intersection of all counterexample kernel variable sets in a category is the common part of the kernel variable sets corresponding to all counterexamples within the same category, which is the necessary variable set for triggering this type of conflict; structural invariants are logical formulas characterizing the necessary conditions for triggering a certain type of conflict, including the necessary variable set and shared preconditions, derived from the common characteristics of the same type of counterexamples.

[0045] The prediction formula is a conflict prediction logic formula based on structural invariants for unsearched boundaries, used to predict whether similar contradictions exist at unknown boundaries. Unsearched boundaries are trajectory length boundary values ​​that have not yet undergone consistency verification. Incremental update is the process of synchronously updating the corresponding category of structural invariants each time a new counterexample is found, used to ensure the accuracy and timeliness of the invariants. The prediction accuracy evaluation process is the process of determining the degree of consistency between the statistical structural invariant prediction results and the actual search results, used to evaluate the predictive effectiveness of the invariants. Boundary priority sorting is the order in which each unsearched boundary is arranged according to the probability of predicted conflict, used to guide the global search scheduling. Forward focusing mapping is the process of injecting the state of the simulation trajectory and the input values ​​as equality constraints into the consistency verification formula, used to focus the search range on the region near the simulation trajectory. Reverse simulation configuration is the process of converting the input and initial state of formal counterexamples into Simulink simulation parameter configurations, used to generate a simulation that can be run directly. Use Cases: Simulation Confirmation and Verification Conclusion: The verification result after simulation reproduction and verification, distinguishing between real defects and false counterexamples; Counterexample Marking: The confirmation status identifier for each potential counterexample, including confirmed and excluded states; Multi-Method Collaborative Closed Loop: The process of constructing a closed-loop verification framework that mutually reinforces reverse dependency graph decomposition, structural invariant prediction, and simulation confirmation and verification, used to achieve synergistic gains in each verification stage; Confidence-Based Grading and Marking: The process of grading and marking conclusions according to the solution result type and verification degree, used to output verification results that distinguish reliability levels; Report Generation: The process of generating a structured verification report based on confirmed counterexamples and structural invariants, used to output standardized verification results; Requirement Traceability: The process of locating defect information to specific requirement items in the requirement table, used to establish a one-to-one traceability relationship between defects and requirement items; Defect Repair: The process of correcting and updating conflicting requirement items, used to achieve iterative optimization of requirements.

[0046] Specifically, such as Figure 5As shown, the process begins by constructing a structural invariant knowledge base. Based on the potential counterexamples and the reverse dependency graph structure, each potential counterexample is stored in the counterexample set. Simultaneously, metadata for each counterexample is recorded, including the trajectory length boundary where the counterexample was discovered, the conflicting requirement pair that was simultaneously violated, the conflict triggering position where the requirement was first violated, and the time span of the conflict obtained by tracing back along the reverse dependency graph from the conflict triggering position. This yields the cumulative counterexample set and its metadata. When the number of counterexamples in the cumulative counterexample set reaches the minimum clustering number, counterexample clustering begins. The minimum clustering number is determined by a trade-off between clustering statistical significance and sample size, ranging from 2 to 5, with an exemplary value of 3. The clustering process begins with primary clustering, grouping counterexamples based on whether their conflict requirements are identical. Different conflict requirements correspond to different contradiction types and are classified into different primary categories. Secondary clustering is then performed, calculating the Jaccard similarity between the kernel variable sets corresponding to each counterexample within each primary category. The kernel variable set is the set of all input variables reachable from the contradiction triggering position in the reverse dependency graph. When the similarity is greater than or equal to the clustering similarity threshold, the corresponding counterexample is assigned to the same secondary subclass. The clustering similarity threshold is determined by balancing clustering granularity and classification accuracy, ranging from 0.5 to 0.8, with an exemplary value of 0.6. The final clustering result is then obtained. For each cluster containing multiple counterexamples, the intersection of the sets of kernel variables corresponding to all counterexamples in that cluster is calculated to obtain the variable structural invariants. Simultaneously, the intersection of the sets of preconditions activated at the contradiction triggering locations of all counterexamples in that cluster is calculated to obtain the precondition structural invariants. The variable structural invariants and precondition structural invariants together constitute the structural invariants corresponding to that type of contradiction. These structural invariants are necessary conditions for triggering that type of contradiction, and any trajectory that triggers that type of contradiction satisfies these invariants. Based on the obtained structural invariants, a prediction formula is constructed for the corresponding cluster. The prediction formula encodes the proposition that there exists a counterexample satisfying the structural invariant on an unsearched boundary. During the incremental boundary search process, the prediction formula is solved first for each unsearched boundary. If the solution result is satisfyable, the boundary is marked as high priority, predicting that it may contain the same type of contradiction; if the solution result is unsatisfactory, the boundary is marked as low priority, predicting that it does not contain the same type of contradiction. For each new counterexample discovered, it is added to the corresponding cluster, and the structural invariants of that cluster are incrementally updated. If the new counterexample causes the intersection to shrink, the corresponding prediction formula is updated synchronously. The prediction accuracy of each structural invariant is periodically evaluated. The prediction accuracy is the ratio of the number of boundaries predicted as high priority and actually found as counterexamples to the total number of boundaries predicted as high priority. When the prediction accuracy is lower than the prediction accuracy threshold, the invariant is marked as low confidence and its scheduling priority is reduced. The prediction accuracy threshold is determined by a trade-off between prediction reliability requirements and computational resource allocation, and its value ranges from 0.1 to 0.3, with an exemplary value of 0.2.A convergence counter is maintained to count the number of rounds in which no new counterexample category is found consecutively. When the number of rounds in which no new counterexample is found consecutively reaches the convergence threshold, it is determined that the structural invariant knowledge base has become complete, and the search is terminated. Finally, the structural invariant knowledge base and boundary priority ranking are obtained. The convergence threshold is determined by the trade-off between pattern stability requirements and verification efficiency, and the value ranges from 3 to 10. For example, a value of 5 is taken.

[0047] Then, simulation verification of bidirectional mapping and iterative closed-loop is performed. Based on potential counterexamples and the baseline simulation trajectory, forward mapping rules and reverse mapping rules are defined. Forward mapping injects the state value and input value at each position on the simulation trajectory as equality constraints into the consistency verification formula, resulting in a constrained verification problem focused on the region near the corresponding simulation trajectory, which is used to narrow the search range and improve solution efficiency. Reverse mapping converts the input signal sequence and initial state of the potential counterexamples obtained from the formal solution into the input parameter configuration and initial state configuration of the Simulink simulation, resulting in directly executable simulation cases. The iteration process is initialized by using the baseline simulation trajectory as the simulation trajectory for the initial iteration, initializing the pseudo-counterexample exclusion set to empty, and setting the iteration round counter to zero. In each iteration, the simulation trajectory of the current iteration is first injected into the consistency counterexample search formula as a constraint through forward mapping. Combined with the eliminated pseudo-counterexample constraints, a focused counterexample search formula is constructed and solved using a delta-complete satisfiability modulus solver. If the solution result is unsatisfiable, the simulation verification of that region is marked as safe, and the process proceeds to the next iteration. If the solution result is satisfiable, the corresponding potential counterexample is obtained. This counterexample is converted into a Simulink simulation configuration through reverse mapping, and Simulink is driven to re-simulate. The simulation output is compared to see if it violates the corresponding requirement. If the requirement violation is reproduced in the simulation, the counterexample is confirmed as a real defect, and the corresponding entry in the counterexample set is marked as confirmed. If the requirement violation is not reproduced in the simulation, the counterexample is determined to be a pseudo-counterexample, added to the pseudo-counterexample exclusion set, and removed from the counterexample set or marked as excluded. The iteration rounds are increased, and the above process of forward focusing, solving, and reverse simulation verification is repeated until the maximum number of iterations is reached, and finally the simulation confirmation verification conclusion and counterexample marking are obtained; the maximum number of iterations is determined by the trade-off between the verification confidence requirement and computing resources, and the value ranges from 5 to 20, with an example value of 10.

[0048] Then, a multi-method collaborative closed-loop and confidence level labeling are implemented. Based on the structural invariant knowledge base, simulation verification conclusions, and the reverse dependency graph structure, a multi-level verification framework is constructed that mutually reinforces each other. The reverse dependency graph structure provides a structural basis for extracting the kernel variable set during the structural invariant calculation process, ensuring the accuracy and completeness of the kernel variables. The structural invariant knowledge base provides high-priority boundary predictions for the focused search in the simulation verification process, guiding the simulation to prioritize high-probability conflict areas. The simulation verification results provide confirmed or excluded status labels for counterexamples in the structural invariant knowledge base, continuously providing feedback to optimize the prediction accuracy of structural invariants, forming a collaborative closed-loop verification mechanism. Based on this multi-level verification framework, the confidence level of the conclusions is graded. For cases where all verification boundaries return δ-unsatisfiable, it is marked as high-confidence pass; for cases returning δ-satisfiable and confirmed by simulation reproduction, it is marked as defect discovery; for cases where the solver times out and returns unsatisfiable, it is marked as low-confidence reference, ultimately yielding graded verification conclusions.

[0049] Finally, a traceable evidence chain is constructed, generating a structured verification report based on hierarchical verification conclusions and counterexample markers. For confirmed defect counterexamples, the counterexample trajectory is analyzed to extract triggering conditions, initial states, and conflicting requirement pairs. Combined with the corresponding structural invariant summaries and prediction accuracy, a counterexample report containing complete defect information is generated. The defect information in the verification report is written back to the requirement table, locating specific requirement rows through requirement record identifiers, establishing a traceable association between requirement defects and model elements. After engineers repair the corresponding requirements according to the report, the version number of the requirement table is incremented, the original counterexample set is retained but the confirmed markers are reset, and all verification steps are re-executed to obtain the repaired verification results. Complete metadata for each verification is recorded, including the original nonlinear function encoding summary, solver error radius, number of connected components in the reverse dependency graph, size of the hot-start instantiation pool, size of the counterexample set, number of structural invariant categories, prediction accuracy for each category, simulation iteration rounds, solution status of each boundary, and confidence level markers, ultimately forming a traceable evidence chain containing verification reports and a structured counterexample knowledge base. In this embodiment, the values ​​of parameters such as minimum number of clusters, cluster similarity threshold, prediction accuracy threshold, convergence threshold, and maximum number of iterations are merely examples. Those skilled in the art can set these values ​​according to actual engineering scenarios and verification requirements. This embodiment does not impose any restrictions on these values.

[0050] This embodiment achieves structured extraction of contradictory patterns through two-level counterexample clustering and intersection induction; predicts and guides the search for unknown boundary conflict probabilities through structural invariant prediction; filters false counterexamples and improves the credibility of results through an iterative closed-loop mapping of simulation and formal verification; and achieves mutual reinforcement of each verification link through a multi-method collaborative closed-loop framework. It realizes hierarchical confidence output and full-link traceability for requirement consistency verification, effectively improving the completeness, accuracy, and engineering practicality of verification for complex nonlinear systems.

[0051] Example 2 like Figure 6 As shown, this embodiment provides a performance consistency verification system based on dynamic simulation coupling, including: Information generation module: Based on the Simulink model file and requirement table module, it obtains the verification pre-processing information set through requirement table parsing and temporal semantic discretization, extraction of the original nonlinear model, generation of benchmark simulation trajectory and extraction of linearized auxiliary model; Decomposition and scheduling module: It is used to obtain the verification decomposition and scheduling information set based on the verification pre-information set through reverse dependency graph construction, sub-problem decomposition and hot start instantiation; Counterexample generation module: Based on the verification decomposition and scheduling information set, it obtains potential counterexamples through simulation-guided priority sorting, integrity checks, and consistency checks. The verification closed-loop module is used to obtain hierarchical verification conclusions and traceable evidence chains based on potential counterexamples through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

[0052] All of the above modules are deployed on a server, which receives data transmitted from the acquisition devices and performs further analysis. The information generation module, as the system's front-end data processing unit, receives Simulink model files and requirement table data uploaded by the acquisition devices. It completes requirement structure parsing, temporal semantic discretization, nonlinear model encoding, benchmark simulation generation, and linearization auxiliary model extraction. It outputs a unified format of pre-verification information set and transmits it to the decomposition and scheduling module, providing a common data foundation for subsequent full-process verification. The decomposition and scheduling module receives the pre-verification information set, completes the decoupling and decomposition of verification problems and prunes irrelevant variables by constructing a reverse dependency graph, identifies potential contradictory pairs through requirement topology analysis and generates a hot-start instantiation pool, outputs a verification decomposition and scheduling information set containing the sub-problem scheduling order and initial search anchor points, and transmits it to the counterexample generation module to guide the solution order and initial search direction of subsequent counterexample searches. The counterexample generation module receives the verification decomposition and scheduling information set, prioritizes the input space using the baseline simulation trajectory as a reference, first performs a requirement coverage integrity check, and then performs a nonlinear consistency counterexample search based on the sub-problem scheduling order and hot-start anchor point. It outputs potential counterexamples that satisfy the system dynamics constraints and transmits them to the verification closed-loop module as raw material for subsequent induction and verification. The verification closed-loop module receives potential counterexamples, extracts structural invariants of various contradictions through two-level clustering and intersection induction, and constructs a predictive knowledge base. It iteratively filters false counterexamples through a bidirectional mapping between simulation and formal verification, ultimately constructing a multi-method collaborative hierarchical verification system and outputting traceable hierarchical verification conclusions and a complete chain of evidence. Simultaneously, the defect information output by the verification closed-loop module can be fed back to the information generation module to support iterative requirement repair and version updates.

[0053] In summary, this invention automates the entire process of verifying the consistency of indicators between the Simulink model and the requirement table through a modular hierarchical architecture. By employing a progressive processing mechanism of standardized pre-processing information, decoupled scheduling of verification problems, heuristic counterexample search, and closed-loop simulation verification, it effectively improves the solution efficiency, result accuracy, and conclusion credibility of verification of complex nonlinear systems. It can support automated verification and quality closure of control system requirement consistency in multiple scenarios.

[0054] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0055] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A method for verifying index consistency based on dynamic simulation coupling, characterized in that, include: Based on the Simulink model file and requirement table module, the verification pre-information set is obtained through requirement table parsing and temporal semantic discretization, original nonlinear model extraction, benchmark simulation trajectory generation and linearized auxiliary model extraction. Based on the aforementioned verification pre-information set, a verification decomposition and scheduling information set is obtained through reverse dependency graph construction, sub-problem decomposition, and hot start instantiation. Based on the aforementioned verification decomposition and scheduling information set, potential counterexamples are obtained through simulation-guided priority sorting, integrity checks, and consistency checks. Based on the potential counterexamples, hierarchical verification conclusions and traceable evidence chains are obtained through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

2. The index consistency verification method based on dynamic simulation coupling according to claim 1, characterized in that, The verification pre-assessment information set includes a complete formal requirement specification model, the original nonlinear model encoding, the baseline simulation trajectory, and a linearized auxiliary model. The methods for obtaining the verification pre-assessment information set include: Based on the Simulink model file and requirement table module, a complete formal requirement specification model is obtained by parsing requirement records, categorical variables, identifying temporal operators, and generating discretization expansion rules. Based on the Simulink model file, the original nonlinear model code is obtained by extracting the dynamic equations, discretizing the recursion, and encoding them into nonlinear arithmetic terms. Based on the Simulink model file, the baseline simulation trajectory is obtained by running typical simulations and checking the requirement satisfaction. Based on the baseline simulation trajectory, a linearized auxiliary model is obtained by selecting a linearized operating point, extracting the state space matrix, and limiting its application range.

3. The index consistency verification method based on dynamic simulation coupling according to claim 2, characterized in that, Based on the Simulink model file and requirement table module, a complete formal requirement specification model is obtained by parsing requirement records, categorical variables, identifying temporal operators, and generating discretization expansion rules, including: Based on the Simulink model file and requirement table module, the basic structure of the requirement record is obtained by parsing the record identifier and precondition expressions line by line; Based on the basic structure of the aforementioned requirement record, the variable classification result is obtained by scanning the signal lines and distinguishing them into sets of input and output variables; Based on the variable classification results, the prev and dur operators are identified by an abstract syntax tree and discretization decision rules are defined to obtain the temporal expansion rules; Based on the aforementioned temporal expansion rules, a complete formalized requirement specification model is obtained by recursively replacing temporal operators and extracting the physical value range.

4. The index consistency verification method based on dynamic simulation coupling according to claim 2, characterized in that, The verification decomposition and scheduling information set includes a reverse dependency graph structure, sub-problem scheduling order, and a hot-start instantiation pool. The methods for obtaining the verification decomposition and scheduling information set include: Based on the complete formal requirement reduction model in the aforementioned pre-verification information set, the reverse dependency graph structure and the sub-problem scheduling order are obtained by extracting constraint boundaries, tracing dependencies in reverse, and decomposing sub-problems. Based on the complete formalized requirement specification model and linearized auxiliary model in the aforementioned verification pre-information set, a hot-start instantiation pool is obtained by constructing a requirement topology graph, identifying potential conflicting pairs, and estimating boundary values.

5. The index consistency verification method based on dynamic simulation coupling according to claim 4, characterized in that, Based on the complete formal requirement reduction model in the aforementioned pre-verification information set, by extracting constraint boundaries, tracing dependencies in reverse, and decomposing sub-problems, the reverse dependency graph structure and the sub-problem scheduling order are obtained, including: Based on the complete formal requirement specification model, the constraint boundaries at each position are obtained by extracting the instantiation postcondition constraints of each output variable at each trajectory position. Based on the constraint boundary, the reverse dependency graph structure is obtained by tracing the values ​​of the preconditions and the input variables they depend on from the set of allowed values. Based on the aforementioned reverse dependency graph structure, by dividing the subproblems according to connected components and pruning irrelevant variables, a simplified set of subproblem variables is obtained. Based on the simplified set of subproblem variables, the subproblem scheduling order is obtained by weighting and sorting by the number of variables and the dependency depth.

6. The index consistency verification method based on dynamic simulation coupling according to claim 5, characterized in that, Based on the complete formal requirement specification model and linear auxiliary model in the aforementioned pre-verification information set, a hot-start instantiation pool is obtained by constructing a requirement topology graph, identifying potential conflicting pairs, and estimating boundary values, including: Based on the complete formal requirement specification model, the relationship topology between requirements and conditions is obtained by constructing a requirement topology graph containing requirement nodes and atomic condition nodes. Based on the aforementioned association topology, a set of potential conflicting pairs is obtained by detecting demand pairs that share precondition atoms but have disjoint postconditions; Based on the set of potential contradictions and the linearization auxiliary model, a hot-start instantiation pool is obtained by quickly estimating the boundary value instances of shared atomic conditions.

7. The index consistency verification method based on dynamic simulation coupling according to claim 2, characterized in that, Based on the aforementioned verification decomposition and scheduling information set, potential counterexamples are obtained through simulation-guided priority sorting, integrity checks, and consistency checks, including: Based on the baseline simulation trajectory, the instantiation priority ranking result is obtained by defining a weighted distance metric and arranging the exploration order; Based on the instantiation priority ranking result and the complete formal requirement specification model, the integrity check result is obtained by constructing an integrity counterexample search formula and solving it using a satisfiability module theory solver. Based on the integrity check results and the verification decomposition and scheduling information set, potential counterexamples are obtained by constructing a consistency counterexample search formula and solving it using a δ-complete satisfiability modulus solver.

8. The index consistency verification method based on dynamic simulation coupling according to claim 4, characterized in that, Based on the potential counterexamples, through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling, hierarchical verification conclusions and traceable evidence chains are obtained, including: Based on the potential counterexamples and the reverse dependency graph structure, a knowledge base of structural invariants is obtained by calculating the intersection of counterexample clustering and the kernel variable set. Based on the potential counterexamples and the benchmark simulation trajectory, through the iterative closed loop of forward focusing mapping and reverse simulation configuration, the simulation verification conclusions and counterexample markers are obtained. Based on the aforementioned structural invariant knowledge base, simulation verification conclusions, and reverse dependency graph structure, hierarchical verification conclusions are obtained by using multiple methods to collaboratively close the loop and labeling them according to confidence level. Based on the aforementioned hierarchical verification conclusions and counterexample markers, a traceable chain of evidence is obtained through report generation, requirement tracing, and defect repair.

9. The index consistency verification method based on dynamic simulation coupling according to claim 8, characterized in that, Based on the aforementioned potential counterexamples and reverse dependency graph structure, a structural invariant knowledge base is obtained through counterexample clustering and kernel variable set intersection calculation, including: Based on the potential counterexamples, by storing each potential counterexample in the counterexample set and recording its discovery boundary, conflict requirement pair, contradiction triggering location and contradiction time span, a cumulative counterexample set and its metadata are obtained; Based on the accumulated negative example set and its metadata, and the reverse dependency graph structure, the clustering results are obtained by performing first-level clustering according to conflict requirements and second-level clustering according to the similarity of the kernel variable set. Based on the clustering results, structural invariants are obtained by calculating the intersection of the kernel variable sets of all counterexamples in each category containing multiple counterexamples; Based on the structural invariants, a knowledge base of structural invariants and a boundary priority ranking are obtained by constructing prediction formulas and solving them preferentially for unsearched boundaries, combined with incremental updates and evaluation of prediction accuracy.

10. A performance consistency verification system based on dynamic simulation coupling, used to implement the performance consistency verification method based on dynamic simulation coupling as described in any one of claims 1-9, characterized in that, The system includes: The information generation module is used to obtain the verification pre-test information set based on the Simulink model file and the requirement table module through requirement table parsing and temporal semantic discretization, original nonlinear model extraction, benchmark simulation trajectory generation and linearized auxiliary model extraction. The decomposition and scheduling module is used to obtain the verification decomposition and scheduling information set based on the verification pre-information set through reverse dependency graph construction, sub-problem decomposition, and hot start instantiation. The counterexample generation module is used to obtain potential counterexamples based on the verification decomposition and scheduling information set through simulation-guided priority sorting, integrity checks, and consistency checks. The verification closed-loop module is used to obtain hierarchical verification conclusions and traceable evidence chains based on the potential counterexamples through counterexample set clustering and structural invariant induction, simulation verification bidirectional mapping and iterative joint reasoning, multi-method collaboration and confidence labeling.

Images