Computer mounting method and computer system for testing black box system

Abstract

To improve the test efficiency of a black box system.SOLUTION: The disclosed method for testing a black box system includes executing a test process that includes executing a model generation process and executing a test of the generated model based on a learning algorithm for generating a model approximating the behavior of the black box system. The test processing includes the parallel execution of multiple different kinds of algorithms for testing the model.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a computer-implemented method and a computer system for testing a black box system.

Background Art

[0002] Non-Patent Document 1 discloses a learning algorithm of a hybrid automaton that approximates the behavior of a black box system.

[0003] Patent Document 1 discloses a formal verification of a hybrid system.

Prior Art Documents

Non-Patent Documents

[0004]

Non-Patent Document 1

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

[0006] A black box system is a system whose part or all of the internal operations or mechanisms are unknown. For example, industrial machines such as automobiles and aircraft are often black box systems.

[0007] Testing a black box system is to check whether the black box system meets a given specification. Since the internal operations and the like of the black box system are unknown, random simulation has conventionally been used for testing the black box system. Random simulation is a method of giving random inputs to the black box system and observing whether the output of the black box system meets the specification. If there is an example (counterexample) that violates the specification in the black box system, the counterexample can be discovered by random simulation. Also, if a counterexample cannot be discovered by random simulation, it can be determined that the black box system is safe (meets the specification).

[0008] However, in random simulation, it is necessary to give a large number of random inputs to the black box system, which is inefficient. In particular, when counterexamples occur only rarely, it is often difficult to discover counterexamples with random inputs. For this reason, it becomes necessary to perform random simulation for a long time, resulting in a decrease in efficiency.

[0009] Therefore, in order to improve the efficiency of testing a black box system, a new technology for testing a black box system is desired.

[0010] One aspect of the present disclosure is a method. The disclosed method can be a computer-implemented method executed by a computer for testing a black box system. The disclosed method includes executing a test process that includes executing a generation process of the model based on a learning algorithm that generates a model approximating the behavior of the black box system, and executing a test of the generated model. The test process may include executing in parallel a plurality of different types of algorithms for testing the model.

[0011] Another aspect of the present disclosure is a system. The disclosed system executes test processing including executing generation processing of the model based on a learning algorithm that generates a model approximating the behavior of a black box system, and executing a test of the generated model. It may be configured as follows. The test processing may include parallelly executing a plurality of different types of algorithms for testing the model.

[0012] Further details will be described as embodiments below.

Brief Description of Drawings

[0013]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Modes for Carrying Out the Invention

[0014] <1. Outline of a Computer-Implemented Method and Computer System for Testing a Black Box System>

[0015] (1) The method according to the embodiment can be a computer-implemented method executed by a computer for testing a black box system. The method according to the embodiment includes executing a generation process of the model based on a learning algorithm that generates a model approximating the behavior of the black box system, and executing a test process that includes executing a test of the generated model. The test process may include parallelly executing a plurality of different types of algorithms for testing the model. By generating a model of the black box system, a test can be performed using a test algorithm applicable to the generated model. Also, by parallelly executing a plurality of different types of algorithms, the model generation process and the test process can be efficiently executed. The plurality of different types of algorithms can be, for example, any two or more algorithms selected from a model checking algorithm of the model, a counterexample search algorithm of the model, and an algorithm for a first equivalence test between the black box system and the model.

[0016] (2) The method according to the embodiment may further include executing post-processing after the execution of the test process. The post-processing may include determining to re-execute the generation process. When a test result is obtained in any one of the plurality of different types of algorithms that are being parallelly executed in the test process, a transition may be made from the test process to the post-processing.

[0017] (3) The plurality of different types of algorithms includes a model checking algorithm as a formal verification of the model and algorithms of types different from the model checking algorithm. The post-processing may include an equivalence test executed when no counterexample of the model is found by the model checking algorithm, and a counterexample verification process executed when a counterexample of the model is found by the model checking algorithm. In the post-processing, if it is determined that the black box system and the model are not equivalent as a result of executing the equivalence test, re-execution of the generation process may be determined. In the post-processing, if it is determined that the counterexample is not a counterexample for the black box system as a result of executing the counterexample verification process, re-execution of the generation process may be determined.

[0018] (4) The plurality of different types of algorithms may include a model checking algorithm as a formal verification of the model and a counterexample search algorithm for the model. The post-processing may include a counterexample verification process executed when a counterexample of the model is found by either the model checking algorithm or the counterexample search algorithm. In the post-processing, if it is determined that the counterexample is not a counterexample for the black box system as a result of executing the counterexample verification process, re-execution of the generation process may be determined.

[0019] (5) The plurality of different types of algorithms may include a model checking algorithm as a formal verification of the model, and an algorithm for a first equivalence test between the black box system and the model. The post-processing may include a second equivalence test that is executed when no counterexample of the model is found by the model checking algorithm. In the test processing, if it is determined that the black box system and the model are not equivalent as a result of executing the first equivalence test, re-execution of the generation processing may be determined. In the post-processing, if it is determined that the black box system and the model are not equivalent as a result of executing the second equivalence test, re-execution of the generation processing may be determined.

[0020] (6) The plurality of different types of algorithms may include an algorithm for a first equivalence test between the black box system and the model, and a different type of algorithm from the algorithm for the first equivalence test. The post-processing may include a second equivalence test that is executed when a test result is obtained in a different type of algorithm from the algorithm for the first equivalence test. In the test processing, if it is determined that the black box system and the model are not equivalent as a result of executing the first equivalence test, re-execution of the generation processing may be determined. In the post-processing, if it is determined that the black box system and the model are not equivalent as a result of executing the second equivalence test, re-execution of the generation processing may be determined.

[0021] (7) The different type of algorithm from the algorithm for the first equivalence test may include at least one of a formal verification algorithm of the model and a counterexample search algorithm of the model.

[0022] (8) The plurality of different types of algorithms may include a model checking algorithm for the model, a counterexample search algorithm for the model, and an algorithm for a first equivalence test between the black box system and the model. The post-processing may include a second equivalence test that is executed when no counterexample of the model is found in the model checking algorithm. The post-processing may include a counterexample verification process that is executed when a counterexample of the model is found as a test result of either the model checking algorithm or the counterexample search algorithm. In the test process, if it is determined that the black box system and the model are not equivalent as a result of executing the first equivalence test, re-execution of the generation process may be determined. In the post-processing, if it is determined that the black box system and the model are not equivalent as a result of executing the second equivalence test, re-execution of the generation process may be determined. In the post-processing, if it is determined that the counterexample is not a counterexample for the black box system as a result of executing the counterexample verification process, re-execution of the generation process may be determined.

[0023] (9) The system according to the embodiment may be configured to execute a test process including executing a generation process of the model based on a learning algorithm that generates a model approximating the behavior of a black box system and executing a test of the generated model. The test process may include parallelly executing a plurality of different types of algorithms for testing the model.

[0024] <2. Example of Method and Computer System for Testing Black Box System>

[0025] Hereinafter, an example of an embodiment of the present invention will be described in more detail with reference to the drawings.

[0026] Figure 1 shows a test method for the black box system M1 according to the embodiment. In the method shown in Figure 1, a model M2 is generated based on a learning algorithm S11 that generates a model approximating the behavior of the black box system M1. Hereinafter, the information processing for generating the model M2 is referred to as model generation processing. The model M2 is, for example, a mathematical model describing the behavior of the black box system M1. The model M2 is, for example, an automaton approximating the behavior of the black box system M1. An automaton is a mathematical model having one or more internal states and rules for changing the internal states. The automaton is, for example, a finite automaton.

[0027] The learning algorithm S11 generates, for example, an automaton (model M2) approximating the behavior of the black box system M1 from the time-series data of the input and output of the black box system M1. As such a learning algorithm S11, various known algorithms can be used. Note that the learning algorithm may generate the model M2 from the data of either the input or the output of the black box system M1.

[0028] For the black box system M1, some or all of the internal characteristics such as internal components or operation logic are unknown. Therefore, it is not possible to test the black box system M1 using its internal characteristics. In contrast, the generated model M2 is a white box and its internal characteristics are known, so the test S12 of the model M2 can be performed using the internal characteristics of the model M2. Here, the information processing for testing the model M2 is referred to as test processing. The test here includes all methods for testing the model, and is a concept including, for example, formal verification such as model checking, counterexample search, equivalence test, etc.

[0029] For the test S12 of model M2, which is a white box, various algorithms for white box testing can be utilized. The test S12 may include, for example, testing whether the given specification is satisfied by model M2. Here, the specification is the specification that the black box system M1 should satisfy.

[0030] If model M2 sufficiently approximates the behavior of the black box system M1, the result of the test S12 of model M2 can be used as the test result of the black box system M1. That is, the result of the test S12 of model M2 can be output S13 as the test result of the black box system M1. The output S13 may include, for example, outputting a counterexample that violates the specification. Also, the output S13 may include outputting that the black box system M1 satisfies the specification (No Error output), or outputting model M2 for which it has been confirmed that the specification is satisfied.

[0031] As algorithms for testing that can be used in a white box where the internal characteristics are known, there are various ones, but typically, for example, there are model checking algorithms and counterexample search algorithms.

[0032] Model checking is a term in computer science and is to check whether a model such as an automaton satisfies a given specification (safety). Model verification is a type of formal verification. Formal verification is verification by a formal method whose correctness has been proven mathematically. In formal verification, without giving various inputs for testing, the same result as if comprehensive testing has been performed for all inputs can be obtained.

[0033] Although model checking does not directly aim to find counterexamples, if there are counterexamples in the model, they can be discovered by checking whether the model meets the given specifications. As a form of formal verification, model checking can be completed relatively early if there are no counterexamples in the model to be verified. However, if there are counterexamples in the model, the verification tends to take time.

[0034] Counterexample search is a method aimed at finding counterexamples in a model. Counterexample search is also called Falsification. Also, a counterexample search tool is also called a Falsification tool. By using a counterexample search algorithm, if there is a counterexample that violates the specification in the model, that counterexample can be quickly discovered. However, in counterexample search, it is not possible to directly verify that the given specification is being met. However, for example, if no counterexample is found after searching for counterexamples for a predetermined time, it is possible to consider that the model meets the specification. However, sufficient time is required to consider that the model meets the specification (i.e., there are no counterexamples).

[0035] In the test process of model M2, if only one algorithm is used, as described above, cases where the test takes time can occur. Therefore, in the test process of the embodiment, for the test S12 of model M2, a plurality of different types of algorithms S12a, S12b are executed in parallel. If a test result is obtained early in any of the plurality of algorithms S12a, S12b being executed in parallel, the ongoing test process can be terminated early even if test results have not been obtained in other algorithms. Therefore, it is possible to speed up the test process. Note that when a test result is obtained in any of the plurality of algorithms S12a, S12b, the execution of other algorithms can be forcibly terminated.

[0036] For example, assume that a model checking algorithm and a counterexample search algorithm are executed in parallel as a plurality of different types of algorithms S12a and S12b. In this case, when testing a model without a counterexample, the model checking algorithm can quickly verify that the model meets the given specifications. Also, when testing a model with a counterexample, the counterexample search algorithm can quickly find the counterexample. Thus, the plurality of different types of algorithms S12a and S12b function complementarily, and when a test result is obtained by any of the algorithms, the test process can be terminated.

[0037] Note that the plurality of different types of algorithms executed in parallel may include an algorithm for random simulation. Although random simulation generally takes a long time, it may also be possible to quickly find a counterexample, thus contributing to the early completion of the test. Also, the plurality of different types of algorithms executed in parallel may include an algorithm for testing whether the model M2 to be tested is equivalent to the black box system M1.

[0038] FIG. 2 shows a system 100 that executes a method for testing the black box system M1 according to an embodiment. The system 100 includes one or more computers. The test methods shown in FIG. 1 and FIGS. 3 to 7 described below are executed by the system 100. That is, each of the methods shown in FIGS. 1 and 3 to 7 is a computer-implemented method executed by a computer.

[0039] As shown in FIG. 2, the computer constituting the system 100 may include a processor 110 and a storage device 120. The processor 110 is connected to the storage device 120. The storage device 120 includes, for example, a primary storage device and a secondary storage device. The primary storage device is, for example, a RAM. The secondary storage device is, for example, a hard disk drive (HDD) or a solid state drive (SSD). The storage device 120 stores a computer program 121 to be executed by the processor 110. The processor 110 reads and executes the computer program 121 stored in the storage device 120. The computer program 121 has program code including instructions for causing the computer to execute various processes to operate the computer as the system 100 according to the embodiment. Further, the computer constituting the system 100 includes an interface 130 for communicating with an external device such as a black box system M1 connected to the system 100. The system 100 transmits data to the outside and receives data from the outside via the interface 130.

[0040] For example, the system 100 can transmit input data given to the black box system M1 and receive data output from the black box system M1. Further, the system 100 can receive specification data 150 for test processing from the outside and store it in the storage device 120.

[0041] The black box system M1 is an industrial machine such as an automobile or an aircraft, for example. The black box system M1 can be, as an example, a hybrid system. A hybrid system is a term in control theory, in which continuous values representing physical quantities such as speed and temperature and discrete values related to the operation of software such as register values and memory addresses affect each other and the entire system operates (see Patent Document 1). Typical hybrid systems include systems such as automobiles and aircraft in which software is involved in the control of physical quantities. For example, in an automobile, continuous values such as the rotational speed of a motor, the pressure of brake oil, and the combustion amount in an internal combustion engine, and discrete values such as whether to operate the ABS change moment by moment to realize the operation of the automobile (see Patent Document 1).

[0042] Since a hybrid system is a complex system in which continuous values and discrete values affect each other during operation, it tends to take a long time for testing. For example, when testing is performed using only the aforementioned model checking alone, it takes a very long time and often does not complete within a practical time.

[0043] FIG. 3 shows an example of a test method that can be suitably used for the black box system M1, which is a hybrid system. Note that the test method shown in FIG. 3 may be used for testing a black box system of software that deals with only discrete values or a black box system of a device that deals with only continuous values.

[0044] The test method shown in FIG. 3 can be executed by the system 100 shown in FIG. 2, similar to the method shown in FIG. 1. The test method shown in FIG. 3 includes executing a generation process S310 for generating a model M2, executing a test process S320 for the generated model M2, and executing a post-test process S330.

[0045] In the generation process S310 of model M2, the generation of model M2 can be performed by an algorithm for learning a black box system, which is a hybrid system. In the generation process S310 of FIG. 3, as an example, the algorithm described in Non-Patent Document 1 can be used. Non-Patent Document 1 discloses a learning algorithm for a hybrid automaton that approximates the behavior of a black box system. A hybrid automaton is an automaton that describes the operation of a hybrid system. When the algorithm described in Non-Patent Document 1 is used in the generation process S310, a hybrid automaton is generated as model M2.

[0046] In the test process S320 of FIG. 3, as an example, tests S321, S322, and S323 of model M2 by three (a plurality of) types of algorithms are executed in parallel. The tests S321, S322, and S323 executed in parallel are performed on the hybrid automaton (model M2) generated in the generation process S310.

[0047] The plurality of tests S321, S322, and S323 executed in parallel may include, as an example, a first test S321, a second test S322, and a third test S323.

[0048] The first test S321 is, as an example, model checking by a model checking algorithm for model M2. As a tool for model checking applicable to model M2 that describes a hybrid system, there is dReach. dReach is a tool (software) for verifying the safety of a hybrid system. For details of dReach, refer to https: / / dreal.github.io / dReach / .

[0049] dReach checks whether a model M2, which is a hybrid system, meets a given specification (safety). If there is no counterexample in model M2, dReach can complete the test relatively early. However, if there is a counterexample in model M2, the test tends to take a long time. When there is a counterexample in model M2, dReach can sometimes find a counterexample that violates the specification (although it takes time) by checking whether model M2 meets the given specification.

[0050] As an example, the second test S322 is a model test by a counterexample search algorithm for model M2. As a tool for counterexample search applicable to model M2 that describes a hybrid system, there is Breach. Breach is a counterexample search tool (falsification tool) for hybrid systems. For details of Breach, see Alexandre Donze. 2010. Breach, A Toolbox for Verification and Parameter Synthesis of Hybrid Systems. In Computer Aided Verification, 22nd International Conference, CAV 2010, Edinburgh, UK, July 15-19, 2010. Proceedings (Lecture Notes in Computer Science), Tayssir Touili, Byron Cook, and Paul B. Jackson (Eds.), Vol. 6174.

[0051] Breach operates to find counterexamples existing in model M2, which is a hybrid system. If there is a counterexample that violates the given specification in model M2, Breach can quickly find that counterexample. However, Breach cannot directly verify that model M2 meets the given specification. If there is no counterexample in model M2, Breach continues to search for counterexamples and the test does not end.

[0052] The third test S323 is an equivalence test (first equivalence test) by an algorithm for confirming the equivalence between the black box system M1 and the model M2. In the first equivalence test, it is tested whether the behaviors of the black box system M1 and the model M2 are equivalent. In the first equivalence test, for example, common inputs are randomly given to the black box system M1 and the model M2, and it is tested whether the outputs of the black box system M1 and the model M2 are the same.

[0053] If the outputs of the black box system M1 and the model M2 are different for common inputs, the black box system M1 and the model M2 are not equivalent. If the outputs of the black box system M1 and the model M2 are all the same for a large number of common inputs, it can be said that the black box system M1 and the model M2 are equivalent. However, since it is necessary to test using a sufficiently large number of common inputs, it takes a considerable amount of time to determine equivalence. On the other hand, to determine that they are not equivalent, it is only necessary to find one case where the outputs of the black box system M1 and the model M2 are different. Therefore, the non-equivalence can be determined relatively early.

[0054] In the equivalence test, since inputs are randomly given to each of the black box system M1 and the model M2, it can also be considered that random simulation is being performed for each of the black box system M1 and the model M2. That is, in the first equivalence test, it can also be determined whether the outputs of each of the black box system M1 and the model M2 satisfy the given specifications. Therefore, during the first equivalence test, a counterexample that violates the given specifications may be discovered in either one or both of the black box system M1 and the model M2.

[0055] In the test process S320 of FIG. 3, in this way, a plurality of tests S321, S322, S323 with one long and one short are executed in parallel. When any test result is obtained in any of the tests S321, S322, S323, the other tests are forcibly terminated, the test process S320 is terminated, and the process proceeds to the post-processing S330.

[0056] The post-processing S330 may include determining S334, S335, S336 to re-execute the generation process S310. For example, when the learning is not sufficient (the model M2 does not sufficiently approximate the black box system M1 and is not equivalent), in the post-processing S330, the re-execution of the generation process S310 may be determined. In the re-execution of the generation process S310, based on the difference in behavior between the black box system M1 and the model M2, re-learning may be performed to reduce the difference. By re-executing (re-learning) the generation process S310, learning progresses, and it can be expected that the model M2 approximates the black box system M1 more closely.

[0057] As shown in FIG. 3, when the post-processing S330 includes determining S334, S335, S336 to re-execute the generation process S310, the generation process S310, the test process S320, and the post-processing S330 may be repeatedly executed. By repeatedly executing the generation process S310, the model M2 approximates the black box system M1 more closely, and a more appropriate model M2 can be obtained.

[0058] The test method of FIG. 3 may include an output process S340 for outputting the test result. The output process S340 is, for example, to display the test result on a computer screen (not shown).

[0059] The post-processing S330 may include determining S344, S335, S336 whether to output the result of the test processing S320 performed on the model M2 in the output processing S340. That is, when a test result is obtained in the test processing S320, in the post-processing S330, it is possible to determine whether to re-execute the generation processing S310 or to execute the output processing S340 to output the test result. For example, if the result of the test performed on the model M2 in the test processing S320 is appropriate as the test result of the black box system M1, the test result is output, and otherwise, the processing flow is controlled so that re-learning is performed.

[0060] Hereinafter, an example of the way to end the test processing S320 will be described.

[0061] As an example, the test result of the first test S321 may be obtained first by parallel execution of three tests S321, S322, and S323. In this case, the second test S322 and the third test S323 being executed are forcibly terminated, and the process proceeds to step S331 of the post-processing S330.

[0062] In the first test S321 for model checking of the model M2, as test results, there are a case where "meets the given specification (verification successful; no counterexample for M2)" is obtained and a case where a counterexample of the model M2 is found. In step S331 that proceeds from the first test S321, it is determined which of these cases the result of the model checking is.

[0063] When the result of the model checking is "meets the given specification (verification successful; no counterexample for M2)" (step S331), the second equivalence test in step S332 is executed. Also, when the result of the model checking is the discovery of a counterexample of the model M2 (step S331), the verification of the counterexample in step S333 is executed.

[0064] The content of the second equivalence test in step S332 can be the same as that of the first equivalence test in step S323. That is, the second equivalence test is a test for verifying the equivalence between the black box system M1 and the model M2. In the equivalence test, for example, a common input is randomly given to the black box system M1 and the model M2, and it is tested whether the outputs of the black box system M1 and the model M2 are the same. Also in the second equivalence test, as in the first equivalence test, counterexamples of either one or both of the black box system M1 and the model M2 may be discovered.

[0065] In model checking S321, if verification is successful (no counterexample of model M2), and in the second equivalence test S332, it is found that the black box system M1 and the model M2 are equivalent (step S334), it can be said that the black box system M1 is also verified successfully (no counterexample of the black box system M1). For example, if it cannot be confirmed that they are "not equivalent" even after the second equivalence test S332 is executed for a sufficient time, it can be said that they are "equivalent". If the black box system M1 and the model M2 are equivalent in the second equivalence test S332 (step S334), the process proceeds to step S341 of the output processing S340. In step S341, it is output that the black box system M1 meets the specification (for example, No Error). In step S341, a model M2 approximating the black box system M1 may also be output.

[0066] Also, in model checking S321, although verification is successful (no counterexample for model M2), it may be found that the black box system M1 and the model M2 are not equivalent in the second equivalence test S332. Alternatively, in model checking S321, although verification is successful (no counterexample for model M2), an example may be discovered in the second equivalence test S332 that is not a counterexample for the black box system M1 but is a counterexample for the model M2. In these cases, it means that the model M2 does not appropriately approximate the black box system M1. In these cases, for re - learning, it is determined to re - execute the generation process S310 of the model M2 (step S334).

[0067] Furthermore, in model checking S321, although verification is successful (no counterexample for model M2), a counterexample of the black box system M1 may be discovered in the second equivalence test S332. When a counterexample of the black box system M1 is discovered (step S334), the process proceeds to step S342 of the output process S340. In step S342, the counterexample discovered in the second equivalence test S332 is output as the counterexample of the black box system M1.

[0068] The verification of the counterexample in step S333 is to check whether the discovered counterexample (the counterexample of model M2) is also a counterexample of the black box system M1. In step S333, for example, when the input in the discovered counterexample (the counterexample of model M2) is given as an input to the black box system M1, the counterexample is verified by whether the output of the black box system M1 violates the specification.

[0069] If the specification is violated, the counterexample discovered in model checking S321 is a counterexample of the black box system M1 (step S335). In this case, in step S342 of the output process S340, the counterexample discovered in model checking S321 is output as the counterexample of the black box system M1.

[0070] On the one hand, when the specification is not violated (when the specification is met), the counterexample discovered by model checking S321 (the counterexample of model M2) is not a counterexample of the black box system M1 (step S335). In this case, it means that model M2 does not appropriately approximate the black box system M1. In this case, for re - learning, it is determined to re - execute the generation process S310 of model M2 (step S335).

[0071] As another example of how the test process S320 ends, when parallel execution of three tests S321, S322, and S323 is in progress, the test result of the second test (counterexample search) S322 may be obtained first. In this case, the ongoing first test S321 and third test S323 are forcibly terminated, and the process proceeds to step S331 of the post - processing S330.

[0072] In the second test S322 for searching counterexamples of model M2, as a test result, a counterexample of model M2 is discovered. In step S333 that proceeds from the second test S322, the counterexample discovered in the counterexample search S322 (the counterexample of model M2) is verified. In the counterexample verification S333 when proceeding from the counterexample search S322, for example, it is verified based on whether the output of the black box system M1 violates the specification when the input in the discovered counterexample (the counterexample of model M2) is given as an input to the black box system M1.

[0073] When the specification is violated, the counterexample discovered in the counterexample search S322 is a counterexample of the black box system M1 (step S335). In this case, in step S342 of the output processing S340, the counterexample discovered in the counterexample search S322 is output as a counterexample of the black box system M1.

[0074] On the one hand, when the specification is not violated (when the specification is satisfied), the counterexample discovered in the counterexample search S322 (the counterexample of model M2) is not a counterexample of the black box system M1 (step S335). In this case, it means that model M2 does not appropriately approximate the black box system M1. In this case, for re-learning, it is determined to re-execute the generation process S310 of model M2 (step S335).

[0075] As yet another example of how the test process S320 ends, when the three tests S321, S322, and S323 are executed in parallel, the test result of the third test (the first equivalence test) S323 may be obtained first. In this case, the ongoing first test S321 and second test S322 are forcibly terminated, and the process proceeds to step S336 of the post-processing S330.

[0076] In the third test S323 for testing the equivalence between the black box system M1 and the model M2, it may be found that the black box system M1 and the model M2 are not equivalent. Alternatively, in the third test S323, an example that is not a counterexample of the black box system M1 but is a counterexample of the model M2 may be discovered. In these cases, it means that model M2 does not appropriately approximate the black box system M1. In these cases, for re-learning, it is determined to re-execute the generation process S310 of model M2 (step S336).

[0077] Also, in the third test S323, a counterexample of the black box system M1 may be discovered. When a counterexample of the black box system M1 is discovered (step S336), in step S342 of the output process S340, the counterexample discovered in the third test S323 is output as a counterexample of the black box system M1.

[0078] In the initial stage of the repetition of the repeatedly executed generation process S310, since the learning is not sufficient, the generated model M2 is often not equivalent to the black box system M1. If they are not equivalent, the first test S321 and the second test S322 for the model M2 are wasted. However, the third test (first equivalence test) S323, which is executed in parallel with the first test S321 and the second test S322, can discover the non-equivalence early and perform re-learning early. As a result, learning can be advanced early and the model M2 can be optimized. Thus, the third test S323 can demonstrate its true value in the initial stage of the repetition in the algorithm shown in FIG. 3.

[0079] As the model M2 sufficiently approximates the black box system M1 through repeated re-learning, it becomes difficult to determine "not equivalent" in the third test S323, and the probability of obtaining test results earlier than the first test S321 and the second test S322 decreases. The parallel execution of the first test S321 and the second test S322 can demonstrate its true value after the model M2 sufficiently approximates the black box system M1.

[0080] Since the first test S321 is model checking, it can discover early when there is no counterexample in the black box system M1 (when the specification is satisfied). Since the second test S322 is counterexample search, it can discover the counterexample early when there is a counterexample in the black box system M1. Therefore, when the first test S321 and the second test S322 are executed in parallel, the test results can be obtained early in either test S321, S322 whether there is a counterexample or not. In particular, in the later stage of the repetition of the algorithm in FIG. 3, it is expected that the model M2 has no counterexample. In such a situation, by executing the first test S321, which is model checking, in parallel, it can be verified at high speed that the model M2 has no counterexample, and the overall speed of the algorithm in FIG. 3 can be increased.

[0081] Figure 4 shows a test method as a reference example. In the test process S320 of Figure 4, instead of multiple algorithms being executed in parallel, only one algorithm is executed alone. In Figure 4, as an example, model checking S321 is executed alone.

[0082] In the case of the test method of Figure 4, for the generated model M2, if model checking S321 is applied and the verification is successful (no counterexample for model M2), equivalence testing S332 is executed. If they are not equivalent, etc., re - learning S310 is performed. Also, as a result of model checking S321, if a counterexample of model M2 is found, the counterexample is verified S333. If the found counterexample is not a counterexample of the black - box system M1, re - learning S310 is performed.

[0083] In the case of the test method of Figure 4, since it is the single execution of model checking S321, if there is no counterexample in model M2, it can be discovered early. However, if there is a counterexample in model M2, it often takes a long time. On the other hand, when model checking S321 and counterexample search S322 are executed in parallel as in the test method shown in Figure 5, if there is no counterexample in model M2, model checking S321 can discover early that there is no counterexample. Also, if there is a counterexample in model M2, counterexample search S322 can discover the counterexample early. Therefore, by using counterexample search S322 in combination, a higher speed can be expected compared to model checking S321 alone. Similarly, for the test method shown in Figure 3, a higher speed can be expected.

[0084] Also, in the case of the test method in FIG. 4, if the time-consuming model checking S321 is not completed, the relearning S310 cannot be performed, and a great deal of time is required for the repetition of the relearning S310. In particular, in the initial stage of the repetition of the relearning S310, since the model M2 is often not equivalent to the black box system M1, even if the model checking S321 is executed over a long period of time, the results cannot be utilized, and in many cases, the relearning S310 should be performed. On the other hand, as in the test method shown in FIG. 6, when the model checking S321 and the equivalence test S323 are executed in parallel, in the initial stage of the repetition of the relearning, it is possible to detect non-equivalence at an early stage and perform the relearning at an early stage. Therefore, when the equivalence test S323 is used in combination, a higher speedup can be expected than with the model checking S321 alone. Similarly, for the test method shown in FIG. 3, a higher speedup can be expected.

[0085] And, since the test method shown in FIG. 3 can utilize the advantages of both the test methods shown in FIGS. 5 and 6, a significant speedup can be expected. Note that the test methods shown in FIGS. 5 and 6 are generally the same as the test method shown in FIG. 3, except that the number of algorithms executed in parallel is different. In FIGS. 5 and 6, the same reference numerals are given to the same processes and procedures as in FIG. 3.

[0086] FIG. 7 shows another example of a test method for parallel execution of a plurality of algorithms. In the test process S320 shown in FIG. 7, the counterexample search S322 and the first equivalence test S323 are executed in parallel. Note that the test method shown in FIG. 7 is generally the same as the test method shown in FIG. 3, except that the number of algorithms executed in parallel is different. In FIG. 7, the same reference numerals are given to the same processes and procedures as in FIG. 3. However, the differences from FIG. 3 in FIG. 7 will be described below.

[0087] In FIG. 7, the counterexample search S322 operates to find counterexamples existing in the model M2 which is a hybrid system. The counterexample search S322 is executed, for example, by Breach. If there are counterexamples in the model M2 that violate the given specification, Breach can quickly find such counterexamples. If Breach in FIG. 7 cannot find a counterexample of the model M2, the model M2 continues to search for counterexamples, but when a predetermined time elapses, it ends due to timeout. In the algorithm of FIG. 7, the end of the counterexample search S322 due to timeout is regarded as the model M2 satisfying the specification (verification successful; no counterexample). Also, in the algorithm of FIG. 7, the end of the counterexample search S322 due to timeout is regarded as the output of the test result that the model M2 satisfies the specification (verification successful; no counterexample).

[0088] In the algorithm of FIG. 7, when the counterexample search S322 ends due to timeout, it proceeds to step S337 of the post-processing S330. Note that when the counterexample search S322 ends due to timeout, the first equivalence test S323 that is being executed in parallel also ends. That is, due to timeout, both the counterexample search S322 and the first equivalence test S323 end.

[0089] In the counterexample search S322 of FIG. 7, as described above, as test results, there are cases where "the specification is satisfied (verification successful; no counterexample of M2)" is obtained and cases where a counterexample of the model M2 is found. In step S337 where it proceeds from the counterexample search S322, it is determined which of these cases the result of the counterexample search S322 is.

[0090] When the result of the counterexample search S322 is "the specification is satisfied (verification successful; no counterexample of M2)" (step S337), the second equivalence test of step S332 is executed. Also, when the result of the counterexample search S322 is the discovery of a counterexample of the model M2 (step S337), the verification of the counterexample of step S333 is executed. The processing of step S332, step S333, and subsequent steps is the same as that in FIG. 3.

[0091] In FIG. 7, at the initial stage of the repetition of the repeatedly executed generation process S310, since the learning is not sufficient, the generated model M2 is often not equivalent to the black box system M1. However, the first equivalence test S323 executed in parallel with the counterexample search S322 can discover the non-equivalence early and perform re-learning early.

[0092] Also, since there are often counterexamples in the model M2, by executing the counterexample search S322 in parallel with the first equivalence test S323, counterexamples can be discovered early. Therefore, by executing the counterexample search S322 and the first equivalence test S323 in parallel, speedup can be achieved.

[0093] <3. Experiment>

[0094] Hereinafter, an experiment in which the black box system M1 is tested by the system 100 according to the embodiment will be described. In the experiment, as the black box system M1, the "Bouncing Ball model" described on the Mathworks website (https: / / jp.mathworks.com / help / simulink / slref / simulation-of-a-bouncing-ball.html) was used. More specifically, a bouncing ball model using the Second-Order Integrator block described on the website was used.

[0095] The bouncing ball model is an example of a hybrid system. The continuous dynamics of the bouncing ball are given by a differential equation using two continuous states: the acceleration g due to gravity, the position x(t) of the ball, and the velocity v(t), and the acceleration g due to gravity. The discrete transition of the bouncing ball occurs as a discrete velocity change due to the collision of the ball with the ground (the position x of the ball is 0). The transition condition in this case is x = 0. Due to the collision, the velocity v of the ball changes discretely. The velocity of the ball immediately before the collision and the velocity of the ball immediately after the collision are related using the coefficient of restitution of the ball.

[0096] For the bouncing ball model used in the experiment, the acceleration g, the initial position x(0), and the initial velocity v(0) are given as external inputs. The acceleration g is input with a value between -9.9 and -9.5, the initial position x(0) of the ball is input with a value between 10 and 12, and the initial velocity v(0) is input with a value between 13 and 15. According to these values, the trajectory of the bouncing ball changes. Figure 8 shows an example of the trajectory of the bouncing ball. In Figure 8, the horizontal axis represents the time t, and the vertical axis represents the position x(t) of the ball.

[0097] In the experiment, as a specification that the black box system should satisfy, a forbidden set was set in the plane (t-x plane) showing the trajectory of the ball. The forbidden region is an area that the ball should not pass through. In Figure 8, as an example, the range where the time t is 5.51 or more and x is 10.0 or more is set as the forbidden region (the "UNSAFE" region shown in Figure 8). If the bouncing ball does not pass through the forbidden region, the black box system is safe (meets the specification), and if it passes through the forbidden region, the black box system is not safe (the specification is violated). In the test of the black box system, g, x(0), and v(0) such that the ball passes through the forbidden region are discovered as counterexamples.

[0098] In the experiment, Experiments #1 to #9 (Experiment #7) with the forbidden regions set as follows were conducted. Note that in Experiments #4 and #5, although the forbidden regions are the same, the operation parameters of the algorithm for testing the model are different. Experiment #1: From time t = 5.51 to the end time T, x >= 10.0 Experiment #2: From time t = 5.51 to the end time T, x >= 15.089 Experiment #3: From time t = 11.4 to the end time T, x >= 5.5 Experiment #4: From time t = 11.4 to the end time T, x >= 6.1 Experiment #5: From time t = 11.4 to the end time T, X >= 6.1 Experiment 6: From time t = 6.14 to 6.16, from x = 13.0 to 13.1 Experiment 7: From time t = 1.62 to 1.64, from x = 18.2 to 18.3 Experiment 8: From time t = 5.8 to 5.9, from x = 11.7 to 11.9 Experiment 9: From time t = 5.96 to 6.02, from x = 12.1 to 12.5

[0099] In each of Experiments 1 to 9, the black box system was tested (for searching counterexamples) using the test methods in Figure 4 (dReach Only), Figure 5 (dReach+Breach), Figure 6 (dReach+Equivalnce Test), and Figure 3 (dReach+Breach+Equivalence Test), respectively. Also, in each of Experiments 1 to 9, the black box system was tested (for searching counterexamples) using random simulation. Figure 9 shows the results thereof.

[0100] In Figure 9, Experiment♯ indicates Experiments 1 to 9. DoD indicates the degree of difficulty of searching for counterexamples by random simulation. In DoD, #sim / time indicates the number of random simulation runs / time [seconds], showing the number of times of running random simulation and the required time until a counterexample is found.

[0101] In Figure 9, #BBC_Iters / Time in Seconds indicates the number of test repetitions / time [seconds], showing the number of repetitions and the required time for each of the test methods in Figures 4, 5, 6, and 3 until a counterexample is found. Note that in Figure 9, TimeOut indicates that the required time exceeded 1 hour and the process could not end. Also, in Figure 9, (D), (B), and (E) described after the numerical value of #sim / time indicate finding a counterexample by dReach, finding a counterexample by Breach, and finding a counterexample by Equialenc Test (equivalence test), respectively.

[0102] As shown in the DoD of FIG. 9, in the random simulation, a large number of inputs need to be randomly given to the black box system, and the number of simulation times is extremely large. Moreover, among the first to ninth experiments, timeouts occurred in seven of them and no counterexamples could be found. Only two experiments (the first experiment and the third experiment) were able to find counterexamples without timing out.

[0103] Also, as shown in "dReach Only" of FIG. 9, in the test method of FIG. 4, since it is a single execution of dReach, which is a model checking algorithm, it takes time if there is a counterexample. In seven experiments except the first experiment and the seventh experiment, no counterexamples could be found and timeouts occurred. This is because it is difficult to find counterexamples with dReach, which is a model checking.

[0104] As shown in "dReach+Breach" of FIG. 9, in the test method of FIG. 5, since the model checking algorithm dReach and the counterexample search algorithm Breach are executed in parallel, counterexamples can be found early. Also, compared to dReach alone ("dReach Only"), the cases of timing out have decreased.

[0105] As shown in "dReach+Equialence Test" of FIG. 9, in the test method of FIG. 6, since the model checking algorithm dReach and the equivalence test are executed in parallel, compared to dReach alone ("dReach Only"), the cases of timing out have decreased, indicating that speedup has been achieved. Note that "dReach+Equialence Test" takes longer overall than "dReach+Breach", which is because the overhead of the Equivalence Test is large.

[0106] As shown in the "dReach+Breach+Equialence Test" of FIG. 9, in the test method of FIG. 3, since the model checking algorithm dReach, the counterexample search algorithm Breach, and the equivalence test are executed in parallel, it can be seen that compared with dReach Only, the cases of timeout are reduced and the speed is increased. Also, in the test method of FIG. 3, there is no timeout, and it can be seen that compared with "dReach+Breach" and "dReach+Equialence Test" that execute the two algorithms in parallel, the cases of timeout are reduced and the speed is increased.

[0107] The present invention is not limited to the above embodiments, and various modifications are possible.

Description of Signs

[0108] 100: System 110: Processor 120: Storage device 121: Computer program 130: Interface 150: Specification data M1: Black box system M2: Model [[ID=2】S11: Learning algorithm S12: Test S12a: Algorithm S13: Output S310: Generation process S320: Test process S321: Model checking S322: Counterexample search S323: First equivalence test S330: Post-processing S331: Judgment S332: Second equivalence test S333: Counterexample verification S334: Judgment S335: Judgment S336: Judgment S337: Judgment S340: Output processing S341: Output S342: Output

Claims

1. A computer-implemented method executed by a computer for testing a black box system, comprising: executing a generation process of the model based on a learning algorithm for generating a model that approximates the behavior of the black box system; executing a test process including executing a test of the generated model; characterized in that the test process includes parallelly executing a plurality of different types of algorithms for testing the model; A computer-implemented method for testing a black box system.

2. further comprising executing a post-processing after the execution of the test process, wherein the post-processing includes determining to re-execute the generation process, and when a test result is obtained in any one of the plurality of different types of algorithms being parallelly executed in the test process, migrating from the test process to the post-processing; The computer-implemented method for testing a black box system according to Claim 1.

3. The plurality of different types of algorithms include a model checking algorithm as a formal verification of the model, and a type of algorithm different from the model checking algorithm ; the post-processing includes an equivalence test executed when no counterexample of the model is found by the model checking algorithm, and a counterexample verification process executed when a counterexample of the model is found by the model checking algorithm, ; in the post-processing, when it is determined that the black box system and the model are not equivalent as a result of executing the equivalence test, re-execution of the generation process is determined; in the post-processing, when it is determined that the counterexample is not a counterexample for the black box system as a result of executing the counterexample verification process, re-execution of the generation process is determined; The computer-implemented method for testing a black box system according to Claim 2.

4. The plurality of different types of algorithms include a model checking algorithm as a formal verification of the model, and a counterexample search algorithm for the model, ; the post-processing includes a counterexample verification process executed when a counterexample of the model is found by any one of the model checking algorithm and the counterexample search algorithm. In the post-processing, if as a result of executing the counterexample verification process, it is determined that the counterexample is not a counterexample for the black box system, re-execution of the generation process is determined. A computer-implemented method for testing a black box system according to claim 2.

5. The plurality of different types of algorithms include a model checking algorithm as a formal verification of the model, and an algorithm for a first equivalence test between the black box system and the model, and include the post-processing includes a second equivalence test that is executed when no counterexample of the model is found by the model checking algorithm. In the test process, if as a result of executing the first equivalence test, it is determined that the black box system and the model are not equivalent, re-execution of the generation process is determined. In the post-processing, if as a result of executing the second equivalence test, it is determined that the black box system and the model are not equivalent, re-execution of the generation process is determined. A computer-implemented method for testing a black box system according to claim 2.

6. The plurality of different types of algorithms include an algorithm for a first equivalence test between the black box system and the model, and a different type of algorithm from the algorithm for the first equivalence test, and include the post-processing includes a second equivalence test that is executed when a test result is obtained in a different type of algorithm from the algorithm for the first equivalence test. In the test process, if as a result of executing the first equivalence test, it is determined that the black box system and the model are not equivalent, re-execution of the generation process is determined. In the post-processing, if as a result of executing the second equivalence test, it is determined that the black box system and the model are not equivalent, re-execution of the generation process is determined. A computer-implemented method for testing a black box system according to claim 2.

7. The different type of algorithm from the algorithm for the first equivalence test includes at least one of a formal verification algorithm of the model and a counterexample search algorithm of the model. A computer-implemented method for testing a black box system according to claim 6.

8. The plurality of different types of algorithms include a model checking algorithm for the model, a counterexample search algorithm for the model, and an algorithm for a first equivalence test between the black box system and the model, and the post-processing includes a second equivalence test that is executed when no counterexample of the model is found in the model checking algorithm, the post-processing includes a counterexample verification process that is executed when a counterexample of the model is found as a test result of either the model checking algorithm or the counterexample search algorithm, in the test process, if it is determined that the black box system and the model are not equivalent as a result of executing the first equivalence test, re-execution of the generation process is determined, in the post-processing, if it is determined that the black box system and the model are not equivalent as a result of executing the second equivalence test, re-execution of the generation process is determined, in the post-processing, if it is determined that the counterexample is not a counterexample for the black box system as a result of executing the counterexample verification process, re-execution of the generation process is determined. A computer-implemented method for testing a black box system according to claim 2.

9. Executing a generation process of the model based on a learning algorithm that generates a model approximating the behavior of a black box system, and executing a test process including executing a test of the generated model, configured as the test process includes parallel execution of a plurality of different types of algorithms for testing the model. System

Images