Model checking apparatus, model checking method, and program

Abstract

To verify time phase logical expression with a small calculation amount.SOLUTION: A model checking apparatus includes an acquiring unit that acquires a state transition model and time phase logical expression, a converting unit that converts the time phase logical expression into constraint information encoded at variable-length time intervals based on mixed integer linear programming, and a result outputting unit that outputs information indicating whether the state transition model satisfies the time phase logical expression based on the state transition model and the constraint information.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present disclosure relates to a model checking device, a model checking method, and a program. [Background technology]

[0002] Model checking, a type of formal verification, is a method for verifying whether a model derived from a hardware or software design satisfies a formal specification by exhaustive search. Model checking has attracted attention as an automated verification technique, and various model checking methods have been proposed.

[0003] For example, Non-Patent Document 1 discloses a technique for performing model checking based on background-theoretic satisfiability problems (SMT: Satisfiability Modulo Theories).For example, Non-Patent Document 2 discloses a technique for generating counterexamples by black-box optimization based on stochastic gradient methods. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Yu, G., Lee, J., Bae, K., "Stlmc: Robust STL model checking of hybrid systems using SMT," Computer Aided Verification - 34th International Conference, CAV 2022, August 7-10, 2022. Proceedings, Part I. Lecture Notes in Computer Science, vol. 13371, pp. 524-537, Springer (2022). [Non-patent document 2] Donz'e, A. "Breach, A toolbox for verification and parameter synthesis of hybrid systems," Computer Aided Verification - 22nd International Conference, CAV 2010, July 15-19, 2010. Proceedings, Lecture Notes in Computer Science, vol. 6174, pp. 167-170, Springer (2010). Summary of the Invention [Problem to be solved by the invention]

[0005] However, conventional techniques leave room for improvement in the efficiency of model checking. For example, trace synthesis, which instantiates time-varying signals that satisfy a formal specification, requires a huge amount of computation.

[0006] An aspect of the present disclosure aims to verify a temporal logic formula with a small amount of calculation. [Means for solving the problem]

[0007] A model checking device according to one aspect of the present disclosure includes an acquisition unit that acquires a state transition model and a temporal logic formula, a conversion unit that converts the temporal logic formula into constraint information encoded with variable-length time intervals based on mixed integer linear programming, and a result output unit that outputs information indicating whether the state transition model satisfies the temporal logic formula based on the state transition model and the constraint information. [Effects of the Invention]

[0008] According to one aspect of the present disclosure, a temporal logic formula can be verified with a small amount of calculation. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 10 is a diagram for explaining trace synthesis. [Figure 2]FIG. 1 is a diagram for explaining an overview of model checking. [Figure 3] FIG. 1 is a diagram for explaining an overview of variable interval coding. [Figure 4] FIG. 10 is a diagram for explaining details of variable interval coding. [Figure 5] FIG. 1 is a block diagram illustrating an example of the overall configuration of a model checking system. [Figure 6] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a computer. [Figure 7] FIG. 2 is a block diagram illustrating an example of a functional configuration of a model checking apparatus. [Figure 8] 1 is a flowchart illustrating an example of a model checking method. [Figure 9] FIG. 10 is a diagram illustrating an example of a comparison result. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted.

[0011] [Embodiment] An embodiment of the present disclosure is an example of an information processing system that performs model checking. Hereinafter, the information processing system according to this embodiment will be referred to as a "model checking system." The model checking system has a function of acquiring a system model and a temporal logic formula, and illustrating an output signal of the system model that satisfies the temporal logic formula. This function is also called "trace synthesis."

[0012] The system model is a mathematical model that models a predetermined system. The system model may be a state transition model that describes the state transition of the system. The system model may output a time-varying signal that indicates the state of the system. The state transition model may include, for example, a probabilistic automaton or a hybrid automaton. In this embodiment, the system model may be, for example, a rectangular hybrid automaton.

[0013] Hereinafter, the system to be modeled will also be referred to as the "target system." The target system may be software or hardware. Examples of the target system include integrated circuits (ICs), automobiles, aircraft, electrical appliances, power plants, and information systems.

[0014] Temporal logic is a part of signal temporal logic (STL), a language capable of expressing the properties of time-series data. Signal temporal logic is a system of rules and notations for understanding and expressing problems in relation to time. Temporal logic is suitable for describing goals in data analysis or model analysis. For this reason, temporal logic is used, for example, in the manufacturing industry to describe system requirements. In this embodiment, the temporal logic may be a logical formula describing the formal specification of the target system.

[0015] Formal specifications are mathematically formulated information that defines requirements for a system. Formal specifications are used in various processes, such as in the manufacturing industry, to clarify the meaning of requirements, automate testing, or automate parameter optimization.

[0016] In formal specification descriptions using signal-based temporal logic, it is difficult to faithfully express the designer's intention in logical formulas. In other words, it is difficult to determine whether the semantic content of mathematical expressions using logical formulas faithfully expresses the designer's intention.

[0017] To address this issue, it is effective to provide designers with examples of logical expressions using trace synthesis. The example of a logical expression is formulated as the problem of generating a time-varying signal σ that satisfies a given temporal logical expression φ. Hereinafter, the time-varying signal σ that satisfies the temporal logical expression φ will also be referred to as the "example signal."

[0018] FIG. 1 is a diagram for explaining trace synthesis. As shown in FIG. 1, trace synthesis is a process of synthesizing an example signal σ that satisfies a temporal logic formula φ. In the example of FIG. 1, the temporal logic formula φ satisfies the condition that the value of x is 3 or more between 0 and 4 seconds (F [0,4] (x≧3)). We can see that the example signal σ is a signal where the value of x is 3 or more in 3.2 seconds.

[0019] Conventionally, methods based on background-theoretic satisfiability problems (SMT: Satisfiability Modulo Theories) (see, for example, Non-Patent Document 1) or methods using black-box optimization (see, for example, Non-Patent Document 2) have been proposed. However, the conventional methods require a huge amount of calculation for a complex temporal logic formula φ, and are insufficient in performance for interactive trial and correction.

[0020] In this embodiment, assuming that the target system can be modeled using a white-box model, temporal logic formulas are converted into constraint information based on mixed-integer linear programming (MILP). MILP is a linear programming problem with a constraint that some of the decision variables must be integer variables.

[0021] In this embodiment, it is assumed that the system model can be coded in MILP exactly or approximately. The model checking system may acquire a system model coded in MILP, or may code the acquired system model in MILP. If the system model and temporal logic formula are coded in MILP, model verification can be performed using an existing MILP solver. A MILP solver is a program that solves MILP problems. One known example of a MILP solver is called the Gurobi Optimizer.

[0022] FIG. 2 is a diagram for explaining an overview of model checking. As shown in FIG. 2, a system model M and a temporal logic formula φ are input to a model checking system. The model checking system converts the system model M and the temporal logic formula φ into a system model αM and constraint information αφ, respectively. The system model αM is a mathematical model coded in MILP. The constraint information αφ is constraint information obtained by coding the formal specification shown in the temporal logic formula φ in MILP.

[0023] The model checking system verifies whether the system model M satisfies the temporal logic formula φ based on the system model αM and the constraint information αφ. Specifically, the model checking system determines whether an output signal of the system model αM that satisfies the constraint information αφ exists (in other words, whether αφ ∧ αM is true).

[0024] The model checking system outputs a check result indicating the result of model checking. In this embodiment, if the system model M satisfies the temporal logic formula φ, the check result includes an output signal of the system model M that satisfies the temporal logic formula φ. On the other hand, if the system model M does not satisfy the temporal logic formula φ, the check result includes information indicating that there is no output signal of the system model αM that satisfies the temporal logic formula φ.

[0025] In this embodiment, when encoding a temporal logic formula using MILP, the variables of the temporal logic formula are sampled at variable-length time intervals. Hereinafter, encoding at variable-length time intervals will be referred to as "variable interval encoding." Conversely, encoding at fixed-length time intervals will be referred to as "constant interval encoding."

[0026] FIG. 3 is a diagram illustrating an overview of variable interval coding. As shown in FIG. 3, in fixed interval coding, variables are sampled periodically at fixed time intervals. In contrast, in variable interval coding, sampling is performed only when the value of variable x changes. In the example of FIG. 3, in fixed interval coding, sampling is performed at seven equally spaced points from t1 to t7. On the other hand, in variable interval coding, sampling is performed at three points from γ1 to γ3, which are independent of t1 to t7. Therefore, when encoding the same time interval t0 to t7, variable interval coding can describe it with fewer variables than fixed interval coding. Furthermore, because there is a degree of freedom in selecting the intervals, variable interval coding has greater expressive power than fixed interval coding.

[0027] Incidentally, some MILP solvers do not distinguish between simple inequality signs (<, >) and inequality signs with equality signs (≦, ≧). This type of MILP solver cannot distinguish between open and closed intervals. An open interval is an interval that does not include a boundary value, and a closed interval is an interval that includes a boundary value. If it is not possible to distinguish between open and closed intervals, it becomes unclear which interval contains the boundary of another interval. Therefore, in this embodiment, this problem is solved by introducing auxiliary variables. The auxiliary variables include a variable that indicates the truth or falsity of the temporal logic formula at each time point and a variable that indicates the strength of the truth or falsity of the temporal logic formula at each time point. This makes it possible to identify the intervals in which the temporal logic formula is true and the intervals in which the temporal logic formula is false, and therefore the time at which the variables should be sampled.

[0028] FIG. 4 is a diagram for explaining the details of variable interval coding. In the example shown in FIG. 4, the temporal logic formula φ expresses that the constraint p is satisfied, that is, the variable α is equal to or less than 3 when the time t is between 0 and 6 seconds. FIG. 4 shows an example of a time-varying signal σ that satisfies the temporal logic formula φ. In MILP, the time-varying signal σ is expressed as a signal consisting of a finite number of real variables γ0, γ N ,x 0,α ,···,x N,α (In Figure 4, N=4).

[0029] In this embodiment, the auxiliary variable ζ i p , ζ i δ,p , i , <φ> i , S i p We use ζ to express the constraints included in the temporal logic formula φ. i p is the time γ i is a variable (truth value) that indicates whether constraint p is satisfied. i δ,p is the time γ i is a variable (truth value) that indicates whether constraint p is strongly satisfied. i is in the interval [γ i-1 ,γ i ] is a variable (truth value) that indicates whether constraint p is satisfied. i is in the interval [γ i-1 ,γ i ] is a variable (truth value) that indicates whether the logical formula φ is satisfied. i p is a variable (real number) that indicates the time length that satisfies the logical formula φ. i p is an example of the first variable. i δ,p is an example of a second variable.

[0030] For example, the ζ shown in Figure 4 i p , ζ i δ,p Referring to the above, it can be seen that at time γ2 (t=6), constraint p is satisfied, but not strongly satisfied. Whether constraint p is strongly satisfied or not is determined by threshold δ. In the example of Figure 4, constraint p indicates that variable α is 3 or less, but if variable α is 3+δ or less, it is determined that constraint p is satisfied. On the other hand, if variable α is not 3 or less, constraint p is not determined to be strongly satisfied. At each time point ζ i p , ζ i δ,p When sampling, as the truth or falsity of constraint p changes, there will be a time when constraint p is satisfied but not strongly satisfied. If this time is identified as the boundary of the interval where the truth or falsity of logical formula φ changes, the boundary between the interval where the temporal logic formula is true and the interval where the temporal logic formula is false will become clear.

[0031] This embodiment aims to verify a temporal logic formula with a small amount of calculation. To this end, in this embodiment, the temporal logic formula is converted into constraint information coded with variable-length time intervals based on mixed integer linear programming, and information indicating whether the state transition model satisfies the temporal logic formula is output based on the state transition model and the constraint information. In one aspect, this embodiment performs model checking based on constraint information expressed with a small number of variables, thereby enabling the verification of a temporal logic formula with a small amount of calculation.

[0032] <Overall structure> The overall configuration of the model checking system in this embodiment will be described with reference to Fig. 5. Fig. 5 is a block diagram showing an example of the overall configuration of the model checking system.

[0033] 5, the model checking system 1000 includes a model checking device 10 and a terminal device 20. The model checking device 10 and the terminal device 20 are connected to each other so as to be able to communicate data with each other via a communication network N such as a LAN (Local Area Network) or the Internet.

[0034] The model checking device 10 is an information processing device such as a personal computer, workstation, or server that performs model checking. The model checking device 10 receives a state transition model to be checked and a temporal logic formula from a terminal device 20, and performs model checking to verify whether the state transition model satisfies the temporal logic formula. The model checking device 10 transmits a test result indicating the result of the model checking to the terminal device 20. The test result may include information indicating whether the state transition model satisfies the temporal logic formula. If the state transition model satisfies the temporal logic formula, the test result may include an output signal of the state transition model that satisfies the temporal logic formula.

[0035] The terminal device 20 is an information processing terminal such as a personal computer, a smartphone, or a tablet terminal operated by a user of the model checking system 1000. The terminal device 20 transmits a state transition model and a temporal logic formula input by the user to the model checking device 10. The terminal device 20 receives the inspection result from the model checking device 10 and presents the inspection result to the user.

[0036] A user of the model checking system 1000 may be a designer of the target system. A user of the model checking system 1000 may include a creator of the system model M or a creator of the temporal logic formula φ. The creator of the system model M or the creator of the temporal logic formula φ may be a third party different from the designer of the target system.

[0037] The overall configuration of the model checking system 1000 shown in FIG. 5 is an example, and various system configuration examples are possible depending on the application and purpose. For example, the model checking system 1000 may include multiple model checking devices 10 and one or more terminal devices 20. For example, the model checking device 10 may be realized by multiple computers, or may be realized as a cloud computing service. For example, the model checking system 1000 may be realized by a standalone computer. The division of devices such as the model checking device 10 and the terminal device 20 shown in FIG. 5 is an example.

[0038] <Hardware configuration> The model checking device 10 and the terminal device 20 may be realized by, for example, a computer. Fig. 6 is a block diagram showing an example of the hardware configuration of a computer.

[0039] 6, the computer 500 includes a CPU (Central Processing Unit) 501, a ROM (Read Only Memory) 502, a RAM (Random Access Memory) 503, a HDD (Hard Disk Drive) 504, an input device 505, a display device 506, a communication I / F (Interface) 507, and an external I / F 508. The CPU 501, the ROM 502, and the RAM 503 form a so-called computer. The hardware components of the computer 500 are connected to each other via a bus line 509. The input device 505 and the display device 506 may be connected to the external I / F 508 for use.

[0040] The CPU 501 is a computing device that reads programs and data from a storage device such as the ROM 502 or the HDD 504 onto the RAM 503 and executes the processes, thereby realizing the overall control and functions of the computer 500. The computer 500 may have a GPU (Graphics Processing Unit) in addition to or instead of the CPU 501.

[0041] The ROM 502 is an example of a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 502 functions as a main storage device that stores various programs, data, etc. required for the CPU 501 to execute various programs installed in the HDD 504. Specifically, the ROM 502 stores boot programs such as a Basic Input Output System (BIOS) and an Extensible Firmware Interface (EFI) that are executed when the computer 500 starts up, as well as data such as OS (Operating System) settings and network settings.

[0042] The RAM 503 is an example of a volatile semiconductor memory (storage device) in which programs and data are erased when the power is turned off. The RAM 503 is, for example, a dynamic random access memory (DRAM) or a static random access memory (SRAM). The RAM 503 provides a working area in which various programs installed in the HDD 504 are expanded when executed by the CPU 501.

[0043] The HDD 504 is an example of a non-volatile storage device that stores programs and data. The programs and data stored in the HDD 504 include an OS, which is basic software that controls the entire computer 500, and applications that provide various functions on the OS. Note that the computer 500 may use a storage device that uses flash memory as a storage medium (e.g., an SSD (Solid State Drive)) instead of the HDD 504.

[0044] The input device 505 includes a touch panel, operation keys and buttons, a keyboard and mouse, a microphone for inputting sound data such as voice, and the like, which are used by the user to input various signals.

[0045] The display device 506 is configured with a display such as a liquid crystal display or organic EL (Electro-Luminescence) display for displaying a screen, a speaker for outputting sound data such as voice, and the like.

[0046] The communication I / F 507 is an interface that connects to a communication network and enables the computer 500 to perform data communication.

[0047] The external I / F 508 is an interface with external devices, such as a drive device 510.

[0048] The drive device 510 is a device for loading a recording medium 511. The recording medium 511 here includes media that record information optically, electrically, or magnetically, such as a CD-ROM, a flexible disk, or a magneto-optical disk. The recording medium 511 may also include semiconductor memories that record information electrically, such as ROMs and flash memories. This allows the computer 500 to read from and / or write to the recording medium 511 via the external I / F 508.

[0049] The various programs to be installed in the HDD 504 are installed, for example, by setting the distributed recording medium 511 in a drive device 510 connected to the external I / F 508 and reading out the various programs recorded on the recording medium 511 by the drive device 510. Alternatively, the various programs to be installed in the HDD 504 may be installed by being downloaded via the communication I / F 507 from a network different from the communication network.

[0050] <Functional configuration> The functional configuration of the model checking system 1000 will be described with reference to Fig. 7. Fig. 7 is a block diagram showing an example of the functional configuration of the model checking system.

[0051] 7, the model checking device 10 includes a model acquisition unit 110, a logical formula acquisition unit 120, a model conversion unit 130, a logical formula conversion unit 140, a signal synthesis unit 150, and a result output unit 160. The model checking device 10 functions as the model acquisition unit 110, the logical formula acquisition unit 120, the model conversion unit 130, the logical formula conversion unit 140, the signal synthesis unit 150, and the result output unit 160 by executing a program installed in advance.

[0052] For example, the model acquisition unit 110, the logical formula acquisition unit 120, the model conversion unit 130, the logical formula conversion unit 140, the signal synthesis unit 150, and the result output unit 160 are realized by processing that is executed by the CPU 501 of a program loaded from the HDD 504 onto the RAM 503 shown in FIG.

[0053] The model acquisition unit 110 acquires a system model M. The system model M may be a state transition model that models a target system. As an example, the system model M may be a rectangular hybrid automaton. The system model M may be a state transition model coded based on MILP. The system model M may be a state transition model that can be coded based on MILP.

[0054] The model acquiring unit 110 may receive electronic data indicating the system model M from the terminal device 20. The model acquiring unit 110 may accept electronic data indicating the system model M input to the input device 505 of the model checking device 10. The model acquiring unit 110 may read out the system model M stored in advance in a storage device of the model checking device 10.

[0055] The logical formula acquisition unit 120 acquires a temporal logical formula φ. The temporal logical formula φ may be a logical formula describing a formal specification of the target system. The temporal logical formula φ may include a logical formula describing a dangerous state of the target system. As an example, the dangerous state of the target system may be a state in which there is a high probability of an accident or the like occurring when the target system is an automobile or an autonomous vehicle.

[0056] The logical formula acquiring unit 120 may receive electronic data indicating the temporal logic formula φ from the terminal device 20. The logical formula acquiring unit 120 may accept electronic data indicating the temporal logic formula φ input to the input device 505 of the model checking device 10. The logical formula acquiring unit 120 may read out the temporal logic formula φ stored in advance in a storage device of the model checking device 10.

[0057] The model conversion unit 130 converts the system model M into a system model αM. The system model αM is a system model coded using MILP. The model conversion unit 130 may convert the system model M acquired by the model acquisition unit 110. The model conversion unit 130 may convert the system model M into the system model αM by coding the system model M based on MILP. When the system model M is coded based on MILP, the model conversion unit 130 may use the system model M acquired by the model acquisition unit 110 as the system model αM.

[0058] The logical formula conversion unit 140 converts the temporal logic formula φ into constraint information αφ. The constraint information αφ is constraint information obtained by encoding the formal specification indicated in the temporal logic formula φ using MILP. The logical formula conversion unit 140 may convert the temporal logic formula φ acquired by the logical formula acquisition unit 120 into constraint information αφ. The logical formula conversion unit 140 may convert the temporal logic formula φ acquired by the logical formula acquisition unit 120 into constraint information αφ by encoding the temporal logic formula φ based on MILP. The logical formula conversion unit 140 may convert the temporal logic formula φ into constraint information αφ by sampling the variables of the temporal logic formula φ at variable-length time intervals.

[0059] The signal synthesis unit 150 synthesizes an example signal σ. The example signal σ is a signal that satisfies the temporal logic formula φ among signals that can be output by the system model M. The signal synthesis unit 150 may synthesize the example signal σ based on the system model αM and constraint information αφ. The signal synthesis unit 150 may search for an example signal σ that satisfies the temporal logic formula φ among signals that can be output by the system model M based on the system model αM and constraint information αφ. The signal synthesis unit 150 may synthesize the example signal σ using a MILP solver.

[0060] The result output unit 160 outputs a test result indicating the result of the model checking. The result output unit 160 may output the test result including information indicating whether or not the system model M satisfies the temporal logic formula φ. The result output unit 160 may determine whether or not the system model M satisfies the temporal logic formula φ based on whether or not the signal synthesis unit 150 has synthesized the example signal σ.

[0061] When the result output unit 160 determines that the system model M satisfies the temporal logic formula φ, it may output the test result including the example signal σ synthesized by the signal synthesis unit 150. On the other hand, when the result output unit 160 determines that the system model M does not satisfy the temporal logic formula φ, it may output the test result including information indicating that there is no output signal of the system model M that satisfies the temporal logic formula φ.

[0062] The result output unit 160 may output information indicating the safety of the target system. When the temporal logic formula φ includes a logic formula describing a dangerous state of the target system, the fact that the system model M does not satisfy the temporal logic formula φ means that the target system is safe. On the other hand, in this case, the fact that the system model M satisfies the temporal logic formula φ means that there is a possibility that the target system is not safe. In other words, the result output unit 160 may output information indicating that the system model M satisfies the temporal logic formula φ or that the system model M does not satisfy the temporal logic formula φ as information indicating the safety of the target system.

[0063] The functional configuration of model checking device 10 shown in Fig. 7 is one example, and it goes without saying that there are various examples of functional configurations depending on the application and purpose. The division of processing units such as model acquisition unit 110, logical formula acquisition unit 120, model conversion unit 130, logical formula conversion unit 140, signal synthesis unit 150, and result output unit 160 shown in Fig. 7 is one example.

[0064] For example, at least two of the model acquisition unit 110, the logical formula acquisition unit 120, the model conversion unit 130, the logical formula conversion unit 140, the signal synthesis unit 150, and the result output unit 160 may be integrated into one processing unit. Also, for example, at least one of the model acquisition unit 110, the logical formula acquisition unit 120, the model conversion unit 130, the logical formula conversion unit 140, the signal synthesis unit 150, and the result output unit 160 may be divided into multiple processing units.

[0065] For example, the model acquisition unit 110 and the logical formula acquisition unit 120 may be integrated into one acquisition unit. Also, for example, the model conversion unit 130 and the logical formula conversion unit 140 may be integrated into one conversion unit.

[0066] <Model checking method> A model checking method executed by the model checking system 1000 according to this embodiment will be described with reference to Fig. 8. Fig. 8 is a flowchart showing an example of the model checking method.

[0067] In step S1, a user of the model checking system 1000 performs an operation to input a system model M into the terminal device 20. The terminal device 20 accepts the system model M input by the user and transmits electronic data indicating the system model M to the model checking device 10.

[0068] The model checking device 10 receives electronic data indicating the system model M from the terminal device 20. The model acquisition unit 110 of the model checking device 10 acquires the system model M based on the electronic data received by the model checking device 10. The model acquisition unit 110 sends the system model M to the model conversion unit 130.

[0069] In step S2, a user of the model checking system 1000 performs an operation to input a temporal logic formula φ to the terminal device 20. The terminal device 20 accepts the input of the temporal logic formula φ by the user and transmits electronic data indicating the temporal logic formula φ to the model checking device 10.

[0070] The model checking device 10 receives electronic data indicating the temporal logic formula φ from the terminal device 20. The logical formula acquisition unit 120 of the model checking device 10 acquires the temporal logic formula φ based on the electronic data received by the model checking device 10. The logical formula acquisition unit 120 sends the temporal logic formula φ to the logical formula conversion unit 140.

[0071] In step S3, the model conversion unit 130 of the model checking device 10 receives the system model M from the model acquisition unit 110. The model conversion unit 130 converts the system model M into a system model αM by encoding the system model M based on MILP. The model conversion unit 130 sends the system model αM to the signal synthesis unit 150. Note that when the system model M is encoded based on MILP, the model conversion unit 130 may send the system model M to the signal synthesis unit 150 as the system model αM.

[0072] In step S4, the logical formula conversion unit 140 of the model checking device 10 receives the temporal logic formula φ from the logical formula acquisition unit 120. The logical formula conversion unit 140 converts the temporal logic formula φ into constraint information αφ coded based on MILP by sampling the variables of the temporal logic formula φ at variable-length time intervals. The logical formula conversion unit 140 sends the constraint information αφ to the signal synthesis unit 150.

[0073] In step S5, the signal synthesis unit 150 of the model checking device 10 receives the system model αM from the model transformation unit 130. The signal synthesis unit 150 also receives the constraint information αφ from the logical formula transformation unit 140.

[0074] The signal synthesis unit 150 searches for an example signal σ that satisfies the temporal logic formula φ among signals that the system model M can output, based on the system model αM and the constraint information αφ. The signal synthesis unit 150 sends the search result for the example signal σ to the result output unit 160. If an example signal σ that satisfies the temporal logic formula φ is searched for, the search result includes the searched example signal σ. On the other hand, if an example signal σ that satisfies the temporal logic formula φ is not searched for, the search result includes information indicating that the example signal σ was not searched for.

[0075] In step S6, the result output unit 160 of the model checking device 10 receives the search result of the example signal σ from the signal synthesis unit 150. The result output unit 160 determines whether the example signal σ is synthesizable or not based on the search result of the example signal σ. Specifically, the result output unit 160 determines whether the example signal σ is included in the search result of the example signal σ. If the search result includes the example signal σ, the result output unit 160 determines that the example signal σ is synthesizable. On the other hand, if the search result does not include the example signal σ, the result output unit 160 determines that the example signal σ is not synthesizable.

[0076] If it is determined that the example signal σ is synthesizable (YES), the result output unit 160 proceeds to step S7. On the other hand, if it is determined that the example signal σ is not synthesizable (NO), the result output unit 160 proceeds to step S8.

[0077] In step S7, result output unit 160 of model checking device 10 acquires example signal σ from the search result for example signal σ. Result output unit 160 generates a test result including example signal σ. Result output unit 160 transmits the test result including example signal σ to terminal device 20.

[0078] In step S8, result output unit 160 of model checking device 10 generates a test result indicating that there is no output signal of system model M that satisfies temporal logic formula φ. Result output unit 160 transmits the test result indicating that there is no output signal of system model M that satisfies temporal logic formula φ to terminal device 20.

[0079] The terminal device 20 receives the inspection result from the model checking device 10. The terminal device 20 displays the inspection result on the display device 506. When the inspection result includes the example signal σ, the terminal device 20 may, for example, display a graph showing the waveform of the example signal σ on the display device 506.

[0080] A user of the model checking system 1000 can refer to the inspection result displayed on the display device 506 of the terminal device 20. For example, the user may refer to the example signal σ included in the inspection result and consider whether the temporal logic formula φ can appropriately express the design intention. If the temporal logic formula φ cannot appropriately express the design intention, the user may modify the temporal logic formula φ and input it again to the terminal device 20. When a new temporal logic formula φ is input, the model checking system 1000 executes the processes from step S1 to step S8 again for the new temporal logic formula φ. In this way, the user can repeatedly execute the model checking method until a temporal logic formula φ that appropriately expresses the design intention is created.

[0081] <Comparison results> The results of comparing the model checking system 1000 with other conventional techniques will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the comparison results.

[0082] In this comparison, the execution time of trace synthesis for four conventional technologies was compared with that of this embodiment as comparative examples. STLts shown in FIG. 9 is an algorithm according to this embodiment. That is, STLts is an algorithm that performs trace synthesis based on MILP with variable interval coding. Breach is a tool that generates counterexamples using black-box optimization based on stochastic gradient methods (see Non-Patent Document 2). ForeSee is a tool that generates counterexamples using black-box optimization based on Monte Carlo tree search (see Reference 1). bluSTL is a tool that optimizes temporal logic formulas based on MILP with fixed interval coding (see Reference 2). STLmc is a tool that performs model checking based on the satisfiability problem with background theory (see Non-Patent Document 1).

[0083] [Reference 1] Zhang, Z., Lyu, D., Arcaini, P., Ma, L., Hasuo, I., Zhao, J. "Effective hybrid system falsification using monte carlo tree search guided by qb-robustness," Computer Aided Verification - 33rd International Conference, CAV 2021, July 20-23, 2021. Proceedings, Part I. Lecture Notes in Computer Science, vol. 12759, pp. 595-618, Springer (2021). [Reference 2] Donz'e, A., Raman, V. "BluSTL: Controller Synthesis from Signal Temporal Logic Specifications," ARCH14-15. 1st and 2nd International Workshop on Applied veRification for Continuous and Hybrid Systems, pp. 160-168.

[0084] RNC (Rear-End Near Collision), NAV (Navigation), and ISO (ISO 34502) indicate the types of formal specifications used as benchmarks. RNC1 to RNC3 and ISO1 to ISO8 are scenarios that define dangerous situations for autonomous vehicles. NAV1 to NAV2 are scenarios that define dangerous situations for autonomous robots.

[0085] FIG. 9 shows the execution time (seconds) when the temporal logic formula φ is written for each scenario and example signals are synthesized in this embodiment and each comparative example. Note that t / o is a timeout, and is a trial that took 600 seconds or more. Trials without a numerical value were not performed due to tool specifications, etc. In FIG. 9, the trial that produced the best result is shown shaded.

[0086] As shown in Fig. 9, in almost all trials except for NAV1, the present embodiment synthesized example signals significantly faster than the comparative example. In the comparative example, most trials required 10 seconds or more, whereas the present embodiment synthesized example signals in less than 1 second in most trials. Fig. 9 shows that the present embodiment can synthesize example signals significantly faster than the prior art. The present embodiment makes it possible to interactively verify even complex temporal logic formulas.

[0087] <Effects of the embodiment> A model checking device 10 according to this embodiment converts a temporal logic formula into constraint information coded with variable-length time intervals based on mixed integer linear programming, and outputs information indicating whether the state transition model satisfies the temporal logic formula based on the state transition model and the constraint information. In one aspect, this embodiment performs model checking based on constraint information expressed with a small number of variables, thereby enabling verification of a temporal logic formula with a small amount of calculation.

[0088] The state transition model may be a mathematical model that outputs a signal indicating the state of the target system. The temporal logic formula may be a logical formula that describes the formal specification of the target system. In one aspect, according to this embodiment, it is possible to verify whether the target system satisfies the formal specification with a small amount of calculation.

[0089] The model checking device 10 may synthesize an output signal of a state transition model that satisfies a temporal logic formula. The model checking device 10 may output an output signal when the state transition model satisfies the temporal logic formula. In one aspect, according to this embodiment, an output signal of a target system that satisfies a formal specification can be exemplified with a small amount of calculation.

[0090] The temporal logic formula may include a logic formula describing a dangerous state of the target system. The model checking device 10 may output information indicating the safety of the target system. According to one aspect, this embodiment enables the safety of the target system to be verified with a small amount of calculation.

[0091] The model checking device 10 may convert a temporal logic formula into constraint information by sampling variables at times when the truth or falsity of the temporal logic formula changes. For constraints included in the temporal logic formula, the model checking device 10 may generate a first variable indicating the truth or falsity of the constraint at each time point and a second variable indicating the strength of the truth or falsity of the constraint at each time point, and identify the time when the truth or falsity of the temporal logic formula changes based on the first variable and the second variable. In one aspect, according to this embodiment, a temporal logic formula can be converted into constraint information based on mixed integer linear programming at variable-length time intervals.

[0092] The model checking system 1000 according to this embodiment operates using the so-called anytime algorithm. That is, the model checking system 1000 can stop each process at any time, output a solution of a certain quality at that time, and then resume the process. For example, even if there is insufficient processing time in the process of generating an example signal, a best-effort result can be obtained. The same advantage is obtained when there is no time-varying signal σ that satisfies the temporal logic formula φ, and the closest time-varying signal σ′ that can satisfy the temporal logic formula φ can be generated.

[0093] The model checking system 1000 according to this embodiment can be applied to the field of autonomous driving, for example. For example, it can be used to formalize disturbance scenarios for autonomous drivers. In addition, as another example, the model checking system 1000 according to this embodiment can be used in the initial requirements definition phase of automotive system design, which is carried out using a V-model.

[0094] [supplement] Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the above-described functions.

[0095] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0096] 10 Model Checker 20 Terminal equipment 110 Model Acquisition Department 120 Logical Expression Acquisition Section 130 Model Conversion Unit 140 Logical Expression Conversion Unit 150 Signal synthesis unit 160 Result output section 1000 Model Checking Systems

Claims

1. an acquisition unit configured to acquire a state transition model and a temporal logic formula; a conversion unit configured to convert the temporal logic formula into constraint information coded with variable length time intervals based on a mixed integer linear programming method; a result output unit configured to output information indicating whether the state transition model satisfies the temporal logic formula based on the state transition model and the constraint information; A model checking apparatus comprising:

2. 2. The model checking apparatus according to claim 1, the state transition model is a mathematical model that outputs a signal indicating the state of the target system; the temporal logic formula is a logical formula describing a formal specification of the target system; Model checking equipment.

3. 3. The model checking apparatus according to claim 2, a signal synthesis unit configured to synthesize output signals of the state transition model that satisfy the temporal logic formula; the result output unit is configured to output the output signal when the state transition model satisfies the temporal logic formula. Model checking equipment.

4. 3. The model checking apparatus according to claim 2, the temporal logic formula includes a logic formula describing a dangerous state of the target system; the result output unit is configured to output information indicating the safety of the target system. Model checking equipment.

5. 2. The model checking apparatus according to claim 1, the conversion unit is configured to convert the state transition model into a mathematical model based on mixed integer linear programming. Model checking equipment.

6. 6. A model checking apparatus according to claim 1, the conversion unit is configured to convert the temporal logic formula into the constraint information by sampling variables at times when the truth or falsity of the temporal logic formula changes. Model checking equipment.

7. 7. A model checking apparatus according to claim 6, the conversion unit is configured to generate, for a constraint included in the temporal logic formula, a first variable indicating the truth or falsity of the constraint at each time point and a second variable indicating the strength of the truth or falsity of the constraint at each time point, and to identify a time at which the truth or falsity of the temporal logic formula changes based on the first variable and the second variable. Model checking equipment.

8. The computer A procedure for obtaining a state transition model and a temporal logic formula; converting the temporal logic formula into constraint information coded with variable-length time intervals based on a mixed integer linear programming method; a step of outputting information indicating whether the state transition model satisfies the temporal logic formula based on the state transition model and the constraint information; A model checking method that performs

9. On the computer, A procedure for obtaining a state transition model and a temporal logic formula; converting the temporal logic formula into constraint information coded with variable-length time intervals based on a mixed integer linear programming method; a step of outputting information indicating whether the state transition model satisfies the temporal logic formula based on the state transition model and the constraint information; A program to execute.

Images