Model checking device and model checking method

Abstract

To efficiently perform model checking of an information processing system achieved by linking multiple services.SOLUTION: A model checking device stores a component composition definition in which the specifications of an orchestrator that links services are prescribed in a predetermined prescribed format, post-synthesis verification properties prescribing the requirements for the orchestrator specifications in the predetermined prescribed format, and a formal specification prescribing the specifications of multiple services in the predetermined prescribed format. Based on the post-synthesis verification properties, a partial specification extraction criteria is generated, which is a standard for extracting partial specifications, which are formal specifications of services used for validating orchestrator specifications. Based on the partial specification extraction criteria, the partial specification of the service used to verify the component composition definition is extracted from the formal specification of the service. Based on the extracted partial specifications, a verification code as a code for verifying the component composition definition is generated. The component composition definition is verified by inputting the verification code to a model checking tool.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a model checking device and a model checking method. [Background technology]

[0002] Patent Document 1 describes a program verification generation device that verifies whether components satisfy program requirements. The program verification generation device stores components in which verification information and implementation for verifying operation are described, and program specifications that describe identification information for components required for a program and specifications that the program must satisfy, selects components based on the identification information in the program specifications, verifies whether the selected components satisfy the program specifications using the verification information of the selected components, and, if it is verified that the selected components satisfy the program specifications, generates a program by combining the implementation of the selected components using the program specifications.

[0003] Patent Document 2 describes a combination service inspection system that, when developing a new service model by combining multiple already-developed service models, inspects whether the new service model is designed according to the required specifications.The system acquires an inspection code for inspecting a second service model from a database in which inspection codes for inspecting multiple already-developed first service models are recorded, acquires inspection conditions for the second service model, converts the acquired inspection conditions into inspection condition codes, and inspects whether the second service model matches the inspection conditions based on the acquired inspection code and inspection condition code.

[0004] Patent Document 3 describes an inspection device for a design model that describes software processing functions based on a specification model that describes product specifications. In inspecting a specification model represented by the transitions of multiple function blocks, the inspection device verifies whether each of the multiple function blocks satisfies its target value. If a function block with a state transition that does not satisfy the target value is extracted, the inspection device resets the target value to match the state transition, and resets the target values ​​of the other function blocks according to the target values ​​of the specification model. Furthermore, the inspection device determines that the specification model satisfies the target value if the other function blocks satisfy the reset target value under constraints that cause the extracted function block to violate the target value. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Laid-Open No. 2004-326366 [Patent Document 2] Japanese Patent Application Laid-Open No. 2009-98770 [Patent Document 3] International Publication No. 2011 / 096037 Summary of the Invention [Problem to be solved by the invention]

[0006] In recent years, microservice architecture (MSA) has been attracting attention as a way to speed up the development of information processing systems. In MSA, information processing systems are developed as a combination of fine-grained, independently deployable services. This limits the scope of impact during maintenance or specification changes, enabling rapid releases and modifications.

[0007] In developing an information processing system using MSA, requests from users are processed as distributed processing by linking multiple services. However, distributed processing requires a system that can guarantee data consistency and other requirements when a failure occurs in an individual service or communication. It is necessary to design it, and the design is more difficult than system development that assumes a monolithic architecture (monolith).

[0008] Model checking is a technology that supports the design of distributed processing systems such as information processing systems using MSA. It expresses the system as a formal specification (hereinafter referred to as "formal specification") from a specific perspective and comprehensively verifies whether the formal specification satisfies given requirements (hereinafter referred to as "verification properties").

[0009] When model checking an information processing system using MSA, first, the verification properties of the formal specifications of the services are verified for each service. Next, the formal specifications of each service are synthesized to generate a formal specification of the orchestrator that connects the services, and the verification properties specific to the orchestrator are verified based on the formal specification.

[0010] However, when performing verification using the above method, formal specifications of components that are unrelated to the verification properties are included in the formal specifications of the orchestrator after synthesis, which poses the problem of expanding the search space during verification and increasing verification time.Furthermore, when services are updated frequently, simply synthesizing all formal specifications after each update will result in the synthesis of formal specifications that are unrelated to the orchestrator's verification properties, resulting in unnecessary re-synthesis and re-verification.

[0011] The program verification and generation device described in Patent Document 1 describes verification information and implementation for verifying operation in components, selects components based on identification information of program specifications, and uses the verification information of the selected components to verify whether the verification information of the components satisfies the specifications of the program to be generated. However, this document does not describe a mechanism for suppressing the expansion of the search space during verification or unnecessary re-synthesis / re-verification.

[0012] Furthermore, the service inspection system described in Patent Document 2 acquires an inspection code for inspecting a second service model (a new service model) from a database in which inspection codes of a plurality of developed first service models are recorded, acquires inspection conditions for the second service model and converts them into inspection condition codes, and inspects whether the second service model matches the inspection conditions based on the inspection code and inspection condition codes. However, this document does not describe a mechanism for suppressing the expansion of the search space during verification or unnecessary re-synthesis / re-verification due to the reasons mentioned above.

[0013] Furthermore, the inspection device described in Patent Document 3 determines that the specification model satisfies the target value if other function blocks satisfy the reset target value under constraints that cause an extracted function block to violate the target value. However, this document does not describe a mechanism for suppressing the expansion of the search space during verification or unnecessary re-synthesis / re-verification due to the above-mentioned reasons.

[0014] The present invention has been made in consideration of the above background, and aims to provide a model checking device and a model checking method that are capable of efficiently performing model checking of an information processing system realized by the collaboration of multiple services. [Means for solving the problem]

[0015] One aspect of the present invention for achieving the above object is a model checking device that performs model checking on an information processing system realized by the coordination of a plurality of services, the model checking device being configured using an information processing device having a processor and a storage device, and storing a component synthesis definition in which a specification of an orchestrator that coordinates the services is described in a predetermined description format, a post-synthesis verification property in which requirements for the orchestrator specification are described in the predetermined description format, and a formal specification in which the specification of each of the plurality of services is described in the predetermined description format, the device generates partial specification extraction criteria that are information that serve as criteria for extracting partial specifications that are formal specifications of the services to be used in verifying the orchestrator specification based on the post-synthesis verification property, extracts the partial specifications of the services to be used in verifying the component synthesis definition from the formal specifications of the services based on the partial specification extraction criteria, generates verification code that is code for verifying the component synthesis definition based on the extracted partial specifications, and verifies the component synthesis definition by inputting the verification code into a model checking tool. The partial specification extraction criteria are generated based on variables or events used in the logic description in the post-synthesis verification properties.

[0016] Other problems and solutions disclosed in the present application will be made clear in the detailed description and drawings. [Effects of the Invention]

[0017] According to the present invention, it is possible to efficiently perform model checking of an information processing system that is realized by the cooperation of a plurality of services. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 10 is a diagram illustrating an example of model checking. [Figure 2] FIG. 1 illustrates an example of model checking of a model based on MSA. [Figure 3] FIG. 1 illustrates an example of model checking performed by a model checking device. [Figure 4A] FIG. 1 illustrates an example of model checking performed by a model checking device. [Figure 4B] FIG. 1 illustrates an example of model checking performed by a model checking device. [Figure 5] FIG. 2 is a diagram illustrating an example of main functions of a model checking device. [Figure 6] FIG. 2 is a system flow diagram illustrating an example of the function of the model checking device. [Figure 7] 10 is a flowchart illustrating an example of a model checking process. [Figure 8] 10 is a flowchart illustrating an example of a process for determining whether or not verification of an updated component is required; [Figure 9] 10 is an example of a past extraction part specification. [Figure 10] 10 is an example of a partial specification for synthesis. [Figure 11] 10 is a flowchart illustrating an example of a partial specification extraction process for a non-updated part. [Figure 12] 10 is a flowchart illustrating an example of a process for determining whether or not other model checking needs to be performed. [Figure 13] FIG. 10 is a diagram illustrating an example of a process for determining whether or not other model checking needs to be performed. [Figure 14] 1 is an example of an information processing device used in the configuration of a model checking device. DETAILED DESCRIPTION OF THE INVENTION

[0019] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, various data may be described using expressions such as "information" and "table," but the various data may be expressed or managed using methods other than the data structures shown. In the following description, the letter "S" before a reference symbol indicates a processing step.

[0020] The following describes a model checking device 100 according to one embodiment of the present invention. The model checking device 100 performs model checking on an information processing system (hereinafter referred to as a "model") derived from hardware and software designs, thereby verifying whether the system satisfies requirements from users and the like.

[0021] Model checking is a technique for verifying whether a model satisfies requirements from users, etc. In model checking, the design and requirements of the model are described using a model description language, which is a language with rigorous mathematical meaning, and then it is comprehensively verified whether the specifications of the target model satisfy the requirements.

[0022] As a tool for model checking (hereinafter referred to as "model checking tool"), for example, Examples include "TLA+" and "SPIN (Simple Promela INterpreter)", which are used to verify the design of distributed processing systems, such as the integration of services (microservices) in cloud environments. Hereinafter, the model specifications written in a given model description language will be referred to as "formal specifications", and the requirements for the model from users, etc. written in a given verification formula (logical formula) will be referred to as "verification properties".

[0023] Figure 1 is a diagram illustrating model checking. As shown in the figure, in model checking, the specifications of a model are expressed as a formal specification 32 written in a predetermined model description language, and it is comprehensively verified whether or not verification property 31 is satisfied in a state space 33 that lists all possible states that the formal specification 32 can take.

[0024] In model checking of a model based on microservice architecture (hereinafter referred to as "MSA"), first, the verification properties of the formal specifications of each service, which are developed independently, are verified individually. Next, the formal specifications of each service are synthesized based on the specifications of the orchestrator that connects the services (hereinafter referred to as "component synthesis definition") to generate verification code (hereinafter referred to as "synthesized verification code"), and it is verified whether the synthesized verification code satisfies the verification properties of the orchestrator specifications (hereinafter referred to as "post-synthesis verification properties").

[0025] Figure 2 shows an example of model checking using "TLA+" for a model based on MSA. In this example, the model (the business realized by the orchestrator) is an information processing system that performs "transfer of funds between accounts." The post-composition verification property is "Eventually, the total balance of all accounts will match the total initial balance of the system (= no loss or increase of balance during the transaction process)." As shown as a component composition definition in the figure, the model shown in the example consists of two components, "Withdraw" and "Deposit." In this example, the formal specifications of the service "Withdraw" and the service "Deposit" are obtained, and the synthesized verification code is generated by synthesizing them. There are.

[0026] In the example of Figure 2, the components of each service (including formal specifications (hereinafter referred to as "software components")) are simply combined to generate the synthesized verification code, so software components (including formal specifications) that are unrelated to the post-synthesis verification property end up in the synthesized verification code, causing the verification target (hereinafter referred to as "search space") to become bloated. For example, if the model is "transfer of funds between accounts" and the post-synthesis verification property is "balance must not become negative," then although "recording process of transaction details" is unrelated to the above-mentioned post-synthesis verification property, the search space becomes bloated due to the variables used in the transaction details and the values ​​(number of states) that the variables can take.

[0027] Furthermore, when services are updated frequently, simply composing all formal specifications after each update can result in the inclusion of formal specifications unrelated to the orchestrator's verification properties, resulting in unnecessary re-composition and re-verification. For example, if the model is "Inter-account fund transfer" and the post-composition verification property is "Balance must not become negative," and a "Fee addition process" is added, re-verification is required because account balance manipulation is involved. However, if, for example, "Information to output details" is added and the "Retrieve past details" process is updated, re-composition and re-verification are unnecessary because they do not involve account balance manipulation, but re-composition and re-verification are still performed in this case.

[0028] Therefore, the model checking device 100 of this embodiment generates extraction criteria for formal specifications (hereinafter referred to as "partial specification extraction criteria") by focusing on information on verification properties specific to formal verification (variables and events in logical expressions) among post-synthesis verification properties. Then, the model checking device 100 extracts formal specifications (hereinafter referred to as "partial specification extraction criteria") to be used for post-synthesis verification based on the partial specification extraction criteria from the formal specifications of each service. By extracting partial specifications (called "partial specifications") and synthesizing the extracted partial specifications to generate synthesized verification code, the size of the synthesized verification code can be reduced, thereby suppressing the expansion of the search space.

[0029] An example is shown in FIG. 3. In this example, the model checking device 100 generates a partial specification extraction criterion focusing on "variables: accounts, total" based on the post-synthesis verification property "EventuallyConsistentAccount == []<>(Sum(accounts) = total)". In addition, the model checking device 100 Using the generated partial specification extraction criteria, the "Withdraw service" and "Deposit service" are extracted as partial specifications from the formal specifications of each service, and these are synthesized based on the component synthesis definition. The synthesized verification code is generated.

[0030] Furthermore, when a service is updated, the model checking device 100 re-extracts the partial specifications of the updated service, compares the re-extracted partial specifications with the partial specifications extracted previously, and includes the partial specifications in the synthesized verification code only if there is a difference between the two, thereby suppressing unnecessary verification when the service is updated.

[0031] 4A and 4B show examples of this case. FIG. 4A shows a case where, for an updated service "Withdraw service specification ver.2", there is no difference between the partial specification "Withdraw service ver.1 partial specification" extracted in the past (before the update) and the partial specification "Withdraw service ver.2 partial specification" extracted after the update. In this case, the model checking device 100 converts the partial specification "Withdraw service ver.2 partial specification" extracted after the update into the synthesized verification code. On the other hand, FIG. 4B shows a case where, for an updated service "Withdraw service specification ver.2," there is a difference between the partial specification "Withdraw service ver.1 partial specification" extracted in the past (before the update) and the partial specification "Withdraw service ver.2 partial specification" extracted after the update. In this case, the model checking device 100 checks whether the partial specification "Withdraw service ver.2 partial specification" extracted after the update is included in the synthesized verification code. do.

[0032] Furthermore, after re-extracting the partial specifications when a service is updated, if there is a difference between the partial specifications before and after the update, the model checking device 100 notifies other component synthesis definitions that refer to the partial specifications before the update that the partial specifications have been updated and that the partial specifications need to be re-verified, thereby preventing omissions in verification.

[0033] <Detailed configuration> Fig. 5 is a block diagram showing the main functions of model checking device 100, and Fig. 6 is a system flow diagram explaining the functions of model checking device 100. As shown in these figures, model checking device 100 has the following functions: storage unit 110, information acquisition management unit 130, updated component extraction unit 135, non-updated component extraction unit 140, partial specification extraction criterion generation unit 145, updated component verification necessity determination unit 150, non-updated component partial specification extraction unit 155, verification code generation unit 160, model checking execution unit 165, and other model checking execution necessity determination unit 170.

[0034] Of the above functions, the storage unit 110 stores information (data) such as a component synthesis definition 111, post-synthesis verification properties 112, a software component group 113, an updated component group 114, an unupdated component group 115, previously extracted partial specifications 118, partial specification extraction criteria 116, partial specifications for synthesis 117, synthesized verification code 119, and verification results 120.

[0035] Among these, the component synthesis definition 111 is the component synthesis definition described above, and includes a description of the formal specification of the orchestrator that realizes business by linking services. The component synthesis definition 111 also includes a description of the software components that are independently developed for each service of the model that is the target of model checking (hereinafter referred to as the "target model"), which have been updated since the previous model checking. (hereinafter referred to as "update presence / absence information"). The component synthesis definition 111 also includes component synthesis definitions of the target model and other models other than the target model.

[0036] The post-composition verification properties 112 are the post-composition verification properties described above, and include a description of verification properties specific to the orchestrator.

[0037] The software component group 113 includes information about software components that realize the services of the target model and models other than the target model (software entities (code, etc.), service format specifications before and after software component updates, etc.). Information about software components in the software component group 113 is identified and managed by software component identifiers (hereinafter referred to as "component IDs").

[0038] The updated component group 114 includes information on software components that have been updated after the previous model checking, extracted from the software component group 113 by the updated component extraction unit 135.

[0039] The no-update component group 115 includes information on software components that have not been updated since the last model checking, extracted from the software component group 113 by the no-update component extraction unit 140.

[0040] The partial specification extraction criteria 116 include criteria (extraction conditions; hereinafter referred to as "partial specification extraction criteria") used when extracting formal specifications (partial specifications) to be used for generating synthesized verification code from the updated component group 114 or the non-updated component group 115, which are generated by the partial specification extraction criteria generation unit 145 based on the post-synthesis verification properties 112.

[0041] The synthesis partial specifications 117 include partial specifications (hereinafter referred to as "synthesis partial specifications") that are extracted by the updated component verification necessity determination unit 150 or the non-updated component partial specification extraction unit 155 and that are used by the verification code generation unit 160 to generate the synthesized verification code 119.

[0042] The previously extracted partial specifications 118 include partial specifications (hereinafter referred to as "previously extracted partial specifications") previously extracted by the updated component verification necessity determination unit 150 or the non-updated component partial specification extraction unit 155.

[0043] The combined verification code 119 includes the combined verification code generated by the verification code generation unit 160 based on the partial specification for combination 117 .

[0044] The verification result 120 includes information about the result of the model checking execution unit 165 verifying whether the synthesized verification code 119 satisfies the post-synthesis verification property 112 through model checking.

[0045] The information acquisition and management unit 130 acquires various information required for model checking (component synthesis definition 111, post-synthesis verification properties 112, software component group 113, etc.) via a user interface, a communication network, etc., and manages the acquired information in the memory unit 110.

[0046] The updated component extraction unit 135 identifies software components that have been updated since the previous model checking, based on the update presence / absence information in the component synthesis definition 111, and extracts information (including formal specifications) of the identified software components from the software component group 113. The storage unit 110 stores the extracted information as the updated component group 114.

[0047] The no-update component extraction unit 140 identifies software components that have not been updated since the previous model checking based on the update presence / absence information of the component synthesis definition 111, and extracts the identified software components. The information on the software components (including format specifications) is extracted from the software component group 113. The extracted information is stored in the storage unit 110 as the non-updated component group 115.

[0048] The partial specification extraction criterion generation unit 145 generates partial specification extraction criteria based on the post-synthesis verification property 112. The generated partial specification extraction criteria are stored in the storage unit 110 as partial specification extraction criteria 116.

[0049] The updated component verification necessity determination unit 150 extracts, as partial specifications, formal specifications to be used for generating synthesized verification code from the updated component group 114, based on the partial specification extraction criteria 116. The extracted partial specifications are stored in the storage unit 110 as partial specifications to be synthesized 117 and previously extracted partial specifications 118.

[0050] The no-update component partial specification extraction unit 155 extracts, as partial specifications, formal specifications to be used for generating synthesized verification code from the no-update component group 115, based on the partial specification extraction criteria 116. The extracted partial specifications are stored in the storage unit 110 as partial specifications for synthesis 117 and previously extracted partial specifications 118.

[0051] Verification code generation unit 160 references component synthesis definition 111 and generates synthesized verification code based on synthesis partial specification 117. Storage unit 110 stores the generated synthesized verification code as synthesized verification code 119.

[0052] The model checking execution unit 165 performs model checking of the target model by providing the synthesized verification code 119 to a model checking tool, and outputs the result as a verification result 120 .

[0053] The other model checking execution necessity determination unit 170 acquires the pre-update partial specifications of the software components of the partial specifications determined to require updating by the updated component verification necessity determination unit 150, and determines whether the acquired pre-update partial specifications are included in the component synthesis definition of other models other than the target model. If the determination result shows that the acquired pre-update partial specifications are included in the component synthesis definition of other models, the other model checking execution necessity determination unit 170 outputs information indicating that re-verification of the other models is required.

[0054] 7 is a flowchart explaining the process (hereinafter referred to as "model checking process S700") that the model checking device 100 configured as described above performs when checking a target model. The model checking process S700 will be explained below with reference to FIG. 7. It is assumed that, at the start of the model checking process S700, the storage unit 110 stores information necessary for executing the model checking process S700 (such as the component synthesis definition 111, the post-synthesis verification property 122, and the software component group 113).

[0055] As shown in the figure, first, the updated component extraction unit 135 identifies software components that have been updated since the previous model checking, based on the update presence / absence information of the component synthesis definition 111, and extracts information (including formal specifications) of the identified software components from the software component group 113. The extracted information is stored in the storage unit 110 as the updated component group 114 (S711).

[0056] Next, the no-update component extraction unit 140 identifies software components that have not been updated since the previous model checking, based on the update presence / absence information in the component synthesis definition 111, and extracts information (including formal specifications) of the identified software components from the software component group 113. The storage unit 110 stores the extracted information as the no-update component group 115 (S712).

[0057] Next, the partial specification extraction criterion generation unit 145 extracts partial specifications based on the post-synthesis verification property 112. The generated partial specification extraction criteria are stored in the storage unit 110 as the partial specification extraction criteria 116 (S713).

[0058] Next, the updated component verification necessity determination unit 150 performs a process to extract partial specifications to be used for generating synthesized verification code from the updated component group 114 based on the partial specification extraction criteria 116 (hereinafter referred to as ``updated component verification necessity determination process S714'').

[0059] 8 is a flowchart for explaining the details of the verification necessity determination process S714 for updated components. The verification necessity determination process S714 for updated components will be explained below with reference to FIG.

[0060] First, the updated component verification necessity determining unit 150 selects one software component from the updated component group 114 (S811).

[0061] Next, the updated component verification necessity determining unit 150 extracts partial specifications from the selected software components based on the partial specification extraction criteria 116 (S812).

[0062] Next, the updated component verification necessity determination unit 150 determines whether data exists in the previously extracted partial specification 118 whose component ID (component ID 1181 described below) and partial specification extraction criteria (partial specification extraction criteria 1182 described below) match those of the selected software component (S813).

[0063] FIG. 9 shows an example of the past extracted partial specification 118. As shown in the figure, the illustrated past extracted partial specification 118 is made up of one or more records having the following items: component ID 1181, partial specification extraction criteria 1182, and partial specification 1183. One record of the past extracted partial specification 118 corresponds to one partial specification. Of the above items, the component ID 1181 stores the identifier of the software component (hereinafter referred to as "component ID"). The partial specification extraction criteria 1182 stores the partial specification extraction criteria used to extract the partial specification. The partial specification 1183 stores the content of the partial specification.

[0064] 8, if data whose component ID and partial specification extraction criteria match those of the currently selected software component exists in the previously extracted partial specification 118 (S813: YES), the process proceeds to S814. On the other hand, if data whose component ID and partial specification extraction criteria match those of the currently selected software component does not exist in the previously extracted partial specification 118 (S813: NO), the process proceeds to S816.

[0065] In S814, the updated component verification necessity determination unit 150 determines whether there is a difference between the partial specification extracted in S812 and the partial specification of the previously extracted partial specification 118 that matched in S813. If there is no difference (S814: NO), the process proceeds to S815. On the other hand, if there is a difference (S814: YES), the process proceeds to S816.

[0066] In S815, the updated component verification necessity determination unit 150 stores the partial specifications extracted in S812 as "verification not required" in the partial specifications for synthesis 117. Thereafter, the process proceeds to S817.

[0067] 10 shows an example of the partial specification for synthesis 117. As shown in the figure, the illustrated partial specification for synthesis 117 is made up of one or more records each having the items of a component synthesis definition 1171, a partial specification 1172, and whether verification is required 1173. One record of the partial specification for synthesis 117 corresponds to one partial specification.

[0068] Among the above items, the component synthesis definition 1171 includes the component synthesis definition identifier (service name A partial specification is stored in the partial specification 1172. Verification necessity 1173 stores information indicating whether or not the partial specification needs to be verified ("verification necessary" or "verification not necessary").

[0069] 8, in S816, the updated component verification necessity determination unit 150 stores the partial specification extracted in S812 as "verification required" in the partial specification for synthesis 117. The updated component verification necessity determination unit 150 also stores the partial specification in the previously extracted partial specification 118. Thereafter, the process proceeds to S817.

[0070] In S817, the updated component verification necessity determination unit 150 determines whether all software components in the updated component group 114 have been selected in S811. If the updated component verification necessity determination unit 150 determines that all software components have not been selected (S817: NO), the process returns to S811. On the other hand, if the updated component verification necessity determination unit 150 determines that all software components have been selected (S817: YES), the updated component verification necessity determination process S714 ends and the process proceeds to S715 in FIG. 7.

[0071] 7, in S715, the model checking device 100 determines whether or not there is a record in which "verification required" is stored in the verification necessity 1173 of the partial specification for synthesis 117. If there is a record in which "verification required" is stored in the verification necessity 1173 of the partial specification for synthesis 117 (S715: YES), the model checking device 100 executes a process of extracting partial specifications from the non-updated component group 115 (hereinafter referred to as "non-updated component partial specification extraction process S716"). On the other hand, if there is no record in which "verification required" is stored in the verification necessity 1173 of the partial specification for synthesis 117 (S715: NO), the model checking process S700 ends.

[0072] 11 is a flowchart for explaining the details of the partial specification extraction process S716 for non-updated parts. The partial specification extraction process S716 for non-updated parts will be explained below with reference to this figure.

[0073] First, the no-update component partial specification extraction unit 155 selects one software component from the no-update component group 115 (S1111).

[0074] Next, the no-update component partial specification extraction unit 155 determines whether data whose component ID and partial specification extraction criteria match those of the currently selected software component exists in the previously extracted partial specification 118 (S1112). If the no-update component partial specification extraction unit 155 determines that data whose component ID and partial specification extraction criteria match those of the currently selected software component exists in the previously extracted partial specification 118 (S1112: YES), processing proceeds to S1113. On the other hand, if the no-update component partial specification extraction unit 155 determines that data whose component ID and partial specification extraction criteria 116 match those of the currently selected software component does not exist in the previously extracted partial specification 118 (S1112: NO), processing proceeds to S1114.

[0075] In S1113, the no-update component partial specification extraction unit 155 stores the partial specification of the data of the previously extracted partial specification 118 that matched in S1112 as "verification not required" in the partial specification for synthesis 117. Thereafter, the process proceeds to S1116.

[0076] In S1114, the non-updated component partial specification extraction unit 155 extracts partial specifications from the software components selected in S1111 based on the partial specification extraction criteria 116.

[0077] Next, the no-update component partial specification extraction unit 155 stores the partial specification of the selected software component extracted in S1114 as "verification required" in the partial specification for synthesis 117. The no-update component partial specification extraction unit 155 also newly stores the partial specification in the previously extracted partial specification 118 (S1115). Thereafter, the processing proceeds to S1116.

[0078] In S1116, the no-update component partial specification extraction unit 155 determines whether or not all software components of the no-update component group 115 have been selected in S1111. If the updated component verification necessity determination unit 150 determines that all software components have not been selected (S1116: NO), the process returns to S1111. On the other hand, if the updated component verification necessity determination unit 150 determines that all software components have been selected (S1116: YES), the no-update component partial specification extraction process S716 ends, and the process proceeds to S717 in FIG. 7.

[0079] 7, the verification code generation unit 160 then references the component synthesis definition 111 and generates synthesized verification code 119 based on the synthesis partial specification 117 (S717). The verification code generation unit 160 generates synthesized verification code 119 so that all partial specifications stored in the synthesis partial specification 117 will be subject to model checking by a model checking tool. That is, if there is at least one partial specification in which "verification required" is stored in the verification necessity 1173 of the synthesis partial specification 117 (S715: YES), the verification code generation unit 160 generates synthesized verification code 119 so that all partial specifications stored in the synthesis partial specification 117 (all partial specifications regardless of the content of the verification necessity 1173) will be subject to model checking by a model checking tool (S717).

[0080] Next, the model checking execution unit 165 performs model checking of the target model by inputting the synthesized verification code 119 into a model checking tool, and outputs the result as a verification result 120 (S718). Note that the content of the verification result 120 is provided to the user via, for example, a user interface.

[0081] Next, the other model checking execution necessity determining unit 170 executes a process of determining whether or not re-verification is required for other models (hereinafter referred to as "other model checking execution necessity determining process S719").

[0082] Fig. 12 is a flowchart illustrating the details of the other model checking execution necessity determination process S719. Fig. 13 is a diagram showing an example of the other model checking execution necessity determination process S719. Below, the other model checking execution necessity determination process S719 will be described with reference to these figures.

[0083] First, the other model checking execution necessity determination unit 170 selects one partial specification from the synthesis partial specification 117 that the updated component verification necessity determination unit 150 has determined to be "verification required" (a partial specification in which "verification required" is stored in verification necessity 1173) (S1211 in Figure 12).

[0084] Next, the other model checking execution necessity determining unit 170 acquires the partial specifications before updating from the previously extracted partial specifications 118 for the software components of the selected partial specifications (S1212 in FIG. 12, S1311 in FIG. 13).

[0085] Next, the other model checking execution necessity determination unit 170 refers to the component synthesis definition 111 and determines whether the acquired pre-update partial specification is included in the component synthesis definition of a model other than the target model (S1213 in FIG. 12, S1312 in FIG. 13). If the acquired pre-update partial specification is not included in the component synthesis definition of a model other than the target model (NO in S1213 in FIG. 12), the process proceeds to S1215. On the other hand, if the acquired pre-update partial specification is included in the component synthesis definition of a model other than the target model (YES in S1213 in FIG. 12), the other model checking execution necessity determination unit 170 outputs (for example, presents to the user via a user interface) information indicating that re-verification of the other model is required (S1214 in FIG. 12, S1313 in FIG. 13).

[0086] In S1215, the other model checking execution necessity determination unit 170 checks whether the part for which verification is required is It is determined whether all specifications have been selected from the partial specifications for synthesis 117. If the other model checking execution necessity determination unit 170 determines that there are partial specifications that have not been selected from the partial specifications for synthesis 117 (S1215: NO), the process returns to S1211. On the other hand, if the other model checking execution necessity determination unit 170 determines that all partial specifications for which verification is set have been selected from the partial specifications for synthesis 117 (S1215: YES), the process returns to FIG. 7, and the model checking process S700 ends.

[0087] As described above, the model checking device 100 of this embodiment generates partial specification extraction criteria by focusing on information on verification properties specific to formal verification (variables and events in logical expressions) among post-synthesis verification properties, extracts partial specifications, which are formal specifications to be used for post-synthesis verification, from the formal specifications of each service based on the partial specification extraction criteria, and generates synthesized verification code by synthesizing the extracted partial specifications. This makes it possible to reduce the size of the synthesized verification code and prevent the search space from expanding.

[0088] Furthermore, when a service is updated, the model checking device 100 re-extracts the partial specifications of the updated service, compares the re-extracted partial specifications with previously extracted partial specifications, and generates and verifies the synthesized verification code only if there is a difference between the two. Specifically, if the previously extracted partial specifications do not contain a partial specification that matches the updated partial specification of the service to be updated (updated component) (S816 in FIG. 8), or if the previously extracted partial specifications do not contain a partial specification of a service not to be updated (non-updated component) (S1115 in FIG. 11), that is, if the partial specifications to be synthesized contain at least one partial specification that "needs verification" (S715: YES), the model checking device 100 generates the synthesized verification code (S717) and verifies the component synthesis definition (S718). On the other hand, if the previously extracted partial specification contains a partial specification that matches the updated partial specification of the service (updated component) that is the target of update (S815 in FIG. 8), and if the previously extracted partial specification contains a partial specification of a software component that is not the target of update (non-updated component) (S1113 in FIG. 11), that is, if the partial specification to be synthesized does not contain a single partial specification that is "requiring verification" (S715: NO), the model checking device 100 does not generate synthesized verification code or verify the component synthesis definition. Therefore, when the partial specification to be synthesized does not contain a single partial specification that is "requiring verification" when updating a service, it is possible to prevent unnecessary re-synthesis and re-verification.

[0089] Furthermore, after re-extracting the partial specifications at the time of service update, if there is a difference between the partial specifications before and after the update, that is, if there is even one partial specification that is deemed to be "verification required" in the partial specifications for synthesis (S715: YES), the model checking device 100 notifies other component synthesis definitions that refer to the partial specifications before the update that the partial specifications have been updated and that re-verification of the partial specifications is required (S719), thereby reliably preventing verification omissions.

[0090] In this way, the model checking device 100 of this embodiment can efficiently perform model checking of an information processing system that is realized by the cooperation of a plurality of services.

[0091] FIG. 14 shows an example of the configuration of an information processing device that constitutes the model checking device 100. The illustrated information processing device 10 includes a processor 11, a main memory device 12, an auxiliary memory device 13, an input device 14, an output device 15, and a communication device 16. Note that the illustrated information processing device 10 may be realized, in whole or in part, by using virtual information processing resources provided using virtualization technology, process space separation technology, or the like, such as a virtual server provided by a cloud system. Also, all or in part of the functions provided by the information processing device 10 may be realized, for example, by a cloud system via an API (Application Program Interface), or the like. Alternatively, the model checking device 100 may be configured using a plurality of information processing devices 10 connected to each other so as to be able to communicate with each other.

[0092] In the figure, the processor 11 may be, for example, a CPU (Central Processing Unit), PU (Micro Processing Unit), GPU (Graphics Processing Unit), FPGA (Field Programmable Gate Array), ASIC (Application Specific Integrated Circuit) ), AI (Artificial Intelligence) chips, etc.

[0093] The main memory device 12 is a device for storing programs and data, and is, for example, a ROM (Read Only Memory). These include non-volatile memory (NVRAM (Non Volatile RAM)), RAM (Random Access Memory), and non-volatile memory (NVRAM).

[0094] The auxiliary storage device 13 is, for example, an SSD (Solid State Drive), a hard disk drive, The auxiliary storage device 13 may be a hard disk, an optical storage device (e.g., a CD (Compact Disc), a DVD (Digital Versatile Disc)), a storage system, a reading / writing device for a recording medium such as an IC card, an SD card, or an optical recording medium, or a storage area of ​​a cloud server. Programs and data can be read into the auxiliary storage device 13 via a recording medium reading device or a communication device 16. The programs and data stored (memorized) in the auxiliary storage device 13 are read into the main storage device 12 as needed.

[0095] The input device 14 is an interface that accepts input from the outside, and is, for example, a keyboard, a mouse, a touch panel, a card reader, a pen-input tablet, a voice input device, or the like.

[0096] The output device 15 is an interface that outputs various information such as the progress of processing and the results of processing. The output device 15 is, for example, a display device (liquid crystal monitor, LCD (Liquid Crystal Display), graphic card, etc.) that visualizes the various information described above, a device that converts the various information described above into audio (audio output device (speaker, etc.)), or a device that converts the various information described above into text (printer, etc.). Note that, for example, the information processing device 10 may be configured to input and output information to and from other devices via the communication device 16.

[0097] The input device 14 and the output device 15 constitute a user interface that receives information from the user and presents information to the user.

[0098] The communication device 16 is a device that realizes communication with other devices. The communication device 16 is a wired or wireless communication interface that realizes communication with other devices via a communication medium such as a communication network, and is, for example, a NIC (Network Interface Card), a wireless communication module, a USB module, or the like.

[0099] The information processing device 10 may be equipped with, for example, an operating system, a file system, a DBMS (DataBase Management System) (relational database, NoSQL, etc.), a KVS (Key-Value Store), etc.

[0100] Each function of the model checking device 100 is realized by the processor 11 reading and executing a program stored in the main memory device 12, or by hardware (FPGA, ASIC, AI chip, etc.) constituting the model checking device 100. The model checking device 100 stores the various pieces of information (data) described above, for example, as tables in a database or files managed by a file system.

[0101] Although one embodiment of the present invention has been described above, it goes without saying that the present invention is not limited to the above embodiment and can be modified in various ways without departing from the spirit of the invention. For example, the above embodiment has been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to an embodiment having all of the described configurations. Some of the configurations of the embodiments can be added to, deleted from, or replaced with other configurations.

[0102] For example, the information extracted or generated in each step of the model checking process S700 shown in Fig. 7 (model configuration, formal specification of the service, component synthesis definition, post-synthesis verification properties, software component group, updated component group, non-updated component group, partial specification extraction criteria, partial specifications for synthesis, previously extracted partial specifications, synthesized verification code, verification results, etc.) may be presented on a user interface so that the user can visually understand the process of the model checking process S700. Also, at each step, editing of the above various information may be accepted from the user via the user interface.

[0103] Furthermore, the above-mentioned configurations, functional units, processing units, processing means, etc. may be partly or entirely implemented in hardware by, for example, designing them as integrated circuits. Furthermore, the above-mentioned configurations, functions, etc. may be implemented in software by a processor interpreting and executing a program that implements each function. Information such as the programs, tables, and files that implement each function may be stored in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or an I / O device. It can be placed on a recording medium such as a C card, SD card, or DVD.

[0104] Furthermore, the layout of the various functional units, processing units, and databases of each information processing device described above is merely an example, and the layout of the various functional units, processing units, and databases can be changed to an optimal layout in terms of the performance, processing efficiency, communication efficiency, etc. of the hardware and software that these devices are equipped with.

[0105] Furthermore, the configuration (schema, etc.) of the database that stores the various types of data described above can be flexibly changed from the perspective of efficient use of resources, improved processing efficiency, improved access efficiency, improved search efficiency, and the like. [Explanation of symbols]

[0106] 100 Model checking device, 110 Memory unit, 111 Component synthesis definition, 112 Post-synthesis verification property, 113 Software component group, 114 Updated component group, 115 Non-updated component group, 116 Partial specification extraction criteria, 117 Partial specification for synthesis, 118 Previously extracted partial specification, 119 Synthesized verification code, 120 Verification result, 130 Information acquisition management unit, 135 Updated component extraction unit, 140 Non-updated component extraction unit, 145 Partial specification extraction criteria generation unit, 150 Updated component verification necessity determination unit, 155 Non-updated component partial specification extraction unit, 160 Verification code generation unit, 165 Model checking execution unit, 170 Other model checking execution necessity determination unit

Claims

1. A model checking device that performs model checking on an information processing system realized by cooperation of a plurality of services, The information processing device includes a processor and a storage device, a component composition definition in which the specifications of an orchestrator that links the services are described in a predetermined description format; a post-synthesis verification property in which requirements for the orchestrator specification are described in a predetermined description format; a formal specification in which the specifications of each of the plurality of services are described in a predetermined description format; Remember, generating partial specification extraction criteria, which are information serving as criteria for extracting partial specifications, which are formal specifications of the service, to be used in verifying the orchestrator specification, based on the post-synthesis verification properties; extracting the partial specification of the service to be used for verifying the component composition definition from the formal specification of the service based on the partial specification extraction criteria; generating a verification code that is a code for verifying the component synthesis definition based on the extracted partial specification; verifying the component synthesis definition by inputting the verification code into a model checking tool; generating the partial specification extraction criteria based on variables or events used in describing logic in the post-synthesis verification properties; Model checking equipment.

2. A model checking device that performs model checking on an information processing system realized by cooperation of a plurality of services, The information processing device includes a processor and a storage device, a component composition definition in which the specifications of an orchestrator that links the services are described in a predetermined description format; a post-synthesis verification property in which requirements for the orchestrator specification are described in a predetermined description format; a formal specification in which the specifications of each of the plurality of services are described in a predetermined description format; Remember, generating partial specification extraction criteria, which are information serving as criteria for extracting partial specifications, which are formal specifications of the service, to be used in verifying the orchestrator specification, based on the post-synthesis verification properties; extracting the partial specification of the service to be used for verifying the component composition definition from the formal specification of the service based on the partial specification extraction criteria; generating a verification code that is a code for verifying the component synthesis definition based on the extracted partial specification; verifying the component synthesis definition by inputting the verification code into a model checking tool; storing the partial specifications previously extracted from the formal specification of the service based on the partial specification extraction criteria as previously extracted partial specifications; When the service is updated, extracting the updated partial specifications of the service that has been updated and the partial specifications of the service that has not been updated based on the partial specification extraction criteria; If the partial specification that matches the updated partial specification of the service that has been updated does not exist in the past extracted partial specification, or if the partial specification of the service that has not been updated does not exist in the past extracted partial specification, generate the verification code and perform the verification of the component synthesis definition; If the partial specification that matches the updated partial specification of the service that has been updated exists in the past extracted partial specification, and if the partial specification of the service that has not been updated exists in the past extracted partial specification, the verification code is not generated and the verification of the component composition definition is not performed. Model checking equipment.

3. 3. The model checking apparatus according to claim 2, A plurality of component composition definitions each having a different orchestrator; the partial specifications extracted for the plurality of component synthesis definitions based on the partial specification extraction criteria; Remember, If the partial specification that matches the updated partial specification of the service that is the target of the update does not exist in the past extracted partial specification, or if the previous extracted partial specification is not the target of the update If the partial specification of the service does not exist in the previously extracted partial specification, another component synthesis definition including the partial specification of the service before the update is extracted; outputting information indicating that re-verification is required for the extracted other component synthesis definitions; Model checking equipment.

4. 2. The model checking apparatus according to claim 1, The information processing system is configured using a microservice architecture (MSA), and the service is a microservice. Model checking equipment.

5. 2. The model checking apparatus according to claim 1, a user interface that presents to a user at least one of the information on the model to be inspected, the formal specification of the service, the component synthesis definition, the post-synthesis verification property, the partial specification extraction criteria, the partial specifications, the verification code, and the verification result of the component synthesis definition, or that accepts editing of the information; Model checking equipment.

6. A model checking device configured using an information processing device having a processor and a storage device, which performs model checking on an information processing system realized by the cooperation of a plurality of services, a component composition definition in which the specifications of an orchestrator that links the services are described in a predetermined description format; a post-synthesis verification property in which requirements for the orchestrator specification are described in a predetermined description format; a formal specification in which the specifications of each of the plurality of services are described in a predetermined description format; storing the generating partial specification extraction criteria, which are information serving as criteria for extracting partial specifications, which are formal specifications of the service used in verifying the orchestrator specification, based on the post-synthesis verification properties; extracting the partial specification of the service to be used for verifying the component composition definition from the formal specification of the service based on the partial specification extraction criterion; generating a verification code that is a code for verifying the component synthesis definition based on the extracted partial specifications; verifying the component synthesis definition by inputting the verification code into a model checking tool; and generating the partial specification extraction criteria based on variables or events used in describing logic in the post-synthesis verification properties; ,Model checking method.

7. A model checking device configured using an information processing device having a processor and a storage device, which performs model checking on an information processing system realized by the cooperation of a plurality of services, a component composition definition in which the specifications of an orchestrator that links the services are described in a predetermined description format; a post-synthesis verification property in which requirements for the orchestrator specification are described in a predetermined description format; a formal specification in which the specifications of each of the plurality of services are described in a predetermined description format; storing the generating partial specification extraction criteria, which are information serving as criteria for extracting partial specifications, which are formal specifications of the service used in verifying the orchestrator specification, based on the post-synthesis verification properties; extracting the partial specification of the service to be used for verifying the component composition definition from the formal specification of the service based on the partial specification extraction criterion; generating a verification code that is a code for verifying the component synthesis definition based on the extracted partial specifications; verifying the component synthesis definition by inputting the verification code into a model checking tool; a step of storing the partial specifications previously extracted from the formal specification of the service based on the partial specification extraction criteria as previously extracted partial specifications; When the service is updated, extracting the updated partial specifications of the service that has been updated and the partial specifications of the service that has not been updated based on the partial specification extraction criteria; The partial specification that matches the updated partial specification of the service that is the target of the update does not exist in the past extracted partial specification, or if the partial specification of the service that is not the target of the update does not exist in the past extracted partial specification, generating the verification code and verifying the component synthesis definition; and a step of not generating the verification code and not performing the verification of the component composition definition when the partial specification that matches the updated partial specification of the service that has become the target of the update exists in the past extracted partial specification and the partial specification of the service that has not become the target of the update exists in the past extracted partial specification; ,Model checking method.

8. 8. A model checking method according to claim 7, The model checking apparatus A plurality of component composition definitions each having a different orchestrator; the partial specifications extracted for the plurality of component synthesis definitions based on the partial specification extraction criteria; storing the extracting another component synthesis definition including a partial specification of the service before the update when the partial specification that matches the partial specification of the service after the update does not exist in the past extracted partial specification, or when the partial specification of the service that is not the target of the update does not exist in the past extracted partial specification; and a step of outputting information indicating that reverification is required for the extracted other component synthesis definitions; Further, the model checking method performs the above.

Images