Model checking device, model checking method and program

Abstract

To execute model inspection for a model whose internal configuration includes an unknown component.SOLUTION: A model inspection device comprises: a model acquisition unit that acquires a state transition model making a state transition between a plurality of components; a partial feature quantity acquisition unit that acquires a partial feature quantity determined in advance for the components; an entire feature quantity calculation unit that calculates the entire feature quantity of the state transition model on the basis of the partial feature quantity for every component; and an inspection execution unit that inspects the state transition model on the basis of the entire feature quantity.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a model checking device, a model checking method, and a program. [Background technology]

[0002] Model checking, a type of formal verification, is a method for verifying whether a model derived from a hardware or software design satisfies a formal specification by exhaustive search. Model checking has attracted attention as an automated verification technique, and various model checking methods have been proposed.

[0003] For example, Non-Patent Document 1 discloses a component-reducing divide-and-conquer algorithm that processes a Markov decision process having a hierarchical component structure using a divide-and-conquer method in order to solve the state space explosion problem of probabilistic model checking. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Kazuki Watanabe, Clovis Eberhart, Kazuyuki Asada, and Ichiro Hasuo, "Compositional Probabilistic Model Checking with String Diagrams of MDPs", CAV 2023, pp 40-61, 2023. Summary of the Invention [Problem to be solved by the invention]

[0005] However, the conventional techniques do not assume that the model to be inspected may include components whose internal configurations are unknown.

[0006] In view of the above technical problems, one aspect of the present invention aims to perform model checking on a model that includes a component whose internal configuration is unknown. [Means for solving the problem]

[0007] In order to solve the above problems, a model checking device according to one aspect of the present invention includes a model acquisition unit that acquires a state transition model that transitions states between a plurality of components, a partial feature acquisition unit that acquires predetermined partial features for the components, an overall feature calculation unit that calculates an overall feature of the state transition model based on the partial features for each component, and an inspection execution unit that inspects the state transition model based on the overall feature. [Effects of the Invention]

[0008] According to one aspect of the present invention, model checking can be performed on a model that includes components whose internal configurations are unknown. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example of a composite Markov decision process. [Figure 2] FIG. 1 illustrates an example of a composite Markov decision process. [Figure 3] FIG. 1 illustrates an example of a white-box model. [Figure 4] FIG. 1 illustrates an example of a black box model. [Figure 5] FIG. 1 is a diagram illustrating an example of a black-box model whose mathematical features are known. [Figure 6] FIG. 1 is a diagram for explaining the constructivity principle. [Figure 7] FIG. 1 is a block diagram illustrating an example of the overall configuration of a model checking system. [Figure 8] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a computer. [Figure 9] FIG. 1 is a block diagram illustrating an example of a functional configuration of a model checking system. [Figure 10] 1 is a flowchart illustrating an example of a model checking method. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted.

[0011] [Embodiment] An embodiment of the present invention is a model checking system for performing model checking of a state transition model. The state transition model in this embodiment includes a plurality of components, and state transitions occur between the components.

[0012] The state transition model in this embodiment may be a quantitative state transition model that calculates a quantitative indicator. The quantitative indicator may include a transition probability or a payoff. Examples of the quantitative state transition model include a Markov decision process or a mean payoff game. A Markov decision process is a probabilistic model in which state transitions occur probabilistically. When the state transition model is a Markov decision process, the quantitative indicator may include the probability of reaching an output from an input and an expected reward (expected value of a payoff).

[0013] <Background> Probabilistic system models can address the uncertainty inherent in real-world systems. Probabilistic model checking provides quantitative results, allowing for more granular evaluation than qualitative verification.

[0014] An example of a probabilistic system model is a Markov Decision Process (MDP). Model checking of a Markov Decision Process is highly practical because it can not only verify specifications (i.e., calculate optimal expected rewards) but also synthesize optimal control strategies. From a theoretical perspective, probabilistic model checking faces the challenge that the problem involves continuous quantities (i.e., probabilities), but many efficient algorithms for probabilistic model checking have been proposed.

[0015] However, even with the efficient algorithms proposed so far, there is a problem that they cannot be realistically verified when the model to be verified becomes complex. This is because the so-called state space explosion problem occurs when the model to be verified becomes too complex, and the model size becomes so large that it exceeds the memory size of the verification machine.

[0016] An effective solution to the state space explosion problem is reductive divide and conquer. Reductive divide and conquer is a method of creating a model structure in which small components are connected in many layers and processing them using a divide and conquer method. In particular, in models with repetition between components, intermediate results can be obtained by repeatedly using the calculation results of each component, which leads to improved processing performance.

[0017] In the model checking of Markov decision processes, many reductive model checking methods have been proposed for various settings. For example, for probabilistic automata, a method for processing composite Markov decision processes by parallel composition has been proposed (see Reference 1). Reference 1 employs an assumption-guarantee style verification algorithm based on multi-objective probabilistic model checking. However, this method requires manual discovery of the contract conditions between parallel components required for processing, and has the drawback of not being fully automatic.

[0018] [Reference 1] Kwiatkowska, MZ, Norman, G., Parker, D., Qu, H., "Compositional probabilistic verification through multi-objective model checking", Information and Computation. vol. 232, pp. 38-65, 2013.

[0019] Another example is the hierarchical model checking method for Markov decision processes (see Reference 2). Reference 2 deals with sequential configurations rather than parallel configurations, and presents a model checking algorithm that calculates the optimal expected reward under the assumption that components are parametrically uniform (in other words, the components have the same shape, but the parameter values ​​may change). However, this method has the drawback of imposing many restrictions on how components can be combined, and does not allow for rework.

[0020] [Reference 2] Junges, S., Spaan, MTJ, "Abstraction-refinement for hierarchical probabilistic models", CAV 2022, pp. 102-123, 2022.

[0021] Non-Patent Document 1 discloses a reductive divide-and-conquer algorithm that solves these problems. Non-Patent Document 1 proposes a method for composing Markov decision processes using a formal graphical language called String Diagram and calculating the optimal expected reward. This method allows for a high degree of freedom in how components are combined, and makes it possible to perform fully automated model checking.

[0022] One of the key elements of the reductive divide and conquer algorithm is the principle of compositionality, which is a conservation law of algebraic structure. More specifically, the reductive divide and conquer algorithm identifies constructive solutions as homomorphisms in an appropriate monoidal category. Another key element of the reductive divide and conquer algorithm is an equation called the decomposition equation. The decomposition equation is an extension of the equation on the probability of reaching a goal to the expected reward.

[0023] However, the reductive divide-and-conquer algorithm assumes that the internal structures of all components included in the model to be checked are known. Conversely, it is not intended to perform model checking on a model that includes components whose internal structures are unknown.

[0024] The internal structure is unknown means that only the input and output are known, and the behavior from the input to the output is not clear. For example, a state transition model can be expressed as a graph consisting of nodes and edges. The internal structure is unknown means, for example, that the number of nodes, the connections between nodes, the gains obtained at the nodes, the transition probabilities of edges, etc. are not disclosed.

[0025] 1 and 2 are diagrams showing an example of a composite Markov decision process. As shown in FIG. 1, the composite Markov decision process A includes components B and C. Components B and C may be Markov decision processes or other models. The composite Markov decision process A shown in FIG. 1 can be divided as shown in FIG. 2. In FIG. 2, ; represents successive composition, a circled character + represents summation, and an arrow represents a constant wire.

[0026] In model checking of a Markov decision process, it is necessary to calculate the expected value of the payoff based on the behavior when an action is selected at each state (position). In Figure 2, if the internal configurations of components B and C are not disclosed, it is not possible to derive the behavior of the composite Markov decision process A. As a result, model checking of the composite Markov decision process A cannot be performed.

[0027] The present embodiment aims to enable model checking of a model including components whose internal configurations are unknown. In this embodiment, a method is proposed that enables model checking even if the internal configurations of components included in the model are unknown, as long as the mathematical features used for model checking are known. In one aspect, model checking can be performed on a model including components whose internal configurations are unknown.

[0028] <Overview of model checking> An overview of model checking in this embodiment will be described with reference to FIGS.

[0029] 3 is a diagram showing an example of a white-box model, which is a state transition model in which the internal configuration of a component is known.

[0030] As shown in Fig. 3, the state transition model MDP(A) includes components CompMDP(B1) and CompMDP(B2). The internal configuration of the component CompMDP(B1) shown in Fig. 3, such as the number of positions P11 to P14, the connections between them, and the transition probabilities between them, is clear. Similarly, the internal configuration of the component CompMDP(B2), such as the number of positions P21 to P24, the connections between them, and the transition probabilities between them, is clear.

[0031] 4 is a diagram showing an example of a black box model. A black box model is a state transition model in which the internal configurations of components are unknown. Black box models include state transition models in which the internal configurations of some components are unknown and the internal configurations of other components are known.

[0032] The components CompMDP(B1) and CompMDP(B2) shown in Fig. 4 have clear inputs and outputs, but their internal configurations are unknown. In Fig. 4, the internal configurations of both the components CompMDP(B1) and CompMDP(B2) included in the state transition model MDP(A) are unknown, but the internal configuration of only one of the components may be unknown.

[0033] Figure 5 is a diagram showing an example of a black box model whose mathematical features are known. Although the internal configuration of a component CompMDP(B1) shown in Figure 5 is not clear, a mathematical feature CompMDP'(B1) is disclosed. Similarly, although the internal configuration of a component CompMDP(B2) shown in Figure 5 is not clear, a mathematical feature CompMDP'(B2) is disclosed.

[0034] The mathematical feature CompMDP' is a performance index corresponding to the behavior, performance, or contract of each component. As shown in Fig. 5, model checking in this embodiment is a method that enables model checking even for a black-box model as long as the mathematical feature of each component is disclosed.

[0035] In the model checking of this embodiment, the state transition model may include components whose internal configurations are known. In this case, mathematical features do not need to be disclosed for components whose internal configurations are known. For components whose internal configurations are known, the behavior of the model can be derived, so it is sufficient to calculate mathematical features based on the behavior of the model.

[0036] <Compositionality principle> In this embodiment, the compositionality principle is used to enable model checking of a black-box model. Figure 6 is a diagram for explaining the compositionality principle.

[0037] In Figure 6, [·] represents a mathematical feature. Figure 6 shows that to calculate the mathematical feature [A;B] of a model, we first calculate the mathematical features [A] and [B] of the components and then combine the results.

[0038] Using the principle of compositionality, even if the internal structure of component B is unknown, it is possible to calculate the mathematical features [A;B] of a model as long as the mathematical features [B] are known. To make the mathematical features known, for example, the provider of component B can disclose only the mathematical features without revealing the internal structure. Alternatively, for example, various inputs can be given to component B, and the mathematical features can be calculated based on the output for each input.

[0039] <Mathematical features> The mathematical feature in this embodiment will be described in more detail. The mathematical feature includes a quantitative index used in model checking and predetermined additional information. The additional information is information used to calculate one quantitative index from multiple quantitative indexes. When the state transition model is a Markov decision process, the quantitative index is an expected value of a gain, and the additional information is a probability of arrival.

[0040] The mathematical feature of a multi-input, multi-output state transition model can be expressed by equation (1), where the state transition model is a Markov decision process.

[0041]

number

[0042] where τ is the scheduler. The scheduler is a function that determines the action to be taken at each position. RPr τ(i,j) is the arrival probability from input i to output j in a scheduler τ. τ (i, j) is the expected value of the gain obtained from input i to output j in a certain scheduler τ. As shown in formula (1), the mathematical feature can be said to be information that lists the expected values ​​of the arrival probability and gain for all combinations of input i, output j, and scheduler τ.

[0043] Hereinafter, the mathematical feature for each component will be referred to as the "partial feature," and the mathematical feature for the entire model will be referred to as the "global feature." Note that both the partial feature and the global feature can be expressed by Equation (1).

[0044] The overall feature of model A including components B and C can be calculated using the algorithm shown in equation (2). Model A is r and the number of inputs from the right is m l and the number of inputs to the left is n r and the number of outputs to the right is n l is a Markov decision process where

[0045]

number

[0046] where seqComp is the sequential composition, sum is the sum, τ is the scheduler of Model A, and p τ i,j is the arrival probability from input i to output j in scheduler τ, and r τ i,j is the expected gain obtained from input i to output j in scheduler τ.

[0047] Model checking using global features can be performed by the algorithm shown in equation (3). Here, model A is assumed to be a Markov decision process with one input and one output. As shown in equation (3), in model checking for a Markov decision process with one input and one output, the maximum expected reward for each scheduler τ is calculated.

[0048]

number

[0049] However, p τ is the set of arrival probabilities for scheduler τ, and r τ is the set of expected gains for scheduler τ.

[0050] <Overall structure> The overall configuration of the model checking system in this embodiment will be described with reference to Fig. 7. Fig. 7 is a block diagram showing an example of the overall configuration of the model checking system.

[0051] 7, the model checking system 1000 includes a model checking device 10 and a terminal device 20. The model checking device 10 and the terminal device 20 are connected to each other so as to be able to communicate data with each other via a communication network N such as a LAN (Local Area Network) or the Internet.

[0052] The model checking device 10 is an information processing device such as a personal computer, a workstation, or a server that performs model checking. The model checking device 10 receives a state transition model to be checked from a terminal device 20, and performs model checking on the state transition model. The model checking device 10 transmits a check result indicating the result of the model checking to the terminal device 20.

[0053] The terminal device 20 is an information processing terminal such as a personal computer, a smartphone, or a tablet terminal operated by a user of the model checking system 1000. The terminal device 20 transmits a state transition model input by the user to the model checking device 10. The terminal device 20 receives the inspection result from the model checking device 10 and presents the inspection result to the user.

[0054] The overall configuration of the model checking system 1000 shown in FIG. 7 is an example, and various system configuration examples are possible depending on the application and purpose. For example, the model checking system 1000 may include multiple model checking devices 10 and one or more terminal devices 20. For example, the model checking device 10 may be realized by multiple computers, or may be realized as a cloud computing service. For example, the model checking system 1000 may be realized by a standalone computer. The division of devices such as the model checking device 10 and the terminal device 20 shown in FIG. 7 is an example.

[0055] <Hardware configuration> The model checking device 10 and the terminal device 20 in this embodiment may be realized by, for example, a computer. Fig. 8 is a block diagram showing an example of the hardware configuration of a computer.

[0056] 8, the computer 500 includes a CPU (Central Processing Unit) 501, a ROM (Read Only Memory) 502, a RAM (Random Access Memory) 503, a HDD (Hard Disk Drive) 504, an input device 505, a display device 506, a communication I / F (Interface) 507, and an external I / F 508. The CPU 501, the ROM 502, and the RAM 503 form a so-called computer. The hardware components of the computer 500 are connected to each other via a bus line 509. The input device 505 and the display device 506 may be connected to the external I / F 508 for use.

[0057] The CPU 501 is a computing device that reads programs and data from a storage device such as the ROM 502 or the HDD 504 onto the RAM 503 and executes the processes, thereby realizing the overall control and functions of the computer 500. The computer 500 may have a GPU (Graphics Processing Unit) in addition to or instead of the CPU 501.

[0058] The ROM 502 is an example of a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 502 functions as a main storage device that stores various programs, data, etc. required for the CPU 501 to execute various programs installed in the HDD 504. Specifically, the ROM 502 stores boot programs such as a Basic Input / Output System (BIOS) and an Extensible Firmware Interface (EFI) that are executed when the computer 500 starts up, as well as data such as OS (Operating System) settings and network settings.

[0059] The RAM 503 is an example of a volatile semiconductor memory (storage device) in which programs and data are erased when the power is turned off. The RAM 503 is, for example, a dynamic random access memory (DRAM) or a static random access memory (SRAM). The RAM 503 provides a working area in which various programs installed in the HDD 504 are expanded when executed by the CPU 501.

[0060] The HDD 504 is an example of a non-volatile storage device that stores programs and data. The programs and data stored in the HDD 504 include an OS, which is basic software that controls the entire computer 500, and applications that provide various functions on the OS. Note that the computer 500 may use a storage device that uses flash memory as a storage medium (e.g., an SSD (Solid State Drive)) instead of the HDD 504.

[0061] The input device 505 includes a touch panel, operation keys and buttons, a keyboard and mouse, a microphone for inputting sound data such as voice, and the like, which are used by the user to input various signals.

[0062] The display device 506 is configured with a display such as a liquid crystal display or organic EL (Electro-Luminescence) display for displaying a screen, a speaker for outputting sound data such as voice, and the like.

[0063] The communication I / F 507 is an interface that connects to a communication network and enables the computer 500 to perform data communication.

[0064] The external I / F 508 is an interface with external devices, such as a drive device 510.

[0065] The drive device 510 is a device for loading a recording medium 511. The recording medium 511 here includes media that record information optically, electrically, or magnetically, such as a CD-ROM, a flexible disk, or a magneto-optical disk. The recording medium 511 may also include semiconductor memories that record information electrically, such as ROMs and flash memories. This allows the computer 500 to read from and / or write to the recording medium 511 via the external I / F 508.

[0066] The various programs to be installed in the HDD 504 are installed, for example, by setting the distributed recording medium 511 in a drive device 510 connected to the external I / F 508 and reading out the various programs recorded on the recording medium 511 by the drive device 510. Alternatively, the various programs to be installed in the HDD 504 may be installed by being downloaded via the communication I / F 507 from a network different from the communication network.

[0067] <Functional configuration> The functional configuration of the model checking system 1000 in this embodiment will be described with reference to Fig. 9. Fig. 9 is a block diagram showing an example of the functional configuration of the model checking system.

[0068] <Model Checker> As shown in FIG. 9, the model checking device 10 in this embodiment includes a component acquisition unit 101, a component storage unit 102, a model acquisition unit 103, a partial feature calculation unit 104, a partial feature acquisition unit 105, an overall feature calculation unit 106, and a test execution unit 107.

[0069] The component acquisition unit 101, the model acquisition unit 103, the partial feature calculation unit 104, the partial feature acquisition unit 105, the overall feature calculation unit 106, and the inspection execution unit 107 are realized, for example, by processing that is executed by the CPU 501 of a program loaded from the HDD 504 to the RAM 503 shown in FIG. 8.

[0070] The component storage unit 102 is realized by, for example, the RAM 503 or the HDD 504 shown in FIG.

[0071] The component acquisition unit 101 acquires component information related to a component. The component acquisition unit 101 may acquire the component information by receiving the component information from the terminal device 20. The component acquisition unit 101 may acquire the component information input by the user via the input device 505.

[0072] The component information includes information indicating the component and predetermined partial features for the component. The component information may include information about a component whose internal configuration is unknown. The component information may also include information about a component whose internal configuration is known.

[0073] The component storage unit 102 stores component information acquired by the component acquisition unit 101. The component storage unit 102 may store component information including partial features calculated by the partial feature calculation unit 104.

[0074] The model acquisition unit 103 acquires a state transition model to be inspected (hereinafter also referred to as a "target model"). The model acquisition unit 103 may acquire the target model by receiving the target model from the terminal device 20. The model acquisition unit 103 may acquire the target model input by the user via the input device 505.

[0075] The target model is a state transition model that includes multiple components as states and performs state transitions between each component. The state transition model may be a quantitative state transition model. The quantitative state transition model may be a Markov decision process or a mean payoff game. The target model may include a component whose internal configuration is unknown.

[0076] The partial feature calculation unit 104 calculates partial feature amounts for components included in the target model acquired by the model acquisition unit 103. The partial feature calculation unit 104 calculates partial feature amounts for components whose internal configurations are known, among the components included in the target model. The partial feature calculation unit 104 does not need to calculate partial feature amounts for components whose partial feature amounts have been acquired by the partial feature acquisition unit 105.

[0077] The partial feature acquisition unit 105 acquires partial features from the component storage unit 102 based on the target model acquired by the model acquisition unit 103. The partial feature acquisition unit 105 acquires partial features related to components whose internal configurations are unknown among the components included in the target model. If partial features related to components whose internal configurations are known are stored in the component storage unit 102, the partial feature acquisition unit 105 may acquire those partial features.

[0078] The overall feature amount calculation unit 106 calculates the overall feature amount for the target model acquired by the model acquisition unit 103 based on the partial feature amount calculated by the partial feature amount calculation unit 104 and the partial feature amount acquired by the partial feature amount acquisition unit 105.

[0079] The test execution unit 107 executes model checking based on the overall feature calculated by the overall feature calculation unit 106. The test execution unit 107 may execute model checking based on a reductive divide-and-conquer algorithm. The test execution unit 107 transmits the test result of the target model to the terminal device 20. The test execution unit 107 may output the test result of the target model to the display device 506 of the model checking device 10.

[0080] Terminal Device As shown in FIG. 9, the terminal device 20 in this embodiment includes a component input unit 201, a model input unit 202, and a result display unit 203.

[0081] The component input unit 201, model input unit 202, and result display unit 203 are realized by, for example, processing that is executed by the CPU 501 in accordance with a program loaded from the HDD 504 onto the RAM 503 shown in FIG.

[0082] The component input unit 201 receives input of component information in response to a user operation, and transmits the received component information to the model checking device 10.

[0083] The model input unit 202 receives an input of a target model in response to a user operation, and transmits the received target model to the model checking device 10.

[0084] The result display unit 203 receives the inspection result of the target model from the model checking device 10. The result display unit 203 outputs the received inspection result to the display device 506 of the terminal device 20.

[0085] <Model checking method> A model checking method executed by the model checking system 1000 in this embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of the model checking method.

[0086] In step S1, the component input unit 201 of the terminal device 20 accepts input of component information in response to a user operation. Next, the component input unit 201 transmits the accepted component information to the model checking device 10.

[0087] In step S2, the component acquisition unit 101 of the model checking device 10 receives component information from the terminal device 20. Next, the component acquisition unit 101 accepts input of the received component information. Then, the component acquisition unit 101 stores the accepted component information in the component storage unit 102.

[0088] In step S3, the model input unit 202 of the terminal device 20 accepts input of a target model in response to a user operation. Next, the model input unit 202 transmits the accepted target model to the model checking device 10.

[0089] In step S4, the model acquiring unit 103 of the model checking device 10 receives the target model from the terminal device 20. Next, the model acquiring unit 103 accepts input of the received target model.

[0090] The processes from step S5 to step S9 are executed for each component included in the target model acquired in step S4.

[0091] In step S5, the model acquisition unit 103 of the model checking device 10 selects an unprocessed component from the components included in the target model. Hereinafter, the selected component will be referred to as the "target component." The model acquisition unit 103 determines whether the internal structure of the target component is known or unknown.

[0092] If the internal structure of the target component is known (YES), the model acquisition unit 103 sends information about the target component to the partial feature calculation unit 104, and the process proceeds to step S6. On the other hand, if the internal structure of the target component is unknown (NO), the model acquisition unit 103 sends information about the target component to the partial feature acquisition unit 105, and the process proceeds to step S8.

[0093] In step S6, the partial feature calculation unit 104 of the model checking device 10 receives information about the target component from the model acquisition unit 103. Next, the partial feature calculation unit 104 derives the behavior of the target component and calculates partial features based on the derived behavior. Then, the partial feature acquisition unit 105 sends the calculated partial features to the overall feature calculation unit 106.

[0094] The partial feature calculation unit 104 may determine whether or not the partial feature related to the target component is stored in the component storage unit 102. If the partial feature related to the target component is stored in the component storage unit 102, the partial feature may be read from the component storage unit 102 instead of calculating the partial feature.

[0095] In step S7, the partial feature calculation unit 104 of the model checking device 10 generates component information using the partial feature related to the target component calculated in step S6 and information indicating the target component. Next, the partial feature calculation unit 104 stores the generated component information in the component storage unit 102. If the partial feature is read from the component storage unit 102 in step S6, the partial feature calculation unit 104 does not need to execute step S7.

[0096] In step S8, the partial feature acquisition unit 105 of the model checking device 10 receives information about the target component from the model acquisition unit 103. Next, the partial feature acquisition unit 105 determines whether or not the partial feature about the target component is stored in the component storage unit 102.

[0097] If partial features related to the target component are stored (YES), the partial feature acquisition unit 105 proceeds to step S9. On the other hand, if partial features related to the target component are not stored (NO), the partial feature acquisition unit 105 ends the model checking method. If the target model includes a component whose internal structure is unknown and for which partial features cannot be acquired, model checking of the target model cannot be performed.

[0098] In step S9, the partial feature acquisition unit 105 of the model checking device 10 reads out partial features related to the target component from the component storage unit 102. Next, the partial feature acquisition unit 105 sends the read partial features to the overall feature calculation unit 106.

[0099] In step S10, overall feature quantity calculation unit 106 of model checking device 10 receives partial feature quantities related to components included in the target model from partial feature quantity calculation unit 104 and partial feature quantity acquisition unit 105. Next, overall feature quantity calculation unit 106 calculates overall feature quantities related to the target model based on the received partial feature quantities. Then, overall feature quantity calculation unit 106 sends the calculated overall feature quantities to inspection execution unit 107.

[0100] In step S11, the check execution unit 107 of the model checking device 10 receives the global feature from the global feature calculation unit 106. Next, the check execution unit 107 performs model checking based on the received global feature. For example, the check execution unit 107 may perform model checking on the target model based on a reductive divide-and-conquer algorithm.

[0101] In step S12, the checking execution unit 107 of the model checking device 10 transmits the checking result to the terminal device 20. The checking result includes the result of the model checking executed in step S11. For example, if the target model is a Markov decision process, the checking result may include an optimal expected reward and a control strategy that can obtain the optimal expected reward. The control strategy is a combination of actions to be taken at each position in the Markov decision process.

[0102] In step S13, the result display unit 203 of the terminal device 20 receives the inspection result from the model checking device 10. Next, the result display unit 203 outputs the inspection result to the display device 506 of the terminal device 20.

[0103] The user can analyze the target model by referring to the inspection results output on the display device 506 of the terminal device 20. For example, if the user finds a defect in the target model, the user may correct the defect and then execute steps S3 to S13 again on the corrected target model.

[0104] <Effects of the embodiment> A model checking device 10 in this embodiment acquires predetermined partial features for a state transition model in which states transition between a plurality of components, calculates an overall feature of the state transition model based on the partial feature of each component, and checks the state transition model based on the overall feature. Conventional model checking does not assume that a model to be checked includes a component whose internal configuration is unknown. In one aspect, this embodiment makes it possible to perform model checking on a state transition model that includes a component whose internal configuration is unknown.

[0105] The model checking device 10 may acquire predetermined partial features for components whose internal configurations are unknown. The model checking device 10 may calculate partial features for components whose internal configurations are known. Therefore, according to this embodiment, model checking can be performed even for a state transition model in which components whose internal configurations are unknown and components whose internal configurations are known are mixed.

[0106] The state transition model may be a quantitative state transition model that calculates a quantitative indicator. The quantitative indicator may include a transition probability or a gain. The quantitative state transition model may be a Markov decision process or a mean payoff game. The partial feature may include a probability of reaching an output from an input of a component and an expected value of a gain. The global feature may include an expected value of a gain of the state transition model. Therefore, according to this embodiment, model checking can be performed even if a quantitative state transition model including a Markov decision process or a mean payoff game includes a component whose internal configuration is unknown.

[0107] As described above, according to this embodiment, even for a black-box model, model checking is possible as long as the mathematical features that indicate the behavior of each component are known. Model checking has been actively researched, and attempts have been made to apply it to industry, but there has been a major constraint that it must be a white-box model, which has limited its applicability.

[0108] This embodiment is not limited to Markov decision processes. It can be applied to any model in which the target system can be expressed by a graph consisting of nodes and edges. For example, it can be applied to parity games or mean payoff games.

[0109] [Application example] The model checking described in the above embodiments can be applied to ensure the safety and reliability of any information system, including, for example, software, hardware (e.g., integrated circuits (ICs)), physical information systems (e.g., automobiles, aircraft, electrical appliances, power plants), and information systems that include artificial intelligence (AI) as components.

[0110] As an application example, we will explain how model checking is applied to automobile development. Automobile manufacturers receive components from many suppliers and manufacture automobiles as final products. When an automobile manufacturer checks a model derived from an automobile design, the suppliers do not need to disclose the internal structure of the components; they only need to disclose the mathematical features to the automobile manufacturer, and the automobile manufacturer can perform model checking.

[0111] In this case, since the supplier knows the internal structure of the component, it can calculate the mathematical features based on its behavior. In addition, the supplier may provide experimentally obtained mathematical features or mathematical features determined by business judgment based on design specifications, etc., as a performance guarantee for the component.

[0112] [supplement] Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to perform each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to perform each of the above-described functions.

[0113] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0114] 10 Model Checker 20 Terminal equipment 101 Component Acquisition Unit 102 Component Storage Unit 103 Model Acquisition Department 104 Partial feature calculation unit 105 Partial feature acquisition unit 106 Overall feature calculation unit 107 Inspection Execution Department 201 Component input section 202 Model Input Section 203 Result display section 1000 Model Checking Systems

Claims

1. a model acquisition unit configured to acquire a state transition model that transitions states among a plurality of components; a component storage unit configured to store partial features predetermined for the component, the partial features including an expected value of a gain and a probability of reaching an output from an input of the component; a partial feature acquisition unit configured to read out, from the component storage unit, the partial feature relating to the component whose behavior from input to output is unclear; an overall feature calculation unit configured to calculate an overall feature including an expected value of a gain of the state transition model based on the partial feature of each component; an inspection execution unit configured to inspect the state transition model based on the overall feature amount; A model checking apparatus comprising:

2. 2. The model checking apparatus according to claim 1, a partial feature calculation unit configured to calculate the partial feature based on the behavior of the component whose behavior from input to output is clear, Model checking equipment.

3. 3. The model checking apparatus according to claim 1, The state transition model is a quantitative state transition model that calculates a quantitative indicator. Model checking equipment.

4. 4. The model checking apparatus according to claim 3, The quantitative indicators include transition probabilities or gains. Model checking equipment.

5. 4. The model checking apparatus according to claim 3, The quantitative state transition model is a Markov decision process or a mean payoff game. Model checking equipment.

6. The computer A procedure for obtaining a state transition model that transitions states between multiple components; a step of storing, in a storage device, partial features that are predetermined for the component, the partial features including an arrival probability from an input to an output of the component and an expected value of a gain; a step of reading from the storage device the partial feature associated with the component whose behavior from input to output is unclear; a step of calculating an overall feature amount including an expected value of a gain of the state transition model based on the partial feature amount for each of the components; inspecting the state transition model based on the overall feature amount; A model checking method that performs

7. On the computer, A procedure for obtaining a state transition model that transitions states between multiple components; a step of storing, in a storage device, partial features that are predetermined for the component, the partial features including an arrival probability from an input to an output of the component and an expected value of a gain; a step of reading from the storage device the partial feature associated with the component whose behavior from input to output is unclear; a step of calculating an overall feature amount including an expected value of a gain of the state transition model based on the partial feature amount for each of the components; inspecting the state transition model based on the overall feature amount; A program to execute.

Images