Model inspection device, model inspection method, automobile manufacturing method, and program

Abstract

This model inspection device comprises: a model acquisition unit that acquires a state transition model that transitions between states of a plurality of components; a partial feature amount acquisition unit that acquires a predetermined partial feature amount for the components; an overall feature amount calculation unit that calculates the overall feature amount of the state transition model on the basis of the partial feature amount for each component; and an inspection execution unit that inspects the state transition model on the basis of the overall feature amount.

Description

Model checking device, model checking method, automobile manufacturing method and program

[0001] The present invention relates to a model checking device, a model checking method, a method for manufacturing an automobile, and a program.

[0002] Model checking, a type of formal verification, is a method for verifying whether a model derived from a hardware or software design satisfies a formal specification by exhaustive search. Model checking has attracted attention as an automated verification technique, and various model checking methods have been proposed.

[0003] For example, Non-Patent Document 1 discloses a component-reducing divide-and-conquer algorithm that processes a Markov decision process having a hierarchical component structure using a divide-and-conquer method in order to solve the state space explosion problem of probabilistic model checking.

[0004] Kazuki Watanabe, Clovis Eberhart, Kazuyuki Asada, and Ichiro Hasuo, "Compositional Probabilistic Model Checking with String Diagrams of MDPs", CAV 2023, pp 40-61, 2023.

[0005] However, the conventional techniques do not assume that the model to be inspected may include components whose internal configurations are unknown.

[0006] In view of the above technical problems, one aspect of the present invention aims to perform model checking on a model that includes a component whose internal configuration is unknown.

[0007] In order to solve the above problems, a model checking device according to one aspect of the present invention includes a model acquisition unit that acquires a state transition model that transitions states between a plurality of components, a partial feature acquisition unit that acquires predetermined partial features for the components, an overall feature calculation unit that calculates an overall feature of the state transition model based on the partial features for each component, and an inspection execution unit that inspects the state transition model based on the overall feature.

[0008] According to one aspect of the present invention, model checking can be performed on a model that includes components whose internal configurations are unknown.

[0009] FIG. 1 is a diagram showing an example of a composite Markov decision process. FIG. 2 is a diagram showing an example of a composite Markov decision process. FIG. 3 is a diagram showing an example of a white-box model. FIG. 4 is a diagram showing an example of a black-box model. FIG. 5 is a diagram showing an example of a black-box model with known mathematical features. FIG. 6 is a diagram for explaining the principle of composition. FIG. 7 is a block diagram showing an example of the overall configuration of a model checking system. FIG. 8 is a block diagram showing an example of the hardware configuration of a computer. FIG. 9 is a block diagram showing an example of the functional configuration of a model checking system. FIG. 10 is a flowchart showing an example of a model checking method.

[0010] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functional configurations are designated by the same reference numerals, and redundant description will be omitted.

[0011] [Embodiment] One embodiment of the present invention is a model checking system that performs model checking of a state transition model. The state transition model in this embodiment includes a plurality of components, and state transitions occur between the components.

[0012] The state transition model in this embodiment may be a quantitative state transition model that calculates a quantitative indicator. The quantitative indicator may include a transition probability or a payoff. Examples of the quantitative state transition model include a Markov decision process or a mean payoff game. A Markov decision process is a probabilistic model in which state transitions occur probabilistically. When the state transition model is a Markov decision process, the quantitative indicator may include the probability of reaching an output from an input and an expected reward (expected value of a payoff).

[0013] <Background> Probabilistic system models can address the uncertainty inherent in real-world systems. Probabilistic model checking provides quantitative testing results, allowing for more detailed evaluation than qualitative verification.

[0014] An example of a probabilistic system model is the Markov Decision Process (MDP). Model checking of a Markov Decision Process is highly practical because it can not only verify specifications (i.e., calculate optimal expected rewards) but also synthesize optimal control strategies. From a theoretical perspective, probabilistic model checking faces the challenge of involving continuous quantities (i.e., probabilities) in the problem, but many efficient algorithms for probabilistic model checking have been proposed.

[0015] However, even with the efficient algorithms proposed so far, there is a problem that they cannot be realistically verified when the model to be verified becomes complex. This is because the so-called state space explosion problem occurs when the model to be verified becomes too complex, and the model size becomes so large that it exceeds the memory size of the verification machine.

[0016] An effective solution to the state space explosion problem is reductive divide and conquer. Reductive divide and conquer is a method of creating a model structure in which small components are connected in many layers and processing them using a divide and conquer method. In particular, in models with repetition between components, intermediate results can be obtained by repeatedly using the calculation results of each component, which leads to improved processing performance.

[0017] Many reductive model checking methods have been proposed for various settings in model checking of Markov decision processes. For example, for probabilistic automata, a method for processing composite Markov decision processes by parallel composition has been proposed (see Reference 1). Reference 1 employs an assumption-guarantee style verification algorithm based on multi-objective probabilistic model checking. However, this method requires manual discovery of the contract conditions between parallel components required for processing, and therefore has the drawback of not being fully automated.

[0018] [Reference 1] Kwiatkowska, MZ, Norman, G., Parker, D., Qu, H., "Compositional probabilistic verification through multi-objective model checking", Information and Computation. vol. 232, pp. 38-65, 2013.

[0019] Another example is the hierarchical model checking method for Markov decision processes (see Reference 2). Reference 2 deals with sequential configurations rather than parallel configurations, and presents a model checking algorithm that calculates the optimal expected reward under the assumption that components are parametrically uniform (in other words, the components have the same shape but parameter values ​​may change). However, this method has the drawback of imposing many restrictions on how components can be combined, and does not allow for rework.

[0020] [Reference 2] Junges, S., Spaan, MTJ, "Abstraction-refinement for hierarchical probabilistic models", CAV 2022, pp. 102-123, 2022.

[0021] Non-Patent Document 1 discloses a reductive divide-and-conquer algorithm that solves these problems. Non-Patent Document 1 proposes a method for composing Markov decision processes using a formal graphical language called String Diagram and calculating the optimal expected reward. This method offers a high degree of freedom in how components are combined, and makes it possible to perform fully automated model checking.

[0022] One of the key elements of the reductive divide and conquer algorithm is the principle of compositionality, which is a conservation law of algebraic structure. More specifically, the reductive divide and conquer algorithm identifies constructive solutions as homomorphisms in an appropriate monoidal category. Another key element of the reductive divide and conquer algorithm is an equation called the decomposition equation. The decomposition equation is an extension of the equation for the probability of reaching a goal to the expected reward.

[0023] However, the reductive divide-and-conquer algorithm assumes that the internal structures of all components included in the model to be checked are known. Conversely, it is not intended to perform model checking on a model that includes components whose internal structures are unknown.

[0024] The internal structure is unknown means that only the input and output are known, and the behavior from the input to the output is not clear. For example, a state transition model can be expressed as a graph consisting of nodes and edges. The internal structure is unknown means, for example, that the number of nodes, the connections between nodes, the gains obtained at the nodes, the transition probabilities of edges, etc. are not disclosed.

[0025] 1 and 2 are diagrams showing an example of a composite Markov decision process. As shown in FIG. 1, a composite Markov decision process model A includes components B and C. Components B and C may be Markov decision processes or other models. The composite Markov decision process model A shown in FIG. 1 can be divided as shown in FIG. 2. In FIG. 2, ";" represents successive synthesis, a circled character "+" represents summation, and an arrow represents a constant wire.

[0026] In model checking of a Markov decision process model, it is necessary to calculate the expected value of the payoff based on the behavior when an action is selected in each state (position). In Figure 2, unless the internal configurations of components B and C are disclosed, it is not possible to derive the behavior of the composite Markov decision process model A. As a result, model checking of the composite Markov decision process model A cannot be performed.

[0027] The present embodiment aims to enable model checking of a model including components whose internal configurations are unknown. In this embodiment, a method is proposed that enables model checking even if the internal configurations of components included in the model are unknown, as long as the mathematical features used for model checking are known. In one aspect, model checking can be performed on a model including components whose internal configurations are unknown.

[0028] <Outline of Model Checking> An outline of model checking in this embodiment will be described with reference to FIGS.

[0029] 3 is a diagram showing an example of a white-box model, which is a state transition model in which the internal configuration of a component is known.

[0030] As shown in Figure 3, the state transition model MDP(A) includes components CompMDP(B1) and CompMDP(B2). The internal configuration of the component CompMDP(B1) shown in Figure 3, such as the number of positions P11 to P14, the connections between them, and the transition probabilities between them, is clear. Similarly, the internal configuration of the component CompMDP(B2), such as the number of positions P21 to P24, the connections between them, and the transition probabilities between them, is clear.

[0031] 4 is a diagram showing an example of a black box model. A black box model is a state transition model in which the internal configurations of components are unknown. Black box models include state transition models in which the internal configurations of some components are unknown and the internal configurations of other components are known.

[0032] The components CompMDP(B1) and CompMDP(B2) shown in Fig. 4 have known inputs and outputs, but their internal configurations are unknown. In Fig. 4, the internal configurations of both the components CompMDP(B1) and CompMDP(B2) included in the state transition model MDP(A) are unknown, but the internal configuration of only one of the components may be unknown.

[0033] 5 is a diagram illustrating an example of a black-box model whose mathematical features are known. Although the internal configuration of a component CompMDP(B1) shown in FIG. 5 is not clear, a mathematical feature CompMDP'(B1) is disclosed. Similarly, although the internal configuration of a component CompMDP(B2) shown in FIG. 5 is not clear, a mathematical feature CompMDP'(B2) is disclosed.

[0034] The mathematical feature CompMDP' is a performance index corresponding to the behavior, performance, or contract of each component. As shown in FIG. 5 , model checking in this embodiment is a method that enables model checking even for a black-box model as long as the mathematical feature of each component is disclosed.

[0035] In the model checking of this embodiment, the state transition model may include components whose internal configurations are known. In this case, mathematical features do not need to be disclosed for components whose internal configurations are known. For components whose internal configurations are known, the behavior of the model can be derived, so it is sufficient to calculate mathematical features based on the behavior of the model.

[0036] <Compositional Principle> In this embodiment, the compositional principle is used to enable model checking of a black-box model. Fig. 6 is a diagram for explaining the compositional principle.

[0037] In Fig. 6, [·] represents a mathematical feature. Fig. 6 shows that in order to calculate the mathematical feature [A; B] of a model, the mathematical feature [A] and [B] of the components are calculated separately and the calculation results are combined.

[0038] By using the principle of compositionality, even if the internal structure of component B is unknown, it is possible to calculate the mathematical feature [A; B] of the model as long as the mathematical feature [B] is known. To make the mathematical feature known, for example, the provider of component B may disclose only the mathematical feature without disclosing the internal structure. Alternatively, for example, various inputs may be given to component B, and the mathematical feature may be calculated based on the output for each input.

[0039] <Mathematical Feature Amount> The mathematical feature amount in this embodiment will be described in more detail. The mathematical feature amount includes a quantitative index used in model checking and predetermined additional information. The additional information is information used to calculate one quantitative index from multiple quantitative indexes. When the state transition model is a Markov decision process, the quantitative index is an expected value of a gain, and the additional information is a probability of arrival.

[0040] The mathematical feature quantity of a multi-input multi-output state transition model can be expressed by equation (1). Here, the state transition model is a Markov decision process.

[0041]

[0042] where τ is the scheduler. The scheduler is a function that determines the action to be taken at each position. τ (i, j) is the arrival probability from input i to output j in a scheduler τ. τ (i, j) is the expected value of the gain obtained from input i to output j in a certain scheduler τ. As shown in formula (1), the mathematical feature can be said to be information that lists the arrival probability and expected value of the gain for all combinations of input i, output j, and scheduler τ.

[0043] Hereinafter, the mathematical feature for each component will also be referred to as a “partial feature,” and the mathematical feature for the entire model will also be referred to as an “overall feature.” Note that both the partial feature and the overall feature can be expressed by Equation (1).

[0044] The overall feature of model A including components B and C can be calculated by the algorithm shown in equation (2). Model A is a model with m inputs from the left. ｒ and the number of inputs from the right is m ｌ and the number of inputs to the left is n ｒ and the number of outputs to the right is n ｌ is a Markov decision process where

[0045]

[0046] where seqComp is sequential composition, sum is summation, τ is the scheduler of Model A, and p τ ｉ，ｊ is the arrival probability from input i to output j in scheduler τ, and r τ ｉ，ｊ is the expected gain obtained from input i to output j in scheduler τ.

[0047] Model checking using global features can be performed by the algorithm shown in equation (3). Here, model A is assumed to be a Markov decision process with one input and one output. As shown in equation (3), in model checking for a Markov decision process with one input and one output, the maximum expected reward for each scheduler τ is calculated.

[0048]

[0049] However, p τ is the set of arrival probabilities in scheduler τ, and r τ is the set of expected gains for scheduler τ.

[0050] <Overall Configuration> The overall configuration of the model checking system in this embodiment will be described with reference to Fig. 7. Fig. 7 is a block diagram showing an example of the overall configuration of the model checking system.

[0051] 7, the model checking system 1000 includes a model checking device 10 and a terminal device 20. The model checking device 10 and the terminal device 20 are connected to each other so as to be able to communicate data with each other via a communication network N such as a local area network (LAN) or the Internet.

[0052] The model checking device 10 is an information processing device such as a personal computer, a workstation, or a server that performs model checking. The model checking device 10 receives a state transition model to be checked from a terminal device 20 and performs model checking on the state transition model. The model checking device 10 transmits a check result indicating the result of the model checking to the terminal device 20.

[0053] The terminal device 20 is an information processing terminal such as a personal computer, a smartphone, or a tablet terminal operated by a user of the model checking system 1000. The terminal device 20 transmits a state transition model input by the user to the model checking device 10. The terminal device 20 receives the inspection result from the model checking device 10 and presents the inspection result to the user.

[0054] The overall configuration of the model checking system 1000 shown in FIG. 7 is an example, and various system configuration examples are possible depending on the application and purpose. For example, the model checking system 1000 may include multiple model checking devices 10 and one or more terminal devices 20. For example, the model checking device 10 may be realized by multiple computers, or may be realized as a cloud computing service. For example, the model checking system 1000 may be realized by a standalone computer. The division of devices such as the model checking device 10 and the terminal device 20 shown in FIG. 7 is an example.

[0055] <Hardware Configuration> The model checking device 10 and the terminal device 20 in this embodiment may be realized by, for example, a computer. Fig. 8 is a block diagram showing an example of the hardware configuration of a computer.

[0056] 8, the computer 500 includes a CPU (Central Processing Unit) 501, a ROM (Read Only Memory) 502, a RAM (Random Access Memory) 503, a HDD (Hard Disk Drive) 504, an input device 505, a display device 506, a communication I / F (Interface) 507, and an external I / F 508. The CPU 501, the ROM 502, and the RAM 503 form a so-called computer. The hardware components of the computer 500 are connected to each other via a bus line 509. The input device 505 and the display device 506 may be connected to the external I / F 508 for use.

[0057] The CPU 501 is a computing device that reads programs and data from a storage device such as the ROM 502 or the HDD 504 onto the RAM 503 and executes processing to realize overall control and functions of the computer 500. The computer 500 may have a GPU (Graphics Processing Unit) in addition to or instead of the CPU 501.

[0058] The ROM 502 is an example of a non-volatile semiconductor memory (storage device) that can retain programs and data even when the power is turned off. The ROM 502 functions as a main storage device that stores various programs, data, etc. required for the CPU 501 to execute various programs installed in the HDD 504. Specifically, the ROM 502 stores boot programs such as a Basic Input / Output System (BIOS) and an Extensible Firmware Interface (EFI) that are executed when the computer 500 starts up, as well as data such as OS (Operating System) settings and network settings.

[0059] The RAM 503 is an example of a volatile semiconductor memory (storage device) in which programs and data are erased when the power is turned off. The RAM 503 is, for example, a dynamic random access memory (DRAM) or a static random access memory (SRAM). The RAM 503 provides a working area in which various programs installed in the HDD 504 are expanded when executed by the CPU 501.

[0060] The HDD 504 is an example of a non-volatile storage device that stores programs and data. The programs and data stored in the HDD 504 include an OS, which is basic software that controls the entire computer 500, and applications that provide various functions on the OS. Note that the computer 500 may use a storage device that uses flash memory as a storage medium (e.g., an SSD (Solid State Drive)) instead of the HDD 504.

[0061] The input device 505 includes a touch panel, operation keys and buttons, a keyboard and mouse, a microphone for inputting sound data such as voice, and the like, which are used by the user to input various signals.

[0062] The display device 506 is composed of a display such as a liquid crystal display or organic electroluminescence (EL) display for displaying a screen, a speaker for outputting sound data such as voice, and the like.

[0063] The communication I / F 507 is an interface that connects to a communication network and enables the computer 500 to perform data communication.

[0064] The external I / F 508 is an interface with external devices, such as a drive device 510.

[0065] The drive device 510 is a device for loading a recording medium 511. The recording medium 511 here includes media that record information optically, electrically, or magnetically, such as CD-ROMs, flexible disks, and magneto-optical disks. The recording medium 511 may also include semiconductor memories that record information electrically, such as ROMs and flash memories. This allows the computer 500 to read from and / or write to the recording medium 511 via the external I / F 508.

[0066] The various programs to be installed in the HDD 504 are installed, for example, by setting the distributed recording medium 511 in a drive device 510 connected to the external I / F 508 and reading the various programs recorded on the recording medium 511 by the drive device 510. Alternatively, the various programs to be installed in the HDD 504 may be installed by being downloaded via the communication I / F 507 from a network different from the communication network.

[0067] <Functional Configuration> The functional configuration of the model checking system 1000 in this embodiment will be described with reference to Fig. 9. Fig. 9 is a block diagram showing an example of the functional configuration of the model checking system.

[0068] <Model Checking Device> As shown in FIG. 9 , the model checking device 10 in this embodiment includes a component acquisition unit 101, a component storage unit 102, a model acquisition unit 103, a partial feature calculation unit 104, a partial feature acquisition unit 105, an overall feature calculation unit 106, and a test execution unit 107.

[0069] The component acquisition unit 101, the model acquisition unit 103, the partial feature calculation unit 104, the partial feature acquisition unit 105, the overall feature calculation unit 106, and the inspection execution unit 107 are realized, for example, by processing in which a program loaded from the HDD 504 shown in FIG. 8 onto the RAM 503 is executed by the CPU 501.

[0070] The component storage unit 102 is realized by, for example, the RAM 503 or the HDD 504 shown in FIG.

[0071] The component acquisition unit 101 acquires component information related to a component. The component acquisition unit 101 may acquire the component information by receiving the component information from the terminal device 20. The component acquisition unit 101 may acquire the component information input by the user via the input device 505.

[0072] The component information includes information indicating the component and predetermined partial features for the component. The component information may include information about a component whose internal configuration is unknown. The component information may also include information about a component whose internal configuration is known.

[0073] The component storage unit 102 stores component information acquired by the component acquisition unit 101. The component storage unit 102 may store component information including partial feature amounts calculated by the partial feature amount calculation unit 104.

[0074] The model acquisition unit 103 acquires a state transition model to be inspected (hereinafter also referred to as a "target model"). The model acquisition unit 103 may acquire the target model by receiving the target model from the terminal device 20. The model acquisition unit 103 may acquire the target model input by the user via the input device 505.

[0075] The target model is a state transition model that includes multiple components as states and performs state transitions between each component. The state transition model may be a quantitative state transition model. The quantitative state transition model may be a Markov decision process or a mean payoff game. The target model may include a component whose internal configuration is unknown.

[0076] The partial feature amount calculation unit 104 calculates partial feature amounts for components included in the target model acquired by the model acquisition unit 103. The partial feature amount calculation unit 104 calculates partial feature amounts for components whose internal configurations are known, among the components included in the target model. The partial feature amount calculation unit 104 does not need to calculate partial feature amounts for components whose partial feature amounts have been acquired by the partial feature amount acquisition unit 105.

[0077] The partial feature acquisition unit 105 acquires partial features from the component storage unit 102 based on the target model acquired by the model acquisition unit 103. The partial feature acquisition unit 105 acquires partial features related to components whose internal configurations are unknown among the components included in the target model. If partial features related to components whose internal configurations are known are stored in the component storage unit 102, the partial feature acquisition unit 105 may acquire those partial features.

[0078] The overall feature amount calculation unit 106 calculates the overall feature amount for the target model acquired by the model acquisition unit 103 based on the partial feature amount calculated by the partial feature amount calculation unit 104 and the partial feature amount acquired by the partial feature amount acquisition unit 105.

[0079] The test execution unit 107 performs model checking based on the overall feature amount calculated by the overall feature amount calculation unit 106. The test execution unit 107 may perform model checking based on a reductive divide-and-conquer algorithm. The test execution unit 107 transmits the test result of the target model to the terminal device 20. The test execution unit 107 may output the test result of the target model to the display device 506 of the model checking device 10.

[0080] <<Terminal Device>> As shown in FIG. 9, the terminal device 20 in this embodiment includes a component input unit 201, a model input unit 202, and a result display unit 203.

[0081] The component input unit 201, model input unit 202, and result display unit 203 are realized by, for example, processing that is executed by the CPU 501 in accordance with a program loaded from the HDD 504 shown in FIG. 8 onto the RAM 503.

[0082] The component input unit 201 receives input of component information in response to a user operation, and transmits the received component information to the model checking device 10.

[0083] The model input unit 202 receives input of a target model in response to a user operation, and transmits the received target model to the model checking device 10.

[0084] The result display unit 203 receives the inspection result of the target model from the model checking device 10. The result display unit 203 outputs the received inspection result to the display device 506 of the terminal device 20.

[0085] <Model Checking Method> A model checking method executed by the model checking system 1000 in this embodiment will be described with reference to Fig. 10. Fig. 10 is a flowchart showing an example of the model checking method.

[0086] In step S1, the component input unit 201 of the terminal device 20 accepts input of component information in response to a user operation. Next, the component input unit 201 transmits the accepted component information to the model checking device 10.

[0087] In step S2, the component acquisition unit 101 of the model checking device 10 receives component information from the terminal device 20. Next, the component acquisition unit 101 accepts input of the received component information. Then, the component acquisition unit 101 stores the accepted component information in the component storage unit 102.

[0088] In step S3, the model input unit 202 of the terminal device 20 accepts input of a target model in response to a user operation. Next, the model input unit 202 transmits the accepted target model to the model checking device 10.

[0089] In step S4, the model acquisition unit 103 of the model checking device 10 receives the target model from the terminal device 20. Next, the model acquisition unit 103 accepts input of the received target model.

[0090] The processes from step S5 to step S9 are executed for each component included in the target model acquired in step S4.

[0091] In step S5, the model acquisition unit 103 of the model checking device 10 selects an unprocessed component from the components included in the target model. Hereinafter, the selected component will be referred to as the "target component." The model acquisition unit 103 determines whether the internal structure of the target component is known or unknown.

[0092] If the internal structure of the target component is known (YES), the model acquisition unit 103 sends information about the target component to the partial feature calculation unit 104, and the process proceeds to step S6. On the other hand, if the internal structure of the target component is unknown (NO), the model acquisition unit 103 sends information about the target component to the partial feature acquisition unit 105, and the process proceeds to step S8.

[0093] In step S6, the partial feature calculation unit 104 of the model checking device 10 receives information about the target component from the model acquisition unit 103. Next, the partial feature calculation unit 104 derives the behavior of the target component and calculates partial feature amounts based on the derived behavior. Then, the partial feature acquisition unit 105 sends the calculated partial feature amounts to the overall feature calculation unit 106.

[0094] The partial feature calculation unit 104 may determine whether or not a partial feature related to the target component is stored in the component storage unit 102. If a partial feature related to the target component is stored in the component storage unit 102, the partial feature may be read from the component storage unit 102 instead of calculating the partial feature.

[0095] In step S7, the partial feature calculation unit 104 of the model checking device 10 generates component information using the partial feature related to the target component calculated in step S6 and information indicating the target component. Next, the partial feature calculation unit 104 stores the generated component information in the component storage unit 102. If the partial feature is read from the component storage unit 102 in step S6, the partial feature calculation unit 104 does not need to execute step S7.

[0096] In step S8, the partial feature acquisition unit 105 of the model checking device 10 receives information about the target component from the model acquisition unit 103. Next, the partial feature acquisition unit 105 determines whether or not partial features related to the target component are stored in the component storage unit 102.

[0097] If partial features related to the target component are stored (YES), the partial feature acquisition unit 105 proceeds to step S9. On the other hand, if partial features related to the target component are not stored (NO), the partial feature acquisition unit 105 ends the model checking method. If the target model includes a component whose internal structure is unknown and for which partial features cannot be acquired, model checking of the target model cannot be performed.

[0098] In step S9, the partial feature acquisition unit 105 of the model checking device 10 reads out partial features related to the target component from the component storage unit 102. Next, the partial feature acquisition unit 105 sends the read partial features to the overall feature calculation unit 106.

[0099] In step S10, the overall feature quantity calculation unit 106 of the model checking device 10 receives partial feature quantities related to components included in the target model from the partial feature quantity calculation unit 104 and the partial feature quantity acquisition unit 105. Next, the overall feature quantity calculation unit 106 calculates overall feature quantities related to the target model based on the received partial feature quantities. Then, the overall feature quantity calculation unit 106 sends the calculated overall feature quantities to the inspection execution unit 107.

[0100] In step S11, the test execution unit 107 of the model checking device 10 receives the global feature amounts from the global feature calculation unit 106. Next, the test execution unit 107 performs model checking based on the received global feature amounts. For example, the test execution unit 107 may perform model checking on the target model based on a reductive divide-and-conquer algorithm.

[0101] In step S12, the checking execution unit 107 of the model checking device 10 transmits the checking result to the terminal device 20. The checking result includes the result of the model checking executed in step S11. For example, if the target model is a Markov decision process, the checking result may include an optimal expected reward and a control strategy that can obtain the optimal expected reward. The control strategy is a combination of actions to be taken at each position in the Markov decision process.

[0102] In step S13, the result display unit 203 of the terminal device 20 receives the inspection result from the model checking device 10. Next, the result display unit 203 outputs the inspection result to the display device 506 of the terminal device 20.

[0103] The user can analyze the target model by referring to the inspection results output on the display device 506 of the terminal device 20. For example, if the user finds a defect in the target model, the user may correct the defect and then execute steps S3 to S13 again on the corrected target model.

[0104] <Effects of the Embodiment> The model checking device 10 in this embodiment acquires predetermined partial features for a state transition model in which states transition between a plurality of components, calculates an overall feature of the state transition model based on the partial feature of each component, and checks the state transition model based on the overall feature. Conventional model checking does not assume that a model to be checked includes a component whose internal configuration is unknown. In one aspect, this embodiment makes it possible to perform model checking on a state transition model that includes a component whose internal configuration is unknown.

[0105] The model checking device 10 may acquire predetermined partial features for components whose internal configurations are unknown. The model checking device 10 may calculate partial features for components whose internal configurations are known. Therefore, according to this embodiment, model checking can be performed even for a state transition model that includes a mixture of components whose internal configurations are unknown and components whose internal configurations are known.

[0106] The state transition model may be a quantitative state transition model that calculates a quantitative indicator. The quantitative indicator may include a transition probability or a gain. The quantitative state transition model may be a Markov decision process or a mean payoff game. The partial feature may include a probability of reaching an output from an input of a component and an expected value of a gain. The global feature may include an expected value of a gain of the state transition model. Therefore, according to this embodiment, model checking can be performed even if a quantitative state transition model including a Markov decision process or a mean payoff game includes a component whose internal configuration is unknown.

[0107] As described above, according to this embodiment, even for a black-box model, model checking is possible as long as the mathematical features that indicate the behavior of each component are known. Model checking has been actively researched, and attempts have been made to apply it to industry, but there has been a major constraint that it must be a white-box model, which has limited its applicability.

[0108] This embodiment is not limited to Markov decision processes. It can be applied to any model in which the target system can be expressed as a graph consisting of nodes and edges. For example, it can be applied to parity games or mean payoff games.

[0109] [Application Example] The model checking described in the above embodiment can be applied to ensuring the safety and reliability of any information system. Here, examples of any information system include software, hardware (e.g., integrated circuits (ICs)), physical information systems (e.g., automobiles, aircraft, electrical appliances, power plants), and information systems that include artificial intelligence (AI) as components.

[0110] As an application example, we will explain how model checking is applied to automobile development. Automobile manufacturers receive components from many suppliers and manufacture automobiles as final products. When an automobile manufacturer checks a model derived from an automobile design, the suppliers do not need to disclose the internal structure of the components; they only need to disclose the mathematical features to the automobile manufacturer, and the automobile manufacturer can perform model checking.

[0111] In this case, since the supplier knows the internal structure of the component, it can calculate the mathematical features based on its behavior. In addition, the supplier may provide experimentally obtained mathematical features or mathematical features determined by business judgment based on design specifications, etc., as a performance guarantee for the component.

[0112] Therefore, an automobile manufacturer can check a state transition model derived from an automobile design based on the model checking method of the embodiment, and can develop and manufacture automobiles by reflecting the results of checking the state transition model in the automobile design.

[0113] [Supplementary Note] Each function of the above-described embodiments can be realized by one or more processing circuits. Here, the term "processing circuit" in this specification includes a processor programmed to execute each function by software, such as a processor implemented by an electronic circuit, as well as devices such as an ASIC (Application Specific Integrated Circuit), a DSP (Digital Signal Processor), an FPGA (Field Programmable Gate Array), and conventional circuit modules designed to execute each of the above-described functions.

[0114] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to these embodiments, and various modifications and changes are possible within the scope of the gist of the present invention described in the claims.

[0115] This application claims priority from Japanese Patent Application No. 2023-217272, filed on December 22, 2023, with the Japan Patent Office, the entire contents of which are incorporated herein by reference.

[0116] REFERENCE SIGNS LIST 10 Model checking device 20 Terminal device 101 Component acquisition unit 102 Component storage unit 103 Model acquisition unit 104 Partial feature amount calculation unit 105 Partial feature amount acquisition unit 106 Overall feature amount calculation unit 107 Check execution unit 201 Component input unit 202 Model input unit 203 Result display unit 1000 Model checking system

Claims

1. A model checking device comprising: a model acquisition unit configured to acquire a state transition model in which state transitions occur between a plurality of components; a partial feature acquisition unit configured to acquire predetermined partial features for the components; an overall feature calculation unit configured to calculate an overall feature of the state transition model based on the partial features for each of the components; and an inspection execution unit configured to inspect the state transition model based on the overall feature.

2. A model checking device according to claim 1, wherein the partial feature acquisition unit is configured to acquire the partial features for the component whose internal configuration is unknown.

3. A model checking apparatus according to claim 2, further comprising a partial feature calculation unit configured to calculate the partial feature for the component whose internal configuration is known.

4. A model checking apparatus according to any one of claims 1 to 3, wherein the state transition model is a quantitative state transition model that calculates a quantitative index.

5. A model checking apparatus according to claim 4, wherein the quantitative indicators include transition probabilities or gains.

6. A model checking apparatus according to claim 4, wherein the quantitative state transition model is a Markov decision process or a mean payoff game.

7. A model checking device according to claim 4, wherein the partial features include an expected value of a gain and a probability of reaching an output from an input of the component.

8. A model checking device according to claim 7, wherein the overall feature amount includes an expected value of a gain of the state transition model.

9. A model checking device according to any one of claims 1 to 8, further comprising a component acquisition unit configured to accept input of information relating to the component, and the inspection execution unit configured to display an inspection result of the state transition model.

10. A model checking method in which a computer executes the following steps: acquiring a state transition model that transitions between a plurality of components; acquiring predetermined partial features for the components; calculating overall features of the state transition model based on the partial features for each component; and checking the state transition model based on the overall features.

11. A method for manufacturing an automobile, comprising: a step of checking the state transition model derived from a design of the automobile based on the model checking method described in claim 10; and a step of manufacturing the automobile based on the results of checking the state transition model.

12. A program for causing a computer to execute the steps of: acquiring a state transition model that transitions between a plurality of components; acquiring predetermined partial features for the components; calculating overall features of the state transition model based on the partial features for each component; and inspecting the state transition model based on the overall features.

Images