JP2010205066A - Counter example analysis support device, counter example analysis support system, counter example analysis support method therefor, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve the problem that it is difficult to identify a cause of a failure from one counter example in the verification of a system using a model inspection. <P>SOLUTION: A plurality of counter examples that are generated are accumulated, and the plurality of the accumulated counter examples are analyzed so that a process that appears in the most counter examples and processing that appears in the most counter examples are output. There is a high possibility that the process or the processing that appears in the most counter examples is the cause of a failure. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a counterexample analysis support apparatus, counterexample analysis support system, counterexample analysis support method and program for verifying a parallel system or software of a parallel system using model checking technology, and in particular, a plurality of counterexamples are integrated and integrated. The present invention relates to a counterexample analysis support device, a counterexample analysis support system, a counterexample analysis support method, and a program that can present a candidate group of failure causes by analyzing the frequency of appearance of processes and processes in a plurality of counterexamples.

  A model checking method is known as a method for verifying operation specifications of a system and software. Model check method is a state transition system model that indicates the operation specifications of the system or software to be verified, and a verification item that indicates the property (verification property) that the operation specification should satisfy. Does the model violate the verification item? This is a method of verifying the operation specification to be verified depending on whether or not.

  Therefore, the input to the model checker, which is the engine that performs model checking, is the model and verification items. In addition to the operation specifications of the verification target system software, this model is the external environment where the verification target system software operates. May also include environmental behavior.

  Using the model checking method, it is possible to verify a parallel system (and its software) in which multiple processes are executed concurrently. SPIN or the like is known as a tool (model checker) that can perform model checking of a concurrent system.

  In the model checking method, when the model violates the verification item (does not satisfy the verification property), a counter example that is an execution example (execution log) when the property is not satisfied is output. In general, there are a plurality of execution examples that do not satisfy the property, and one counter example corresponds to one of the examples. One counterexample can be enormous. In particular, a counter example when a parallel system is verified by model checking may include processing in a plurality of processes.

  The counter example shows one execution example that does not satisfy the verification property, and does not indicate the cause that the verification property is not satisfied, that is, the cause of the malfunction. Therefore, when the operation specification is inspected by the model checking method, if a counterexample is output, the system (software) developer must analyze the counterexample and find a defect in the system (software).

  Therefore, as a first problem, there is a problem that it is difficult to find the cause of the malfunction from a counter example in the verification using the model check of the system. The reason is that counterexamples can be enormous, and it is difficult for humans to analyze them by hand.

  The second problem is that it is difficult to find the cause of the malfunction from the counterexample in the verification of the parallel system. The reason for this is that in addition to the reason for the first problem, in the case of concurrent system verification, the counterexample can include processing in multiple processes, so which of which processes and which of these processes are related to the failure. This is because it is not known only by counterexamples.

  Therefore, Non-Patent Document 1 describes a method for supporting the first problem using a pattern obtained by extracting a typical defect and patterning this counterexample analysis.

Satoko Takada, 3 others, “Application examples of model checking for industrial controllers”, Software Quality Symposium 2008

  However, the problem in Non-Patent Document 1 is that it is generally difficult to obtain a typical defect pattern for identifying the cause of the defect from the counterexample. The reason is that if there is no similar system or there are few similar systems as verification targets, sufficient information sufficient to extract a possible defect as a pattern cannot be obtained.

  Therefore, the present invention has been made in view of the above-described problems, and an object thereof is to provide a counterexample analysis support apparatus that can assist in identifying the cause of a system failure.

  In order to solve the above-described problem, the counterexample analysis support apparatus according to the present invention includes a system operation specification having a plurality of processes or a model indicating a system operation specification and an external environment, and a verification item indicating a property to be satisfied by the model. The model checking means for checking whether or not the model satisfies the verification item and generating one or more counterexamples if the model does not satisfy the verification item, and one model and A plurality of counterexamples generated by the model checking means for one verification item are collected and stored, and a counterexample analysis means for analyzing a plurality of accumulated counterexamples and obtaining processing appearing in the most counterexamples, Output means for outputting information for specifying the processing obtained by the counterexample analysis means.

  Further, the counterexample analysis support system in the present invention determines whether or not the input operation specification of the system having a plurality of processes or the model indicating the system operation specification and the external environment satisfies the verification item indicating the property to be satisfied. A counterexample analysis support system comprising: a model checking device that inspects and generates a counterexample; and a counterexample analysis support device that analyzes and outputs the counterexample. The model checking device refers to a model and a verification item. Then, it has a model checking means for checking whether or not the model satisfies the verification item and generating one or more counter examples if the model does not satisfy the verification item. Multiple counterexamples generated by the model checking means for one verification item are collected and stored, and the collected counterexamples are analyzed and appear in the most counterexamples. A counter example analysis means for determining the processing, characterized by comprising output means for outputting information specifying the processing obtained by the counter example analysis means.

  Further, the counterexample analysis support method of the counterexample analysis support apparatus according to the present invention includes a system operation specification having a plurality of input processes or a model indicating a system operation specification and an external environment, and a verification item indicating a property that the model should satisfy And a model checking step for checking whether or not the model satisfies the verification item and generating one or more counterexamples if the model does not satisfy the verification item, one model and one verification A plurality of counterexamples generated and stored in a model checking step for an item, a counterexample integration step for storing and storing, a counterexample analysis step for analyzing a plurality of accumulated counterexamples, and obtaining processing appearing in the most counterexamples, and counterexamples And an output step for outputting information for specifying the processing obtained in the analysis step.

  Further, the counterexample analysis support method of the counterexample analysis support system according to the present invention is a model checker that is used to input a system operation specification having a plurality of processes or a model indicating a system operation specification and an external environment, and to satisfy the model. A model checking step for checking whether or not the model satisfies the verification item with reference to the verification item indicating the property, and generating one or more counterexamples if the model does not satisfy the verification item, and counterexample analysis The support device collects multiple counterexamples generated in the model checking step for one model and one verification item, analyzes the stored counterexample integration step, and analyzes the multiple counterexamples that are stored. A counterexample analysis step for obtaining a process appearing in the counterexample, and an output step for outputting information for specifying the process obtained in the counterexample analysis step. And butterflies.

  Further, the program according to the present invention refers to a system operation specification having a plurality of input processes or a model indicating a system operation specification and an external environment, and a verification item indicating a property to be satisfied by the model. Check whether the verification item satisfies the verification item, and if the model does not satisfy the verification item, one or more counterexamples are generated, and one model and one verification item are subjected to the model checking processing The counter-example collection process that collects and stores multiple counter-examples generated by the analysis, the counter-example analysis process that analyzes the multiple counter-examples that have been collected and finds the process that appears in the most counter-examples, and the process that was obtained in the counter-example analysis process An output process for outputting specified information is executed by a computer.

  Further, the program according to the present invention includes: a model checking apparatus, a system operation specification having a plurality of input processes or a system operation specification and a model indicating an external environment; and a verification item indicating a property to be satisfied by the model. A model checking process for checking whether or not the model satisfies the verification item and generating one or more counterexamples if the model does not satisfy the verification item, and a model by the counterexample analysis support device, Multiple counterexamples generated by model checking for a single verification item are collected and stored, and the counterexample analysis for analyzing the multiple counterexamples that have been collected and determining the processes that appear in the most counterexamples It is characterized by causing a computer to execute a process and an output process for outputting information specifying the process obtained in the counterexample analysis process.

  According to the present invention, by analyzing a plurality of counterexamples and obtaining processes and processes that appear in many counterexamples, a process or process that is likely to cause a failure is output. It is possible to effectively assist in finding the cause of the malfunction from the counterexample.

It is a block diagram which shows the structure of the counterexample analysis assistance apparatus of this invention which concerns on the 1st and 2nd embodiment of this invention. It is a block diagram which shows the structure of the counterexample analysis assistance apparatus of this invention which concerns on the 3rd Embodiment of this invention. It is a block diagram which shows the structure of the counterexample analysis assistance apparatus of this invention which concerns on the 4th Embodiment of this invention. It is a block diagram which shows the structure of the counterexample analysis assistance apparatus of this invention which concerns on the 5th Embodiment of this invention. It is a lineblock diagram of the counterexample analysis support system of the present invention concerning the embodiment of the present invention. It is a figure which shows an example of a counter example. It is a figure which shows an example of statistical information. It is a figure which shows an example of the most frequent appearance information.

  Next, the best mode for carrying out the invention will be described in detail with reference to the drawings.

(First embodiment)
FIG. 1 is a configuration diagram of a counterexample analysis support apparatus according to the first embodiment of the present invention. The counterexample analysis support apparatus includes an input unit 1, a model checking unit 2, a counterexample accumulation unit 3, a counterexample analysis unit 4, and an output unit 5. Each of these means generally operates as follows.

  The input means 1 is an input to the model checking means, and is for inputting a model and verification items. The model indicates the operation specifications of the system or software to be verified, and may further include the behavior of the external environment in which the system software to be verified operates. The verification item represents the property to be verified.

  The model checking unit 2 is an engine that performs model checking. As a specific example, the model checking unit 2 is a functional unit having the same function as a model checker such as SPIN.

  The counter example accumulation unit 3 accumulates a plurality of counter examples generated by the model checking unit 2.

  The counterexample analysis unit 4 analyzes a plurality of counterexamples accumulated by the counterexample stacking unit 3 and generates statistical information on the number of appearances of processes in the plurality of counterexamples. Further, the most frequent appearance information indicating the process with the largest number of appearances is generated.

  The output means 5 is for outputting the statistical information generated by the counterexample analysis means 4 and the most frequently occurring information.

  Next, the overall operation of the present embodiment will be described in detail with reference to FIG.

  Input to the model checking means 2 is performed by the input means 1. If the model checking means 2 is SPIN, for example, a model described in Promela and a verification item described in a linear temporal logic formula (LTL) are input.

  The model checking unit 2 checks whether the model input from the input unit 1 satisfies the verification items and outputs the result. If the verification item is satisfied, the counterexample is not output, and it is not necessary to perform the analysis, so the operation ends here.

  If the verification item is not satisfied, the model checking means can generate a plurality of counterexamples. Here, the model checking means is activated to generate and save all counterexamples. For example, when the model checking means is SPIN, it is stored with consecutive numbers so that all counter examples can be identified by an option given to the model checking means, or the operation is suppressed so that only one counter example is stored. Can be toggled, but it is invoked with the option to save everything.

  The counterexample accumulation means 3 receives the output of the model checking means 2, accumulates and stores a plurality of counterexamples generated by the model checking means 2.

  The counterexample analysis unit 4 generates statistical information regarding processing included in the counterexamples for a plurality of counterexamples accumulated by the counterexample stacking unit 3. In the counter example, which process is executed is described in order. The counterexample analysis unit 4 counts the number of appearances of how many counterexamples a process appears, and generates statistical information of the number of times the process appears. Such statistical information can be used as auxiliary information when the user of the present apparatus analyzes a failure.

  Further, the counterexample analysis unit 4 obtains the process with the largest number of appearances from the statistical information and generates the most frequent appearance information. This most frequent appearance process is often the cause of problems.

  The output means 5 receives and outputs the statistical information and the most frequent appearance information from the counterexample analysis means 4.

  In the present embodiment, the counterexample accumulation unit 3 accumulates a plurality of counterexamples, and the counterexample analysis unit 4 analyzes a plurality of counterexamples to obtain processes appearing in many counterexamples and outputs the processing to the output unit 5. Therefore, it is possible to identify a process that is likely to cause a defect without manually analyzing one counterexample.

(Second Embodiment)
The counterexample analysis support apparatus according to the second embodiment of the present invention takes the same form as that of the first embodiment. As shown in FIG. 1, the input means 1, the model checking means 2, and the counterexample accumulation means. 3, counterexample analysis means 4, and output means 5. In the present embodiment, a case where the verification target system is a parallel system, that is, a system in which a plurality of processes move in parallel is targeted.

  The input means 1, the model checking means 2, and the counterexample collecting means 3 operate in the same manner as in the first invention.

  The counterexample analysis unit 4 generates statistical information regarding processing included in the counterexamples for a plurality of counterexamples accumulated by the counterexample stacking unit 3. In the counter example, which process has performed what process is described in order. The counterexample analysis means 4 counts the number of appearances of how many counterexamples each process appears. Further, the counterexample analysis unit 4 counts the number of appearances of how many counterexamples the process performed by each process appears. Such analysis is performed, and statistical information on the number of appearances of processes and the number of appearances of processes in a plurality of counterexamples is generated.

  Such statistical information can be used as auxiliary information when the user of the present apparatus analyzes a failure. Further, the counterexample analysis unit 4 obtains the most frequently appearing information by obtaining the most frequently appearing process and the most frequently appearing process from the statistical information. This most-occurring process and most-appearing process are often the cause of defects.

  The output means 5 receives and outputs the statistical information and the most frequent appearance information from the counterexample analysis means 4.

  In the present embodiment, the counterexample accumulation unit 3 accumulates a plurality of counterexamples, and the counterexample analysis unit 4 analyzes a plurality of counterexamples to obtain processes and processes that frequently appear in the counterexamples, and outputs them to the output unit 5. Since it is configured, it is possible to identify a process or process that is likely to cause a failure of the concurrent system without manually analyzing one counterexample.

(Third embodiment)
FIG. 2 is a configuration diagram of a counterexample analysis support apparatus according to the third embodiment of the present invention. The counterexample analysis support apparatus includes an input unit 1, a model checking unit 2, a counterexample accumulation unit 3, a counterexample analysis unit 4, an output unit 5, and a counterexample search unit 6.

  First, the input unit 1 performs input to the model checking unit 2 as in the first and second embodiments, and the model checking unit 2 and the counter example accumulation unit 3 are the same as in the first and second embodiments. To work.

  In addition to the same operations as those in the first or second embodiment, the counterexample analysis unit 4 includes a list of appearance processes for each counterexample (if the verification target system is a parallel system) and an appearance process for each counterexample. Generate a list.

  The counterexample search means 6 searches for counterexamples that match the search conditions specified by the user from the counterexamples accumulated in the counterexample stacking means 3.

  The user inputs search conditions for counterexamples using the input means 1 in order to view only a specific counterexample from a plurality of counterexamples (collected in counterexample stacking means 3). Search conditions include (when the verification target system is a parallel system) an appearing process (“Process A appears”), appearing process (“Process a appears”), and length of counterexample It may be the sum, product, or negation of those.

  The output unit 5 outputs the statistical information and the most frequently occurring information received from the counterexample analysis unit 4 and / or the counterexample searched by the counterexample search unit 6.

  In the present embodiment, in addition to the configurations of the first and second aspects of the invention, since it is configured to have counterexample search means, counterexamples that are considered to be helpful when a user identifies a defect (most frequent appearance process) And the shortest occurrence process appears and the shortest etc.) can be retrieved and output, which helps the user to more accurately identify the defect.

(Fourth embodiment)
FIG. 3 is a configuration diagram of a counterexample analysis support apparatus according to the fourth embodiment of the present invention. The counterexample analysis support apparatus includes an input unit 1, a model group storage unit 11, an overall control unit 21, a model checking unit 2, a counterexample accumulation unit 3, a counterexample analysis unit 4, a counterexample search unit 6, and an output. And means 5.

  The input means 1 is used for inputting a model and verification items. The model may be a plurality of models. Typically, the parts indicating the verification target system are exactly the same, but the parts indicating the environment are a plurality of different models. The verification item is one verification item that is verified in common to the plurality of models.

  A plurality of models input by the input unit 1 are stored in the model group storage unit 11.

  The overall control means 21 sequentially verifies the models stored in the model group storage means 11 one by one, and each time verification for one model is completed, the counterexamples are accumulated in the counterexample stacking means 3, and all models are verified. The whole is controlled so that the analysis by the counterexample analysis means 4 is performed after the data are accumulated.

  The overall control means 21 sequentially takes out one model from the model storage means 11 and inputs it to the model checking means 2. The verification items input by the input unit 1 are input to the model checking unit 2.

  The model checking means 2 verifies the given model and verification items, and generates a plurality of counterexamples (when the model does not satisfy the verification items).

  The counterexample accumulation unit 3 receives the output of the model checking unit 2 and accumulates and stores a plurality of counterexamples generated by the model checking unit 2. Since the verification by the model checking unit 2 is performed a plurality of times by the number of models by the overall control unit 21, the output of the model checking unit 2 is received for each verification and counter examples are accumulated.

  When the verification of all the models is completed, the overall control unit 21 activates the counter example analysis unit 4. The counter example analysis unit 4 operates in the same manner as in the first and second embodiments, and generates statistical information and most frequent appearance information.

  The output unit 5 operates in the same manner as in the first and second embodiments, and receives and outputs the statistical information and the most frequent appearance information from the counter example analysis unit 4.

  In the present embodiment, in addition to the configurations of the first and second aspects of the invention, since the overall control unit and the model group storage unit are configured, a plurality of verification target systems are the same and only the environment is different. It is possible to analyze a plurality of counterexamples when the model is verified, and to identify a process or process that is highly likely to cause a failure of the verification target system.

(Fifth embodiment)
FIG. 4 is a configuration diagram of a counterexample analysis support apparatus according to the fifth embodiment of the present invention. The counterexample analysis support apparatus includes an input unit 1, a model group storage unit 11, an overall control unit 21, a model checking unit 2, a counterexample accumulation unit 3, a counterexample analysis unit 4, a counterexample search unit 6, and a model. A search unit 7 and an output unit 5 are included.

  The input means 1 is first used to input a model and verification items, as in the fourth embodiment.

  The overall control unit 21 and the model checking unit 2 operate in the same manner as in the fourth embodiment.

  In addition to the same operation as in the fourth embodiment, the counter-example accumulation unit 3 records the correspondence between the model and the counter-example (which model is the counter-example generated for the counter-example).

  The counterexample analysis unit 4 operates in the same manner as in the third embodiment, and generates statistical information, most frequent appearance information, a list of appearance processes for each counterexample, and a list of appearance processes for each counterexample.

  The output means 5 receives and outputs the statistical information and the most frequent appearance information from the counterexample analysis means 4.

  The user inputs search conditions for counterexamples using the input means 1 in order to view only a specific counterexample from a plurality of counterexamples (collected in counterexample stacking means 3). Search conditions include (when the verification target system is a parallel system) an appearing process (“Process A appears”), appearing process (“Process a appears”), and length of counterexample Furthermore, their sum, product, or negation may be used.

  The counterexample search means 6 searches for counterexamples that match the search conditions specified by the user from the counterexamples accumulated in the counterexample stacking means 3.

  The model search means 7 receives the counterexample searched by the counterexample search means 6, refers to the correspondence between the model and counterexample recorded in the counterexample accumulation means 3, and searches the model group storage means 11 for a model corresponding to the counterexample.

  The output means 5 outputs the counterexample searched by the counterexample search means 6 and the model searched by the model search means 7.

  In this embodiment, in addition to the configuration of the fourth embodiment, since it is configured to have counterexample search means and model search means, counterexamples that are considered to be helpful when a user identifies a defect (most frequently) It is possible to search for and output a model corresponding to the counter-example and the appearance process and the most frequent appearance process and the shortest, and to help the user to identify the defect more accurately.

(Sixth embodiment)
FIG. 5 is a configuration diagram of the counterexample analysis support system 100 according to the embodiment of the present invention. The counterexample analysis support system includes a counterexample analysis support device 110 and a model checking device 120.

  The model checking device 120 has the same function as the model checking unit 2 in each of the above embodiments, and is a model checker such as SPIN as a specific example.

  The counterexample analysis support apparatus 110 has functions other than the model checking unit in each embodiment, and performs the same processing as the counterexample analysis support apparatus described in each embodiment.

  Next, the operation of the best mode for carrying out the present invention will be described using specific examples.

  The operation specifications and inspection items are input by the input unit 1, and the model checking unit 2 performs verification to generate a counterexample. Assume that the generated counter examples are three as shown in FIG.

  Here, it is assumed that each line of the counter example is described as process name.process name. These three counter examples are stored in counter example stacking means 3. The counterexample analysis means 4 analyzes the number of appearances of processes and the number of appearances of processes for three stored counterexamples.

  Here, the number of appearances of process procA is 3, the number of appearances of process procB is 2, the number of appearances of process procC is 1, and the number of appearances of process procD is 1. Similarly, the number of appearances of the process is also obtained. In this way, the counterexample analysis unit 4 generates statistical information including the number of appearances of processes and the number of appearances of processes. The statistical information in this case is shown in FIG. Further, the counterexample analysis unit 4 generates the most frequently occurring information indicating the process with the most appearances and the process with the most appearances from the statistical information. The most frequent appearance information in this case is shown in FIG.

  Each component of the counterexample analysis support apparatus in the embodiment of the present invention includes a CPU, a memory of a computer, a program that realizes a component loaded in the memory, a storage unit such as a hard disk that stores the program, and a network connection It is realized by any combination of hardware and software centering on the interface. It will be understood by those skilled in the art that there are various modifications to the implementation method and apparatus.

  The counterexample analysis support apparatus in the embodiment of the present invention includes counterexample accumulation means (3 in FIG. 1) and counterexample analysis means (4 in FIG. 1), and a model indicating a verification target system (and its environment) , Collect all counterexamples generated by the model checker for one verification item, and operate to check what processes appear in many of the integrated counterexamples and processing performed by the verification target system and output the results To do. Processes and processes that appear in many counterexamples are often the cause of problems, so by adopting a configuration that includes counterexample accumulation means and counterexample analysis means and outputting information on processes that appear in many counterexamples, Aim can be achieved.

  The first effect of the present embodiment is that the apparatus can effectively support the developer in finding out the cause of the malfunction from the counterexample in system verification. The reason is that by analyzing a plurality of counterexamples and obtaining processes and processes that appear in many counterexamples, a process or process that is likely to cause a defect is output.

  The second effect is that, even when the developer cannot obtain information on typical patterns of defects, the system can provide information that is considered to be effective for counterexample analysis instead. The reason for this is that it analyzes the multiple counterexamples generated by the model checker without using information on the typical pattern of the defect, and seeks processes and processes that appear in many counterexamples, causing the problem. This is to output a process or process with a high possibility.

  Although the embodiments have been described above, various modifications and changes can be made to these embodiments and specific examples without departing from the broad scope and scope of the present invention defined in the claims.

  According to the present invention, the present invention can be applied to an application such as a failure analysis support tool in a tool for verifying the validity of design in software development. Further, the present invention can be applied to an application such as a failure analysis support tool in a tool for verifying design validity in hardware development.

DESCRIPTION OF SYMBOLS 1 Input means 2 Model inspection means 3 Counterexample accumulation means 4 Counterexample analysis means 5 Output means 6 Counterexample search means 7 Model search means 11 Model group storage means 21 Overall control means

Claims (21)

Whether the model satisfies the verification item by referring to the operation specification of the system having a plurality of processes or the model indicating the system operation specification and the external environment, and the verification item indicating the property that the model should satisfy Model checking means for checking whether or not the model does not satisfy the verification item, and generates one or more counterexamples;
A plurality of counterexamples generated by the model checking means for one model and one verification item are collected and stored;
A counterexample analysis means for analyzing a plurality of accumulated counterexamples and obtaining a process appearing in the most counterexamples,
And an output means for outputting information for specifying the processing obtained by the counterexample analysis means. The system is composed of a plurality of processes operating in parallel,
When the process is a parallel system that executes a plurality of processes, the counterexample analysis means further determines a process that appears in the most counterexamples,
2. The counterexample analysis support apparatus according to claim 1, wherein the output means outputs information for specifying a process. The counterexample analysis means further calculates the number of counterexamples in which each process appears and the number of counterexamples in which each process appears,
The counter example analysis support apparatus according to claim 1, wherein the output unit outputs the number obtained by the counter example analysis unit. A counter example search means for searching a counter example that matches an input condition from the counter examples stored in the counter example accumulation means,
4. The counter example analysis support apparatus according to claim 1, wherein the output unit outputs information searched by the counter example search unit. 5. A model group storage means for storing a plurality of input models;
5. The counterexample analysis support apparatus according to claim 1, wherein the model checking unit checks whether or not the plurality of models satisfy the same verification item one by one in order. Counterexample search means for searching counterexamples that match the input conditions from counterexamples stored in the counterexample accumulation means;
Model search means for searching the model group storage means for a model corresponding to the counter example searched by the counter example search means,
6. The counter example analysis support apparatus according to claim 5, wherein the output unit outputs information for specifying a counter example and a model searched by the counter example search unit and the model search unit. A model checking device that generates a counterexample by checking whether a system operation specification having a plurality of processes or a model indicating a system operation specification and an external environment satisfies a verification item indicating a property to be satisfied. And a counterexample analysis support device that analyzes and outputs the counterexample, and a counterexample analysis support system comprising:
The model checking device
A model that checks whether or not the model satisfies the verification item with reference to the model and the verification item, and generates one or more counterexamples if the model does not satisfy the verification item Having inspection means,
The counterexample analysis support device includes:
A counter example accumulation unit that accumulates and stores a plurality of counter examples generated by the model checking unit for one model and one verification item;
A counterexample analysis means for analyzing a plurality of accumulated counterexamples and obtaining a process appearing in the most counterexamples,
An anti-example analysis support system comprising: output means for outputting information for specifying the processing obtained by the counter-example analysis means. The system is composed of a plurality of processes operating in parallel,
When the process is a parallel system that executes a plurality of processes, the counterexample analysis means further determines a process that appears in the most counterexamples,
8. The counterexample analysis support system according to claim 7, wherein the output means outputs information for specifying a process. The counterexample analysis means further calculates the number of counterexamples in which each process appears and the number of counterexamples in which each process appears,
9. The counterexample analysis support system according to claim 7, wherein the output means outputs the number obtained by the counterexample analysis means. The counter example search means further searches for counter examples that match the input conditions from the counter examples stored in the counter example accumulation means,
10. The counter example analysis support system according to claim 7, wherein the output unit outputs information searched by the counter example search unit. A model group storage means for storing a plurality of input models;
11. The counterexample analysis support system according to claim 7, wherein the model checking unit checks whether or not the plurality of models satisfy the same verification item one by one in order. Counterexample search means for searching counterexamples that match the input conditions from counterexamples stored in the counterexample accumulation means;
Model search means for searching the model group storage means for a model corresponding to the counter example searched by the counter example search means,
12. The counter example analysis support system according to claim 11, wherein the output unit outputs information for identifying the counter example and model searched by the counter example search unit and the model search unit. Whether the model satisfies the verification item by referring to the operation specification of the system having a plurality of processes or the model indicating the system operation specification and the external environment, and the verification item indicating the property that the model should satisfy A model checking step that checks whether or not the model does not satisfy the verification item and generates one or more counterexamples;
A plurality of counterexamples generated in the model checking step for one model and one verification item are collected and stored;
A counterexample analysis step for analyzing a plurality of accumulated counterexamples and obtaining a process appearing in the most counterexamples;
A counterexample analysis support method for a counterexample analysis support apparatus, comprising: an output step of outputting information for specifying the processing obtained in the counterexample analysis step. The system is composed of a plurality of processes operating in parallel,
When the process is a parallel system that executes a plurality of processes, the counterexample analysis step determines a process that appears in the most counterexamples,
14. The counterexample analysis support method of the counterexample analysis support apparatus according to claim 13, wherein the output step outputs information for specifying a process. The counterexample analysis step further determines the number of counterexamples in which each process appears and the number of counterexamples in which each process appears,
15. The counterexample analysis support method for a counterexample analysis support apparatus according to claim 13 or 14, wherein the output step outputs the number obtained in the counterexample analysis step. A counterexample search step for searching counterexamples that match the input conditions from counterexamples stored in the counterexample accumulation step;
The counter example analysis support method of the counter example analysis support apparatus according to any one of claims 13 to 15, wherein the output step outputs the information searched in the counter example search step. A model group storing step for storing a plurality of input models;
The counter example of the counterexample analysis support apparatus according to any one of claims 13 to 16, wherein the model checking step checks whether or not the plurality of models satisfy the same verification items one by one in order. Analysis support method. A counterexample search step for searching counterexamples that match the input conditions from counterexamples stored in the counterexample accumulation step;
A model search step for searching from a plurality of models storing models corresponding to the counterexamples searched in the counterexample search step,
18. The counterexample analysis support method of the counterexample analysis support apparatus according to claim 17, wherein the output step outputs information specifying a counterexample and a model searched by the counterexample search step and the model search step. With reference to a system operation specification or a system operation specification having a plurality of processes inputted by a model checking device, a model indicating the external environment, and a verification item indicating a property to be satisfied by the model, the model is A model checking step that checks whether a verification item is satisfied and generates one or more counterexamples if the model does not satisfy the verification item;
A counterexample accumulation step of collecting and storing a plurality of counterexamples generated in the model checking step for one model and one verification item by the counterexample analysis support device;
A counterexample analysis step for analyzing a plurality of accumulated counterexamples and obtaining a process appearing in the most counterexamples;
A counterexample analysis support method for a counterexample analysis support system, comprising: an output step of outputting information specifying the processing obtained in the counterexample analysis step. Whether the model satisfies the verification item by referring to the operation specification of the system having a plurality of processes or the model indicating the system operation specification and the external environment, and the verification item indicating the property that the model should satisfy A model checking process that checks whether or not the model does not satisfy the verification item and generates one or more counterexamples;
A plurality of counterexamples generated by the model checking process for one model and one verification item are accumulated and stored,
Analyzing a plurality of counterexamples collected, and counterexample analysis processing for obtaining processing that appears in the most counterexamples,
A program for causing a computer to execute an output process for outputting information for specifying a process obtained in the counterexample analysis process. With reference to a system operation specification or a system operation specification having a plurality of processes inputted by a model checking device, a model indicating the external environment, and a verification item indicating a property to be satisfied by the model, the model is A model checking process that checks whether a verification item is satisfied and generates one or more counterexamples if the model does not satisfy the verification item;
By counterexample analysis support apparatus, a plurality of counterexamples generated in the model checking process for one model and one verification item are collected and stored,
Analyzing a plurality of counterexamples collected, and counterexample analysis processing for obtaining processing that appears in the most counterexamples,
A program for causing a computer to execute an output process for outputting information for specifying a process obtained in the counterexample analysis process.

Images