JP2010262365A - Device for measurement of model inspection validity - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To predict the complexity of a relationship between parallel processes in advance, and to provide a policy for determining the validity/invalidity of model inspection execution in advance. <P>SOLUTION: A model inspection validity measuring device includes: an inter-process communication information analysis unit for generating inter-process communication information based on the state transition table data of each process; an inter-process communication information input/output unit for urging a user to select the inter-process communication information corresponding to processes operating in parallel, and for synthesizing an external event with the selected inter-process communication information, and for generating post-synthesis inter-process communication information, and for calculating the number of event states of each event about the inter-process communication information and the post-synthesis inter-process communication information; and a complexity calculation unit for calculating complexity based on the number of frames in the state transition table data and the number of event states of the inter-process communication information and the post-synthesis inter-process communication information. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a model checking effectiveness measuring device, and more particularly to a model checking effectiveness measuring device which is a device for extracting the relationship of inter-process communication and measuring the effectiveness of model checking based on this.

  Today, an embedded device (computer (microcontroller)) is an electronic device that has a built-in computer and performs processing specialized for a specific application, such as a mobile phone, flat-screen TV, DVD / HDD recorder, car navigation system. , Digital cameras, etc.) are spreading and developing. In these embedded devices, the need for incorporating more complex control and application functions into the devices is increasing due to the technological innovation of hardware. In an embedded device, a plurality of devices need to operate in a coordinated manner, and it is necessary to check whether there is a contradiction between a state between devices and a control specification that is a transition sequence thereof, and a system needs to be constructed.

  In a control specification described in the state transition model, there is a model checking method as a method for checking the correctness of the described specification. According to the model checking method, it is possible to detect deadlocks and check the reach / unreach state under specific conditions for all possible execution sequences in the state transition model.

  However, the cost of conducting such model checking cannot be overlooked. Since it is necessary to create a model for verification other than actual development, the cost of model creation increases. Even if a model can be created, if the specifications are complex or large, the state search tree may become large and the actual search may not be possible, resulting in no test results.

  For this reason, instead of performing model checking on all systems, it is necessary to estimate in advance whether the target range model is a problem area suitable for model checking, and to predict the cost effectiveness of the model. There is sex.

  In general, when model checking is performed, a state to be checked and a state transition model based on discrete events corresponding to the state to be checked are described in advance as a state transition table. The size and complexity of a certain model can be examined from the number of cells in the described state transition table.

  FIG. 23 shows an example of a state transition table of a certain state transition model. In this state transition model, there are four states A1, A2, A3, A4 and five events ev1, ev2, ev3, ev4, and ev5. The number of cells that this state transition table has is the number of states (4) × the number of events (5) = 20. This cell number may be used as an index indicating the size and complexity of the model.

  However, such complexity prediction based on the number of cells in the state transition table depends only on the number of states and events in one process, and the relationship between events in a plurality of processes cannot be considered. The complexity of the relationship between multiple processes must be examined by finding the relationship of events between multiple processes.

  An example in which the complexity prediction cannot be performed appropriately with the number of cells in the state transition table is shown below. Here, a protocol that simply passes data (referred to as α protocol) is compared with a protocol that waits for a return value for the passed data (referred to as β protocol), and its complexity is based on the number of cells. Whether it can be evaluated.

  FIG. 24 is a sequence diagram of the α protocol. The α protocol includes A process and B process which are parallel processes. First, the A process and the B process are in the initial state. Next, when the time lapse time as an event occurs, the state of the A process becomes the Data1 transmission state. The A process that has entered the Data 1 transmission state executes Data 1 transmission (transmits Data 1 to the B process) as an action.

  The B process that has received Data1 from the A process changes its state from the initial state to the Data1 receiving state.

  Next, when a time lapse time which is an event occurs in the Data1 transmission state, the A process transitions to the Data2 transmission state. The A process that is in the Data2 transmission state executes Data2 transmission (transmits Data2 to the B process) as an action.

  The B process that has received Data2 from the A process changes its state from the Data1 reception state to the Data2 reception state.

  FIG. 25 shows a state transition table of the A process. As shown in the figure, the number of cells in the state transition table of the A process is “3”. Further, FIG. 26 shows a state transition table of the B process. As shown in the figure, the number of cells in the state transition table of the B process is “6”. In other words, the number of cells, which is an index indicating the complexity of the protocol with no asynchronous communication response shown in FIG. 24, is “3” + “6” = 9.

  As a comparison of the α protocol in FIG. 24, FIG. 27 shows a sequence diagram of the β protocol, which is a communication protocol waiting for an asynchronous communication response.

  The β protocol includes an A ′ process and a B ′ process that are parallel processes. First, the A ′ process and the B ′ process are in the initial state. Next, when a time lapse time as an event occurs, the state of the A ′ process transitions to the ready transmission state. The A ′ process that is in the ready transmission state executes ready transmission (transmits a ready message to the B process) as an action.

  The B ′ process that has received the ready message from the A ′ process changes its state from the initial state to the ready reception state. Next, the B ′ process in the ready reception state executes ok transmission (sends an ok message to the A ′ process) as an action.

  The A ′ process that has received the ok message from the B ′ process changes its state from the ready transmission state to the ok reception state.

  FIG. 28 shows a state transition table of the A ′ process. As shown in the figure, the number of cells in the state transition table of the A ′ process is “6”. FIG. 29 shows a state transition table of the B ′ process. As shown in the figure, the number of cells in the state transition table of the B ′ process is “2”. That is, the number of cells, which is an index indicating the complexity of the β protocol, which is a communication protocol waiting for an asynchronous communication response shown in FIG. 27, is “6” + “2” = 8.

  Comparing the above two communication protocols, α protocol and β protocol, α protocol is a simple protocol that only passes data, whereas β protocol waits for a return value for the passed data. It is a more complicated protocol than the α protocol. However, there is no big difference between “9” and “8” in the number of squares in both state transition tables. Thus, the characteristics in the communication protocol cannot be read only from the number of cells in the state transition table.

  In general, there is no conventional technology that predicts the effectiveness of model checking in advance, but similar technology is used for the conversion from state transition table to interprocess communication information, which is a technology used to predict the effectiveness. Exists (Patent Document 1). This prior art is a method for automatically creating a data transmission control sequence diagram based on the communication protocol specification described on the basis of the state transition table, and based on the state transition table of the own process. A data transmission control sequence diagram is automatically created when the user sequentially gives an event from the partner process regarding the data communication relationship between the partner process and the partner process.

Japanese Unexamined Patent Publication No. 3-91855

  As described above, according to the conventional technique, it is impossible to estimate in advance whether or not the model of the target range is a problem area suitable for model checking and to predict and implement the cost effectiveness.

  The object of the present invention is to make it possible to predict the complexity of the relationship between parallel processes in advance, and to determine in advance whether or not to perform model checking when the checking condition relates to the state of the parallel process. The objective is to provide guidelines (indicators, judgment materials).

  In this patent, inter-process communication information is calculated from the state transition table, but is generated within a range that can be automatically calculated from the state transition table. The range that can be automatically calculated is that data is sent to the partner process for the event in the own process, the data is received by the partner process, and the data is sent from the partner process to the own process. This is a continuous range.

  As means for solving the above problems, the present invention has the following features.

  The present invention includes a first analysis unit that generates inter-process communication information based on state transition table data of each process that constitutes a model whose complexity is to be measured, and the first analysis unit. Inter-process communication information that displays or presents inter-process communication information, prompts the user to select inter-process communication information corresponding to processes operating in parallel, and combines an external event with the selected inter-process communication information. Second analysis means for generating post-combination inter-process communication information and calculating the number of event states for each event for the inter-process communication information and post-combination inter-process communication information; and the number of events and the number of states in the state transition table data The complexity is calculated based on the number of cells that is the product of the above and the number of event states of the inter-process communication information and the post-synthesis inter-process communication information. It is characterized by a means.

  According to the present invention, it is possible to predict the complexity of the relationship between parallel processes in advance, and if the checking condition relates to the state of the parallel process, whether or not model checking should be performed in advance is determined in advance. It is possible to provide guidelines (indicators, judgment materials) for judgment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[1. Overview]
The present invention is based on the premise that specifications to be input for model checking are input to the model checking effectiveness measuring apparatus using a state transition table. The model checking effectiveness measurement device extracts information related to communication between processes (called inter-process communication information) from the input state transition table, and performs model checking on the complexity of communication between the extracted processes. By calculating from this point of view, the complexity of the model to be inspected is predicted and used as a guideline for model inspection.

  As a method for realizing this, the present invention uses the following two techniques.

<Technology 1> Conversion rules from state transition table to inter-process communication information Describe the relationship between processes as inter-process communication information based on the state transition table of each process that makes up the model that is the target of effectiveness evaluation To do. The inter-process communication information is, for example, data described in the following format: “Example”: (A: ev1, B: gev1, C: gev2, A, B: gev3)
<Technology 2> Complexity calculation of inter-process communication information From the above-mentioned inter-process communication information, the complexity is calculated based on parallelism and responsiveness between processes.

[1. Configuration of Model Checking Effectiveness Measurement Device]
The present embodiment is proposed as a model checking effectiveness measuring device (hereinafter abbreviated as “measuring device”). The model checking effectiveness measuring device is a device that outputs complexity, which is a guideline for estimating in advance whether the model in the target range is a problem area suitable for model checking using the above-described techniques 1 and 2. .

  The measurement apparatus according to the present embodiment is an apparatus realized by an information processing apparatus such as a computer or a workstation. The information processing apparatus includes an arithmetic processing unit (CPU), a main memory (RAM), a read-only memory (ROM), an input / output device (I / O), and, if necessary, an external storage device such as a hard disk device. It is a device.

  FIG. 1 is a functional block diagram showing a configuration example of a measuring device. The measurement apparatus 1 includes an inter-process communication information analysis unit 10 that receives as input the state transition table data 2 of each process that constitutes a model whose complexity is to be measured, and an inter-process communication information analysis unit 10 connected to the inter-process communication information analysis unit 10. A communication information storage unit 20, an interprocess communication information input / output unit 30 connected to the interprocess communication information storage unit 20, a parallel operable input unit 40 connected to the interprocess communication information input / output unit 30, and an interprocess It has a complexity calculation unit 50 connected to the communication information analysis unit 10 and the inter-process communication information storage unit 20, and a complexity display unit 60 connected to the complexity calculation unit 50.

  Here, “connected” is not limited to a physically coupled state, but includes a state in which data can be exchanged. Moreover, each said component respond | corresponds to the function implement | achieved by the program executed by CPU and CPU, and the measuring device 1 does not need to actually be equipped with the hardware corresponding to each component.

  Hereinafter, each component of the measuring device 1 will be described.

[1.1. Interprocess communication information analysis section]
The interprocess communication information analysis unit 10 corresponding to the first analysis means of the present invention analyzes the state transition table data 2 of each process and generates interprocess communication information. The “interprocess communication information” is data for the measurement device 1 to calculate the complexity. Details and specific examples of the interprocess communication information will be described later.

  The inter-process communication information analysis unit 10 passes the created inter-process communication information to the inter-process communication information storage unit 2 for storage.

  Further, the inter-process communication information analysis unit 10 calculates the number of cells of the state transition table from the state transition table data 2 and stores it in the inter-process communication information storage unit 20.

[1.2. Interprocess communication information storage]
The inter-process communication information storage unit 20 has a function of storing the inter-process communication information generated by the inter-process communication information analysis unit. Further, it has a function of storing inter-process communication information generated by an inter-process communication information input / output unit 30 described later and composed of external events.

[1.3. Interprocess communication information input / output section]
The inter-process communication information input / output unit 30 corresponding to the second analysis unit of the present invention displays or presents the inter-process communication information stored in the inter-process communication information storage unit 20 in an appropriate format such as a character or graphic format. It has the function to do. The inter-process communication information input / output unit 30 displays the inter-process communication information in text or graphic format, and handles the processes operating in parallel among the inter-process communication information to the user (user of the measuring apparatus 1, operator, etc.) Prompt to select interprocess communication information. The user designates interprocess communication information corresponding to processes operating in parallel from the displayed or presented interprocess communication information. This designation may be performed by the user using an input device such as a keyboard or a pointing device.

  When the interprocess communication information that operates in parallel is designated by the user, the interprocess communication information input / output unit 30, based on those relationships, interprocess communication information (hereinafter referred to as “interprocess communication information”) that combines external events with the interprocess communication information. Called “inter-process communication information after synthesis”).

  The inter-process communication information input / output unit 30 calculates the number of event states for each event obtained as a result of combining external events in the inter-process communication information based on the post-combination inter-process communication information.

  The inter-process communication information input / output unit 30 registers the sum of post-combination inter-process communication information and the number of event states for each inter-process communication information in the inter-process communication information storage unit 20.

[1.4. Input unit capable of parallel operation]
The parallel operable input unit 40 has a function of causing the user to specify interprocess communication information corresponding to a process operating in parallel among the interprocess communication information displayed or presented by the interprocess communication information input / output unit 30. This designation may be performed by the user using an input device such as a keyboard or a pointing device.

[1.5. Complexity calculator]
The complexity calculation unit 50 corresponding to the calculation means of the present invention includes the number of cells in the state transition table registered in the inter-process communication information storage unit 20 and the events of the inter-process communication information and / or the post-synthesis inter-process communication information. It has a function to calculate complexity from the number of states.

  The “complexity” is a value obtained by dividing the sum of the number of event states by the number of cells in the state transition table.

[1.6. Complexity display]
The complexity display unit 60 has a function of displaying or presenting a value calculated by the complexity calculation unit 50 or an index of model checking effectiveness based on this value. Any form, mode, or method of display or presentation may be used. For example, it is possible to display and print the numerical value itself, or display or print a message (for example, conformity, nonconformity, impossible) according to the number.

[2. Example of operation]
Next, an operation example of the measurement apparatus 1 will be described.

  Hereinafter, in order to describe an operation example of the measurement apparatus 1, a system that is a measurement target of complexity is used. This system consists of three processes: A process, B process, and C process. FIG. 2 shows a state transition diagram of the A process, FIG. 3 shows a state transition diagram of the B process, and FIG. 4 shows a state transition diagram of the C process. In FIG. 2 to FIG. 4, “Event name / Process name: Global event name” is displayed in the form of “event name / process name”, which is sent to the process indicated by the process name when the event indicated by the event name occurs. It means that a global event occurs.

  First, a user prepares state transition table data (referred to as state transition table data) of each process constituting the system for a system that operates in a parallel process, which is a complexity measurement target. The state transition table data 2 is prepared in advance by the user, and at this time, data shared by parallel processes or communication events are defined as global events (gev) on the state transition table. In other words, a global event is an event that refers to the data of another process by some method such as shared memory or message communication. On the other hand, a local event is independent of other processes and has a user input or error event. In the state transition table data 2, the event is generated as “ev”.

  In the state transition table data 2, when issuing a global event to another process, the issue of the global event is clearly indicated in the action column of the corresponding cell. At this time, specify the target process of the issue destination. In the present embodiment, issuance of a global event is described in the form of “issue destination process name: global event name” in the action column of the target cell. For example, when a global event “gev1” is issued to the B process, “B: gev1” is described in the action field of the corresponding cell.

  FIGS. 5 to 7 show examples of the state transition table data 2 prepared for input to the measurement apparatus 1. FIG. 5 is a diagram showing the state transition table data for the above-mentioned A process, FIG. 6 is a diagram showing the state transition table data for the above-mentioned B process, and FIG. 7 is the above-mentioned C process. It is the figure which showed the state transition table data about. Each state transition table data 2 has a column corresponding to the global event.

  In FIG. 7, the description “A, B: gev2” means that a global event “gev2” having the A process and the B process as an issue destination is issued.

  (2) The state transition table data 2 is input to the measuring device 1 by the user. The input state transition table data 2 is received by the inter-process communication information analysis unit 10. The inter-process communication information analysis unit 10 processes the received state transition table data 2. FIG. 8 is a flowchart illustrating an example of processing contents in which the inter-process communication information analysis unit 10 processes the state transition table data 2, and FIG. 9 is a flowchart following the flowchart of FIG. Hereinafter, the operation (processing) of the inter-process communication information analysis unit 10 will be described with reference to FIGS. 8 and 9.

  First, state transition table data 2 is prepared for each process constituting the system whose complexity is to be measured as described above, and this state transition table data 2 is input to the inter-process communication information analysis unit 10 (S10). . The inter-process communication information analysis unit 10 that has received the state transition table data 2 reads the contents of one line of the state transition table data 2 for one process (S20).

  The inter-process communication information analysis unit 10 identifies one square among the squares included in the line read in S20, and determines whether a global event (symbol: gev) is included in the action column of the square. (S30).

  If it is determined in step S30 that the global event (symbol: gev) is not included, the inter-process communication information analysis unit 10 determines whether or not the determination in S30 has been performed for all the cells in the line read in immediately preceding S20. Determine (S50). On the other hand, if it is determined in step S30 that a global event (symbol: gev) is included, the inter-process communication information analysis unit 10 extracts an event and an action corresponding to the column of the cell as inter-process communication information. To do.

  For example, the following inter-process communication information (hereinafter referred to as process communication information A) is generated from the state transition table data 2 of the A process shown in FIG.

(A: ev1, B: gev1)
Further, the following inter-process communication information (hereinafter referred to as process communication information B) is generated from the state transition table data 2 of the B process shown in FIG.

(B: gev1, C: gev2)
Further, the following inter-process communication information (hereinafter referred to as process communication information C) is generated from the state transition table data 2 of the C process shown in FIG.

(C: gev2, A, B: gev3)
Returning to FIG. 8, the description of the operation example (processing) of the inter-process communication information analysis unit 10 will be continued.

  When the control moves to step S50, the inter-process communication information analysis unit 10 determines whether or not the determination of S30 has been made for all the cells in the current processing target row (S50). When it is determined that the determination of S30 is not performed for all the cells in the target row (S50, No), the inter-process communication information analysis unit 10 returns to S30, and executes the processes of S30 and S40 for the unprocessed cells. On the other hand, when it is determined in S50 that the determination of S30 has been performed for all the squares (S50, Yes), the inter-process communication information analysis unit 10 performs S20 to S50 for all the rows of the current state transition table data 2 to be processed. It is determined whether or not the above process has been performed (S60). If it is determined that the processing from S20 to S50 is not performed for all the rows of the target state transition table data 2 (S60, No), the inter-process communication information analysis unit 10 returns to S20, and the unprocessed rows from S30. The process of S50 is executed. On the other hand, if it is determined in S60 that the processing from SS30 to S50 has been performed for all the rows (S60, Yes), as the number of cells in the state transition table data 2, the global event in the state transition table data 2 and other than global events The number of extracted events is stored as the number of events, and the product of the number of events and the number of states is stored and held as a number of squares (S70).

  Next, the inter-process communication information analysis unit 10 determines whether or not the processing from S20 to S70 has been executed for all the state transition table data 2 input in S10 (S80). When it is determined that the processing from S20 to S70 is not executed for all the state transition table data 2 (S80, No), the inter-process communication information analysis unit 10 returns to S10, and the unprocessed state transition table Data 2 is input (S10). On the other hand, when it is determined that the processing from S20 to S70 has been executed for all the state transition table data 2 for the system whose complexity is to be measured (S80, Yes), the inter-process communication information analysis unit 10 performs S70. The total number of cells for each state transition table data 2 stored and held is calculated, and the calculated value is stored in the inter-process communication information storage unit 20 as the number of state transition table cells of the measurement target system (see FIG. 9, S90).

  Next, the interprocess communication information analysis unit 10 reads the interprocess communication information extracted in S40 (S100). The inter-process communication information analysis unit 10 determines whether there is inter-process communication information in which the read inter-process communication information starts with a normal event (local event) (S110). If it is determined that there is no inter-process communication information whose first event is a normal event (S110, No), the process proceeds to S160 described later. On the other hand, when it is determined that there is inter-process communication information whose head is a normal event (S110, Yes), the inter-process communication information analysis unit 10 reads inter-process communication information whose head is a normal event (S120). Next, the inter-process communication information analysis unit 10 searches the inter-process communication information of the transmission destination process for another inter-process communication information whose head is the same as the global event of the transmission source (S130). In other words, the inter-process communication information having the same global event as the input event as the output event of the inter-process communication information read in S120 is searched.

  The inter-process communication information analysis unit 10 determines whether there is such inter-process communication information as a result of searching in S130 (S140). If it is determined that there is no such inter-process communication information (S140, No), the process returns to S110, and the processes from S110 to S140 are performed for other inter-process communication information. On the other hand, if it is determined that there is such inter-process communication information (S140, Yes), the inter-process communication information read in the latest S120 and the inter-process communication information searched in the latest S130 are combined. Then, new inter-process communication information (referred to as post-combination process communication information) is generated (S150). “Combining” means that when the output event in one inter-process communication information is the same as the input event in the other inter-process communication information, the output event and the input event are combined with each other as a sequential event. This refers to generating post-combination interprocess communication information.

  Taking the above-mentioned A process, B process, and C process as an example, the inter-process communication information of the A process is (A: ev1, B: gev1), and the inter-process communication information of the B process is (B: gev1, C : Gev2). The output event of the former inter-process communication information is gev1, and the latter input event of the inter-process communication information is gev1. Therefore, synthesized inter-process communication information (A: ev1, B: gev1, C: gev2) is generated from the inter-process communication information.

  Further, between the synthesized interprocess communication information (A: ev1, B: gev1, C: gev2) and interprocess communication information (C: gev2, A, B: gev3) of the C process, the former Since the output event and the latter input event are the same, these inter-process communication information is further combined, and the post-synthesis inter-process communication information (A: ev1, B: gev1, C: gev2, A, B: gev3) is obtained. It will be finally obtained.

  Returning to FIG. 9, the description of the flowchart will be continued. After S150, the inter-process communication information analysis unit 10 determines whether or not the processing from S110 to S150 has been performed for all the inter-process communication information (S160). If it is determined that the processing from S110 to S150 is not performed for all the inter-process communication information (S160, No), the inter-process communication information analysis unit 10 returns to S110 and continues synthesizing the inter-process communication information. On the other hand, if it is determined that the processing from S110 to S150 has been performed for all the inter-process communication information (S160, Yes), the inter-process communication information analysis unit 10 uses the post-combination inter-process communication information generated in S150 as the inter-process communication information. The registration is performed in the storage unit 20, and the process ends (S170).

  An operation example (processing) of the measurement apparatus 1 after S170 will be described with reference to FIGS. FIG. 10 is a flowchart showing an operation example (processing) of the measuring apparatus 1 after S170, and FIG. 11 is a flowchart following FIG.

  After S170, the measuring device 1, more specifically, the interprocess communication information input / output unit 30, uses the interprocess communication information (including post-combination interprocess communication information) stored in the interprocess communication information storage unit 20 as characters or It is displayed or presented in an appropriate format such as a diagram format, and prompts the user to specify the interprocess communication information in which the interprocess communication information operates simultaneously (operates in parallel) (S210). The user designates inter-process communication information corresponding to processes operating in parallel using the parallel operation enable input unit 40. The user designates inter-process communications that can be started simultaneously in different processes as inter-process communication information that may be executed in parallel. The point of extraction is performed by referring to the start event start state of the inter-process communication information and determining whether or not it can occur simultaneously in the system.

  In the case of asynchronous communication, problems such as message crossing are likely to occur by operating in parallel in addition to responsiveness. By identifying the inter-process communication information that can be executed simultaneously, it is possible to identify all the global events that each process can generate during communication.

  An example of interprocess communication information corresponding to processes operating in parallel will be given. 12A and 12B are state transition diagrams of the X process and the Y process. The post-combination inter-process communication information of these X process and Y process is (X: time, Y: ready; X: OK) and (Y: time, X: ready; Y: OK). Since these inter-process communication information is activated by the time event from the initial state in both the X process and the Y process, it can be said that they can be executed simultaneously.

  Returning to FIG. 10, the description of the operation of the measuring device 1 is continued.

  Next, the measuring device 1, more specifically, the complexity calculator 50 generates inter-process communication information in which an external event is inserted in the inter-process communication information that is simultaneously operated designated by the user (S230). More specifically, the complexity calculation unit 50 sends an external event to the interprocess communication information in consideration of the possibility that another global event will arrive while sending a global event between the interprocess communication information that can be executed in parallel. Insert (S230).

  Using the X process and Y process shown in FIG. 12 as an example, an external event is inserted into the interprocess communication information performed in S230, and interprocess communication information is generated in consideration of the possibility that another global event will arrive. Will be explained.

  In the X process of FIG. 12A, there is a possibility that the X process also receives the ready transmitted from the Y process after the X process transmits ready and before the Y process receives ready. The Y process takes into account that the X process enters a ready transmission state or a ready reception state.

  Further, there is a possibility that the Y process also receives ok after the ok is transmitted from the Y process and before the X process receives ok. Therefore, the X process takes into account that the Y process enters the ready reception state or the ok reception state.

In the inter-process communication information (X: time, Y: ready; X: OK) of the X process, the transmission information to the X process is inserted when the Y process is transmitted, and the transmission information of the Y process is inserted when the X process is transmitted. . In this case,
(X: time, Y: ready (X: ready); X: ok (Y: ok))
Inter-process communication information is generated.

On the other hand, in the inter-process communication information (Y: time, X: ready; Y: OK) of the Y process, transmission information to the Y process is inserted when the A process is transmitted, and transmission information of the X process is transmitted when the Y process is transmitted. insert. In this case,
(Y: time, X: ready (Y: ready); Y: ok (X: ok))
Inter-process communication information is generated. FIG. 13 shows a state transition diagram of the X and Y processes when considering the possibility of parallel operation.

  Returning to FIG. 10, the description of the operation example of the measuring device 1 is continued.

  Next, the complexity calculation unit 50 determines the number of event states of each inter-process communication information, and registers the determined number of event states in the inter-process communication information storage unit 20.

  The “number of event states” is the sum of the number of transmission events and the number of external events. Specifically, the complexity calculation unit 50 extracts interprocess communication information in which an external event may occur during transmission due to simultaneous activation. In the inter-process communication information, what is shown in parentheses () for a transmission event is an external event that may occur during transmission.

  An example will be described. FIG. 14 shows the interprocess communication information of the X process and the Y process described above, and the interprocess communication information in which an external event is inserted. FIG. 14A shows inter-process communication information with an external event inserted for the X process, and FIG. 14B shows inter-process communication information with an external event inserted for the Y process. For any inter-process communication information, the number of event states is 2 states + 2 states = 4 states, and the number of event states is 4.

  Subsequent to step S240, the complexity calculation unit 50 performs processing for considering responsiveness in the inter-process communication information. “Responsiveness” means that, in inter-process communication information, for example, after sending “ready”, a message responding to a message sent by one side, such as waiting for ok reception, is returned. Responsiveness depends on how many states until waiting for a response are divided.

  Next, the processes after S240 will be described with reference to FIG.

  First, the complexity calculation unit 50 reads the interprocess communication information from the interprocess communication information storage unit 20. The read interprocess communication information is interprocess communication information in which an external event is inserted.

  Next, the complexity calculation unit 50 searches the read interprocess communication information for a response event to the self process excluding the head event (S260). The complexity calculator 50 determines whether there is a response event as a result of the search (S270). When it is determined that there is no response event (S270, No), the complexity calculator 50 shifts control to S300 described later. On the other hand, when it is determined that there is a response event (S270, Yes), the complexity calculation unit 50 uses the product of the previous event state number and the response event state number as the final event state number of the response event to perform inter-process communication. The information is registered in the information storage unit 20 (S280). The number of response event states is the value obtained by multiplying the number of event states before the response event (referred to as the number of previous event states) by the number of response event states. Call). FIG. 15 shows the number of response event states in the interprocess communication information of the X process and the Y process described above.

  Next, the complexity calculation unit 50 obtains a value obtained by dividing the total number of event states for the interprocess communication information by the number of cells of the state transition table data corresponding to the interprocess communication information, and calculates the value between the interprocess processes. The communication information complexity is registered in the inter-process communication information storage unit 20 (S290). The total event state number is the sum of the event state number obtained in S240 and the final event state number of the response event obtained in S280.

  Next, the complexity calculation unit 50 determines whether or not S260 to S290 have been performed for all the interprocess communication information registered in the interprocess communication information storage unit 20 (S300). If the above process is performed for all inter-process communication information (S300, Yes), the process ends. If the above process is not performed for all inter-process communication information (S300, No), the process returns to step S250. S260 to S290 are executed for the remaining interprocess communication information.

  Above, description of the operation example (process) of the measuring device 1 is complete | finished.

[3. Complexity measurement example]
An example of measurement of complexity by the measurement apparatus 1 according to the present embodiment is shown.
(1) When there is no protocol that can be activated simultaneously between communication protocols FIG. 16 shows a state transition diagram for a system when there is no protocol that can be activated simultaneously between communication protocols. This system is composed of a process and b process. FIG. 17 shows a state transition table of a system composed of the a process and the b process shown in FIG. When the complexity of this system is measured by the measuring apparatus 1, the number of event states is 2 and the number of cells is 15. Therefore, complexity = number of event states / number of cells = 2/15 = 0.13.

(2) When one of the communication protocols is a protocol that can be activated simultaneously FIG. 18 shows a state transition diagram for a system in which one of the communication protocols is a protocol that can be activated simultaneously. This system includes an a ′ process and a b ′ process. FIG. 19 shows a state transition table of a system composed of the a ′ process and the b ′ process shown in FIG. When the complexity of this system is measured by the measuring apparatus 1, the number of event states is 8 and the number of cells is 15, so that complexity = number of event states / number of cells = 8/15 = 0.53.

(3) When both communication protocols are protocols that can be activated simultaneously FIG. 20 shows a state transition diagram for a system in which both communication protocols can be activated simultaneously. This system is composed of an a ″ process and a b ″ process. FIG. 21 shows a state transition table of a system composed of the a ″ process and the b ″ process shown in FIG. When the complexity of this system is measured by the measuring device 1, the number of event states is 12 and the number of squares is 12. Therefore, the complexity = the number of event states / the number of squares = 12/12 = 1.

[4. Complexity assessment]
Next, how to evaluate the model check of the system to be measured based on the complexity value output by the measuring device 1 will be described.

  FIG. 22 shows an example of a table showing the relationship between complexity, inter-process relationship, significance of model checking, and effectiveness of model checking. The table shown in this example is classified into three categories according to the complexity value, and comments are made on the inter-process relationship, the significance of model checking, and the effectiveness of model checking for each category. However, the contents of this table and the classification of categories are merely examples, and the technical scope of the present invention is not intended to be limited to this standard.

[5. Summary]
According to the present invention, interprocess communication information, which is a communication protocol between processes, can be derived from the specifications of a single process represented by a state transition table, and responsiveness and parallelism tend to be problematic in asynchronous communication. It is possible to define the complexity of the relationship between processes by paying attention, and it is possible to predict in advance what kind of model checking is effective from the complexity of the defined asynchronous communication.

The functional block diagram which showed the example of a structure of the measuring device concerning embodiment of this invention State transition diagram of process A State transition diagram of process B State transition diagram of C process Diagram showing state transition table data for process A Diagram showing state transition table data for process B The figure which shows the state transition table data regarding C process The flowchart which showed an example of the processing content which the inter-process communication information analysis part processes the state transition table data 2 Flowchart following the flowchart of FIG. The flowchart which shows the operation example (process) of the measuring apparatus after S170, Flowchart following FIG. (A) is a state transition diagram of the X process, and (B) is a state transition diagram of the Y process. State transition diagram of X and Y processes when considering the possibility of parallel operation (A) is a diagram showing interprocess communication information in which an external event is inserted for the X process, (B) is a diagram showing interprocess communication information in which an external event is inserted for the Y process. (A) is a diagram showing the number of response event states in the interprocess communication information of the X process, and (B) is a diagram showing the number of response event states in the interprocess communication information of the Y process. State transition diagram for the system when there is no protocol that can be started simultaneously between communication protocols The figure which shows the state transition table of the system comprised by a process shown in FIG. 16, and b process State transition diagram for the system when one of the communication protocols is a protocol that can be started simultaneously State transition table of the system composed of a ′ process and b ′ process shown in FIG. State transition diagram for the system when both protocols can be started simultaneously The figure which shows the state transition table of the system comprised by the a "process and b" process which were shown in FIG. Diagram showing an example of a table showing the relationship between complexity, interprocess relationships, significance of model checking, and effectiveness of model checking Diagram showing an example of a state transition table for a state transition model Alpha protocol sequence diagram A diagram showing the state transition table of process A The figure which shows the state transition table of B process Sequence diagram of β protocol The figure which shows the state transition table of A 'process The figure which shows the state transition table of B 'process

DESCRIPTION OF SYMBOLS 1 ... Model check effectiveness measuring device 2 ... State transition table data 10 ... Inter-process communication information analysis part 20 ... Inter-process communication information storage part 30 ... Inter-process communication information input / output part 40 ... Parallel operation possible input part 50 ... Complexity Calculation unit 60 ... Complexity display unit

Claims (2)

First analysis means for generating inter-process communication information based on state transition table data of each process constituting a model whose complexity is to be measured;
Display or present the interprocess communication information generated by the first analysis means, prompt the user to select interprocess communication information corresponding to processes operating in parallel, and externally select the selected interprocess communication information. A second analysis unit that generates post-combination inter-process communication information that is inter-process communication information obtained by compositing an event, and calculates the number of event states for each event for the inter-process communication information and the post-combination inter-process communication information;
Computation means for calculating complexity based on the number of cells, which is the product of the number of events and the number of states in the state transition table data, and the number of event states of the inter-process communication information and the post-synthesis inter-process communication information. Model check effectiveness measuring device characterized by. In the inter-process communication information or the post-synthesis inter-process communication information, when the second analysis means has a response event to the self-process excluding the head event, the second event state number and the response event state number The model check effectiveness measuring device according to claim 1, wherein the product is calculated as a final event state number of the response event.

Images