JPH0675761A - Specification verifier - Google Patents

Abstract

PURPOSE:To ensure the rational verification of the specifications. CONSTITUTION:A specification verifier proves the specifications described by an algebraical description language processing system. Then the specification verifier is provided with a storage means 2 which stores the subjects of the specification verification and also the history, the results, etc., of the specification verification processing, a verifying means 1 which selects an equality out of a set E of equalities consisting of the necessary pairs obtained in the verification procedure set for the verifying items and the specification verifying subjects to decide the failure of the verifying item, the failure of verification or the continuation of the verification, generates an item rewriting rule and a necessary pair to repeat the procedure to add the necessary pair to the set E in a verification continuation state, and performs the specification verification processing to set up the verifying item when the set E becomes idle, and a verification setback means 3 which traces the details of the specification verification processing based on the information on the history, the result, etc., of the means 2 when the verification procedure is scattered and then executes again the verification processing of the means 1 in accordance with other selected conditions accordant with a selection rule at the time point of the desired details.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a specification verification specification verification device in an algebraic specification description language processing system having a specification verification function.

[0002]

2. Description of the Related Art In an algebraic specification description language processing system, the described algebraic specification is verified to confirm whether or not the specification satisfies a verification item. This is called specification verification.

In the specification verification procedure for the described algebraic specifications, term rewriting rules (directed equations) and equations called “needs” are generated one after another, but a primitive that generates all existing pairs. Verification efficiency is poor in the standard specification verification procedure.

Therefore, as a verification method for improving efficiency, for example, Laurent Fribourg (Fribourg, L,: A Stro
ng Restriction of the Inductive Completion Procedu
re, in Proc. 13th Int. Colloquium Automata, Langua
ges and Programming, Lecture Noltes in Computer Sci
ence 226, Springer-Verlag (1986), pp.105-115).
There is a verification procedure that uses the concept of y). The verification procedure using this concept does not generate all required pairs, but selectively generates required pairs. Further, conventionally, this selection rule is fixed to one.

[0005] Here, the term "paired" means that one term may be rewritten into two different terms by two different term rewriting rules. An equation connecting these two terms with an equal sign is used. That is.

[0006]

As described above, in the conventional specification verification method, the selection rule for selecting and generating the required pair is fixed to one. In the case of a primitive procedure that generates all pairs, it can be considered that one rule "select all" is fixed.

Therefore, when the verification procedure diverges due to a certain pair generated according to the fixed selection rule (that is, in the case where the verification procedure is infinite), another pair is required. If it can be selected, the verification procedure may be stopped (that is, converged), but it is not possible to stop (converge) the verification procedure due to the configuration in which such another selection cannot be made. was there.

Therefore, the object of the present invention is to
It is an object of the present invention to provide a specification verification device having a verification means capable of reselecting a required pair when a verification procedure may diverge without fixing one selection rule.

[0009]

In order to achieve the above object, the present invention is configured as follows. That is, as a verification device for verifying the specifications of the specifications described by the algebraic description language processing system, a storage unit that stores the target of the specification verification and also stores the history and the result of the specification verification process, Select one of the equations E from the set of equations consisting of required pairs obtained in the course of the verification procedure for the verification item and specification verification target for the verification target, and check whether the verification item is not satisfied or the verification fails or the verification continues. If it is a continuation, the procedure for generating the term rewriting rule and the required pair and adding the required pair to the set E is repeated, and if the set E becomes an empty set, the verification item is established. When the verification procedure diverges and the specification verification means that performs the processing, the history of the specification verification processing is traced back based on information such as the history and results of the specification verification processing stored in the storage means. It was constructed and a verification backtracking means for re-verifies the above specification verification means in accordance with the different conditions selected conforming to the selection rule from the time of the desired history.

[0010]

In the specification verifying apparatus of the present invention, when it is determined that the verification procedure may diverge while the specification verifying unit is performing the specification verification using the storage information of the storage unit, the temporary verification is temporarily performed. The verification procedure can be interrupted and the verification procedure can be returned to the appropriate stage. Then, the specification verification condition can be selected again and the verification procedure can be continued again. As a result, there is a possibility that the specification verification procedure, which has been divergent and could not be completed in the past, will be completed.

[0011]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing an embodiment of a specification verification device according to the present invention. In FIG. 1, 1 is a pair generation unit, 2 is a storage unit, 3 is a return unit after verification, 4 is a reselection determination unit, 5 is a return location selection unit, and 6 is a reselection unit.

The pair generation unit 1 is for generating a pair (equation) from the given specification description and executing the specification verification. When the specification verification suspension command is received, the specification verification is temporarily stopped, Further, after the temporary suspension, when the return point designation information is received, of the cycles executed so far, the storage section 2 is traced back to the cycle corresponding to the return point designation information and reaches the orientation processing point in that cycle. It also has the function of returning the contents of.

The storage unit 2 stores equations such as required pairs used in verification, history of processing, progress of processing, and the like. In addition, the verification return unit 3 returns the procedure to an appropriate stage when the verification procedure is likely to diverge, and redoes the selection of the required pair. Further, the post-verification return unit 3 is
The reselection determination unit 4, the return location selection unit 5, and the reselection unit 6 are included.

Return point selection section 5 in return section 3 after verification
Is for setting up to which cycle of the verification cycle that has already been executed (one cycle unit) is returned, and the reselection determination unit 4 receives a command to verify the pair generation unit 1. The operation for interrupting the procedure (verification process) is performed. Further, the reselection unit 6 refers to the contents of the storage unit 2 based on the given pair selection rule,
It has the function of reexamining all possible pair choices and presenting all possible choices. This presentation may be performed by displaying on a display device (not shown).

In the specification verification apparatus of the present invention, the reselection judgment unit 4 judges that the automatic verification procedure may diverge when the pair generation unit 1 uses the storage unit 2 to verify the specifications. In such a case, the verification procedure in the pair generation unit 1 is temporarily interrupted, the verification procedure is returned to an appropriate stage by the return point selection unit 5, and another pair is reselected by the reselection unit 5. , The verification procedure continues again.

As a result, the conventional method diverges and ends (converges).
It is possible to secure the possibility of ending the specification verification procedure that could not be done. It should be noted that the above-described determination in the reselection determination unit 4 and the above-described selection in the return point selection unit 6 can be realized both automatically and manually.

Next, the operation of the embodiment of the present invention will be described in detail. After the specification according to the purpose is described by the algebraic description language, the described specification and the verification item are stored in the storage unit 2.
, And the specification generation unit 1 is activated to verify the specifications.

Here, for convenience of explanation, the following is defined. That is, P is a set of specifications (a complete term rewriting system that satisfies the definition principle), T is a set of verification items (equations that the specifications must satisfy), and R is a set of term rewriting rules obtained by the verification procedure. , E be a set for storing the pairs obtained in the verification procedure.

The initial value of the set R is an empty set, and the initial value of the set E is T. All of these are stored in the storage unit 2. The specification verification is to confirm whether the specifications satisfy the verification items.

In this embodiment, Laurent Frib is used as a verification process in the pair-to-be-created section 1 for generating a pair and performing specification verification.
We will use the procedure for obtaining pairs by using the concept of perfect duplicate possibility proposed by ourg. Although this procedure itself is not a product of the present invention, it bears a part of the verification process, and will be briefly described with reference to FIG.

As shown in FIG. 2, the process in the pair generation unit 1 first checks the contents of the storage unit 2 (S1). Then, when the set E is an empty set, the operator is notified that the verification items are satisfied, and the verification procedure is ended. On the other hand, as a result of the examination, when the set E is not an empty set, one equation F is fairly selected from the set E and the equation F is removed from the set E (S2). Whether or not the equation is unnecessary in the verification procedure is checked (S3), and if it is unnecessary, nothing is performed and the process returns to the first step, that is, step S1.

On the other hand, if it is determined in step S3 that it is necessary, the pair generation unit 1 next checks whether or not the equation F can be replaced with another equation (S4). As a result, if the equation F can be replaced by another equation, add the other equation to the set E and return to the beginning. That is, it returns to step S1. Otherwise, proceed to the verification item failure determination.

In the verification item failure determination, the pair generation unit 1 determines whether or not the equation F is inconsistent with the merged set of the specification set P and the set R (S5). Then, as a result of the determination, if there is a contradiction, the operator is informed that the verification item is not established, and the verification procedure ends, and if there is no contradiction, the verification is continued. That is, if there is no contradiction, the process proceeds to step S6.

When the verification items are not satisfied, the equation F is oriented according to a predetermined method. That is, it is determined whether or not the orientation is possible (S6). As a result, if the orientation is not possible, the verification is unsuccessful. In such a case, notify the operator to that effect. Finish the verification procedure.

As a result of the determination in step S6, if the orientation is possible, the pair generation unit 1 performs orientation (S7),
Next, the pair generation unit 1 selects one of the completely left-overable occurrences of the oriented equation F (S).
8) With respect to the appearance, a required pair obtained by overlapping the set P of specifications is added to the set E (S9). The above is one cycle of the procedure for acquiring the required pair using the concept of complete duplication possibility.

When one cycle ends, the procedure returns to the beginning of the procedure (S1), and the above cycle is repeated until the verification procedure ends (converges) or fails. The pair generation unit 1 is made to perform the above procedure.

By the way, in this embodiment, the pairwise selection rule for the oriented equality is that, as described above, "select one completely overlapping occurrence from the left-hand side of the equation, and P for that occurrence. It is said that "the required pair obtained by overlapping."

In this verification procedure, the pair generation unit 1
Then, the expressions already in the set R and the set E are deleted, the orientation is given, or a new expression is added. Therefore, in order to enable the backtracking of the verification procedure by the backtracking unit 3, all the information such as which expression was deleted, oriented, and added at which stage of verification is stored in the storage unit 2. (See Figure 4).

FIG. 5 shows an example of the storage unit 2. In this example, the initial state is the set of specifications P = {0 + X-> X, S (X) + Y-> S (X + Y)} ... (specification) Initial value of E T = {(A + B) + C = A + (B + C)} (verification item) Set E = T set R = φ (empty set) (However, X, Y, A, B, C indicate variables. The equal sign, S, and + indicate a function.) At this time, it is the state of the storage unit 2 immediately after the following verification procedure is performed.

[Process 1.1] In the first cycle of the verification procedure, (A + B) + C = A + (B + C) is selected from the set E, and A + (B + C)
-> (A + B) + C. [Process 1.2] Next, A + (B + C)-> (A + B) + C left side A + (B +
From C), select the occurrences that allow complete overlap. in this case,
On the left-hand side A + (B + C), the occurrences that can be completely overlapped in the set P are A + (B + C) and B + C, so one of them is selected. For example, assume that the appearance B + C is selected. Then, with respect to this appearance, the required pair in which the set P of specifications is superposed is obtained. The equation used to overlap the set P of specifications is S (X) + Y-> S (X + Y) which matches the pattern of the selected occurrence A + (B + C) in the set P. is there. B to S (X)
, When Y is substituted for C, A + (B + C)-> (A + B) + C becomes A + (S (X) + Y)-> (A + S (X) + Y)… (1 ), And the term rewriting rule S (X) + Y
Applying-> S (X + Y) results in A + (S (X) + C)-> A + (S (X + Y))… (2). From the equations (1) and (2) above, the pair A + (S (X + Y)) = (A +
S (X)) + Y is obtained.

[Process 1.3] The pair obtained in process 1.2 is transferred to the set E, and the rewriting rule {A + (B + C)-> (A +
B) + C} is moved to the set R. This gives R = (A + (B + C)-
> (A + B) + C}, E = {A + (S (X + Y)) = (A + S (X)) + Y}, and the first cycle of proof ends.

[Process 2.1] In the second cycle of the proof procedure, A + (S (X + Y)) = (A + S (X)) + Y is selected from the set E and A + (S (X + Y ))-> (A + S (X)) + Y.
In other words, what remains in the set E is A + (S (X + Y)) = (A + S (X)) +
Since it is Y, this is selected and its orientation is determined.

[Processing 2.2] A + (S (X + Y))-> (A + S (X))
Occurrence of complete duplication X + Y by the set P from the left side of + Y
Select. Then, if the set P of specifications is overlapped as described above, the pair A + (S (S (X + Y))) = (A + S (S
(X))) + Y is obtained.

[Process 2.3] The essential pairs obtained in process 2.2 are transferred to the set E, and the rewriting rule A + (S (X + Y))-> (A +
S (X)) + Y moves to set R. This gives R = (A + (B + C)-
-> (A + B) + C, A + (S (X + Y))-> (A + S (X)) + Y} and E = {A + (S (S (X + Y)) ) = (A + S (S (X))) + Y}, and the second cycle of proof ends.

[Processing 3.1] In the third cycle of the certification procedure, A + (S (S (X + Y))) = (A + S (S (X))) + Y is selected from the set E. That is, A + (S (S (X
+ Y))) = (A + S (S (X))) + Y, so this is selected. FIG. 5 shows the state of the storage unit 2 when the verification procedure has reached this point. Now, this theorem proof procedure does not stop (converge).

In this case, A + (S (S (... X + Y) ...)) =
This is because the expressions of the form (A + S (S ... (X) ...)) + Y become the elements of the set E one after another, and the set E never becomes an empty set. That is, [n, A + (S (S (… X + Y)…)), (A + S (S…
(X)…)) + Y], [Gen, n-3], [Del *], [Sel, n-2,-
This is because the information of the form->]] is added to the storage unit 2 one after another.

In such a case, the post-verification return unit 3 of the present invention provides a method of interrupting an infinite number of procedures and changing the verification path. Hereinafter, the operation of the post-verification return unit 3 will be described. FIG. 3 shows the processing in the post-verification return unit 3, and the manner of change in the storage unit 2 in this example is shown in FIGS. 6 and 7.
In this embodiment, it is assumed that the reselection determination unit 4, the return location selection unit 5, and the reselection unit 6 are all manually operated by the operator.

When the verification procedure as shown in FIG. 2 is carried out by the pair generation unit 1, the contents of the result and the history information (progress contents) thus generated are sequentially stored in the storage unit 2, and The content is displayed on a display device (not shown). Therefore, the operator determines whether or not the verification procedure continues indefinitely while looking at the displayed contents. This can be judged from the tendency by seeing how the results change from experience. Therefore, make this judgment at some stage.

In this example, since the reselection judging section 4 executes the process by manual operation, when the operator judges that the verification procedure may continue indefinitely (S1).
1), the verification procedure is interrupted by manual command input (S12). When the verification procedure is interrupted by this operation, the input of the return point to the return point selection unit 5 is awaited (S13). Therefore, the operator causes the display device to display the history information of the verification procedure, decides which cycle of the verification is to be returned from the history information, and inputs the numerical value to the return point selection unit 5.

Then, the pair generation unit 1 changes the current contents of the storage unit 2 according to the input information from the location selection unit 5,
In the cycle corresponding to the input numerical value, the state is returned to the state just before the pair is acquired (S14). In this way, by inputting a numerical value from the location selection unit 5, the current contents of the storage unit 2 are returned to the state immediately before acquisition of the required pair in the cycle corresponding to the input numerical value.

For example, if "1" is input to the return point selection unit 5 in order to return to the first cycle, the contents of the storage unit 2 are stored in the first cycle of the verification procedure by the action of the pair generation unit 1. A + (B + C)-> (A + B) + C in the eye
It is changed to the content in the state of being directed to.

That is, in the first cycle of the verification procedure, (A + B) + C = A + (B + C) is selected from the set E, and A + (B +
C)-> (A + B) + C, after moving to the required acquisition, this is the state just before the acquisition of this required "A + (B + C)
-> (A + B) + C state ”. FIG. 6 shows the state of the storage unit 2 at this time.

Next, the reselection unit 6 is operated by the operator to perform a reselection operation. The required pair selection rule in this embodiment is "a required pair obtained by selecting one occurrence that can be completely overlapped from the left side of the equation and superimposing the set P on the occurrence".
Is to choose. Therefore, the reselection unit 6 refers to the contents of the storage unit 2 and performs an operation of reselecting the appearances that can be completely overlapped. As a result, all possible repeatable occurrences on the left side of the equation that are currently selected and oriented by the reselection unit 6 are extracted and presented on a display device (not shown).

The operator selects one of those appearances that should take the next pair (S15). In this example the expression A + (B +
C)-> (A + B) + C left side A + (B + C) has a set P that can be completely duplicated: "A + (B + C)" and "B + C" .

Since the history information in the storage unit 2 indicates that the verification procedure did not stop (converge) due to the selection of the appearance "B + C" in the previous time, the operator selects from these two times this time. Choose "A + (B + C)". When this selection is input to the reselection determination unit 4 (S15), this information is input to the required pair generation unit 1, and the required pair generation unit 1 receives this information and specifies it for the appearance "A + (B + C)". A pair is generated by superimposing the set P of (S16). Substituting S (X) for A, A + (B + C)-> (A + B) + C becomes S (X) + (B + C)-> S (X) + C… (11) Becomes Substituting B + C for Y, S (X) + Y-> S (X + Y)
Is S (X) + (B + C)-> S (X + (B + C))… (12), so from Eqs. (11) and (12) we need S (X + (B + C) ) = (S (X) +
B) + C is obtained. As a result, the pair generation unit 1 appears B +
A pair S (X + (B + C)) = (S (X) + B) + C is generated for C, replaced as an element of the set E, and the set R is also changed. R = {A + (B + C)-> (A + B) + C} E = {S (X + (B + C)) = (S (X) + B) + C} It's the end. FIG. 7 shows the state of the storage unit 2 at the end of this cycle of the certification procedure.

After that, the normal verification procedure is continued again. In this example, after this, the set E becomes empty,
The verification is completed normally, and the establishment of the verification items is confirmed. This proves that the contents of the set P satisfy the contents of the set T.

In this embodiment, the reselection judging section 4,
The return point selection unit 5 and the reselection unit 6 are all manual, but at the time of making these judgments / selections, it is possible to automatically predict the possibility of infinite execution of the verification procedure and to suggest it to the operator. It is possible.

As described above in detail, the system according to the present invention generates the required pair and the required pair generation unit for verifying the specification,
When the verification procedure is likely to diverge, if the verification procedure is likely to diverge, the procedure goes back to an appropriate stage and reselects the required procedure. Further, the post-verification return section is composed of a reselection determination section, a return location selection section, and a reselection section.

In the specification verifying apparatus of the present invention, when it is determined that the automatic verification procedure may diverge when the pair generation unit performs the specification verification using the stored information in the storage unit. The verification procedure is temporarily interrupted, the verification procedure is returned to an appropriate stage, the pair of required selections are re-selected, and the verification procedure is continued again. Therefore, there is a possibility that the specification verification procedure may end even if the verification procedure cannot be completed due to divergence in the past depending on the selection method of the pair.

Therefore, according to the present invention, in the specification verification procedure, if there is a possibility that the procedure is repeated indefinitely and does not stop due to the selection of a certain pair, the verification procedure is performed up to an appropriate stage. It is possible to go back and select again and continue verification based on that selection. Therefore, if the pair selection is incorrect and the verification procedure does not converge, it is possible to converge the verification procedure by reselecting. The present invention is not limited to the embodiments described above and shown in the drawings, but can be appropriately modified and carried out within the scope of the invention.

[0051]

As described above in detail, according to the present invention, the required pair can be reselected when the verification procedure is likely to diverge, and thus the required pair can be erroneously selected. When the verification procedure does not converge, it is possible to provide the specification verification device capable of converging the verification procedure by reselecting.

[Brief description of drawings]

FIG. 1 is a block diagram showing an embodiment of the present invention.

FIG. 2 is a flowchart explaining the operation of the device of the present invention.

FIG. 3 is a flowchart illustrating the operation of the device of the present invention.

FIG. 4 is a diagram for explaining the operation of the device of the present invention.

FIG. 5 is a diagram for explaining the operation of the device of the present invention.

FIG. 6 is a diagram for explaining the operation of the device of the present invention.

FIG. 7 is a diagram for explaining the operation of the device of the present invention.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 ... Pair generation section 2 ... Storage section 3 ... Return section after verification 4 ... Reselection determination section 5 ... Return location selection section 6 ... Reselection section

Claims (2)

[Claims] 1. As a verification device for verifying specifications of software specifications described by an algebraic description language processing system, specification verification means for executing specification verification processing based on equality logic, specification verification target, and specification verification. When the specification verification process is not completed, a storage means for storing the equations used during processing and history information of the specification verification process, and if the specification verification process is not completed, trace the history of the specification verification process and change the conditions to start the specification verification process from the middle stage. A specification verifying device, comprising: a verification returning unit for controlling the specification verifying unit so as to redo it. 2. As a verification device for verifying specifications of software specifications described by an algebraic description language processing system, a memory for storing a target of specification verification and a history and result of specification verification processing. Means and verification items for the target for which the specification verification is to be performed, and one equality is selected from the set E of the equalities obtained by the verification procedure for the target for which the specification verification is performed. Or, it is determined whether the verification is continued, and if it is continued, the procedure for generating the term rewriting rule and the essential pair and adding the essential pair to the set E is repeated. If the set E becomes an empty set, the verification item is established. Based on the information such as the history and the result of the specification verification process stored in the storage unit when the verification procedure diverges
The configuration includes retroactive means for tracing back the process of the specification verification process and re-executing the verification process of the specification verification unit in accordance with another selected condition that conforms to the selection rule from the time of the desired process. Specification verification device characterized by.