WO2024060377A1 - 联锁数据安全性的形式化验证方法和系统 - Google Patents

联锁数据安全性的形式化验证方法和系统 Download PDF

Info

Publication number
WO2024060377A1
WO2024060377A1 PCT/CN2022/131326 CN2022131326W WO2024060377A1 WO 2024060377 A1 WO2024060377 A1 WO 2024060377A1 CN 2022131326 W CN2022131326 W CN 2022131326W WO 2024060377 A1 WO2024060377 A1 WO 2024060377A1
Authority
WO
WIPO (PCT)
Prior art keywords
verification
interlocking
formal
interlocking data
data
Prior art date
Application number
PCT/CN2022/131326
Other languages
English (en)
French (fr)
Inventor
王燕芩
魏民
张铭瑶
朱迎春
李卫娟
张程
刘丽娟
陈虹
Original Assignee
卡斯柯信号有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 卡斯柯信号有限公司 filed Critical 卡斯柯信号有限公司
Publication of WO2024060377A1 publication Critical patent/WO2024060377A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures

Definitions

  • the invention relates to the technical field of track interlocking data verification, and in particular to a formal verification method and system for interlocking data security.
  • the computer interlocking system is a high-security system involving the safety of life and property in rail transportation. Its safety needs to be guaranteed by the consistency of the system logic design and safety requirements and special safety protection measures. In terms of system implementation, there is a problem of inaccurate system implementation due to inaccurate demand description, which further leads to the final system function failure, which can easily endanger driving safety.
  • the complexity of general data design largely depends on the complexity of the station type.
  • the function implementation of the interlocking data instantiation tool also depends on the station type.
  • general interlocking rules can meet the needs of the station type, but for complex station types, general interlocking rules cannot meet the functional needs of the station type, which requires manual logical design of special interlocking functions.
  • the double-chain instantiation tool for interlocking data cannot be adapted to all site types. Special site types may cause errors in the interlocking data files generated by instantiation.
  • the present invention aims to solve one of the technical problems in the related art, at least to a certain extent.
  • one purpose of the present invention is to provide a formal verification method for the security of interlocking data based on the Boolean logic characteristics of interlocking data and based on strict mathematical proof theory and full state space exhaustive search. This method has execution speed It has the characteristics of fast and high automation, and can effectively verify the satisfaction and safety of specific interlocking data for the interlocking system requirements.
  • a formal verification method for interlocking data security including:
  • the interlocking data is used to formally verify the general model to describe the general safety requirements of the interlocking system.
  • the interlocking data includes VTL files describing interlocking operation logic, TLE files describing station topology and signaling equipment attributes, SyID interface files describing the interlocking system and other systems, and station equipment function list STA At least one of the configuration files.
  • the general verification data after obtaining the general verification data and before performing automatic verification, it also includes: determining the scope of the formal verification of the interlocking data according to the station equipment function list STA configuration file.
  • the formal verification tool when a verification error occurs, the formal verification tool also outputs a verification error problem list through the human-machine interface.
  • the method also includes:
  • the verification object after the verification object passes the formal verification, it also includes: generating an interlocking data security verification report.
  • the method also includes: comparing the double-chain files output by the double-chain interlocking data security conversion tool, and when the double-chain files are consistent, randomly selecting one of the double-chain files. Chain output files serve as input data to the formal verification tool.
  • the VTL file includes the status information of each equipment in the station, the internal logic information of the interlocking operation, the external control command information of the interlocking operation, and the Boolean equation information describing the interlocking logic operation relationship between the variables of each equipment. of at least one.
  • the TLE file includes at least one of the names and equipment attribute information of all signaling equipment in the station, information on the connection relationship between each equipment, and route table information describing the interlocking restriction relationship of the signaling equipment.
  • the SyID interface file includes operation requests and equipment status display information for the interface with the host computer, equipment control commands and status detection information for the interface with the trackside equipment, route status information for the interface with the train control equipment, and
  • the driver of the fully electronic execution unit interface collects at least one of the information.
  • the station equipment function list STA configuration file includes at least one of interlocking station equipment information, route information, signal display information, approach section information and route unlocking delay time information.
  • the second aspect of the present invention provides a formal verification system for interlocking data security, including:
  • a verification general model establishment module is used to establish the interlocking data formal verification general model, and establish a mapping relationship between the safety logic attributes set in the interlocking data formal verification general model and the interlocking equipment, interlocking logic parameters and station interlocking functions in the interlocking data;
  • the interlocking data security conversion module is connected to the verification general model establishment module.
  • the interlocking data security conversion module is used to perform security conversion on the interlocking data to be verified according to the mapping relationship to obtain the formalization of the interlocking data.
  • a formal security verification module connected to the interlocking data security conversion module, the formal security verification module is used to automatically verify the verification object selected from the general verification data according to the selected verification algorithm;
  • the formal counterexample verification debugging module is connected to the formal security verification module.
  • the formal counterexample verification debugging module is used to obtain and analyze the verification error problem list, and when there is a counterexample description in the verification error problem list, The counterexample describes how to perform counterexample verification debugging;
  • An interlocking data security verification result generation module is connected to the formal security verification module.
  • the interlocking data security verification result generation module is used to generate an interlocking data security verification report based on the output result of the formal security verification module.
  • the third aspect of the present invention provides a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed by a processor, the above-mentioned formal verification method for the security of interlocking data is implemented.
  • the fourth aspect of the present invention provides an electronic device, including a processor and a memory.
  • a computer program is stored on the memory.
  • the computer program is executed by the processor, the above-mentioned connection is realized.
  • Formal verification method for lock data security is realized.
  • the present invention applies formal verification technology to the verification of interlocking data of the computer interlocking system, which can verify the interlocking system's satisfaction with the safety specifications after the data configuration is instantiated, and can discover in advance that the interlocking system is inconsistent with the general application model. and errors caused by incomplete application-specific conversion rules and the subjectivity of the data verification process.
  • the specific application interlocking data after instantiation is the real interlocking software for on-site interlocking station applications. Therefore, the present invention passes formal verification. This method verifies the security of interlocking data and can further improve the security of interlocking products.
  • the present invention adopts a formal verification method that combines inductive verification and model testing to cover all the state spaces of the system in a certain test scenario, and can verify the impossibility of dangerous events.
  • the present invention uses formal modeling language to establish a general model for formal verification of interlocking data, which can prevent deviations in understanding of requirements from causing design errors or test errors.
  • the present invention establishes a mapping relationship between the safety logic attributes set in the general model of formal verification of interlocking data and the interlocking equipment, interlocking logic parameters and station interlocking functions in the interlocking data, and performs a safety transformation on the interlocking data to be verified according to the mapping relationship to obtain the general verification data required by the general model of formal verification of interlocking data, so that the method can be applied to complex station types.
  • the present invention also provides a complete formal verification tool to perform data certification process, and the present invention can also generate an independent interlocking data verification report to provide effective security arguments for system security and facilitate project security assessment.
  • the present invention also provides the configuration of the verification range of the security requirement attributes of the interlocking data.
  • the present invention selects the general security requirements that need to be verified according to the configuration, and provides customized verification of the interlocking data of the interlocking functions of different stations, which can reduce the verification process.
  • the traversal of the China-Africa interlocking functional safety requirements model can effectively improve the efficiency of software verification and make verification more flexible for projects of different sizes.
  • the present invention also provides interlocking data security conversion technology to generate universal format verification files, thereby providing a unified file processing format for interlocking data in different formats to facilitate the flexible application of verification models in different interlocking systems.
  • Figure 1 is a flow chart of a formal verification method for interlocking data security provided by an embodiment of the present invention.
  • FIG. 2 is a schematic diagram of the structure of interlocking data provided by an embodiment of the present invention.
  • Figure 3 is a work flow chart of a formal verification method for interlocking data security provided by an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of the structure of a formal verification tool provided by an embodiment of the present invention.
  • Figure 5 is a structural block diagram of a formal verification system for interlocking data security provided by an embodiment of the present invention.
  • Figure 1 is a flow chart of a formal verification method for interlocking data security provided by an embodiment of the present invention. As shown in Figure 1, the method includes:
  • Step S1 Use formal modeling language to establish a general model for formal verification of interlocking data.
  • the interlocking data is designed based on the relay circuit control principle of 6502 relay centralized interlocking.
  • the interlocking data in the 6502 electrical centralized circuit is Interlocking logical relationships are described.
  • the interlocking data inherits the functional relays defined in the 6502 circuit (in the interlocking data, all relays are called parameters or variables), realizing the mapping association of interlocking logic parameters and station equipment, and combining
  • the logical operators "AND”, “OR”, and “NOT” perform logical operations on the specified parameters of the equipment, and abstract the Boolean algebraic expression of the relays of each logical circuit based on the link relationship of the interlocking equipment in the station data topology. , forming a Boolean expression with interlocking meaning, which constitutes the interlocking data of a specific station.
  • the logic of each Boolean equation in the interlocking data is designed based on different application scenarios and different interlocking functions of the interlocking system, which defines the restriction relationship between each signaling device.
  • the interlocking data in this embodiment includes VTL files describing the interlocking operation logic, TLE files describing the station topology and signaling equipment attributes, SyID interface files describing the interlocking system and other systems, and station files. At least one of the field device function list STA configuration files.
  • the VTL file is used to record the interlocking logic operation relationship between the station interlocking equipment, which includes the status information of each station equipment, the internal logic information of the interlocking operation, the external control command information of the interlocking operation, and the description of each equipment variable. At least one of the Boolean equation information of the interlocking logical operation relationship.
  • the TLE file is a text file, which includes the names and equipment attribute information of all signaling equipment in the station (such as equipment type, equipment usage and special inspection conditions, etc.), and the connection relationship information between each equipment (such as uplink connection relationship, downlink connection relationship, etc.) ), and at least one of the route table information describing the interlocking restriction relationship of the signaling equipment.
  • the SyID interface file is used to record all communication interface information of the interlocking system, including operation requests and equipment status display information with the host computer interface, equipment control commands and status detection information with the trackside equipment interface, and progress with the train control equipment interface. At least one of the road status information and the drive collection information interfaced with the fully electronic execution unit.
  • Station equipment function list STA configuration file includes at least one of interlocking station equipment information, approach information, signal display information, approach section information and approach unlocking delay time information.
  • the simplest and most effective method is to directly verify the converted data of the TLE file and the VTL file, and according to the verification needs, the verification auxiliary input required in the verification process can be File STA files are converted and recognized to verify the security of the interlocked data.
  • the general model for formal verification of interlocking data in this embodiment is used to describe the general safety requirements of the interlocking system.
  • the general safety requirements described in the natural language of the interlocking system can be converted into a general model for formal verification of interlocking data described in a formal language, that is, the formal modeling of the safety requirements of the interlocking system can be realized.
  • Step S2 Establish a mapping relationship between the safety logic attributes set in the general model for formal verification of interlocking data and the interlocking equipment, interlocking logic parameters and station interlocking functions in the interlocking data.
  • the definition of safety logic attributes in the general model can be formally verified based on the interlocking data, and the link relationship between the safety logic attributes and the interlocking equipment, interlocking logic parameters, and station interlocking functions in the interlocking data can be established, and Determine the validation objects and validation inputs in the interlocking data.
  • the naming rules of variables in the general model for formal verification of interlocking data can be defined to implement the mapping of formal requirement variables and interlocking data code variables.
  • the reference format of the matching file key predicate regarding the mapping of formal variables and code variables is: CLASSNAME@VARNAME//represents the formal variable (input variable or equation) VARNAME of a certain class CLASSNAME.
  • the optional value can be defined as the default value DEFAULT, and based on the definition of DEFAULT, the full name of the corresponding class can be obtained.
  • users can also customize the type type in the system's type module to implement more complex variable name mapping. For example, for the train route TRAIN_ROUTE in the interlocking data, when the route route name is mapped to its corresponding variable name that defines the route name, the route type suffix of the route name must be ignored.
  • Step S3 Securely transform the interlocking data to be verified according to the mapping relationship, and obtain the general verification data required by the general model for formal verification of interlocking data.
  • a double-chain interlocking data security conversion tool can be used to securely convert the interlocking data to be verified.
  • the method also includes: comparing the double-chain files output by the double-chain interlocking data security conversion tool, and when the double-chain files are consistent, randomly selecting an output file from the double-chain files as the formal verification tool Input data.
  • an independent and different double-chain interlocking data security conversion tool can be used to securely transform the interlocking data to be verified to generate formalization of interlocking data.
  • Generic validation data needed to validate the generic model.
  • the application-specific interlocking data file for a specific station can be converted into a data format LCF file that can be recognized by the formal verification tool.
  • the LCF file format is shown in Table 1 below.
  • the double-chain interlocking data security conversion tool Translator1&Translator2 can be used for conversion.
  • each chain translator needs to implement the conversion function of VTL files, TLE files, STA files and SyID files, and provide a comparison function of double-chain output files.
  • the output conversion file of one chain can be used as the input of the formal verification tool for verification.
  • after obtaining the general verification data and before performing automatic verification it also includes: determining the scope of the formal verification of the interlocking data according to the station equipment function list STA configuration file.
  • whether to perform verification for general verification requirements can be configured.
  • the scope of general verification requirements can be determined based on the interlocking station function list, such as whether there is a route continuation function, signal light extinguishing, train shunting functions, etc.
  • the requirement definition value in the configuration file that does not require verification is always true, and is marked with "AlwaysTure", whose format is: "Verification requirement number”: AlwaysTure. It should be noted that when there are multiple requirements that are not applicable to the station data, the branches will be configured one by one.
  • Step S4 Select the verification object from the general verification data, and select the verification algorithm to automatically verify the verification object through the formal verification tool to complete the formal verification of interlocking data security.
  • the formal verification tool can also output a list of verification error questions through the human-machine interface when a verification error occurs.
  • the method further includes: obtaining and analyzing the verification error problem list to analyze whether there is a counterexample description in the verification error problem list, and when there is a counterexample description, performing counterexample verification debugging according to the counterexample description; obtaining Counterexample verification analysis results, and correct the interlocking data to be verified based on the counterexample verification analysis results, and return to the steps of safe transformation of the interlocking data to be verified until all verification objects pass formal verification; and after the verification objects pass formal verification , generate an interlocking data security verification report.
  • the verification algorithm can be selected through the human-machine interface of the formal verification tool to perform formal automatic verification through the formal verification tool, and wait for the verification results returned by the formal verification tool.
  • the formal verification tool is shown in Figure 4.
  • the formal verification module that is, the formal verification tool, includes a general verification module and a specific application configuration module.
  • the verification methods used by the general verification module include boundary value verification method and interpolation verification method. and inductive verification methods.
  • the verification record of the verification object in the interlocking data associated with each verification requirement is automatically generated in the specific application data engineering package/iLock-save, that is, the verification error problem list.
  • the verification record is To describe whether the verification object meets the security requirement model. Among them, the verification objects can be approaches, switches, signals, sections, section combinations, etc.
  • the formal verification tool After the formal verification tool outputs the verification error problem list through the human-machine interface, it can analyze whether there is a counterexample description in the verification error problem list, and when the analysis finds that a counterexample description exists, perform counterexample verification debugging based on the counterexample description to find the verification object. Reasons why it does not meet the requirements. Specifically, the list of verification error issues can be analyzed. For example, the verification object whose verification result of each security requirement is invalid can be determined.
  • the verification object can be judged to be a counterexample to the security requirement, and based on the verification Boolean equation of the object, analyze the actual status of the input parameters that make the Boolean equation operation result false (error), and determine the expected status of the input parameters required by the interlocking application scenario corresponding to the current demand model. Analyze the causes of data design errors corresponding to the inconsistency between the actual state of the input parameters and the expected state.
  • the interlocking data to be verified is corrected based on the error cause analysis results. After the verification interlocking data is modified correctly, return and re-execute the steps for safe conversion of the interlocking data to be verified, as well as subsequent verification steps, until the verification results of the verification objects corresponding to all verification requirements are valid (valid), and after verification After the object passes formal verification, the interlocking data security verification report is generated through the human-machine interface selection of the formal verification tool.
  • Figure 5 is the structure of a formal verification system for interlocking data security provided by an embodiment of the present invention.
  • the formal verification system 10 of interlocking data security includes: verification general model establishment module 11, interlocking data security conversion module 12, formal security verification module 13, formal counterexample verification debugging module 14 and Interlocking data security verification result generation module 15.
  • the interlocking data security conversion module 12 is an independent module, using security tools developed by different double chains, and the other modules are integrated verification tools.
  • the verification general model establishment module 11 is used to establish a general model for formal verification of interlocking data, and establish the security logic attributes set in the general model for formal verification of interlocking data and the interlocking devices in the interlocking data.
  • the mapping relationship between interlocking logic parameters and station interlocking functions; the interlocking data security conversion module 12 is connected to the verification general model establishment module 11, and the interlocking data security conversion module 12 is used to perform security verification on the interlocking data to be verified according to the mapping relationship Transform to obtain the universal verification data required by the general model for formal verification of interlocking data;
  • the formal security verification module 13 is connected to the interlocking data security conversion module 12, and the formal security verification module 13 is used to verify the general verification data based on the selected verification algorithm.
  • the verification object selected in the verification data is automatically verified; the formal counterexample verification debugging module 14 is connected to the formal security verification module 13.
  • the formal counterexample verification debugging module 14 is used to obtain and analyze the verification error problem list, and in the verification error problem list When there is a counterexample description, counterexample verification and debugging is performed on the counterexample description;
  • the interlocking data security verification result generation module 15 is connected to the formal security verification module 13, and the interlocking data security verification result generation module 15 is used according to the formal security verification module 13.
  • the output results generate an interlocking data security verification report.
  • the present invention also provides a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed by the processor, the above-mentioned formal verification method of interlocking data security is implemented.
  • the present invention also provides an electronic device, including a processor and a memory.
  • a computer program is stored on the memory.
  • the computer program is executed by the processor, the above-mentioned formal verification method of interlocking data security is implemented.
  • the interlocking Boolean logic data is mainly composed of Boolean logic equations describing interlocking logic, and the interlocking Boolean logic equations are connected by first-order predicate logic operators, the interlocking Boolean logic data is formally verified.
  • the formal The verification method starts from the perspective of state space and performs model testing on it.
  • the present invention adopts a formal verification method that combines inductive verification and model testing to prove that the output of the system cannot cause dangerous events to occur.
  • all state spaces of each cycle can be covered through model testing, and all cycles can be covered through inductive verification.
  • interlocking data was mainly tested through experience to verify its security. However, it was specifically tested through the traversal method, which cannot cover all state space problems, and in limited cases It takes up to 2 months of testing time to traverse and test a small and medium-sized station under certain security requirements.
  • the present invention uses formal verification of interlocking data to complete the interlocking data security verification work in about 1 day, which is greatly It improves the scope and efficiency of interlocking data verification and saves labor costs, thereby improving system software security with advanced technical methods based on a solid theoretical basis and further ensuring driving safety.
  • the present invention has been applied to the security verification of interlocking data of the iLOCK interlocking system, and has been applied to actual station data.
  • the present invention adopts a formal method to verify the interlocking data, thereby providing guarantee for the security of the system. Since the internal security of the interlocking system mainly involves Boolean logic in the interlocking data, the interlocking formal verification adopted in the present invention is based on the security requirements of the system. Through model inspection, it is proved that the security requirements of the interlocking software have been realized and the system functions have been met. System requirements, and the present invention can detect defects in the interlocking system design as early as possible through verification and improve product quality and safety.
  • the present invention uses a formal verification method that combines inductive verification and model testing to cover all the state spaces of the system in a certain test scenario, and can verify that dangerous events are unlikely to occur; the present invention uses The formal modeling language establishes a general model for formal verification of interlocking data to prevent deviations in understanding requirements from causing design errors or test errors; the present invention establishes the security logic attributes set in the general model for formal verification of interlocking data.
  • the mapping relationship between the interlocking equipment, interlocking logic parameters and station interlocking functions in the interlocking data, and the interlocking data to be verified are safely transformed according to the mapping relationship, and the universal model requirements for formal verification of interlocking data are obtained.
  • Verification data can make the method applicable to complex station types; in addition, the present invention also provides a complete formal verification tool to perform the data certification process, and the present invention can also generate an independent interlocking data verification report to ensure system security. It provides effective safety arguments to facilitate project safety assessment; and it also provides the configuration of the verification range of the safety requirement attributes of the interlocking data. The present invention selects the general safety requirements that need to be verified according to the configuration, and interlocks the interlocking functions of different stations.
  • the data provides customized verification, which can reduce the traversal of non-site interlocking function safety requirement models during the verification process, thereby effectively improving the efficiency of software verification and making verification more flexible for projects of different sizes; finally, the present invention also provides Interlocking data security conversion technology to generate universal format verification files, thereby providing a unified file processing format for different formats of interlocking data to facilitate the flexible application of verification models in different interlocking systems.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Stored Programmes (AREA)

Abstract

本发明公开了一种联锁数据安全性的形式化验证方法和系统，该方法包括：采用形式化建模语言建立联锁数据形式化验证通用模型；建立联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；根据映射关系对待验证联锁数据进行安全转化，得到联锁数据形式化验证通用模型需求的通用验证数据；从通用验证数据中选择验证对象，并选择验证算法通过形式化验证工具自动验证验证对象，以完成联锁数据安全性的形式化验证。本发明能够有效验证特定联锁数据对联锁系统需求实现的可满足性和安全性。

Description

联锁数据安全性的形式化验证方法和系统 技术领域
本发明涉及轨道联锁数据验证技术领域，尤其涉及一种联锁数据安全性的形式化验证方法和系统。
背景技术
计算机联锁系统是轨道交通运输中涉及生命财产安全的高安全性系统，其安全性需通过系统逻辑设计与安全需求的一致性和特殊安全防护措施保证。而在系统实现上，存在因需求描述不准确导致系统实现不准确，进一步导致最终系统功能失效的问题，容易危及行车安全。
结合联锁系统应用数据的设计过程和特点，因人工参与主要存在于联锁数据设计过程中的TLE文件和VTL文件的设计阶段，所以联锁系统应用数据在人工设计上也可能存在数据安全问题。
传统的联锁数据开发、设计和测试的方法并不能证明其所实现的安全相关系统完全满足功能需求和安全需求。采用传统的开发、测试、验证方法主要存在以下几方面问题：
1)使用自然语言描述需求，需求内容不够详细，容易产生二义性，设计和测试阶段均可能会出现因为对需求理解的偏差而造成设计错误或测试错误的情况。
2)传统的测试方法无法覆盖系统在某个测试场景下的所有的状态空间，这就导致一些潜在的危险问题可能没有在测试时被发现，却在实际运行中会发生。
3)对于安全需求的验证目前主要是通过开展需求、设计、实现过程中的对应关系进行追踪，大多仅停留在文档的层面，无法识别所有的危害场景，所以无法保证软件实现能够规避所有风险，以完全满足安全需求，而且对于安全需求的验证多采用人工分析的方式，效率较低，需要投入较多的人力资源。
另外，通用数据设计的复杂度很大程度上取决于车站站型的复杂性，同 时，联锁数据实例化工具在功能实现上也依赖于车站站型。对于简单站型，通用联锁规则能够满足站型需要，但对于复杂站型，通用联锁规则无法满足站型功能上的需要，其需要人工进行特殊联锁功能的逻辑设计。同时，因站型的复杂性，联锁数据的双链实例化工具无法适配所有站型，特殊站型可能导致实例化生成的联锁数据文件存在错误。
发明的公开
本发明旨在至少在一定程度上解决相关技术中的技术问题之一。为此，本发明的一个目的在于提供一种基于联锁数据的布尔逻辑特点，并基于严格数学证明理论、全状态空间穷尽搜索的联锁数据安全性的形式化验证方法，该方法具有执行速度快、高自动化的特点，并能够有效验证特定联锁数据对联锁系统需求实现的可满足性和安全性。
为达到上述目的，本发明通过以下技术方案实现：
一种联锁数据安全性的形式化验证方法，包括：
采用形式化建模语言建立联锁数据形式化验证通用模型；
建立所述联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；
根据所述映射关系对待验证联锁数据进行安全转化，得到所述联锁数据形式化验证通用模型需求的通用验证数据；
从所述通用验证数据中选择验证对象，并选择验证算法通过形式化验证工具自动验证所述验证对象，以完成联锁数据安全性的形式化验证。
可选的，通过所述联锁数据形式化验证通用模型描述联锁系统通用安全需求。
可选的，采用双链联锁数据安全转换工具对所述待验证联锁数据进行安全转化。
可选的，所述联锁数据包括描述联锁运算逻辑的VTL文件、描述站场拓扑结构和信号设备属性的TLE文件、描述联锁系统与其他系统的SyID接口文件和站场设备功能列表STA配置文件中的至少一种。
可选的，在得到所述通用验证数据之后，并进行自动验证之前，还包括：根据所述站场设备功能列表STA配置文件确定联锁数据形式化验证的范围。
可选的，所述形式化验证工具在发生验证错误时，还通过人机接口输出验证错误问题列表。
可选的，所述方法还包括：
获取并分析所述验证错误问题列表，以分析所述验证错误问题列表中是否存在反例描述，并在存在反例描述时，根据所述反例描述执行反例验证调试；
获取反例验证分析结果，并根据所述反例验证分析结果修正所述待验证联锁数据，以及重新返回对所述待验证联锁数据进行安全转化的步骤，直至所有验证对象通过形式化验证。
可选的，在所述验证对象通过形式化验证之后，还包括：生成联锁数据安全验证报告。
可选的，所述方法还包括：对所述双链联锁数据安全转换工具输出的双链文件进行比较，并在所述双链文件比较一致时，从所述双链文件中任意取一链输出文件作为所述形式化验证工具的输入数据。
可选的，所述VTL文件包括车站各设备的状态信息、联锁运算的内部逻辑信息、联锁运算的对外控制命令信息以及描述各设备变量间的联锁逻辑运算关系的布尔等式信息中的至少一种。
可选的，所述TLE文件包括车站内所有信号设备的名称和设备属性信息、各设备间的前后连接关系信息，以及描述信号设备联锁制约关系的进路表信息中的至少一种。
可选的，所述SyID接口文件包括与上位机接口的操作请求和设备状态显示信息、与轨旁设备接口的设备控制命令和状态检测信息、与列控设备接口的进路状态信息，以及与全电子执行单元接口的驱动采集信息中的至少一种。
可选的，所述站场设备功能列表STA配置文件包括联锁车站设备信息、进路信息、信号显示信息、接近区段信息和进路解锁延时时间信息中的至少一种。
为达到上述目的，本发明第二方面提供了一种联锁数据安全性的形式化验证系统，包括：
验证通用模型建立模块，用于建立所述联锁数据形式化验证通用模型， 并建立所述联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；
联锁数据安全转化模块，与所述验证通用模型建立模块连接，所述联锁数据安全转化模块用于根据所述映射关系，对待验证联锁数据进行安全转化，得到所述联锁数据形式化验证通用模型需求的通用验证数据；
形式化安全验证模块，与所述联锁数据安全转化模块连接，所述形式化安全验证模块用于根据所选择的验证算法对从所述通用验证数据中选择的验证对象进行自动验证；
形式化反例验证调试模块，与所述形式化安全验证模块连接，所述形式化反例验证调试模块用于获取并分析验证错误问题列表，以及在所述验证错误问题列表存在反例描述时，对所述反例描述执行反例验证调试；
联锁数据安全验证结果生成模块，与所述形式化安全验证模块连接，所述联锁数据安全验证结果生成模块用于根据所述形式化安全验证模块的输出结果生成联锁数据安全验证报告。
为达到上述目的，本发明第三方面提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时，实现上述所述的联锁数据安全性的形式化验证方法。
为达到上述目的，本发明第四方面提供了一种电子设备，包括处理器和存储器，所述存储器上存储有计算机程序，所述计算机程序被所述处理器执行时，实现上述所述的联锁数据安全性的形式化验证方法。
本发明至少具有以下技术效果：
1、本发明将形式化验证技术应用于计算机联锁系统联锁数据的验证，能够验证经过数据配置实例化之后的联锁系统对安全规范的满足性，可提前发现联锁系统因通用应用模型和特定应用转换规则不完整及数据验证过程的主观性而导致的错误，并且实例化之后的特定应用联锁数据才是真正联锁车站现场应用的联锁软件，由此本发明通过形式化验证方法验证联锁数据的安全性，可进一步提升联锁产品的安全性。
2、本发明采用归纳验证和模型检验相结合的形式化验证方法可覆盖系统在某个测试场景下的所有的状态空间，并可对危险事件不可能发生情况进行验证。
3、本发明采用形式化建模语言建立联锁数据形式化验证通用模型可防止出现对需求理解的偏差而造成设计错误或测试错误的情况。
4、本发明建立联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系，并根据映射关系对待验证联锁数据进行安全转化，得到联锁数据形式化验证通用模型需求的通用验证数据，可使得该方法能够适用于复杂站型。
5、本发明还提供了完整的形式化验证工具执行数据证明的过程，并且本发明还能够生成独立的联锁数据验证报告，以为系统安全性提供有效的安全论据，方便进行项目安全评估。
6、本发明还提供了联锁数据对安全需求属性验证范围的配置，本发明根据配置选择需要验证的通用安全需求，对不同车站联锁功能联锁数据提供定制化的验证，可减少验证过程中非本站联锁功能安全需求模型的遍历，从而可有效提高软件验证效率，并对于不同规模的项目实施验证更加灵活。
7、本发明还提供了联锁数据安全转换技术，以生成通用格式验证文件，从而可为不同格式联锁数据提供统一文件处理格式，以方便验证模型在不同联锁系统中的灵活应用。
附图的简要说明
图1为本发明一实施例提供的联锁数据安全性的形式化验证方法的流程图。
图2为本发明一实施例提供的联锁数据的结构示意图。
图3为本发明一实施例提供的联锁数据安全性的形式化验证方法的工作流程图。
图4为本发明一实施例提供的形式化验证工具的结构示意图。
图5为本发明一实施例提供的联锁数据安全性的形式化验证系统的结构框图。
实现本发明的最佳方式
以下结合附图和具体实施例对本发明作进一步详细说明。根据下面说明和权利要求书，本发明的优点和特征将更清楚。需说明的是，附图均采用非 常简化的形式且均使用非精准的比率，仅用以方便、明晰地辅助说明本发明实施例的目的。
下面参考附图描述本实施例的联锁数据安全性的形式化验证方法和系统。
图1为本发明一实施例提供的联锁数据安全性的形式化验证方法的流程图。如图1所示，该方法包括：
步骤S1：采用形式化建模语言建立联锁数据形式化验证通用模型。
本实施例中，联锁数据是基于6502继电集中联锁的继电电路控制原理设计，其是通过定义特定的语法、语义规则，并应用布尔代数的表达方式，对6502电气集中电路中的联锁逻辑关系进行描述。联锁数据在描述上，继承了6502电路中定义的各功能继电器(在联锁数据中，所有继电器均称为参数或变量)，实现了联锁逻辑参数和站场设备的映射关联，并结合逻辑运算符“与”、“或”、“非”对设备的指定参数进行逻辑运算，以及根据站场数据拓扑结构中联锁设备的链接关系，抽象出各逻辑电路的继电器的布尔代数表达式，形成了具有联锁意义的布尔表达式，构成了特定车站联锁数据。需要说明的是，联锁数据中的每条布尔等式的逻辑是根据联锁系统的不同应用场景和不同联锁功能设计，其定义了每个信号设备间的制约关系。
如图2所示，本实施例中的联锁数据包括描述联锁运算逻辑的VTL文件、描述站场拓扑结构和信号设备属性的TLE文件、描述联锁系统与其他系统的SyID接口文件和站场设备功能列表STA配置文件中的至少一种。
其中，VTL文件用于记录车站联锁设备之间的联锁逻辑运算关系，其包括车站各设备的状态信息、联锁运算的内部逻辑信息、联锁运算的对外控制命令信息以及描述各设备变量间的联锁逻辑运算关系的布尔等式信息中的至少一种。TLE文件为文本文件，其包括车站内所有信号设备的名称和设备属性信息(如设备类型、设备用途和特殊检查条件等)、各设备间的前后连接关系信息(如上行连接关系、下行连接关系)，以及描述信号设备联锁制约关系的进路表信息中的至少一种。SyID接口文件用于记录联锁系统所有通信接口信息，其包括与上位机接口的操作请求和设备状态显示信息、与轨旁设备接口的设备控制命令和状态检测信息、与列控设备接口的进路状态信息，以及与全电子执行单元接口的驱动采集信息中的至少一种。站场设备功能列表 STA配置文件包括联锁车站设备信息、进路信息、信号显示信息、接近区段信息和进路解锁延时时间信息中的至少一种。
本实施例中，针对联锁数据的形式化验证，最简单、有效地方法是直接对TLE文件和VTL文件转换后的数据进行验证，并可根据验证需要，对验证过程中需要的验证辅助输入文件STA文件进行转换识别，以验证联锁数据的安全性。
需要说明的是，本实施例中的联锁数据形式化验证通用模型是用以描述联锁系统通用安全需求的。具体的，如图3所示，可将联锁系统自然语言描述的通用安全需求转换成形式化语言描述的联锁数据形式化验证通用模型，即实现联锁系统安全需求的形式化建模。
步骤S2：建立联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系。
本实施例中，可依据联锁数据形式化验证通用模型中安全逻辑属性定义，建立安全逻辑属性与联锁数据中联锁设备、联锁逻辑参数、车站联锁功能之间的链接关系，并确定联锁数据中的验证对象和验证输入。
具体的，可对于每个单站联锁数据，定义联锁数据形式化验证通用模型中变量的命名规则，以用于实现形式化需求变量和联锁数据代码变量的映射。本实施例中，关于形式化变量和代码变量映射的匹配文件关键谓词的引用格式为：CLASSNAME@VARNAME//表示某个类CLASSNAME的形式化变量(输入变量或者等式)VARNAME。其中，当变量名称缺失时，可将可选值定义为默认值DEFAULT，并根据DEFAULT的定义，得到对应类的全名。
需要说明的是，用户还可在系统的type模块自定义type类型，用以实现较为复杂的变量名称映射。如联锁数据中的列车进路TRAIN_ROUTE，当进路由进路名称映射到其对应的定义进路名称的变量名时，必须忽略进路名称的进路类型后缀。
步骤S3：根据映射关系对待验证联锁数据进行安全转化，得到联锁数据形式化验证通用模型需求的通用验证数据。
本实施例中，可采用双链联锁数据安全转换工具对待验证联锁数据进行安全转化。其中，该方法还包括：对双链联锁数据安全转换工具输出的双链 文件进行比较，并在双链文件比较一致时，从双链文件中任意取一链输出文件作为形式化验证工具的输入数据。
本实施例中，可按照联锁数据形式化验证通用模型的数据格式要求，采用独立的相异双链联锁数据安全转换工具，对待验证联锁数据进行安全转化，以产生联锁数据形式化验证通用模型需要的通用验证数据。
具体的，可将针对某一具体车站的特定应用联锁数据文件转换成形式化验证工具可识别的数据格式LCF文件，其中LCF文件格式参见下表1。
表1 LCF文件格式
Figure PCTCN2022131326-appb-000001
其中，可采用双链联锁数据安全转换工具Translator1&Translator2进行转换。本实施例中，每一链翻译器均需要实现对VTL文件、TLE文件和STA文件和SyID文件的转换功能，并提供对双链输出文件的比较功能。其中，在双链文件比较一致时，可任取一链输出转换文件作为形式化验证工具的输入，进行验证。
在本发明的一个实施例中，在得到通用验证数据之后，并进行自动验证之前，还包括：根据站场设备功能列表STA配置文件确定联锁数据形式化验证的范围。
具体的，可对通用验证需求是否执行验证进行可配置处理。例如，在验 证前，可根据联锁车站功能列表，如是否有延续进路功能、信号机灭灯、调车功能等，确定通用验证需求范围。其中，配置文件中对于无需执行验证的需求定义值永远为真，并使用“AlwaysTure”标记，其格式为：“验证需求编号”：AlwaysTure。需要说明的是，当存在多个需求对车站数据不适用时，则分行逐一配置。
步骤S4：从通用验证数据中选择验证对象，并选择验证算法通过形式化验证工具自动验证验证对象，以完成联锁数据安全性的形式化验证。
其中，形式化验证工具在发生验证错误时，还可通过人机接口输出验证错误问题列表。
在本发明的一个实施例中，该方法还包括：获取并分析验证错误问题列表，以分析验证错误问题列表中是否存在反例描述，并在存在反例描述时，根据反例描述执行反例验证调试；获取反例验证分析结果，并根据反例验证分析结果修正待验证联锁数据，以及重新返回对待验证联锁数据进行安全转化的步骤，直至所有验证对象通过形式化验证；以及在验证对象通过形式化验证之后，生成联锁数据安全验证报告。
具体的，可通过形式化验证工具人机接口，选择验证算法，以通过形式化验证工具执行形式化自动验证，并等待形式化验证工具返回的验证结果。其中，形式化验证工具即如图4所示，形式化验证模块即形式化验证工具包括通用验证模块和特定应用配置模块，其中，通用验证模块采用的验证方法包括边界值验证法、插值验证法和归纳验证法。
进一步的，形式化验证工具验证完成后，自动在特定应用数据工程包/iLock-save中自动生成每条验证需求关联的联锁数据中验证对象的验证记录即验证错误问题列表，该验证记录用以描述验证对象是否满足安全需求模型。其中，验证对象可以为进路、道岔、信号机、区段、区段组合等。
形式化验证工具通过人机接口输出验证错误问题列表后，可对验证错误问题列表中是否存在反例描述进行分析，并在分析得到存在反例描述时，根据反例描述执行反例验证调试，以查找验证对象与需求不符合的原因。具体的，可分析验证错误问题列表，如确定每个安全需求验证结果为invalid(无效)的验证对象，当确定验证结果为invalid时，则可判断该验证对象为安全需求的反例，并根据验证对象的布尔等式，分析使布尔等式运算结果为false (错误)的输入参数的实际状态，以及判断当前需求模型对应的联锁应用场景所要求的输入参数的预期状态。分析输入参数实际状态和预期状态不一致所对应的数据设计错误的原因。
进一步的，根据错误原因分析结果修正待验证联锁数据。待验证联锁数据修改正确后，再返回重新执行对待验证联锁数据进行安全转化的步骤，以及之后的验证步骤，直至所有验证需求对应的验证对象的验证结果为valid(有效)，并在验证对象通过形式化验证之后，通过形式化验证工具的人机接口选择生成联锁数据安全验证报告。
图5为本发明一实施例提供的联锁数据安全性的形式化验证系统的结构
框图。如图5所示，该联锁数据安全性的形式化验证系统10包括：验证通用模型建立模块11、联锁数据安全转化模块12、形式化安全验证模块13、形式化反例验证调试模块14和联锁数据安全验证结果生成模块15。
其中，联锁数据安全转化模块12为独立模块，采用相异双链开发的安全工具，其他模块为集成化验证工具。
本实施例中，验证通用模型建立模块11用于建立联锁数据形式化验证通用模型，并建立联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；联锁数据安全转化模块12与验证通用模型建立模块11连接，联锁数据安全转化模块12用于根据映射关系对待验证联锁数据进行安全转化，得到联锁数据形式化验证通用模型需求的通用验证数据；形式化安全验证模块13与联锁数据安全转化模块12连接，形式化安全验证模块13用于根据所选择的验证算法对从通用验证数据中选择的验证对象进行自动验证；形式化反例验证调试模块14与形式化安全验证模块13连接，形式化反例验证调试模块14用于获取并分析验证错误问题列表，以及在验证错误问题列表存在反例描述时，对反例描述执行反例验证调试；联锁数据安全验证结果生成模块15与形式化安全验证模块13连接，联锁数据安全验证结果生成模块15用于根据形式化安全验证模块13的输出结果生成联锁数据安全验证报告。
需要说明的是，本实施例的的联锁数据安全性的形式化验证系统具体实施方式可参见上述联锁数据安全性的形式化验证方法的具体实施方式，为避免冗余，此处不再赘述。
进一步的，本发明还提供了一种计算机可读存储介质，其上存储有计算机程序，计算机程序被处理器执行时，实现上述的联锁数据安全性的形式化验证方法。
进一步的，本发明还提供了一种电子设备，包括处理器和存储器，存储器上存储有计算机程序，计算机程序被处理器执行时，实现上述的联锁数据安全性的形式化验证方法。
由于联锁数据主要是由描述联锁逻辑的布尔逻辑等式构成的，而联锁布尔逻辑等式采用一阶谓词逻辑运算符连接，对联锁布尔逻辑数据进行形式化验证，其中，形式化验证方法从状态空间的角度出发，对其进行模型检验。对于一个完善的联锁系统，除了要通过测试说明各项功能需求被正确无误的实现，还必须验证上述各种危险事件的不可能发生。本发明采用归纳验证和模型检验相结合的形式化验证方法可证明系统的输出无法导致危险事件发生。其中，通过模型检验可以覆盖每一个周期的所有状态空间，而通过归纳验证，则可以覆盖所有的周期。
并且，在联锁数据准备过程中，以往主要通过经验来进行联锁数据的测试以验证其安全性，但是其具体是通过遍历的方法来测试，其无法覆盖所有状态空间的问题，且在有限的安全需求情况下遍历测试一个中小型车站需消耗长达2个月的测试时间，而本发明采用联锁数据的形式化验证可以在1天左右完成联锁数据安全性验证工作，极大的提升了联锁数据验证的范围和效率，并节约了人力成本，从而在坚实的理论基础上以先进的技术方法提升了系统软件安全性，进一步保障了行车的安全。
另外，本发明已经被应用于iLOCK联锁系统联锁数据的安全验证，并对实际车站数据开通应用。本发明采用形式化方法对联锁数据进行验证，为系统的安全提供了保障。由于联锁系统内部安全主要涉及联锁数据中的布尔逻辑，而本发明采用的联锁形式化验证是从系统的安全需求出发，通过模型检验证明联锁软件的安全需求已经实现且系统功能满足系统需求，并且，本发可通过验证尽早发现联锁系统设计上的缺陷，提升产品质量和安全性。
综上所述，本发明采用归纳验证和模型检验相结合的形式化验证方法可覆盖系统在某个测试场景下的所有的状态空间，并可对危险事件不可能发生情况进行验证；本发明采用形式化建模语言建立联锁数据形式化验证通用模 型可防止出现对需求理解的偏差而造成设计错误或测试错误的情况；本发明建立联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系，并根据映射关系对待验证联锁数据进行安全转化，得到联锁数据形式化验证通用模型需求的通用验证数据，可使得该方法能够适用于复杂站型；另外，本发明还提供了完整的形式化验证工具执行数据证明的过程，并且本发明还能够生成独立的联锁数据验证报告，以为系统安全性提供有效的安全论据，方便进行项目安全评估；以及，还提供了联锁数据对安全需求属性验证范围的配置，本发明根据配置选择需要验证的通用安全需求，对不同车站联锁功能联锁数据提供定制化的验证，可减少验证过程中非本站联锁功能安全需求模型的遍历，从而可有效提高软件验证效率，并对于不同规模的项目实施验证更加灵活；最后，本发明还提供了联锁数据安全转换技术，以生成通用格式验证文件，从而可为不同格式联锁数据提供统一文件处理格式，以方便验证模型在不同联锁系统中的灵活应用。
尽管本发明的内容已经通过上述优选实施例作了详细介绍，但应当认识到上述的描述不应被认为是对本发明的限制。在本领域技术人员阅读了上述内容后，对于本发明的多种修改和替代都将是显而易见的。因此，本发明的保护范围应由所附的权利要求来限定。

Claims (16)

  1. 一种联锁数据安全性的形式化验证方法，其特征在于，包括：
    采用形式化建模语言建立联锁数据形式化验证通用模型；
    建立所述联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；
    根据所述映射关系对待验证联锁数据进行安全转化，得到所述联锁数据形式化验证通用模型需求的通用验证数据；
    从所述通用验证数据中选择验证对象，并选择验证算法通过形式化验证工具自动验证所述验证对象，以完成联锁数据安全性的形式化验证。
  2. 如权利要求1所述的联锁数据安全性的形式化验证方法，其特征在于，通过所述联锁数据形式化验证通用模型描述联锁系统通用安全需求。
  3. 如权利要求1所述的联锁数据安全性的形式化验证方法，其特征在于，采用双链联锁数据安全转换工具对所述待验证联锁数据进行安全转化。
  4. 如权利要求3所述的联锁数据安全性的形式化验证方法，其特征在于，所述联锁数据包括描述联锁运算逻辑的VTL文件、描述站场拓扑结构和信号设备属性的TLE文件、描述联锁系统与其他系统的SyID接口文件和站场设备功能列表STA配置文件中的至少一种。
  5. 如权利要求4所述的联锁数据安全性的形式化验证方法，其特征在于，在得到所述通用验证数据之后，并进行自动验证之前，还包括：根据所述站场设备功能列表STA配置文件确定联锁数据形式化验证的范围。
  6. 如权利要求1所述的联锁数据安全性的形式化验证方法，其特征在于，所述形式化验证工具在发生验证错误时，还通过人机接口输出验证错误问题列表。
  7. 如权利要求6所述的联锁数据安全性的形式化验证方法，其特征在于，还包括：
    获取并分析所述验证错误问题列表，以分析所述验证错误问题列表中是否存在反例描述，并在存在反例描述时，根据所述反例描述执行反 例验证调试；
    获取反例验证分析结果，并根据所述反例验证分析结果修正所述待验证联锁数据，以及重新返回对所述待验证联锁数据进行安全转化的步骤，直至所有验证对象通过形式化验证。
  8. 如权利要求7所述的联锁数据安全性的形式化验证方法，其特征在于，在所述验证对象通过形式化验证之后，还包括：生成联锁数据安全验证报告。
  9. 如权利要求3所述的联锁数据安全性的形式化验证方法，其特征在于，还包括：对所述双链联锁数据安全转换工具输出的双链文件进行比较，并在所述双链文件比较一致时，从所述双链文件中任意取一链输出文件作为所述形式化验证工具的输入数据。
  10. 如权利要求4所述的联锁数据安全性的形式化验证方法，其特征在于，所述VTL文件包括车站各设备的状态信息、联锁运算的内部逻辑信息、联锁运算的对外控制命令信息以及描述各设备变量间的联锁逻辑运算关系的布尔等式信息中的至少一种。
  11. 如权利要求4所述的联锁数据安全性的形式化验证方法，其特征在于，所述TLE文件包括车站内所有信号设备的名称和设备属性信息、各设备间的前后连接关系信息，以及描述信号设备联锁制约关系的进路表信息中的至少一种。
  12. 如权利要求4所述的联锁数据安全性的形式化验证方法，其特征在于，所述SyID接口文件包括与上位机接口的操作请求和设备状态显示信息、与轨旁设备接口的设备控制命令和状态检测信息、与列控设备接口的进路状态信息，以及与全电子执行单元接口的驱动采集信息中的至少一种。
  13. 如权利要求4所述的联锁数据安全性的形式化验证方法，其特征在于，所述站场设备功能列表STA配置文件包括联锁车站设备信息、进路信息、信号显示信息、接近区段信息和进路解锁延时时间信息中的至少一种。
  14. 一种联锁数据安全性的形式化验证系统，其特征在于，包括：
    验证通用模型建立模块，用于建立所述联锁数据形式化验证通用模型，并建立所述联锁数据形式化验证通用模型中设定的安全逻辑属性与联锁数据中的联锁设备、联锁逻辑参数和车站联锁功能之间的映射关系；
    联锁数据安全转化模块，与所述验证通用模型建立模块连接，所述联锁数据安全转化模块用于根据所述映射关系，对待验证联锁数据进行安全转化，得到所述联锁数据形式化验证通用模型需求的通用验证数据；
    形式化安全验证模块，与所述联锁数据安全转化模块连接，所述形式化安全验证模块用于根据所选择的验证算法对从所述通用验证数据中选择的验证对象进行自动验证；
    形式化反例验证调试模块，与所述形式化安全验证模块连接，所述形式化反例验证调试模块用于获取并分析验证错误问题列表，以及在所述验证错误问题列表存在反例描述时，对所述反例描述执行反例验证调试；
    联锁数据安全验证结果生成模块，与所述形式化安全验证模块连接，所述联锁数据安全验证结果生成模块用于根据所述形式化安全验证模块的输出结果生成联锁数据安全验证报告。
  15. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时，实现如权利要求1-13中任一项所述的联锁数据安全性的形式化验证方法。
  16. 一种电子设备，其特征在于，包括处理器和存储器，所述存储器上存储有计算机程序，所述计算机程序被所述处理器执行时，实现如权利要求1-13中任一项所述的联锁数据安全性的形式化验证方法。
PCT/CN2022/131326 2022-09-19 2022-11-11 联锁数据安全性的形式化验证方法和系统 WO2024060377A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202211139197.8 2022-09-19
CN202211139197.8A CN115525929A (zh) 2022-09-19 2022-09-19 联锁数据安全性的形式化验证方法和系统

Publications (1)

Publication Number Publication Date
WO2024060377A1 true WO2024060377A1 (zh) 2024-03-28

Family

ID=84697921

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/131326 WO2024060377A1 (zh) 2022-09-19 2022-11-11 联锁数据安全性的形式化验证方法和系统

Country Status (2)

Country Link
CN (1) CN115525929A (zh)
WO (1) WO2024060377A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105678022A (zh) * 2016-02-24 2016-06-15 卡斯柯信号有限公司 面向方面的联锁系统安全需求形式化建模及验证方法
EP3395643A1 (en) * 2017-04-28 2018-10-31 ALSTOM Transport Technologies Method for checking safety requirements of ssi-based data used in an interlocking control system
CN111338948A (zh) * 2020-02-24 2020-06-26 华东师范大学 形式化验证系统
CN113031934A (zh) * 2021-04-06 2021-06-25 卡斯柯信号有限公司 一种用于形式化验证的联锁数据安全转换方法及翻译器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105678022A (zh) * 2016-02-24 2016-06-15 卡斯柯信号有限公司 面向方面的联锁系统安全需求形式化建模及验证方法
EP3395643A1 (en) * 2017-04-28 2018-10-31 ALSTOM Transport Technologies Method for checking safety requirements of ssi-based data used in an interlocking control system
CN111338948A (zh) * 2020-02-24 2020-06-26 华东师范大学 形式化验证系统
CN113031934A (zh) * 2021-04-06 2021-06-25 卡斯柯信号有限公司 一种用于形式化验证的联锁数据安全转换方法及翻译器

Also Published As

Publication number Publication date
CN115525929A (zh) 2022-12-27

Similar Documents

Publication Publication Date Title
Forster et al. Verification of business process quality constraints based on visual process patterns
CN109634600B (zh) 一种基于安全扩展SysML和AADL模型的代码生成方法
US20170236234A1 (en) Risk management method and system for a land transporation system
CN107220539B (zh) 基于需求的ima安全验证分析方法
Bahig et al. Formal verification of automotive design in compliance with ISO 26262 design verification guidelines
Chen et al. Formal modeling and validation of stateflow diagrams
Filipovikj et al. SMT-based consistency analysis of industrial systems requirements
CN112527256A (zh) 一种集成化水电站模型开发系统及方法
Bernaerts et al. Validating industrial requirements with a contract-based approach
Ratiu et al. FASTEN: an extensible platform to experiment with rigorous modeling of safety-critical systems
Jetley et al. Applying software engineering practices for development of industrial automation applications
Gocht et al. End-to-end verification for subgraph solving
WO2024060377A1 (zh) 联锁数据安全性的形式化验证方法和系统
CN104216703A (zh) 嵌入式软件系统程序的开发方法
Singh et al. Specification-guided automated debugging of CPS models
CN114510414B (zh) 一种基于符号执行对智能合约功能属性进行形式化验证的方法及系统
Botham et al. PICASSOS–Practical applications of automated formal methods to safety related automotive systems
CN111427565B (zh) 形式化验证方法
Ortega‐Cabezas et al. Application of rule‐based expert systems in hardware‐in‐the‐loop simulation case study: Software and performance validation of an engine electronic control unit
CN112232031A (zh) 电力物联网边缘数据模型校验方法、装置及存储介质
CN115398358A (zh) 用于分析可编程逻辑控制器程序的方法
Semeráth et al. Validation of Derived Features and Well-Formedness Constraints in DSLs: By Mapping Graph Queries to an SMT-Solver
Filipovikj et al. Bounded invariant checking for stateflow programs
Ortega-Cabezas et al. Application of Rule-Based Expert Systems and Dynamic-Link Libraries to Enhance Hardware-in-The-Loop Simulation Results.
US20240211653A1 (en) Verification of model-based systems engineering artifacts

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22959378

Country of ref document: EP

Kind code of ref document: A1