123 research outputs found
Flow fact automata for the expression and the integration of properties in WCET analysis
No full textDans le domaine des systèmes critiques, l'analyse des temps d'exécution des programmes est nécessaire pour planifier et ordonnancer au mieux différentes tâches et par extension pour dimensionner les systèmes. La durée d'exécution d'un programme dépend de divers facteurs comme ses entrées ou le matériel utilisé. Or cette variation temporelle pose problème dans les systèmes temps-réel dans lesquels il est nécessaire de dimensionner précisément les temps processeur alloués à chaque tâche, et pour cela, connaître leur temps d'exécution au pire cas. Au sein de l'équipe TRACES à l'IRIT, nous cherchons à calculer une borne supérieure à ce temps d'exécution au pire cas qui soit la plus précise possible. Pour cela, nous travaillons sur le graphe de flot de contrôle d'un programme qui représente un sur-ensemble des ses exécutions possibles, que nous accompagnons d'annotations sur des comportements spécifiques du programme susceptibles de réduire la sur-approximation de notre estimation. Dans les outils destinés au calcul du temps d'exécution au pire cas des programmes, les annotations sont habituellement exprimées et intégrées grâce à des langages d'annotation spécifiques. Nous proposons d'utiliser des automates appelés automates d'annotation de flot en lieu et place de ces langages, afin de fonder non seulement l'expression, mais également l'intégration d'annotations dans l'analyse sur des bases formelles. Nous présentons ces automates enrichis de contraintes, de variables et d'une hiérarchie et nous montrons comment ils supportent les divers types d'annotations utilisés dans le domaine de l'analyse du temps d'exécution au pire cas. Par ailleurs, l'intégration des annotations dans une analyse se fait habituellement par l'association de contraintes numériques au graphe de flot de contrôle. Les automates que nous présentons supportent cette méthode mais leur expressivité offre également de nouvelles possibilités d'intégration basées sur le dépliage du graphe de flot de contrôle. Nous présentons des résultats expérimentaux issus de la comparaison de ces deux méthodes qui montrent comment le dépliage de graphe peut améliorer la précision de l'analyse. A terme, ce gain de précision dans l'estimation du temps d'exécution au pire cas permettra de mieux exploiter le matériel sans faire courir de risques à l'utilisateur ou au système.In the domain of critical systems, the analysis of execution times of programs is needed to schedule various task at best and by extension to dimension the whole system. The execution time of a program depends on multiple factors such as entries of the program or the targeted hardware. Yet this time variation is an issue in real-time systems where the duration is required to allow correct processor time to each task, and in this purpose, we need to know their worst-case execution time. In the TRACES team at IRIT, we try to compute a safe upper bound of this worst-case execution time that would be as precise as possible. In order to do so, we work on the control flow graph of a program that represents an over-set of its possible executions and we combine this structure with annotations on specific behaviours of the program that might reduce the over-approximation of our estimation. Tools designed to compute worst-case execution times of programmes usually support the expression and the integration of annotations thanks to specific annotation languages. Our proposal is to replace these languages with a type of automata named flow fact automata so that not only the expression but also the integration of annotations in the analysis inherit from the formal basis of automata. Based on these automata enriched with constraints, variables and a hierarchy, we show how they support the various annotation types used in the worst-case execution time domain. Additionally, the integration of annotations in an analysis usually lead to associate numerical constraint to the control flow graph. The automata presented here support this method but their expressiveness offers new integration possibilities based on the partial unfolding of control flow graph. We present experimental results from the comparison of these two methods that show how the graph unfolding can improve the analysis precision. In the end, this precision gain in the worst-case execution time will ensure a better usage of the hardware as well as the absence of risks for the user or the system itself
Quantifying the Precision of Numerical Abstract Domains
No full textIn the context of the Abstract Interpretation framework, initiated by Cousot and Cousot to model program static analyses, numerous numerical abstract domains have been proposed. Their number is due to both the intended usage of the domains (properties to prove) and the trade-off between precision and computation efficiency. In this paper, we propose a way to quantify the precision of abstract values belonging to numerical domains like intervals, octagons or polyhedra. To do so, we rely on the fact that abstract values of that kind describe some volumes that can be measured. The article focuses on the definition and computation of this precision, also providing examples of application
Quantifying the Precision of Numerical Abstract Domains
No full textIn the context of the Abstract Interpretation framework, initiated by Cousot and Cousot to model program static analyses, numerous numerical abstract domains have been proposed. Their number is due to both the intended usage of the domains (properties to prove) and the trade-off between precision and computation efficiency. In this paper, we propose a way to quantify the precision of abstract values belonging to numerical domains like intervals, octagons or polyhedra. To do so, we rely on the fact that abstract values of that kind describe some volumes that can be measured. The article focuses on the definition and computation of this precision, also providing examples of application
Improving WCET Analysis Precision through Automata Product
No full textReal-time scheduling of application requires sound estimation of the Worst-Case Execution Time (WCET) of each task. Part of the over-approximation introduced by the WCET analysis of a task comes from not taking into account the fact that the (implicit) worst-case execution path may be infeasible. This article does not address the question of finding infeasible paths but provides a new formalism of automata to describe sets of infeasible paths. This formalism combines the possibilities to express state-based path acceptance (like in regular automata), constraints on counters (in the Implicit Path Enumeration Technique fashion) and contexts of validity (like in State charts). We show the applicability of our proposal by performing infeasible paths aware WCET analyses within the OTAWA framework. We provide algorithms that transform the control flow graph and/or the constraints system supporting the WCET analysis in order to exclude the specified paths
Precise Interprocedural Analysis in the Presence of Pointers to the Stack
No full textInternational audienceIn a language with procedures calls and pointers as parameters, an instruction can modify memory locations anywhere in the call-stack. The presence of such side effects breaks most generic interprocedural analysis methods, which assume that only the top of the stack may be modified. We present a method that addresses this issue, based on the definition of an equivalent local semantics in which writing through pointers has a local effect on the stack. Our second contribution in this context is an adequate representation of summary functions that models the effect of a procedure, not only on the values of its scalar and pointer variables, but also on the values contained in pointed memory locations. Our implementation in the interprocedural analyser PInterproc results in a verification tool that infers relational properties on the value of Boolean, numerical and pointer variables
Hierarchical Shape Abstraction of Dynamic Structures in Static Blocks
No full textInternational audienceWe propose a hierarchical shape abstract domain, so as to infer structural invariants of dynamic structures such as lists living inside static structures, such as arrays. This programming pattern is often used in safety critical embedded software that need to ''allocate'' dynamic structures inside static regions due to dynamic memory allocation being forbidden in this context. Our abstract domain precisely describes such hierarchies of structures. It combines several instances of simple shape abstract domains, dedicated to the representation of elementary shape properties, and also embeds a numerical abstract domain. This modular construction greatly simplifies the design and the implementation of the abstract domain. We provide an implementation, and show the effectiveness of our approach on a problem taken from a real code
Inferring Effective Types for Static Analysis of C Programs
No full textInternational audienceThe C language does not have a specific Boolean type: Boolean values are encoded with integers. This is also true for enumerated types, that may be freely and silently cast to and from integers. On the other hand, verification tools aiming at inferring the possible values of variables at each program point may benefit from the information that some (integer) variables are used solely as Boolean or enumerated type variables, or more generally as finite type variables with a small domain. Indeed, specialized and efficient symbolic representations such as BDDs may be used for representing properties on such variables, whereas approximated representations like intervals and octagons are better suited to larger domain integers and floating-points variables. Driven by this motivation, this paper proposes a static analysis for inferring more precise types for the variables of a C program, corresponding to their effective use. The analysis addresses a subset of the C99 language, including pointers, structures and dynamic allocation
Life and Work of Dr. Vilko Anderlić
No full textNa temelju arhivske građe Dijecezanskog arhiva u Đakovu članak obrađuje, povodom 120. obljetnice rođenja, život i rad dr. Vilka Anderlića (1882.-1957.), svećenika Đakovačke i Srijemske biskupije i profesora na Visokoj bogoslovnoj školi u Đakovu te pisca prvog priručnika katoličke društvene nauke, pod naslovom „Sociologija“, objavljenog 1912. godine u Đakovu. Nakon prikaza profesorske službe (1911.-1914.) te župničke službe u Berku (1914.-1930.) i Sotinu (1930.-1957.) članak ukazuje na određene probleme s kojima se dr. Anderlić susretao u svojoj pastoralnoj službi i koji su odredili njegov spisateljski rad. Ističe se tako nacionalno pitanje u župi Sotin, problem s vjeronaukom u školama nakon 1945. godine te razna gospodarska pitanja (društvena pravednost, komunalna politika, seljačko i radničko pitanje, žensko pitanje), nastala prodorom liberalizma i kasnije marksističke ideologije. Članak završava prikazom izdavačke i uredničke djelatnosti dr. Anderlića u tjedniku „Hrvatski Borac“ te njegovom iscrpnom bibliografijom radova.On the occasion of the 120'h birth anniversary of Dr. Vilko Anderlić, the article portrays his life and work (1882 - 1957). Priest in the Diocese of Đakovo and Srijem, professor at the School of Theology in Đakovo, Dr. Anderlić was also the author of the first manual of Catholic social doctrine published in Đakovo in 1912 under the title "Sociology". The article first focuses on his teaching (1911 - 1914), then the time when he was a parish priest in Berok (1914 - 1930) and Sotin (1930 -1957), then it points to certain difficulties Dr. Anderlić was facing in his pastoral work, difficulties which somehow defined his writing. Among the problems he was facing we can mention the ethnic issue in Sotin, problems with catechism in schools after 1945, various economic issues (social justice, municipal system, peasents', workers' and women's rights issues), which were a result of the outburst of liberalism and later on Marxist ideology. In its conclusion the article shows a survey of Dr. Anderlić's publishing and editorial work in the weekly magazine "Hrvatski Borac", presenting a meticulous bibliography of his works
Long-Run Cost Analysis by Approximation of Linear Operators over Dioids
No full textInternational audienceIn this paper we present a semantics-based framework for analysing the quantitative behaviour of programs with respect to resource usage. We start from an operational semantics in which costs are modelled using a dioid structure. The dioid structure of costs allows the definition of the quantitative semantics as a linear operator. We then develop a theory of approximation of such a semantics, which is akin to what is offered by the theory of abstract interpretation for analysing qualitative properties, in order to compute effectively global cost information from the program. We focus on the notion of long-run cost, which models the asymptotic average cost of a program. The abstraction of the semantics has to take two distinct notions of order into account: the order on costs and the order on states. We prove that our abstraction technique provides a correct approximation of the concrete long-run cost of a program
Concrete Memory Models for Shape Analysis
No full textInternational audienceThis paper discusses four store-based concrete memory models. We characterize memory models by the class of pointers they support and whether they use numerical or symbolic offsets to address values in a block. We give the semantics of a C-like language within each of these memory models to illustrate their differences. The language we consider is a fragment of Leroy's Clight, including arrays, pointer arithmetics but excluding casts. All along the paper, we link these concrete memory models with existing shape analyses
- …
