Analysing Switch-Case Code with Abstract Execution

Constructing the control-flow graph (CFG) of machine code is made difficult by dynamic transfers of control (DTC), where the address of the next instruction is computed at run-time. Switchcase statements make compilers generate a large variety of machine-code forms with DTC. Two analysis approaches are commonly used: pattern-matching methods identify predefined instruction patterns to extract the target addresses, while analytical methods try to compute the set of target addresses using a general value-analysis. We tested the abstract execution method of the SWEET tool as a value analysis for switch-case code. SWEET is here used as a plugin to the Bound-T tool: thus our work can also be seen as an experiment in modular tool design, where a general value-analysis tool is used to aid the CFG construction in a WCET analysis tool. We find that the abstract-execution analysis works at least as well as the switch-case analyses in Bound-T itself, which are mostly based on pattern-matching. However, there are still some weaknesses: the abstract domains available in SWEET are not well suited to representing sets of DTC target addresses, which are small but sparse and irregular. Also, in some cases the abstract-execution analysis fails because the used domain is not relational, that is, does not model arithmetic relationships between the values of different variables. Future work will be directed towards the design of abstract domains eliminating these weaknesses

Teaching WCET Analysis in Academia and Industry: A Panel Discussion

The last item on the programme of the WCET\u2709 workshop was a panel discussion on "Teaching WCET analysis in academia and industry". The panelists presented three position statements to initiate a general discussion of the subject. This summary contains the panelists\u27 position statements and notes of the panel discussion

The WCET Tool Challenge 2011

Following the successful WCET Tool Challenges in 2006 and 2008, the third event in this series was organized in 2011, again with support from the ARTIST DESIGN Network of Excellence. Following the practice established in the previous Challenges, the WCET Tool Challenge 2011 (WCC'11) defined two kinds of problems to be solved by the Challenge participants with their tools, WCET problems, which ask for bounds on the execution time, and flow-analysis problems, which ask for bounds on the number of times certain parts of the code can be executed. The benchmarks to be used in WCC'11 were debie1, PapaBench, and an industrial-strength application from the automotive domain provided by Daimler AG. Two default execution platforms were suggested to the participants, the ARM7 as "simple target'' and the MPC5553/5554 as a "complex target,'' but participants were free to use other platforms as well. Ten tools participated in WCC'11: aiT, Astr\'ee, Bound-T, FORTAS, METAMOC, OTAWA, SWEET, TimeWeaver, TuBound and WCA

OASIcs, Volume 10, WCET\u2709, Complete Volume

OASIcs, Volume 10, WCET\u2709, Complete Volum

Abstract COMPUTING TIME AS A PROGRAM VARIABLE: A WAY AROUND INFEASIBLE PATHS

Conditional branches connect the values of program variables with the execution paths and thus with the execution times,  including the worstcase execution time (WCET). Flow analysis aims to discover this connection and represent it as loop bounds and other path constraints. Usually,  a specific analysis of the dependencies between branch conditions and assignments to variables creates some representation of the feasible paths,  for example as IPET executioncount constraints, from which a WCET bound is calculated. This paper explores another approach that uses a more direct connection between variable values and execution time. The execution time is modeled as a program variable. An analysis of the dependencies between variables,  including the executiontime variable,   gives   a   WCET   bound   that   excludes   many   infeasible   paths. Examples   show   that   the approach often works,  in principle. It remains to be seen if it is scalable to real programs. 1

Analysing SwitchCase Tables by Partial Evaluation

Tracing the flow of control in code generated from switchcase statements is difficult for static program analysis tools when the code contains jumps to dynamically computed target addresses. Analytical methods such as abstract interpretation using integer intervals can work for some forms of switchcase code, for example a jump via a table of addresses indexed 1.. n, but fail when the target compiler encodes the switchcase structure in a ROM table with a complex format and uses a library routine to interpret the table at runtime. This paper shows how to extract the flow of control from such switchcase tables by partial evaluation of the tableinterpreting routine. The resulting controlflow graph allows accurate analysis of the execution time and the logical conditions for reaching each case in the switchcase statement. The method is implemented in Tidorum's BoundT tool for worstcase executiontime analysis. The implementation builds on some basic BoundT features for modeling program states in the flowgraph and propagating constant values through the graph. 1

WCET 2009 -- Preface to 9th International Workshop on Worst-Case Execution Time Analysis

On June 30, 2009, thirty-five people from nine countries and three continents met in Trinity College, Dublin, to hold the 9th International Workshop on Worst-Case Execution Time Analysis (WCET\u2709, http://www.artist-embedded.org/artist/WCET-2009.html). The workshop was organised as a satellite event of the 21st Euromicro Conference on Real-Time Systems (ECRTS\u2709, http://ecrts09.dsg.cs.tcd.ie). The final proceedings here presented contain the workshop papers as updated in response to the discussion at the workshop, the abstract of the invited talk by prof. Petru Eles, and a summary of the panel discussion that concluded the workshop. The slide presentations can be retrieved from the workshop web-site referenced above