SAS'01 Invited Industrial Static Analysis Tool Demos


Reinhold Heckmann (AbsInt Angewandte Informatik GmbH)

Tool demo: Stack Usage Analysis
Stack overflow is now a thing of the past!!

Abstract: On many typical embedded systems, the memory for the stack(s) has to be allocated statically by the system designer. Due to the complexity of embedded software this is often a challenging task. Typical applications have to handle many sources of inputs which often requires complex interrupt handling code. Underestimating stack usage can lead to serious runtime errors which can be difficult to find. Overestimating stack usage means a waste of the scarce memory resources.
    We present a program analysis tool that determines automatically the stack usage of an application. This not only reduces development effort but also helps to prevent runtime errors due to stack overflow. The latter point is especially important for safety-critical applications.
    The tool determines system and user stack heights for applications given as a set of .src format assembly files produced by the Tasking C compiler for the popular Infineon C16x and STMicroelectronics ST10 microcontroller families. First, an application-wide control-flow graph is calculated. On this graph, an interprocedural ``constant propagation'' on the stack pointer registers is performed.
    The analysis results are presented by means of a software visualization component. Stack height differences are shown as annotations in the call graph and control-flow graph of the application. This detailed information on stack usage provides valuable feedback in optimizing the stack usage of an application.


Reinhold Heckmann (AbsInt Angewandte Informatik GmbH)

Tool demo:
Worst Case Execution Time Prediction for Hard Real-Time Systems

Abstract: Computers controlling potentially hazardous machinery and systems are expected to always provide their answers within reliable time bounds. Consequently, for the modeling and planning of such embedded systems it is essential that the worst case execution times (WCET) of all program tasks are known.
    Modern processor components like caches and pipelines complicate the task of determining the WCET considerably, since the execution time of a single instruction may depend on the execution history. For example, the safe yet almost never valid assumption of a cache hit never occurring results in a serious overestimate of the WCET.
    We present a program analysis tool that determines automatically a safe upper bound for the execution time of a task in an embedded application. The tool reads an executable in binary form for the popular Motorola ColdFire 5307 microcontroller.
    First, an application-wide control-flow graph is reconstructed. Then, a value analysis computes address intervals of data accesses (interval analysis [Cousot & Cousot, 1977]). These intervals are used in a combined interprocedural cache and pipeline analysis that finds upper bounds for the runtimes of basic blocks in all execution contexts. These results plus user-provided upper bounds for loop counts are automatically translated into an integer linear program whose solution bounds the execution time of the task.
    This static analysis approach allows for overcoming traditional error-prone and expensive methods, like partitioning the application into code snippets, determining their worst-case inputs and manual measurement of their runtime, and combining these results to find the worst-case path.
    Thus our approach not only reduces development effort but also helps to prevent runtime errors due to missed deadlines. The latter point is especially important for safety-critical applications.