TIC: a scalable model checking based approach to WCET estimation

Metta, Ravindra; Becker, Martin; Bokil, Prasad; Chakraborty, Samarjit; Venkatesh, R.

doi:10.1145/2907950.2907961

Cited by 12 publications

(7 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Possible improvements over this include: i) encoding some of the functional semantics of the program into the modelchecking problem [13,4] ii) using "trace partitioning" [18] or "path focusing" [14] in the abstract-interpretation phase.…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Ascertaining Uncertainty for Efficient Exact Cache Analysis

Touzeau

Maïza

Monniaux

et al. 2017

Computer Aided Verification

View full text Add to dashboard Cite

Abstract. Static cache analysis characterizes a program's cache behavior by determining in a sound but approximate manner which memory accesses result in cache hits and which result in cache misses. Such information is valuable in optimizing compilers, worst-case execution time analysis, and side-channel attack quantification and mitigation. Cache analysis is usually performed as a combination of "must" and "may" abstract interpretations, classifying instructions as either "always hit", "always miss", or "unknown". Instructions classified as "unknown" might result in a hit or a miss depending on program inputs or the initial cache state. It is equally possible that they do in fact always hit or always miss, but the cache analysis is too coarse to see it. Our approach to eliminate this uncertainty consists in (i) a novel abstract interpretation able to ascertain that a particular instruction may definitely cause a hit and a miss on different paths, and (ii) an exact analysis, removing all remaining uncertainty, based on model checking, using abstract-interpretation results to prune down the model for scalability. We evaluated our approach on a variety of examples; it notably improves precision upon classical abstract interpretation at reasonable cost.

show abstract

Section: Discussionmentioning

confidence: 99%

“…Metta et al [13] also employ model checking to increase the precision of WCET analysis. However, they do not take into account low-level features such as caches.…”

Section: Related Workmentioning

confidence: 99%

Ascertaining Uncertainty for Efficient Exact Cache Analysis

Touzeau

Maïza

Monniaux

et al. 2017

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…There are also techniques for improving the accuracy of cache analysis, e.g., by using symbolic execution or model checking to refine the cache analysis results [13,40,56] and by extending the analysis from single-core to multi-core CPUs [38]. However, none of these techniques considered speculative execution, which is the focus of our work.…”

Section: Related Workmentioning

confidence: 99%

Abstract interpretation under speculative execution

Wang

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Analyzing the behavior of a program running on a processor that supports speculative execution is crucial for applications such as execution time estimation and side channel detection. Unfortunately, existing static analysis techniques based on abstract interpretation do not model speculative execution since they focus on functional properties of a program while speculative execution does not change the functionality. To fill the gap, we propose a method to make abstract interpretation sound under speculative execution. There are two contributions. First, we introduce the notion of virtual control flow to augment instructions that may be speculatively executed and thus affect subsequent instructions. Second, to make the analysis efficient, we propose optimizations to handle merges and loops and to safely bound the speculative execution depth. We have implemented and evaluated the proposed method in a static cache analysis for execution time estimation and side channel detection. Our experiments show that the new method, while guaranteed to be sound under speculative execution, outperforms state-of-the-art abstract interpretation techniques that may be unsound.CCS Concepts • Software and its engineering → Formal software verification; Compilers; • Security and privacy → Cryptanalysis and other attacks. SpeculativeAbstract Interpretation Architectural Parameters (cache config., speculation depth) Control Flow Analysis

show abstract

“…The DOD relation is important (together with NTSCD) when we want to slice possibly non-terminating programs with irreducible control flow graphs and preserve their termination properties as well as data integrity [1,33]. This is a common requirement when slicing is used as a preprocessing step before program verification [9,23,26], worst-case execution time analysis [29], information flow analysis [18,19], analysis of concurrent programs [18] with busy-waiting synchronization or synchronization where possible spurious wake-ups of threads are guarded by loops (e.g., programs using the pthread library), and analysis of reactive systems and generic state-based models [2,24,33]. The DOD relation is studied in Sect.…”

Section: Introductionmentioning

confidence: 99%

Fast Computation of Strong Control Dependencies

Chalupa

Klaška

Strejček

et al. 2021

Computer Aided Verification

View full text Add to dashboard Cite

We introduce new algorithms for computing non-termination sensitive control dependence (NTSCD) and decisive order dependence (DOD). These relations on vertices of a control flow graph have many applications including program slicing and compiler optimizations. Our algorithms are asymptotically faster than the current algorithms. We also show that the original algorithms for computing NTSCD and DOD may produce incorrect results. We implemented the new as well as fixed versions of the original algorithms for the computation of NTSCD and DOD. Experimental evaluation shows that our algorithms dramatically outperform the original ones.

show abstract

TIC: a scalable model checking based approach to WCET estimation

Cited by 12 publications

References 19 publications

Ascertaining Uncertainty for Efficient Exact Cache Analysis

Ascertaining Uncertainty for Efficient Exact Cache Analysis

Abstract interpretation under speculative execution

Fast Computation of Strong Control Dependencies

Contact Info

Product

Resources

About