Abstract. The determination of upper bounds on execution times, commonly called WorstCase Execution Times (WCETs), is a necessary step in the development and validation process for hard real-time systems. This problem is hard if the underlying processor architecture has components such as caches, pipelines, branch prediction, and other speculative components. This article describes different approaches to this problem and surveys several commercially available tools and research prototypes.

We present a family of abstract-interpretation algorithms that are capable of determining \shape invariants" of programs that perform destructive updating on dynamically allocated storage. The main idea is to represent the stores that can possibly arise during execution using three-valued logical structures.Questions about properties of stores can be answered by evaluating predicate-logic formulae using Kleene's semantics of three-valued logic:If a formula evaluates to true, then the formula holds in every store represented by the three-valued structure. If a formula evaluates to false, then the formula does not hold in any store represented by the three-valued structure.If a formula evaluates to unknown, then we do not know if this formula always holds, never holds, or sometimes holds and sometimes does not hold in the stores represented by the three-valued structure. Three-valued logical structures are thus a conservative representation of memory stores.The approach described is a parametric framework: It provides the basis for generating a family of shape-analysis algorithms by varying the vocabulary used in the three-valued logic.

We present a family of abstract-interpretation algorithms that are capable of determining "shape invariants" of programs that perform destructive updating on dynamically allocated storage. The main idea is to represent the stores that can passibly arise during execution using three-valued logical structures.Questions about properties of stores can be answered by evaluating predicate-logic formulae using Kleene's semantics of three-valued logic:l If a formula evaluates to true, then the formula holds in every store represented by the three-valued structure.l If a formula evaluates to false, then the formula does not hold in any store represented by the three-valued structure.l If a formula evaluates to unknown, then we do not know if this formula always holds, never holds, or sometimes holds and sometimes does not hold in the stores represented by the three-valued structure.Three-valued logical structures are thus a conservative representation of memory stores. The approach described is a parametric framework: It provides the basis for generating a family of shape-analysis algorithms by varying the vocabulary used in the three-valued logic.Permission to make digital or hard copies of all or parl ufthis work for personal or classroom me is granted withwt fee procided that copies are not made or distrihutcd for profit or cnrnmercinl advantage IIKI that copies bear this notice and the full citation on the first page. To copy otherwise. to republid~, to post on sewers or to redistribute tn lists, requires prior specific permission anJ!or a fee.

No abstract

No abstract

No abstract

No abstract

interpretation is a technique for the static detection of dynamic properties of programs. It is semantics based, that is, it computes approximative properties of the semantics of programs. On this basis, it allows for correctness proofs of analyses. It replaces commonly used ad hoc techniques by systematic, provable ones, and it allows the automatic generation of analyzers from speci cations as in the Program Analyzer Generator, PAG. In this paper, abstract interpretation is applied to the problem of predicting the cache behavior of programs. Abstract semantics of machine programs are dened which determine the contents of caches. For interprocedural analysis, existing methods are examined and a new approach that is especially tailored for the cache analysis is presented. This allows for a static classi cation of the cache behavior of memory references of programs. The calculated information can be used to sharpen worst case execution time estimations. It is possible to analyze instruction, data, and combined instruction/data caches for common (re)placement and write strategies. Experimental results are presented that demonstrate the applicability of the analysis.