Certifying and Reasoning on Cost Annotations in C Programs

Abstract

We present a so-called labelling method to enrich a compiler in order to turn it into a "cost annotating compiler", that is, a compiler which can lift pieces of information on the execution cost of the object code as cost annotations on the source code. These cost annotations characterize the execution costs of code fragments of constant complexity. The first contribution of this paper is a proof methodology that extends standard simulation proofs of compiler correctness to ensure that the cost annotations on the source code are sound and precise with respect to an execution cost model of the object code. As a second contribution, we demonstrate that our label-based instrumentation is scalable because it consists in a modular extension of the compilation chain. To that end, we report our successful experience in implementing and testing the labelling approach on top of a prototype compiler written in ocaml for (a large fragment of) the C language. As a third and last contribution, we provide evidence for the usability of the generated cost annotations as a mean to reason on the concrete complexity of programs written in C. For this purpose, we present a Frama-C plugin that uses our cost annotating compiler to automatically infer trustworthy logic assertions about the concrete worst case execution cost of programs written in a fragment of the C language. These logic assertions are synthetic in the sense that they characterize the cost of executing the entire program, not only constant-time fragments. (These bounds may depend on the size of the input data.) We report our experimentations on some C programs, especially programs generated by a compiler for the synchronous programming language Lustre used in critical embedded software.

Formal Verification of Loop Bound Estimation for WCET Analysis

“…In P, there are 2 annotations, written as 2 calls to a specific built-in function and used here to mark loop entries. 3 They are attached to program points 4 and 6 and will be transported throughout compilation. The CompCert compiler will place the comment "loop1" (resp.…”

“…To the best of our knowledge, the only work related to formal verification of loop bound calculation is [3], where the formal verification consists in using Hoare logic to verify that a program satisfies its specification including a cost annotation (expressed by an equality of the form global cost = constant value). A Frama-C plugin has been developed in order to experiment the approach on simple programs without nested loops.…”

Indexed Labels for Loop Iteration Dependent Costs

“…), and cost-labelled statements: S, T ::= · · · | α : S Cost labels allow us to track some program points along the compilation chain. For further details we refer to [6].…”

“…The theoretical basis of the CerCo compiler has been outlined by Amadio et al [6], where in particular the labelling approach is described. Summarising, the proposal consists in 'decorating' the source code by inserting labels at key points.…”

Linear dependent types in a call-by-value scenario

“…A recent proposal by Amadio and Régis-Gianas [34] allows to reason on the the cost of higher-order functional programs by way of so-called cost-annotations, being sure that the actual behavior of compiled code somehow reflects the annotation. The logic in which cost annotations are written, however, is a higher-order Hoare logic.…”