Program Paths Research Articles

Beyond loop bounds: comparing annotation languages for worst-case execution time analysis

Worst-case execution time (WCET) analysis is concerned with computing a precise-as-possible bound for the maximum time the execution of a program can take. This information is indispensable for developing safety-critical real-time systems, e. g., in the avionics and automotive fields. Starting with the initial works of Chen, Mok, Puschner, Shaw, and others in the mid and late 1980s, WCET analysis turned into a well-established and vibrant field of research and development in academia and industry. The increasing number and diversity of hardware and software platforms and the ongoing rapid technological advancement became drivers for the development of a wide array of distinct methods and tools for WCET analysis. The precision, generality, and efficiency of these methods and tools depend much on the expressiveness and usability of the annotation languages that are used to describe feasible and infeasible program paths. In this article we survey the annotation languages which we consider formative for the field. By investigating and comparing their individual strengths and limitations with respect to a set of pivotal criteria, we provide a coherent overview of the state of the art. Identifying open issues, we encourage further research. This way, our approach is orthogonal and complementary to a recent approach of Wilhelm et al. who provide a thorough survey of WCET analysis methods and tools that have been developed and used in academia and industry.

Program analysis via satisfiability modulo path programs

Path-sensitivity is often a crucial requirement for verifying safety properties of programs. As it is infeasible to enumerate and analyze each path individually, analyses compromise by soundly merging information about executions along multiple paths. However, this frequently results in a loss of precision. We present a program analysis technique that we call Satisfiability Modulo Path Programs (SMPP), based on a path-based decomposition of a program. It is inspired by insights that have driven the development of modern SMT(Satisfiability Modulo Theory) solvers. SMPP symbolically enumerates path programs using a SAT formula over control edges in the program. Each enumerated path program is verified using an oracle, such as abstract interpretation or symbolic execution, to either find a proof of correctness or report a potential violation. If a proof is found, then SMPP extracts a sufficient set of control edges and corresponding interference edges, as a form of proof-based learning. Blocking clauses derived from these edges are added back to the SAT formula to avoid enumeration of other path programs guaranteed to be correct, thereby improving performance and scalability. We have applied SMPP in the F-Soft program verification framework, to verify properties of real-world C programs that require path-sensitive reasoning. Our results indicate that the precision from analyzing individual path programs, combined with their efficient enumeration by SMPP, can prove properties as well as indicate potential violations in the large.

Interview: Progress on the FDA's Critical Path Initiative

Janet Woodcock is the Director of the US FDA's Center for Drug Evaluation and Research. Dr Woodcock has held various positions within the FDA's Office of the Commissioner from October 2003 until 1 April, 2008, as Deputy Commissioner and Chief Medical Officer, Deputy Commissioner for Operations and Chief Operating Officer and Director of the Critical Path Programs. She oversaw scientific and medical regulatory operations for the FDA. Dr Woodcock served as Director of the Center for Drug Evaluation and Research at the FDA from 1994 to 2005. She previously served in other positions at the FDA including Director of the Office of Therapeutics Research and Review and Acting Deputy Director of the Center for Biologics Evaluation and Research. Dr Woodcock received her MD from Northwestern Medical School (IL, USA), and completed further training and held teaching appointments at the Pennsylvania State University (PA, USA)and the University of California in San Francisco (CA, USA). She joined the FDA in 1986.

Migration management: an approach for improving strategy implementation

PurposeThis paper aims to investigates a process called “migration management.”, which the authors, Strategos consultants, believe that most companies need to link strategy development and strategy execution.Design/methodology/approachMigration management employs two core perspectives to achieve better strategy implementation – a “future state” description considers identity and a “migration path” charts action.”FindingsBy creating and properly using clear statements of desired future identity and sequenced, interrelated paths of action programs within management processes oriented toward learning and adaptation, companies have been able to overcome the dilemmas and challenges associated with traditional approaches to strategy implementation.Practical implicationsWith the intermediate future state and the overall migration path as guides, managers can translate the migration path programs into specific projects and initiatives.Originality/valueThe paper introduces the “future state” concept, which articulates what a knowledgeable observer would write if asked to describe the successful company and its new competencies at the end of the strategy time horizon. The paper describes the process for designing the migration path, the roadmap for getting to the “future state” from the present.

Sharp Static Analysis of Programs

Static program analysis has been studied for many years.It is an important topic in the research of programming languages and compilers.Recently,it has also attracted researchers from other areas such as formal methods and software engineering,and some ideas have been used for program verification and testing.This paper compares various static analysis techniques,according to the syntactic features,data types and correctness properties targeted by the techniques.The paper focuses on a class of analysis techniques that are based on program paths,especially symbolic execution;discusses the path feasibility problem,its difficulty and its subproblems.A method for computing a data coverage measure of paths is also described.

Effectively Metamorphic Testing Based on Program Path Analysis

Metamorphic testing is very practical and effective for programs with oracle problems.Much research has been done in this field.Based upon existed methods of metamorphic testing and program path-analysis,the authors first present a set of metamorphic testing criteria for the test with binary metamorphic relations.These criteria define the adequacy of metamorphic test suites at several different levels.Then,three new testing algorithms are given to generate test suites that could satisfy the criteria above.Finally,these algorithms' performances are fully proved with the technique of mutation analysis.The experiment results show that testing effects are greatly decided by the selection of metamorphic relations and testing criteria,and the algorithm APCEMST could detect faults quickly and exactly with fewer test cases than traditional method.

Tool path programming optimization for incremental sheet forming applications

Incremental sheet forming is an emerging process to manufacture sheet metal parts that is well adapted for small batch production or prototypes. The adjustment time is short, as it is sufficient to modify the tool motions to optimize the manufacturing process. Tool path generation therefore becomes a key topic linked to incremental sheet forming, and process characteristics ask for dedicated tool paths. Hence, this paper first discusses the impact of tool path types and other programming parameters on process implementation through an experimental campaign performed on a parallel kinematics machine tool. Then, a new approach to generate and control Intelligent CAM programmed tool paths is proposed. The major purpose of this innovative concept is to use process constraints for programming and controlling the tool path, which are adapted during the running of the CNC program according to real-time process data evaluation. Validation studies and an industrial implementation are finally presented to assess the efficiency of the proposed approach.

Dynamic warp formation

Recent advances in graphics processing units (GPUs) have resulted in massively parallel hardware that is easily programmable and widely available in today's desktop and notebook computer systems. GPUs typically use single-instruction, multiple-data (SIMD) pipelines to achieve high performance with minimal overhead for control hardware. Scalar threads running the same computing kernel are grouped together into SIMD batches, sometimes referred to as warps. While SIMD is ideally suited for simple programs, recent GPUs include control flow instructions in the GPU instruction set architecture and programs using these instructions may experience reduced performance due to the way branch execution is supported in hardware. One solution is to add a stack to allow different SIMD processing elements to execute distinct program paths after a branch instruction. The occurrence of diverging branch outcomes for different processing elements significantly degrades performance using this approach. In this article, we propose dynamic warp formation and scheduling, a mechanism for more efficient SIMD branch execution on GPUs. It dynamically regroups threads into new warps on the fly following the occurrence of diverging branch outcomes. We show that a realistic hardware implementation of this mechanism improves performance by 13%, on average, with 256 threads per core, 24% with 512 threads, and 47% with 768 threads for an estimated area increase of 8%.

Cross-cultural issues in linguistic, visual-quantitative, and written-numeric supports for mathematical thinking

An in-depth analysis of the major early numerical aspects (single-digit and multidigit addition and subtraction) in a representative Chinese textbook series and a US textbook series (Math Expressions) with major East Asian components illustrated how linguistic issues create different teaching and learning tasks for the same mathematical topic and how additional meaning-making supports may be needed in the US. Analyses of multidigit methods in several East Asian textbooks revealed a wide range of written-numeric support of the steps in these operations. Coherence and learning paths in both programs were identified. A framework that identifies elements of a coherent learning path of meaning-making supports is proposed to facilitate future cross-cultural analyses.

The Critical Path Program in Taiwan

Taiwan’s Critical Path Program facilitates the development process for niche products of new drug and medical devices. The program fosters a favorable regulatory environment by establishing guidance systems and identifying selected index cases for successful stories through achievement-based proactive consultation. A total of 27 index cases were selected from a total of 68 cases submitted. Two index cases have been terminated due to poor results. Five index cases have been ended with milestones achieved. In 2008, 21 index cases were actively in operation. Nine of them have advanced from the preclinical stage to the clinical stage. The proactive consultation mechanism, rolling review, impact on funding mechanisms, milestone achievement, and customer satisfaction feedback of this program are described in this article.

Generalizing neural branch prediction

Improved branch prediction accuracy is essential to sustaining instruction throughput with today's deep pipelines. Traditional branch predictors exploit correlations between pattern history and branch outcome to predict branches, but there is a stronger and more natural correlation between path history and branch outcome. We explore the potential for exploiting this correlation. We introduce piecewise linear branch prediction , an idealized branch predictor that develops a set of linear functions, one for each program path to the branch to be predicted, that separate predicted taken from predicted not taken branches. Taken together, all of these linear functions form a piecewise linear decision surface. We present a limit study of this predictor showing its potential to greatly improve predictor accuracy. We then introduce a practical implementable branch predictor based on piecewise linear branch prediction. In making our predictor practical, we show how a parameterized version of it unifies the previously distinct concepts of perceptron prediction and path-based neural prediction. Our new branch predictor has implementation costs comparable to current prominent predictors in the literature while significantly improving accuracy. For a deeply pipelined simulated microarchitecture our predictor with a 256-KB hardware budget improves the harmonic mean normalized instructions-per-cycle rate by 8% over both the original path-based neural predictor and 2Bc- gskew . The average misprediction rate is decreased by 16% over the path-based neural predictor and by 22% over 2Bc- gskew .

A foundation for flow-based program matching

Reasoning about program control-flow paths is an important functionality of a number of recent program matching languages and associated searching and transformation tools. Temporal logic provides a well-defined means of expressing properties of control-flow paths in programs, and indeed an extension of the temporal logic CTL has been applied to the problem of specifying and verifying the transformations commonly performed by optimizing compilers. Nevertheless, in developing the Coccinelle program transformation tool for performing Linux collateral evolutions in systems code, we have found that existing variants of CTL do not adequately support rules that transform subterms other than the ones matching an entire formula. Being able to transform any of the subterms of a matched term seems essential in the domain targeted by Coccinelle. In this paper, we propose an extension to CTL named CTLVW (CTL with variables and witnesses) that is a suitable basis for the semantics and implementation of the Coccinelles program matching language. Our extension to CTL includes existential quantification over program fragments, which allows metavariables in the program matching language to range over different values within different control-flow paths, and a notion of witnesses that record such existential bindings for use in the subsequent program transformation process. We formalize CTL-VW and describe its use in the context of Coccinelle. We then assess the performance of the approach in practice, using a transformation rule that fixes several reference count bugs in Linux code.

Smoothing and simplification algorithm for Computer Aided Manufacturing paths with complex curves

Abstract Using a Computer Aided Manufacturing (CAM) system based on the studied algorithm, displacements can be achieved across complex paths at constant velocity and with high precision without intermediate stops. This allows the use of laser as a tool for marking or machining. In addition, the algorithm reduces the number of needed points for path programming. The most frequent complex curves in CAD formats are simplified to straight lines and circular arcs. To have full constant velocity auxiliary paths of acceleration and deceleration are used.

EXE

This article presents EXE, an effective bug-finding tool that automatically generates inputs that crash real code. Instead of running code on manually or randomly constructed input, EXE runs it on symbolic input initially allowed to be anything. As checked code runs, EXE tracks the constraints on each symbolic (i.e., input-derived) memory location. If a statement uses a symbolic value, EXE does not run it, but instead adds it as an input-constraint; all other statements run as usual. If code conditionally checks a symbolic expression, EXE forks execution, constraining the expression to be true on the true branch and false on the other. Because EXE reasons about all possible values on a path, it has much more power than a traditional runtime tool: (1) it can force execution down any feasible program path and (2) at dangerous operations (e.g., a pointer dereference), it detects if the current path constraints allow any value that causes a bug. When a path terminates or hits a bug, EXE automatically generates a test case by solving the current path constraints to find concrete values using its own co-designed constraint solver, STP. Because EXE’s constraints have no approximations, feeding this concrete input to an uninstrumented version of the checked code will cause it to follow the same path and hit the same bug (assuming deterministic code). EXE works well on real code, finding bugs along with inputs that trigger them in: the BSD and Linux packet filter implementations, the dhcpd DHCP server, the pcre regular expression library, and three Linux file systems.

Theory and Techniques for Automatic Generation of Vulnerability-Based Signatures

In this paper, we explore the problem of creating \emph{vulnerability signatures}. A vulnerability signature is based on a program vulnerability, and is not specific to any particular exploit. The advantage of vulnerability signatures is that their quality can be guaranteed. In particular, we create vulnerability signatures which are guaranteed to have zero false positives. We show how to automate signature creation for any vulnerability that can be detected by a runtime monitor. We provide a formal definition of a vulnerability signature, and investigate the computational complexity of creating and matching vulnerability signatures. We systematically explore the design space of vulnerability signatures. We also provide specific techniques for creating vulnerability signatures in a variety of language classes. In order to demonstrate our techniques, we have built a prototype system. Our experiments show that we can, using a single exploit, automatically generate a vulnerability signature as a regular expression, as a small program, or as a system of constraints. We demonstrate techniques for creating signatures of vulnerabilities which can be exploited via multiple program paths. Our results indicate that our approach is a viable option for signature generation, especially when guarantees are desired.

Optimisation of tree path pipe network with nonlinear optimisation method

In this paper, the optimisation of pipe network with hot water is presented. The mathematical model, consisting of the nonlinear objective function and system of nonlinear equations for the hydraulics limitations is developed. On its basis, the computer program for determination optimal tree path with the use of simplex method was solved. For economic estimation the capitalised value method, which consider all costs of investment and operation was used. The results are presented for real case study network with 24 nodes and 33 pipe sectors.

DARC

OSprof is a versatile, portable, and efficient profiling methodology based on the analysis of latency distributions. Although OSprof has offers several unique benefits and has been used to uncover several interesting performance problems, the latency distributions that it provides must be analyzed manually. These latency distributions are presented as histograms and contain distinct groups of data, called peaks, that characterize the overall behavior of the running code. By automating the analysis process, we make it easier to take advantage of OSprof's unique features. We have developed the Dynamic Analysis of Root Causes system (DARC), which finds root cause paths in a running program's call-graph using runtime latency analysis. A root cause path is a call-path that starts at a given function and includes the largest latency contributors to a given peak. These paths are the main causes for the high-level behavior that is represented as a peak in an OSprof histogram. DARC performs PID and call-path filtering to reduce overheads and perturbations, and can handle recursive and indirect calls. DARC can analyze preemptive behavior and asynchronous call-paths, and can also resume its analysis from a previous state, which is useful when analyzing short-running programs or specific phases of a program's execution. We present DARC and show its usefulness by analyzing behaviors that were observed in several interesting scenarios. We also show that DARC has negligible elapsed time overheads for normal use cases.

Grammar-based whitebox fuzzing

Whitebox fuzzing is a form of automatic dynamic test generation, based on symbolic execution and constraint solving, designed for security testing of large applications. Unfortunately, the current effectiveness of whitebox fuzzing is limited when testing applications with highly-structured inputs, such as compilers and interpreters. These applications process their inputs in stages, such as lexing, parsing and evaluation. Due to the enormous number of control paths in early processing stages, whitebox fuzzing rarely reaches parts of the application beyond those first stages. In this paper, we study how to enhance whitebox fuzzing of complex structured-input applications with a grammar-based specification of their valid inputs. We present a novel dynamic test generation algorithm where symbolic execution directly generates grammar-based constraints whose satisfiability is checked using a custom grammar-based constraint solver. We have implemented this algorithm and evaluated it on a large security-critical application, the JavaScript interpreter of Internet Explorer 7 (IE7). Results of our experiments show that grammar-based whitebox fuzzing explores deeper program paths and avoids dead-ends due to non-parsable inputs. Compared to regular whitebox fuzzing, grammar-based whitebox fuzzing increased coverage of the code generation module of the IE7 JavaScript interpreter from 53% to 81% while using three times fewer tests.

A kinematics and experimental analysis of form error compensation in ultra-precision machining

Ultra-precision machining has drawn much attention and the error compensation is an essential issue for improving the accuracy of the machining process. However, the analysis of kinematics errors on the surface generation in ultra-precision machining has received relatively little attention. Ultra-precision machine can be represented as a multi-body system. Based on the theory of multi-body system, a kinematics model of two-axis ultra-precision machining system has been developed in the present study. Hence, a software error compensation method is incorporated which is carried out by modifying the idea tool path in the NC program. The modified NC program takes into account the kinematics error factors and so the actual tool path generation can be compensated for the kinematics errors on the machining of the surface of the workpiece. To verify the theoretical kinematics model and the error compensation method, a series of machining experiments have been conducted and the experimental results indicate that better surface quality was achieved with the implementation of the proposed compensation method.

Exceptional situations and program reliability

It is difficult to write programs that behave correctly in the presence of run-time errors. Proper behavior in the face of exceptional situations is important to the reliability of long-running programs. Existing programming language features often provide poor support for executing clean-up code and for restoring invariants. We present a data-flow analysis for finding a certain class of exception-handling defects: those related to a failure to release resources or to clean up properly along all paths. Many real-world programs violate such resource usage rules because of incorrect exception handling. Our flow-sensitive analysis keeps track of outstanding obligations along program paths and does a precise modeling of control flow in the presence of exceptions. Using it, we have found over 1,300 exception handling defects in over 5 million lines of Java code. Based on those defects we propose a programming language feature, the compensation stack, that keeps track of obligations at run time and ensures that they are discharged. We present a type system for compensation stacks that tracks collections of obligations. Finally, we present case studies to demonstrate that this feature is natural, efficient, and can improve reliability.