Static Analysis Research Articles

The ART of Sharing Points-to Analysis: Reusing Points-to Analysis Results Safely and Efficiently

Data-flow analyses like points-to analysis can vastly improve the precision of other analyses, and enable powerful code optimizations. However, whole-program points-to analysis of large Java programs tends to be expensive – both in terms of time and memory. Consequently, many compilers (both static and JIT) and program-analysis tools tend to employ faster – but more conservative – points-to analyses to improve usability. As an alternative to such trading of precision for performance, various techniques have been proposed to perform precise yet expensive fixed-point points-to analyses ahead of time in a static analyzer, store the results, and then transmit them to independent compilation/program-analysis stages that may need them. However, an underlying concern of safety affects all such techniques – can a compiler (or program analysis tool) trust the points-to analysis results generated by another compiler/tool? In this work, we address this issue of trust in the context of Java, while accounting for the issue of performance. We propose ART: Analysis-results Representation Template – a novel scheme to efficiently and concisely encode results of flow-sensitive, context-insensitive points-to analysis computed by a static analyzer for use in any independent system that may benefit from such a precise points-to analysis. ART also allows for fast regeneration of the encoded sound analysis results in such systems. Our scheme has two components: (i) a producer that can statically perform expensive points-to analysis and encode the same concisely, (ii) a consumer that, on receiving such encoded results (called artwork), can regenerate the points-to analysis results encoded by the artwork if it is deemed “safe”. The regeneration scheme completely avoids fixed-point computations and thus can help consumers like static analyzers and JIT compilers to obtain precise points-to information without paying a prohibitively high cost. We demonstrate the usage of ART by implementing a producer (in Soot) and two consumers (in Soot and the Eclipse OpenJ9 JIT compiler). We have evaluated our implementation over various benchmarks from the DaCapo and SPECjvm2008 suites. Our results demonstrate that using ART, a consumer can obtain precise flow-sensitive, context-insensitive points-to analysis results in less than (average) 1% of the time taken by a static analyzer to perform the same analysis, with the storage overhead of ART representing a small fraction of the program size (average around 4%).

A Dependent Nominal Physical Type System for Static Analysis of Memory in Low Level Code

We tackle the problem of checking non-proof-carrying code , i.e. automatically proving type-safety (implying in our type system spatial memory safety) of low-level C code or of machine code resulting from its compilation without modification. This requires a precise static analysis that we obtain by having a type system which (i) is expressive enough to encode common low-level idioms, like pointer arithmetic, discriminating variants by bit-stealing on aligned pointers, storing the size and the base address of a buffer in distinct parts of the memory, or records with flexible array members, among others; and (ii) can be embedded in an abstract interpreter. We propose a new type system that meets these criteria. The distinguishing feature of this type system is a nominal organization of contiguous memory regions, which (i) allows nesting, concatenation, union, and sharing parameters between regions; (ii) induces a lattice over sets of addresses from the type definitions; and (iii) permits updates to memory cells that change their type without requiring one to control aliasing. We provide a semantic model for our type system, which enables us to derive sound type checking rules by abstract interpretation, then to integrate these rules as an abstract domain in a standard flow-sensitive static analysis. Our experiments on various challenging benchmarks show that semantic type-checking using this expressive type system generally succeeds in proving type safety and spatial memory safety of C and machine code programs without modification, using only user-provided function prototypes.

Making Formulog Fast: An Argument for Unconventional Datalog Evaluation

With its combination of Datalog, SMT solving, and functional programming, the language Formulog provides an appealing mix of features for implementing SMT-based static analyses (e.g., refinement type checking, symbolic execution) in a natural, declarative way. At the same time, the performance of its custom Datalog solver can be an impediment to using Formulog beyond prototyping—a common problem for Datalog variants that aspire to solve large problem instances. In this work we speed up Formulog evaluation, with some surprising results: while 2.2× speedups can be obtained by using the conventional techniques for high-performance Datalog (e.g., compilation, specialized data structures), the big wins come by abandoning the central assumption in modern performant Datalog engines, semi-naive Datalog evaluation. In the place of semi-naive evaluation, we develop eager evaluation, a concurrent Datalog evaluation algorithm that explores the logical inference space via a depth-first traversal order. In practice, eager evaluation leads to an advantageous distribution of Formulog’s SMT workload to external SMT solvers and improved SMT solving times: our eager evaluation extensions to the Formulog interpreter and Soufflé’s code generator achieve mean 5.2× and 7.6× speedups, respectively, over the optimized code generated by off-the-shelf Soufflé on SMT-heavy Formulog benchmarks. All in all, using compilation and eager evaluation (as appropriate), Formulog implementations of refinement type checking, bottom-up pointer analysis, and symbolic execution achieve speedups on 20 out of 23 benchmarks over previously published, hand-tuned analyses written in F ♯ , Java, and C++, providing strong evidence that Formulog can be the basis of a realistic platform for SMT-based static analysis. Moreover, our experience adds nuance to the conventional wisdom that traditional semi-naive evaluation is the one-size-fits-all best Datalog evaluation algorithm for static analysis workloads.

Sound and Partially-Complete Static Analysis of Data-Races in GPU Programs

GPUs are progressively being integrated into modern society, playing a pivotal role in Artificial Intelligence and High-Performance Computing. Programmers need a deep understanding of the GPU programming model to avoid subtle data-races in their codes. Static verification that is sound and incomplete can guarantee data-race freedom, but the alarms it raises may be spurious and need to be validated. In this paper, we establish a True Positive Theorem for a static data-race detector for GPU programs, i.e., a result that identifies a class of programs for which our technique only raises true alarms. Our work builds on the formalism of memory access protocols, that models the concurrency operations of CUDA programs. The crux of our approach is an approximation analysis that can correctly identify true alarms, and pinpoint the conditions that make an alarm imprecise. Our approximation analysis detects when the reported locations are reachable (control independence, or CI), and when the reported locations are precise (data independence, or DI), as well identify inexact values in an alarm. In addition to a True Positive result for programs that are CI and DI, we establish the root causes of spurious alarms depending on whether CI or DI are present. We apply our theory to introduce FaialAA, the first sound and partially complete data-race detector. We evaluate FaialAA in three experiments. First, in a comparative study with the state-of-the-art tools, we show that FaialAA confirms more DRF programs than others while emitting 1.9× fewer potential alarms. Importantly, the approximation analysis of FaialAA detects 10 undocumented data-races. Second, in an experiment studying 6 commits of data-race fixes in open source projects OpenMM and Nvidia’s MegaTron, FaialAA confirmed the buggy and fixed versions of 5 commits, while others were only able to confirm 2. Third, we show that 59.5% of 2,770 programs are CI and DI, quantifying when the approximation analysis of FaialAA is complete. This paper is accompanied by the mechanized proofs of the theoretical results presented therein and a tool (FaialAA) implementing of our theory.

Scaling Abstraction Refinement for Program Analyses in Datalog using Graph Neural Networks

Counterexample-guided abstraction refinement (CEGAR) is a popular approach for automatically selecting abstractions with high precision and low time costs. Existing works cast abstraction refinements as constraint-solving problems. Due to the complexity of these problems, they cannot be scaled to large programs or complex analyses. We propose a novel approach that applies graph neural networks to improve the scalability of CEGAR for Datalog-based program analyses. By constructing graphs directly from the Datalog solver’s calculations, our method then uses a neural network to score abstraction parameters based on the information in these graphs. Then we reform the constraint problems such that the constraint solver ignores parameters with low scores. This in turn reduces the solution space and the size of the constraint problems. Since our graphs are directly constructed from Datalog computation without human effort, our approach can be applied to a broad range of parametric static analyses implemented in Datalog. We evaluate our approach on a pointer analysis and a typestate analysis and our approach can answer 2.83× and 1.5× as many queries as the baseline approach on large programs for the pointer analysis and the typestate analysis, respectively.

Automated Verification of Parametric Channel-Based Process Communication

A challenge of writing concurrent message passing programs is ensuring the absence of partial deadlocks, which can cause severe memory leaks in long running systems. Several static analysis techniques have been proposed for automatically detecting partial deadlocks in Go programs. For a large enterprise code base, we found these tools too imprecise to reason about process communication that is parametric, i.e., where the number of channel communication operations or the channel capacities are determined at runtime. We present a novel approach to automatically verify the absence of partial deadlocks in Go program fragments with such parametric process communication. The key idea is to translate Go fragments to a core language that is sufficiently expressive to represent real-world parametric communication patterns and can be encoded into Dafny programs annotated with postconditions enforcing partial deadlock freedom. In situations where a fragment is partial deadlock free only when the concurrency parameters satisfy certain conditions, a suitable precondition can often be inferred. Experimental results on a real-world code base containing 583 program fragments that are beyond the reach of existing techniques have shown that the approach can verify the absence of partial deadlocks in 145 cases. For an additional 228 cases, a nontrivial precondition is inferred that the surrounding code must satisfy to ensure partial deadlock freedom.

Structural Analysis Technique and Its Validation for Large Range Mirror Refocusing System for Spaceborne Deployable Telescopes

Large aperture deployable telescopes with numerous onboard instruments are popular in the space industry for astronomy. Scientific data in various wavelength bands, from 0.6µ to 28µ, is provided by these instruments and is crucial for deep space exploration. The deployment mechanisms handle the alignment and functionality at the telescope level only. At instrument level, there is always a need for a refocusing system which can cater individual need of instrument for focusing independent to other instruments nearby. In this paper, we present a structural analysis technique for such a type of large range mirror refocusing mechanism, similar to the Near Infrared Spectrograph (NIRSpec) payload of the James Webb Space Telescope (JWST). The method relies on geometric non-linearity for large deflection, in which the structure's stiffness matrix changes as a function of loading. We have designed, analyzed structurally, and tested a 4mm range slider crank based compliant mechanism. The outcomes of linear and non-linear static analysis, computed numerically, have been compared. There are noticeable significant variations in one direction between the two analyses' results. The results are validated using appropriately designed and realized test setups, like measurements of displacement, changes in focus and image position of the optical system.

Programmable MCMC with Soundly Composed Guide Programs

Probabilistic programming languages (PPLs) provide language support for expressing flexible probabilistic models and solving Bayesian inference problems. PPLs with programmable inference make it possible for users to obtain improved results by customizing inference engines using guide programs that are tailored to a corresponding model program. However, errors in guide programs can compromise the statistical soundness of the inference. This article introduces a novel coroutine-based framework for verifying the correctness of user-written guide programs for a broad class of Markov chain Monte Carlo (MCMC) inference algorithms. Our approach rests on a novel type system for describing communication protocols between a model program and a sequence of guides that each update only a subset of random variables. We prove that, by translating guide types to context-free processes with finite norms, it is possible to check structural type equality between models and guides in polynomial time. This connection gives rise to an efficient type-inference algorithm for probabilistic programs with flexible constructs such as general recursion and branching. We also contribute a coverage-checking algorithm that verifies the support of sequentially composed guide programs agrees with that of the model program, which is a key soundness condition for MCMC inference with multiple guides. Evaluations on diverse benchmarks show that our type-inference and coverage-checking algorithms efficiently infer types and detect sound and unsound guides for programs that existing static analyses cannot handle.

HardTaint: Production-Run Dynamic Taint Analysis via Selective Hardware Tracing

Dynamic taint analysis (DTA), as a fundamental analysis technique, is widely used in security, privacy, and diagnosis, etc. As DTA demands to collect and analyze massive taint data online, it suffers extremely high runtime overhead. Over the past decades, numerous attempts have been made to lower the overhead of DTA. Unfortunately, the reductions they achieved are marginal, causing DTA only applicable to the debugging/testing scenarios. In this paper, we propose and implement HardTaint, a system that can realize production-run dynamic taint tracking. HardTaint adopts a hybrid and systematic design which combines static analysis, selective hardware tracing and parallel graph processing techniques. The comprehensive evaluations demonstrate that HardTaint introduces only around 8% runtime overhead which is an order of magnitude lower than the state-of-the-arts, while without sacrificing any taint detection capability.

A new membrane finite element based on the strain approach

Membrane elements with in-plane rotation are applicable for modeling thin planar structures that are only stressed by volume and surface loads acting in their plane. In this paper a new finite element designed for static and free vibration analysis, featuring a four-node configuration is presented. Each node incorporates two engineering displacements and a fictive rotation, aligning with strain approach principles. The displacements field of this element is based on the assumed functions for the various strains satisfying the compatibility equations. This developed element passed all benchmark tests in the case of bending and shear problems. In static analysis, the displacements, strains, and stresses are calculated, while the free vibration analysis aims to determine natural frequencies, including both axial and fundamental frequencies. The proposed membrane element is validate through a series of selected examples, demonstrating its effectiveness and accuracy. The results consistently indicate that the new element exhibits high performance and exactitude in both types of analysis.

Development of Learning Video Media in Biology Subjects

The purpose of this study is to produce valid and practical learning video media for use in the learning process. This research is a development research used to produce a product in the form of learning video media. The stages in this development include: planning stage, design stage, and development stage. The subjects in this study were 2 validators consisting of learning media experts and content or learning media material experts, 31 grade XI science students and 1 Biology subject teacher. Data collection techniques used observation, interviews, questionnaires and documentation. The data analysis techniques used were Qualitative Descriptive Analysis, and Descriptive Static Analysis. Research on this offers novelty in the form of more visual and interactive learning media, allowing students to understand complex biological concepts through interesting graphical and animated representations. In addition, these learning videos provide flexibility for students to learn independently and repeatedly, thus improving conceptual understanding and accommodating various learning styles.

Oscillatory features of German–English sentence processing: Evidence from an EEG study

Aims and objectives: In this study, we investigated the neural oscillatory patterns occurring during sentence-level overt bilingual processing tasks on 46 German–English bilinguals with the intention of finding out if there were task-specific oscillations for this language pair. Methodology: Four tasks, including Language 2 (L2) listening, Language 1 (L1) speaking, L2 shadowing (i.e., repeating a segment of an utterance), and backward interpreting (i.e., orally translating L2 sentences to L1), were implemented with the technique of electroencephalography (EEG). Data and analysis: Data included demographic indices, neural oscillation metrics, and oral production scores from participants. Static spectral analysis, time–frequency analysis, principal components analysis, cross-frequency coupling, and inferential statistics were applied to the data. Findings: The sensory task and articulatory tasks differed greatly in the delta–theta band and the beta–gamma band in terms of time–frequency dynamics. Analyses also revealed variations in a frontal/prefrontal theta component and a distinct gamma component across the four tasks. Moreover, we found a right fronto-temporal theta–gamma coupling unique to backward interpreting. Originality: The task-wise comparison experiment paradigm has rarely been implemented in neuroimaging research on language, especially so in EEG research on bilingualism. Significance: The findings provide novel insights for the understanding of language conversion mechanism and may benefit the training of professional interpreters.

Optimized position analysis of multi-directional active mounting system based on quantification formula

This paper mainly studies the influence of active mounting system for vehicle engine vibration from both theoretical and experimental aspects. First, an active mounting system that considers both horizontal and vertical directions is proposed, modeled, analyzed and verified. The structure contains a bent beam representing the engine, two sets of actuator and elastomer forming active paths, and a straight beam representing the chassis. Second, the force and phase of the active mounts at each location combination are calculated based on static and dynamic methods. The dynamic analysis method is used to examine how the control signal changes with the input signal to learn the correlation between them. The static analysis is employed to obtain the change in force applied to the paths when the position of the input signal changes and to find the optimized placement criteria. Through the position relationship between force and mounting, a specific position where the applied force is relatively small was considered the optimized position of the active mounting system. Finally, these criteria were verified with experiments and the results are matched well with each other.

A Comparison of Free and Mapped Meshes for Static Structural Analysis

Abstract This study addresses the challenge faced by Finite Element Analysts when choosing between free and mapped meshes, especially in terms of convergence stability and solution accuracy. The investigation focuses on 3D solid models under static structural loading, analyzed using Ansys® and MSC Patran®. Both free and mapped mesh types, employing equivalent 3D solid elements, are used to assess an aircraft structural component under design load conditions, with fixed boundaries. For free meshes, Tet10 elements in Patran (equivalent to Solid 72 in Ansys) are used, whereas for mapped meshes, CPENTA / CHEXA elements in Patran (equivalent to Wed6 / Hex8 in Ansys) are employed. Mesh convergence studies ensure that discretization does not affect the numerical solution. Notably, a significant stress increase is observed with successive refinement of free meshes, while mapped meshes achieve mesh independence at coarser refinement levels. Comparison of fringe plots indicates the same location for maximum deformation and equivalent stress in both free and mapped mesh models. The findings demonstrate that free meshes tend to underpredict maximum deformation and equivalent stress compared to mapped meshes, with both meshes showing deformation and stress at consistent locations. The findings underscore the importance of carefully choosing the appropriate mesh type, particularly when analyzing critical structural components, to ensure reliability and accuracy in FEA simulations.

Static and stability analyses of multi-strut type aluminium alloy suspen-dome structure with large opening

By combining the advantages of the multi-strut concept in cable dome structures with aluminum alloy material, a new type of prestressed spatial structure—the multi-strut aluminum alloy suspen-dome with a large opening—has been developed by integrating a lower prestressed support system into an aluminum alloy reticulated shell. The optimal structural configuration was determined by comparing the static, stability, and economic performance of three types of upper chord mesh topologies for this structure. Subsequently, an analysis of the static performance and large-scale parameters affecting the structural stability of the optimal grid topology was conducted. The study explored the influence of structural prestressing, overall shape, and support stiffness—encompassing three categories and seven parameters—on structural stability and material consumption. Additionally, the effects of initial imperfections and load distribution forms on structural stiffness and stability were further examined. Finally, the static properties, stability, and economic indicators of the structure were compared with two other structural systems: the steel suspen-dome and the cable dome. The results indicate that the pentagonal grid topology provides the best structural performance and that the structure is sensitive to cooling effects. Optimal values for key design parameters, such as the rise-span ratio and thickness-span ratio, were identified. Moreover, the economic advantages of the aluminum alloy suspen-dome compensate for its mechanical performance shortcomings compared to the steel suspen-dome. These findings offer innovative solutions and a scientific basis for the selection and stability design of aluminum alloy suspen-dome structures.

Nonlinear Static and Dynamic Analysis of Semi-Infinite Porous Medium with Twin Tunnel

Nonlinear Static and Dynamic Analysis of Semi-Infinite Porous Medium with Twin Tunnel

Case study: structural feasibility analysis for a reinforced concrete building

Currently, the residential building sector in Brazil is experiencing continuous growth, despite the adverse impacts caused by 2 years of the Covid-19 pandemic. Therefore, there is a demand for structural projects that enable the execution of these works from a structure that is viable from the point of view of safety, good conditions of use, comfort and economy. Technical and practical knowledge is a fundamental requirement for a good project, combined with skill in a technological analysis and sizing tool. Having said that, the present work proposed to develop the analysis and structural design, with the help of the Brazilian software TQS®, of a multi-family residential building in reinforced concrete, using both linear and nonlinear static analyses. The central motivation was to address structural challenges and ensure that the design complies with Brazilian standards, thereby improving the quality and safety of residential buildings. The work sought to follow all the design steps of a structure in order to meet the requirements recommended by Brazilian standards. Based on the analyses, it was possible to adopt solutions for the various structural problems that arose during the design and, finally, obtain the final document with all the details of the structure.

Mechanical analysis of modified femoral neck system in the treatment of osteoporotic femoral neck fractures

BackgroundDespite the explicit biomechanical advantages associated with FNS, it is currently inconclusive, based on the existing literature, whether Femoral Neck System (FNS) outperforms Cannulated cancellous screws (CSS) in all aspects. Due to variances in bone morphology and bone density between the elderly and young cohorts, additional research is warranted to ascertain whether the benefits of FNS remain applicable to elderly osteoporosis patients. This study aimed to investigate the biomechanical properties of FNS in osteoporotic femoral neck fractures and propose optimization strategies including additional anti-rotation screw.MethodsThe Pauwels type III femoral neck fracture models were reconstructed using finite element numerical techniques. The CSS, FNS, and modified FNS (M-FNS) models were created based on features and parameterization. The various internal fixations were individually assembled with the assigned normal and osteoporotic models. In the static analysis mode, uniform stress loads were imposed on all models. The deformation and stress variations of the femur and internal fixation models were recorded. Simultaneously, descriptions of shear stress and strain energy were also incorporated into the figures.ResultsFollowing bone mass reduction, deformations in CSS, FNS, and M-FNS increased by 47%, 52%, and 40%, respectively. The equivalent stress increments for CSS, FNS, and M-FNS were 3%, 43%, 17%, respectively. Meanwhile, variations in strain energy and shear stress were observed. The strain energy increments for CSS, FNS, and M-FNS were 4%, 76%, and 5%, respectively. The shear stress increments for CSS, FNS, and M-FNS were 4%, 65% and 44%, respectively. Within the osteoporotic model, M-FNS demonstrated the lowest total displacement, shear stress, and strain energy.ConclusionModified FNS showed better stability in the osteoporotic model (OM). Using FNS alone may not exhibit immediate shear resistance advantages in OM. Concurrently, the addition of one anti-rotation screw can be regarded as a potential optimization choice, ensuring a harmonious alignment with the structural characteristics of FNS.

On the application of the finite cell method to static analysis of trabecular bone tissue specimen using high‐resolution microCT data

On the application of the finite cell method to static analysis of trabecular bone tissue specimen using high‐resolution microCT data

Evaluating accession decisions in customs unions: a dynamic machine learning approach

Previous work in the literature on regional economic integration has proposed the use of machine learning algorithms to evaluate the composition of customs unions, specifically, to estimate the degree to which customs unions match “natural markets” arising from trade flow data or appear to be driven by other factors such as political considerations. This paper expands upon the static approaches used in previous studies to develop a dynamic framework that allows to evaluate not only the composition of customs unions at a given point in time, but also changes in the composition over time resulting from accessions of new member states. We then apply the dynamic algorithm to evaluate the evolution of the global landscape of customs unions using data on bilateral trade flows of 200 countries from 1958 to 2018. A key finding is that there is considerable variation across different accession rounds of the European Union as to the extent to which these are aligned with the structure of “natural markets,” with some accession rounds following more strongly a commercial logic than others. Similar results are also found for other customs unions in the world, complementing the insights obtained from static analyses.