ILP-Based Interprocedural Path Analysis

  • Henrik Theiling
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 2491)


Program analysis usually works on control flow graphs (CFGs) and on a call graph (CG). The standard CGs contain one node for each function, but for precise analyses, it may be desirable to distinguish function invocations by their execution history.

This distinction is useful, e.g., to improve the precision of worst-case execution time (WCET) analysis for real-time systems. Our WCET analysis supports these advanced techniques for interprocedural analysis. The first part of the WCET analysis, i.e, the prediction of microarchitecture behaviour, uses Abstract Interpretation, for which tools already support the methods for function distinction by execution history.

The second part of WCET prediction is the worst-case path analysis, which can be performed using the well-established technique of Implicit Path Enumeration using Integer Linear Programming. So far, support for arbitrary interprocedural analysis techniques in one framework was not discussed in literature. This paper closes this gap.


Path Analysis Basic Block Abstract Interpretation Control Flow Graph Call Graph 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    R. Arnold, F. Mueller, and D. Whalley. Bounding Worst-Case Instruction Cache Performance. In Proceedings of the 15th IEEE Real-Time Systems Symposium (RTSS), Dec. 1994.Google Scholar
  2. 2.
    P. Cousot and R. Cousot. Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints. In Proceedings of the 4th ACM Symposium on Principles of Programming Languages, 1977.Google Scholar
  3. 3.
    J. Engblom. Processor Pipelines and Static Worst-Case Execution Time Analysis. PhD Thesis, Acta Universitatis Upsaliensis, 2002.Google Scholar
  4. 4.
    J. Engblom and A. Ermedahl. Modeling Complex Flows for Worst-Case Execution Time Analysis. In Proceedings of the 21st IEEE Real-Time Systems Symposium, Dec. 2000.Google Scholar
  5. 5.
    C. Ferdinand. Cache Behavior Prediction for Real-Time Systems. PhD Thesis, Universitat des Saarlandes, 1997.Google Scholar
  6. 6.
    C. Ferdinand, R. Heckmann, M. Langenbach, F. Martin, M. Schmidt, H. Theiling, S. Thesing, and R. Wilhelm. Reliable and Precise WCET Determination for a Real-Life Processor. In Proceedings of EMSOFT 2001, First Workshop on Embedded Software, volume 2211 of Lecture Notes in Computer Science, 2001.Google Scholar
  7. 7.
    C. Ferdinand, D. Kästner, M. Langenbach, F. Martin, M. Schmidt, J. Schneider, H. Theiling, S. Thesing, and R. Wilhelm. Run-Time Guarantees for Real-Time Systems — The USES Approach. In Proceedings of Informatik’ 99-Arbeitstagung Programmiersprachen, Paderborn, 1999.Google Scholar
  8. 8.
    Y.-T. S. Li and S. Malik. Performance Analysis of Embedded Software Using Implicit Path Enumeration. In Proceedings of the 32nd ACM/IEEE Design Automation Conference, 1995.Google Scholar
  9. 9.
    Y.-T. S. Li, S. Malik, and A. Wolfe. Efficient Microarchitecture Modeling and Path Analysis for Real-Time Software. In Proceedings of the 16th IEEE Real-Time Systems Symposium (RTSS), 1995.Google Scholar
  10. 10.
    Y.-T. S. Li, S. Malik, and A. Wolfe. Performance Estimation of Embedded Software with Instruction Cache Modeling. In Proceedings of the IEEE/ACM International Conference on Computer-Aided Design, 1995.Google Scholar
  11. 11.
    Y.-T. S. Li, S. Malik, and A. Wolfe. Cache Modeling for Real-Time Software: Beyond Direct Mapped Instruction Caches. In Proceedings of the 17th IEEE Real-Time Systems Symposium (RTSS), 1996.Google Scholar
  12. 12.
    S.-S. Lim, Y H. Bae, G. T. Jang, B.-D. Rhee, S. L. Min, C. Y. Park, H. Shin, K. Park, S.-M. Moon, and C. S. Kim. An Accurate Worst Case Timing Analysis for RISC Processors. IEEE Transactions on Software Engineering, 21(7), 1995.Google Scholar
  13. 13.
    S.-S. Lim, J. Hee Han, J. Kim, and S. Lyul Min. A Worst Case Timing Analysis Technique for Multiple Issue Machines. In Proceedings of the 19th IEEE Real-Time Systems Symposium (RTSS), 1998.Google Scholar
  14. 14.
    F Martin. PAG Reference Manual. Universität des Saarlandes, 1995.Google Scholar
  15. 15.
    F. Martin. Generation of Pro gram Analyzers. PhD thesis, Universität des Saarlandes, 1999.Google Scholar
  16. 16.
    F. Martin, M. Alt, R. Wilhelm, and C. Ferdinand. Analysis of Loops. In Proceedings of the International Conference on Compiler Construction (CC’98). Springer-Verlag, 1998.Google Scholar
  17. 17.
    Motorola. Coldfire Microprocessor Family Programmer’s Reference Manual, 1997.Google Scholar
  18. 18.
    F Mueller, D. B. Whalley, and M. Harmon. Predicting Instruction Cache Behavior. In Proceedings of the ACM SIGPLAN Workshop on Language, Compiler and Tool Support for Real-Time Systems, 1994.Google Scholar
  19. 19.
    G. Ottoson and M. Sjödin. Worst-Case Execution Time Analysis for Modern Hardware Architectures. In Proceedings of the ACM SIGPLAN Workshop on Language, Compiler and Tool Support for Real-Time Systems, 1997.Google Scholar
  20. 20.
    P. Puschner and C. Koza. Calculating the Maximum Execution Time of Real-Time Programs. Real-Time Systems, 1, 1989.Google Scholar
  21. 21.
    J. Schneider and C. Ferdinand. Pipeline Behaviour Prediction for Superscalar Processors by Abstract Interpretation. In In Proceedings of the ACM SIGPLAN Workshop on Languages, Compilers, and Tools for Embedded Systems, 1999.Google Scholar
  22. 22.
    M. Sicks. Adre\bestimmung zur Vorhersage des Verhaltens von Daten-Caches. Diploma Thesis, Universität des Saarlandes, 1997.Google Scholar
  23. 23.
    F. Stappert, A. Ermedahl, and J. Engblom. Efficient Longest Executable Path Search for Programs with Complex Flows and Pipeline Effects. In Proceedings of the 4th International Conference on Compilers, Architectures, and Synthesis for Embedded Systems (CASES 2001), Atlanta, Georgia, USA, November 2001.Google Scholar
  24. 24.
    H. Theiling. Extracting Safe and Precise Control Flow from Binaries. In Proceedings of the 7th International Conference on Real-Time Computing Systems and Applications (RTCSA), Cheju Island, South Korea, 2000.Google Scholar
  25. 25.
    H. Theiling. Generating Decision Trees for Decoding Binaries. In Proceedings of the ACM SIGPLAN Workshop on Language, Compiler and Tools for Embedded Systems, Snowbird, Utah, USA, June 2001.Google Scholar
  26. 26.
    H. Theiling and C. Ferdinand. Combining Abstract Interpretation and ILP for Microarchitecture Modelling and Program Path Analysis. In Proceedings of the 19th IEEE Real-Time Systems Symposium (RTSS), Madrid, Spain, 1998.Google Scholar
  27. 27.
    H. Theiling, C. Ferdinand, and R. Wilhelm. Fast and Precise WCET Prediction by Seperate Cache and Path Analyses. Real-Time Systems, 18(2/3), May 2000.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2002

Authors and Affiliations

  • Henrik Theiling
    • 1
  1. 1.Universität des Saarlandes and AbsInt Angewandte Informatik GmbHSaarbrückenGermany

Personalised recommendations