SORIHUELA DEL

The majority of approaches to path analysis in the field of timing analysis is concerned with the computation of WCET: the length of a longest path, given a control flow graph, time bounds of program points as node weights and a flow constraint model. Despite their common theoretical basis, existing approaches are quite heterogeneous in nature. We first show how path lengths can be computed from path expressions, then we show how existing proposals on path analysis relate to this representation. Further, we provide a brief overview of the most prominent approaches in general.

From Path Expressions to Path Lengths

There exists a simple homomorphism between path expressions and the problem of computing length bounds of paths. Recall the underlying algebraic structure of path expressions. If we ignore mutual exclusion, then bounded path expressions are defined over the algebra (E, ∪, ∅, ·, ,[l,h]) such that for a given set of constraints, l and h denote lower and upper flow bounds. The expression P[l,h]denotes the finite expansion to ∪l..hP with P∗= P[0,∞]. Let ω(u, v) denote the cost of an edge5. Then function W denotes the costs of the longest path recursively by:

W (P ) =                            −∞ if P = ∅ 0 if P =  ω(u, v) if P = e = (u, v) max(W (P1), W (P2)) if P = P1∪ P2 W (P1) + W (P2) if P = P1· P2 P l..hW (P ) if P = P[l,h] (5.32)

In other words, the underlying algebraic structure of bounded path expressions can simply be replaced by (N0 ∪ {−∞}, max, −∞, +, 0) to obtain maximal path lengths

Chapter 5. Path Analysis 99

(W (P ) = −∞ denotes infeasibility). Symmetrically, lengths of shortest paths can be computed by the algebra (N0∪ {−∞}, min, ∞, +, 0).

Path expressions form a general formal basis for path problems encountered in timing analysis. In particular, they define the connection between symbolic representation and evaluation.

Approaches to Path Analysis

Path expressions are based on a (graph) grammar that supports sequences, branches and cycles. The cost model defined in Equation 5.32 specifies semantic rules that can be applied during reduction already; hence, costs can be computed without an explicit representation of program structure by means of path expressions in the first place.

(a) Sequence (b) Branch (c) Loop

Figure 5.10: Attributed grammar for longest paths

Example Consider Figure 5.10 which illustrates schematically a grammar along with semantic rules for cost computation of longest paths. Let ω denote time bounds for the execution of elements and let β denote loop bounds. Then the computed cost for a fully reduced graph yields a global time bound.

A path expression is just an AST of a corresponding grammar in canonical form. Approaches to path analysis that compute costs from AST are commonly referred to as (syntax ) tree-based [4] approaches. Usually, their grammar directly reflects more complex

high-level constructs, such as those listed in Figure 5.5 and Figure 5.6.

Computing costs by reduction has some drawbacks. Reduced regions are small and potentially yield multiple exits. Semantics to derive time bounds is therefore significantly locally constrained and potentially less precise. Moreover, upon reduction, an approximation has to be computed which is globally sound. Hence each reduction further decreases precision. For example in Figure 5.10b, total cost of the branch region will always be the longest path regardless the cost of the two individual paths. Another significant problem of both theoretic and practical nature is that parsing and reduction is not easily unified with concepts of general program analysis as reasoning about paths is limited to regions denoted by grammar “non-terminals”. Safe cost estimates are therefore typically overly pessimistic. Initially, the authors of [143] proposed this approach for high-level timing analysis (cf. Section 5.2.1). Different variants in different scenarios of timing analysis sharing the same principle have been further proposed in [144–148]. Generation of symbolic expressions is explicitly addressed in [148, 149].

Chapter 5. Path Analysis 100

Path-based [4] analysis generally refers to approaches that perform partial cost computation during reduction. Intuitively, it is exploited that in reducible graphs path lengths are cheaply computed on the DAGs that form the respective loop bodies (cf. Algorithm B.15). Hence, explicit reduction is limited to loops only. All of these

approaches share a common outline, which is sketched as follows: 1) For each loop L with head h in postorder of loop nesting tree:

1.1) Compute longest path π in loop body 1.2) Reduce graph G(i+1)← G(i)_\

h(G(i)|L) 1.3) Reassign weight ω(h) ← β(h) × |π|

2) Compute longest path on condensation graph G(k)

As long as there are loops, compute the weight of innermost loops first. Replace the loops by representatives, multiply a loop bound with a given weight and repeat. The final graph will be a DAG for which weight is computed once again.

The advantage over tree-based approaches is that semantics can be computed on usually much larger regions — the loop bodies — which potentially results in tighter time bounds. Otherwise, it shares the general limitations of reduction approaches: Upon reduction an approximation has to be computed to obtain a cost metric which is sound for all region exits. For example, in Figure 5.6d, the final iteration of this loop must be considered a kernel to yield a safe bound on path length for all exits. Second, program semantics are not easily taken into account since upon reduction of some inner loop, context in terms of program state “up to” the loop region is unavailable. Also reduction makes it difficult to discriminate loops with shared heads without explicit prior graph transformation. Proposed path-based analyses vary in their objectives and their approaches towards the general limitations. A simple and formally clean approach to path-based analysis is proposed in [150] for the recursive generation of path expressions, similar to our notion of path expressions. Other, comparably complex approaches [128, 151, 152] focus on interleaving path analysis with micro-architectural analysis with different approaches to limit imprecision due to reduction. In [137], the problem is approached by means of path expressions as defined above. It shall be noted that that some approaches [153] provide countermeasures to mitigate imprecision upon reduction.

A body of approaches is based on integer linear programming (ILP) (cf. Appendix C). We have already formalized path problems in Section 5.1.1, all of which have linear constraint models and can be directly solved in ILP. Most approaches are based on Equation 5.9 to solve maxlen, but provide diverse extensions for greater semantic richness or to address its specific shortcomings. Collectively, these approaches are commonly referred to as being based on the implicit path enumeration technique (IPET) [154]. Solutions to flow problems as discussed in Section 5.1.1 are always integer [99] due to the totally unimodularity property (cf. Appendix C). Hence, they are efficiently solvable as non-integer linear programs, although in general ILP is NP-complete. The complexity of variations of maxlen is potentially worse. In particular, adding additional constraints to flow problems, such as mutual infeasibility, make them NP complete [137, 155, 156].

Chapter 5. Path Analysis 101

A general framework for mutual exclusion constraints for IPET is discussed in [157]. Various flow bound extension are proposed in [153]. IPET gains much of its popularity due to the simplicity of the base model and the fact that global constraints do not require extra effort. On the other hand, the consideration of additional semantics is difficult due to the limited expressiveness of the linear equation model. Numerous proposals [45, 136, 142, 158–161] address the problem of adding program or architecture semantics for improved time bounds. Besides IPET, in [82, 162] graph reduction is modeled in ILP. Experiments with parametric ILP [163] have been conducted in [164, 165].

Apart from these isolated approaches to path analysis, holistic approaches based on model checking combining various stages of timing analysis have been proposed [166–168].