Cyber-Physical Systems (CPS) are integrations of computation and physical processes. Embedded computers and networks monitor and control the physical processes, usually with feedback loops where physical processes affect computations and vice versa. The economic and societal potential of such systems is vastly greater than what has been realized, and major investments are being made worldwide to develop the technology. There are considerable challenges, particularly because the physical components of such systems introduce safety and reliability requirements qualitatively different from those in general- purpose computing. Moreover, physical components are qualitatively different from object-oriented software components. Standard abstractions based on method calls and threads do not work. This paper examines the challenges in designing such systems, and in particular raises the question of whether today's computing and networking technologies provide an adequate foundation for CPS. It concludes that it will not be sufficient to improve design processes, raise the level of abstraction, or verify (formally or otherwise) designs that are built on today's abstractions. To realize the full potential of CPS, we will have to rebuild computing and networking abstractions. These abstractions will have to embrace physical dynamics and computation in a unified way.

/pdf/cyber-physical-systems-design-challenges-57gxu3wcxl.pdf

Cyber Physical Systems: Design Challenges

During the past twenty-one years, over seventy-five papers and nine Ph.D. theses have been published on pointer analysis. Given the tomes of work on this topic one may wonder, “Haven'trdquo; we solved this problem yet?'' With input from many researchers in the field, this paper describes issues related to pointer analysis and remaining open problems.

https://www.cs.trinity.edu/~mlewis/CSCI3294-F01/Papers/p54-hind.pdf

Pointer analysis: haven't we solved this problem yet?

This paper presents the first scalable context-sensitive, inclusion-based pointer alias analysis for Java programs. Our approach to context sensitivity is to create a clone of a method for every context of interest, and run a context-insensitive algorithm over the expanded call graph to get context-sensitive results. For precision, we generate a clone for every acyclic path through a program's call graph, treating methods in a strongly connected component as a single node. Normally, this formulation is hopelessly intractable as a call graph often has 10 14 acyclic paths or more. We show that these exponential relations can be computed efficiently using binary decision diagrams (BDDs). Key to the scalability of the technique is a context numbering scheme that exposes the commonalities across contexts. We applied our algorithm to the most popular applications available on Sourceforge, and found that the largest programs, with hundreds of thousands of Java bytecodes, can be analyzed in under 20 minutes.This paper shows that pointer analysis, and many other queries and algorithms, can be described succinctly and declaratively using Datalog, a logic programming language. We have developed a system called bddbddb that automatically translates Datalog programs into highly efficient BDD implementations. We used this approach to develop a variety of context-sensitive algorithms including side effect analysis, type analysis, and escape analysis.

/pdf/cloning-based-context-sensitive-pointer-alias-analysis-using-1oggp24ce1.pdf

Cloning-based context-sensitive pointer alias analysis using binary decision diagrams

Most points-to analysis research has been done on different systems by different groups, making it difficult to compare results, and to understand interactions between individual factors each group studied. Furthermore, points-to analysis for Java has been studied much less thoroughly than for C, and the tradeoffs appear very different. We introduce SPARK, a flexible framework for experimenting with points-to analyses for Java. SPARK supports equality- and subset-based analyses, variations in field sensitivity, respect for declared types, variations in call graph construction, off-line simplification, and several solving algorithms. SPARK is composed of building blocks on which new analyses can be based.

We demonstrate SPARK in a substantial study of factors affecting precision and efficiency of subset-based points-to analyses, including interactions between these factors. Our results show that SPARK is not only flexible and modular, but also offers superior time/space performance when compared to other points-to analysis implementations.

/pdf/scaling-java-points-to-analysis-using-spark-5e5bapxxhs.pdf

Scaling Java points-to analysis using SPARK

Software attacks often subvert the intended data-flow in a vulnerable program. For example, attackers exploit buffer overflows and format string vulnerabilities to write data to unintended locations. We present a simple technique that prevents these attacks by enforcing data-flow integrity. It computes a data-flow graph using static analysis, and it instruments the program to ensure that the flow of data at runtime is allowed by the data-flow graph. We describe an efficient implementation of data-flow integrity enforcement that uses static analysis to reduce instrumentation overhead. This implementation can be used in practice to detect a broad class of attacks and errors because it can be applied automatically to C and C++ programs without modifications, it does not have false positives, and it has low overhead.

/pdf/securing-software-by-enforcing-data-flow-integrity-12k1vmqjps.pdf

Securing software by enforcing data-flow integrity

We describe the design and implementation of a system for very fast points-to analysis. On code bases of about million lines of unpreprocessed C code, our system performs field-based Andersen-style points-to analysis in less than a second and uses less than 10MB of memory. Our two main contributions are a database-centric analysis architecture called compile-link-analyze (CLA), and a new algorithm for implementing dynamic transitive closure. Our points-to analysis system is built into a forward data-dependence analysis tool that is deployed within Lucent to help with consistent type modifications to large legacy C code bases.

/pdf/ultra-fast-aliasing-analysis-using-cla-a-million-lines-of-c-4lfm5sofpz.pdf

Ultra-fast aliasing analysis using CLA: a million lines of C code in a second

Known algorithms for pointer analysis are “global” in the sense that they perform an exhaustive analysis of a program or program component In this paper we introduce a demand-driven approach for pointer analysis Specifically, we describe a demand-driven flow-insensitive, subset-based, con text-insensitive points-to analysis Given a list of pointer variables (a query), our analysis performs just enough computation to determine the points-to sets for these query variables Using deductive reachability formulations of both the exhaustive and the demand-driven analyses, we prove that our algorithm is correct We also show that our analysis is optimal in the sense that it does not do more work than necessary We illustrate the feasibility and efficiency of our analysis with an implementation of demand-driven points-to analysis for computing the call-graphs of C programs with function pointers The performance of our system varies substantially across benchmarks - the main factor is how much of the points-to graph must be computed to determine the call-graph For some benchmarks, only a small part of the points-to graph is needed (eg pouray emacs and gcc), and here we see more than a 10x speedup For other benchmarks (eg burlap and gimp), we need to compute most (> 95%) of the points-to graph, and here the demand-driven algorithm is considerably slower, because using the demand-driven algorithm is a slow method of computing the full points-to graph

Demand-driven pointer analysis

Typical embedded hardware/software systems are implemented using a combination of C and an hdl such as Verilog. While each is well-behaved in isolation, combining the two gives a nondeterministic model whose ultimate behavior must be validated through expensive (cycle-accurate) simulation.We propose an alternative for describing such systems. Our shim (software/hardware integration medium) model, effectively Kahn networks with rendezvous communication, provides deterministic concurrency. We present the Tiny-shim language for such systems and its semantics, demonstrate how to implement it in hardware and software, and discuss how it can be used to model a real-world system.By providing a powerful, deterministic formalism for expressing systems, designing systems and verifying their correctness will become easier.

/pdf/shim-a-deterministic-model-for-heterogeneous-embedded-46bupik2fm.pdf

SHIM: a deterministic model for heterogeneous embedded systems

Typical embedded hardware/software systems are implemented using a combination of C and an HDL such as Verilog. While each is well-behaved in isolation, combining the two gives a nondeterministic model of computation whose ultimate behavior must be validated through expensive (cycle-accurate) simulation. We propose an alternative for describing such systems. Our software/hardware integration medium (shim) model, effectively Kahn networks with rendezvous communication, provides deterministic concurrency. We present the Tiny-shim language for such systems and its semantics, demonstrate how to implement it in hardware and software, and discuss how it can be used to model a real-world system. By providing a powerful, deterministic formalism for expressing systems, designing systems, and verifying their correctness will become easier

/pdf/shim-a-deterministic-model-for-heterogeneous-embedded-3f7ee2evmm.pdf

Concurrent programming languages should be a good fit for embedded systems because they match the intrinsic parallelism of their architectures and environments. Unfortunately, typical concurrent programming formalisms are prone to races and nondeterminism, despite the presence of mechanisms such as monitors.In this paper, we propose SHIM, the core of a deterministic concurrent language, meaning the behavior of a program is independent of the scheduling of concurrent operations. SHIM does not sacrifice power or flexibility to achieve this determinism. It supports both synchronous and asynchronous paradigms-loosely and tightly synchronized threads-the dynamic creation of threads and shared variables, recursive procedures, and exceptions.We illustrate our programming model with examples including breadth-first-search algorithms and pipelines. By construction, they are race-free. We provide the formal semantics of SHIM and a pre-liminary implementation.

/pdf/scheduling-independent-threads-and-exceptions-in-shim-2jhmnb1x5v.pdf

Olivier Tardieu

Papers

Ultra-fast aliasing analysis using CLA: a million lines of C code in a second

Demand-driven pointer analysis

SHIM: a deterministic model for heterogeneous embedded systems

SHIM: a deterministic model for heterogeneous embedded systems

Scheduling-independent threads and exceptions in SHIM