Static Program Analysis

Static Program Analysis


• Reasoning about program behavior
• Automated and without execution
• Used for verifying correctness, bug detection, and understanding program behavior

The Need for Static Analysis


• Reduces the time writing test cases
• Reduces the time running program in the debugger
• Reduces the time needed to inspect core dumps

Uses of Static Analysis


• Finds errors like null pointer dereferences, security flaws, and memory leaks.
Verifies properties, program crash prevention and unauthorized memory access prevention.

• Can infer values a variable can have and the locks a function obtains.

Static Analysis Challenges


• Static analysis is limited because Rice's Theorem states non-trivial program behavior properties are undecidable.

• Approximation is always required.

Static Analysis in Practice


• Aims to underapproximate the set of errors soundly.
• Focuses on reporting some or all errors of a certain kind with no false alarms.
• Involves trade-offs between soundness and completeness.
 Soundness ensures reported errors are real.
 Completeness ensures all real errors are reported.

• Sacrifices completeness for soundness in practice, potentially reporting false alarms but avoiding missed bugs.

Kinds of Static Analysis


• Determined via axes like sensitivity to control flow, context, and path.

• Control-flow sensitive takes the order of statements into account.
• Context-sensitive takes the call stack into account.
• Path-sensitive takes the values of variables into account.

Data Flow Analysis


• A general static analysis framework.
• Aims to compute a data flow fact describing the program state for each program point.
• Uses data flow facts, transfer functions, a confluence operator, and iterative application until convergence.

Available Expressions Example


• An expression $e$ is available at point $p$ if it is evaluated on every path to $p$ and no variables in $e$ assignments after the last evaluation.

• Used for common subexpression elimination.

Formalization of Available Expressions


• Data flow fact is a set of expressions.
• Transfer functions include kill(n) i.e. expressions no longer available after node $n$, and gen(n) expressions that become available after node $n$.

• $OUT[n] = (IN[n] - kill[n]) \cup gen[n]$.
• The confluence operator is intersection ($IN[n] = \bigcap_{p \in pred[n]} OUT[p]$).
• The initial data flow fact is an empty set ($OUT[entry] = \emptyset$).

Kill and Gen


• For an assignment statement, kill(x = \dots) includes all expressions containing x i.e. the variables on the left-hand side.

• $kill(x = \dots) = {e \mid x \in e}$
• An assignment statement generates right-hand side expression if not killed.

• $gen(x = e) = {e} \text{ if } x \notin e$

Algorithm for Available Expressions


• Initialize $OUT[entry] = {}$, and $OUT[n] =$ Universe for each node $n != entry$.

• Iterate:
 $IN[n] =$ intersection of $OUT[p]$ for all predecessors $p$ of $n$.
 $OUT[n] = (IN[n] - kill[n]) \cup gen[n]$.

Termination of Algorithm


• Terminates if data flow facts form a lattice of finite height and transfer functions are monotonic.
• A lattice is a partially ordered set with least upper bound and a greatest lower bound for every pair of elements.
• Finite height and monotonic transfer functions ensure termination.
• Monotonic means $x \sqsubseteq y \Rightarrow f(x) \sqsubseteq f(y)$.

Partial Orders


• A partial order has binary relation $\sqsubseteq$ that is Reflexive ($x \sqsubseteq x$), Anti-symmetric, and Transitive.

Lattices


• Least Upper Bound.
• Greatest Lower Bound
.
• Complete Lattice.

Transfer Functions


• $f$ is monotonic if $x \sqsubseteq y \Rightarrow f(x) \sqsubseteq f(y)$.
• Set union and set difference are monotonic which lead to transfer functions are monotonic.

Initial Value of OUT[n] Modification

• Modifying the initial value of $OUT[n]$ to empty set:
 Still terminates and the result remain safe.
• The analysis becomes less precise detecting fewer available expressions.

Confluence Operator Modification

• Modifying confluence operator to union:
 Still terminates and result remain safe.
• The analysis becomes less precise detecting fewer available expressions.

Backwards Analysis


• Involves analyzing a program backward in reverse like with live variables and reaching definitions.

Diviser Pour Régner (Divide and Conquer) Paradigm


• It solves a problem by dividing it into sub-problems, then combining the sub-problem solutions to solve the initial problem.
• Etapes: Diviser, Regner, Combiner

Programmation Dynamique (Dynamic Programming)


• It is a problem-solving method that breaks down a problem into sub-problems, solves each sub-problem only once, and stores the solutions in a table. The solution of the initial problem is obtained by combining the sub-problems stored in the table.

Algorithmes Gloutons (Greedy Algorithms)


• Makes locally optimal choices at each step with the hope of finding a global optimum.

Backtracking


• Incrementally builds candidates to the solution with partial solution abandonment unless an appropriate one is found.

Clustering


• Clustering algorithms group data points into clusters and are unsupervised learning methods.
• A good clustering should have high intra-cluster similarity and low inter-cluster similarity.

K-means Clustering Algorithm


• Steps include initializing cluster centers randomly, assigning points to the nearest center, and updating cluster centers until convergence. $J = \sum_{i=1}^n ||x_i - \mu_{c_i}||^2$

How to choose K?


• By methods such as Elbow or Silhouette.

Hierarchical Clustering Algorithm


• Initializes by creating each data point a cluster
• Types: Agglomerative and Divisive.

• It may or may not be scalable to large datasets.
• It can also be sensitive to noise and outliers.

Sum of Vectors


• $\vec{A} = A_x\hat{i} + A_y\hat{j}$
• $\vec{B} = B_x\hat{i} + B_y\hat{j}$
• $\vec{R} = (A_x + B_x)\hat{i} + (A_y + B_y)\hat{j}$

Scalar Product


• $\vec{A} \cdot \vec{B} = AB \cos(\theta)$
• $\vec{A} \cdot \vec{B} = (A_x\hat{i} + A_y\hat{j}) \cdot (B_x\hat{i} + B_y\hat{j}) = A_xB_x + A_yB_y$

Vector Product


• $\vec{A} \times \vec{B} = AB \sin(\theta) \hat{k}$
• $\vec{A} \times \vec{B} = (A_x\hat{i} + A_y\hat{j}) \times (B_x\hat{i} + B_y\hat{j}) = (A_xB_y - A_yB_x)\hat{k}$

MRU


• $v = \frac{x}{t}$

MRUV


• $v = v_0 + at$
• $x = x_0 + v_0t + \frac{1}{2}at^2$
• $v^2 = v_0^2 + 2a(x - x_0)$

Newton Laws


• $\sum \vec{F} = m\vec{a}$
• $F_{AB} = -F_{BA}$

Work


• $W = \vec{F} \cdot \vec{d} = Fd\cos(\theta)$

Energy


• $E_c = \frac{1}{2}mv^2$
• $E_p = mgh$

Power


• $P = \frac{W}{t}$

Quantum Mechanical Model


• Explains behavior of matter, especially electrons in atoms.
• Replaced classical mechanics which failed to describe electrons accurately.

Heisenberg's Uncertainty Principle

• States that there's a fundamental limit to precisely knowing a particle's position and momentum.
• $ΔxΔp≥\frac{h}{4π}$.

Louis de Broglie (1924)


• Matter can act as a wave.
• de Broglie equation: $\lambda=\frac{h}{p}=\frac{h}{mv}$

Quantam Numbers


• Principal quantam number (n): n = 1, 2, 3,...
• Angular momentum quantum number (l): l = 0, 1, 2,..., n-1
• Magnetic quantum number ($m_l$): $m_l$ = -l, -l+1,..., 0,..., l-1, l
• Spin quantum number ($m_s$): $m_s$ = +1/2 or -1/2

Electron Configuration


• Describes the arrangement of electrons in an atom.
• Aufbau principle, Hund's rule, and Pauli exclusion principle.

Reaction Rate

• The speed at which reactants are converted into products.
• It is typically expressed as the change in concentration of reactants or products per unit time.

Factors Affecting Reaction Rates

• Concentration of Reactants, Temperature, Surface Area, Catalysts, Pressure, Light and Nature of Reactants.

Activation Energy ($E_a$)

• The minimum energy required for a reaction to occur.
• It is the energy barrier that reactants must overcome to form products.

Electric Chamber Furnace LHT / LBHT

• Max Temperature(Tmax): 1100 °C, 1200 °C or 1300 °C
• Two-sides heating
• Heating elements are highly durable
• Light refractory bricks(multilayered insulation)

Chamber Furnace N / N..HA

• Max Temperature(Tmax): 1100 °C, 1200 °C or 1300 °C
• Two-sides heating
• Support tubes for Heating elements free the radiation heat
• Light refractory bricks(multilayered insulation)

Convection Chamber Furnace N../K

• Max Temperature(Tmax): 450 °C or 600 °C
• Temperature uniformity is excellent
• Horizontal forced convection
• Air velocity is optimized

Ashing Furnace L 9/11/SKM

• Max Temperature(Tmax): 1100 °C
• Two-sides heating
• Silicon carbide heating rods
• Roof has an Exhaust air vent