### Table 3 Static conflict interpretation

"... In PAGE 13: ... The administration tool was developed to assist the security administrator with specifying high-level or- ganizational separation of duty policy. The conflicts that are identified prohibit certain assignments ac- cording to Table3 . Consider the following example.... In PAGE 14: ...required, and the association can be made. However, if one or both are involved in a conflicting relation- ship, a check that is in line with Table3 is performed to see whether the association should be allowed (3 ) or disallowed (8 ). Where appropriate, the admin- istration tool will also suggest remedial action to dis- allowed associations.... ..."

### TABLE 1. Levels of Abstraction and their interpretation.

### Table 1: Results of abstract interpretation for the quicksort program

1992

Cited by 110

### Table 1. Result of abstract interpretation for example flowchart.

2003

"... In PAGE 2: ... The system is solved by fixed-point iteration for the simplified system, which converges in nine iterations. The result is shown in Table1 . (BQ stands for the universal set: CB BC BP BQ thus means that we allow any starting state in the analysis.... ..."

Cited by 22

### Table 1. Result of abstract interpretation for example flowchart.

2003

"... In PAGE 14: ... Note also that since many of the asserted functions are common to various tasks, inaccuracies in assumptions are propagated among tasks. As an example, let us present results concerning task Mil_Bus_Manager ( Table1 ). This task manages the bus that connects the different satellite payloads, and is the largest and most complex task of the CDMU application.... In PAGE 14: ... This task manages the bus that connects the different satellite payloads, and is the largest and most complex task of the CDMU application. Table1 . WCET calculation results Task WCET given by Bound-T (ms) WCET reported in design documents (ms) Mil_Bus_Manager 15.... In PAGE 14: ... WCET calculation results Task WCET given by Bound-T (ms) WCET reported in design documents (ms) Mil_Bus_Manager 15.79 20 Table1 reports two different values: the WCET estimated by Bound-T, and the WCET reported in the design documents of the CDMU application. The latter value is mainly based on in-service history information of previous missions of similar applications.... In PAGE 14: ... The latter value is mainly based on in-service history information of previous missions of similar applications. As shown in Table1 , the WCET given by Bound-T (about 16 ms) was slightly under the value reported in the design documents (20 ms). 5.... In PAGE 59: ...#Variables #Constraints CFG/TGs 67 114 ECFG 43 32 Table1 : ILP formulations of matsum (branch pre- diction modeling) with the two approaches as always miss, then the self loop edge e1 of A, which results in cache hit, is trimed off from the CCG. This results in the flow increase of e2 and consequently more cache misses for B.... In PAGE 59: ...06s Table 2: Impact of ILP problem size and nature on solving time (results of the CFG/TGs approach) graphs) and the other one using single ECFG. In Table1 , the numbers of variables and constraints of the matsum benchmark (modeling branch predic- tion) are presented. Obviously, the ECFG has less variables and constraints than the CFG/TGs.... In PAGE 67: ... We propose to collect an agreed set of requirements from the WCET Community on the information needed to perform WCET analysis with the aim of producing a white paper to influence compiler manufacturers and vendors to make such information available. Table1 , below, lists the items we have collected so far. ordered by requirement category.... In PAGE 67: ... Other future work includes finding collateral benefits, prioritizing the requirements, and defining the data formats and other interfaces for implementing the requirements. Table1 . Compiler and linker support for timing analysis Requirement category Property, mapping or control Examples Supported analyses Properties on source-code level Tree structure of the code Intra-procedural control structures: sequence, conditional, switch/case, loop, exception.... In PAGE 89: ...ending code). # insts crc CRC computation 54 790 fft1 FFT using Cooly-Turkey algorithm 3163 jfdctint JPEG slow-but-accurate integer implementation of the forward DCT 5828 lms LMS adaptive signal enhancement 535 985 ludcmp LU decomposition 7 797 Table1 . Benchmark applications (from the SNU suite) 4.... In PAGE 100: ... The system is solved by fixed-point iteration for the simplified system, which converges in nine iterations. The result is shown in Table1 . (BQ stands for the universal set: CB BC BP BQ thus means that we allow any starting state in the analysis.... ..."

### Table 2: The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more).

1999

"... In PAGE 7: ...3 allows us to simplify drastically the argument that the shape-analysis framework is correct, because the correctness of the abstract semantics falls out directly from the Embedding Theorem. Table2 illustrates the steps of an abstract interpretation of reverse on the structure S2 from Figure 2. The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v).... In PAGE 7: ... The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v). The appropriate predicate-update formulae for each statement are shown in the second column of Table2 . Table 2 lists a predicate-update formula p0(v) only if predicate p is a ected by the execution of the statement.... In PAGE 8: ...Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st2: t = y; t0(v) = y(v) S4 sm u K u1 x st3: y = x; y0(v) = x(v) S5 sm u K u1 x;y st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S6 sm u K u1 y x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S7 sm u K u1 y x - st2: t = y; t0(v) = y(v) S8 sm u K u1 y;t x - st3: y = x; y0(v) = x(v) S9 sm u K u1 t y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S10 sm u K u1 t y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S11 sm u - K u1 t y;x -... In PAGE 9: ...Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st2: t = y; t0(v) = y(v) S12 - sm u K u1 t;y;x - st3: y = x; y0(v) = x(v) S13 - sm u K u1 t;y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S14 - sm u K u1 t;y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S15 - quot;! # n smis u K u1 t;y;x - As we will see, this approach has a number of good properties: The abstract-interpretation process will always terminate if we guarantee that the number of elements in three-valued structures is bounded.... In PAGE 9: ... By de ning appropriate instrumentation predicates, it is possible to emulate some previous shape-analysis algorithms. The shape-analysis algorithm illustrated in Table2 is essentially that of Chase et al. [CWZ90].... In PAGE 21: ... For three-valued structures, the analog of equation (43) does not hold, even for those structures that are tight embeddings of concrete structures from 2-CSTRUCT[P; F]. For example, for the abstract execution of the rst statement in Table2 (st1 : y = NULL), which transforms structure S2 to S3, we have [[ apos;is]]S3 3 ([v 7! u]) = 1=2, whereas the predicate-update formula yields [[ apos;st is]]S2 3 ([v 7! u]) = 0. In fact, this is the origin of the Instrumentation Principle (Observation 2.... In PAGE 22: ... Therefore, the maximal number of individuals in a structure is 25 = 32; however, because sm cannot have the value 1, the maximal number of individuals in a structure is really only 16. (On the other hand, Table2 shows that each structure that arises in the analysis of reverse has at most two individuals.) 2 One way to obtain a bounded structure is to map individuals into abstract individuals named by the de nite values of the unary predicate symbols.... In PAGE 22: ...11 In structure S2 from Figure 2, the canonical name of individual u1 is ufxg;fy;t;isg, and the canonical name of u is u;;fx;y;t;isg. In structure S5, which arises after the rst abstract interpretation of statement st3 in Table2 , the canonical name of u1 is ufx;yg;ft;isg, and the canonical name of u is u;;fx;y;t;isg. 2 For any two bounded structures S; S0 2 B-STRUCT[P], it is possible to check whether S v S0 holds in time linear in the (explicit) sizes of S and S0, using the following two-phase procedure: 1.... In PAGE 24: ...formula structure st2: t = y; t0(v) = y(v) S0 12 sm u K t;y;x - st3: y = x; y0(v) = x(v) S0 13 sm u K t;y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S0 14 sm u K t;y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S0 15 quot;! # n smis u K t;y;x - Table 9: The bounded structures that actually arise for the last four blocks of Table2 when t embedc is applied at each step. De nition 4.... In PAGE 24: ... In Section 2, we did not wish to complicate the discussion with the issue of mapping structures into bounded structures. For this reason, the last four blocks of Table2 are deliberately inconsistent with equation (45). The bounded structures that actually arise when t embedc is applied at each step are shown in Table 9.... In PAGE 26: ...ures in which apos; evaluates to a de nite value, i.e., focus apos;(S) = maximal 0 @ 8 lt; :S0 S0 2 3-STRUCT[P] S0 v S for all Z : [[ apos;]]S0 3 (Z) 6 = 1=2 9 = ; 1 A 2 Example 5.3 The upper part of Figure 7 illustrates the application of focus to the formula apos;st4 x (v) and the structure S5 that we have in reverse just after the rst application of statement st3: y = x and just before the rst application of statement st4: x = x- gt;n in Table2 . This results in three structures: The structure S5;f;0, in which apos;st4 x (v) evaluates to 0 for all individuals.... In PAGE 34: ... Thus, in S6;2 u:1 is no longer a summary node. There are important di erences between the structures S6;0; S6;1, and S6;2 that result from the improved transformer for statement st4 : x = x- gt;n and the structure S6 that is the result of the simple version of the transformer (see the fourth entry of Table2 ): x points to a summary node in S6, whereas in none of S6;0; S6;1, and S6;2 does x point to a summary node. 2 5.... ..."

Cited by 342

### Table 2: The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more).

1999

"... In PAGE 7: ...3 allows us to simplify drastically the argument that the shape-analysis framework is correct, because the correctness of the abstract semantics falls out directly from the Embedding Theorem. Table2 illustrates the steps of an abstract interpretation of reverse on the structure S2 from Figure 2. The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v).... In PAGE 7: ... The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v). The appropriate predicate-update formulae for each statement are shown in the second column of Table2 . Table 2 lists a predicate-update formula p0(v) only if predicate p is a ected by the execution of the statement.... In PAGE 7: ... Thus, after st1 program-variable y does not point to any element. Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st1: y = NULL; y0(v) = 0 S3 sm u K u1 x... In PAGE 9: ...Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st2: t = y; t0(v) = y(v) S12 - sm u K u1 t;y;x - st3: y = x; y0(v) = x(v) S13 - sm u K u1 t;y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S14 - sm u K u1 t;y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S15 - quot;! # n smis u K u1 t;y;x - As we will see, this approach has a number of good properties: The abstract-interpretation process will always terminate if we guarantee that the number of elements in three-valued structures is bounded.... In PAGE 9: ... By de ning appropriate instrumentation predicates, it is possible to emulate some previous shape-analysis algorithms. The shape-analysis algorithm illustrated in Table2 is essentially that of Chase et al. [CWZ90].... In PAGE 21: ... For three-valued structures, the analog of equation (43) does not hold, even for those structures that are tight embeddings of concrete structures from 2-CSTRUCT[P; F]. For example, for the abstract execution of the rst statement in Table2 (st1 : y = NULL), which transforms structure S2 to S3, we have [[ apos;is]]S3 3 ([v 7! u]) = 1=2, whereas the predicate-update formula yields [[ apos;st is]]S2 3 ([v 7! u]) = 0. In fact, this is the origin of the Instrumentation Principle (Observation 2.... In PAGE 22: ... Therefore, the maximal number of individuals in a structure is 25 = 32; however, because sm cannot have the value 1, the maximal number of individuals in a structure is really only 16. (On the other hand, Table2 shows that each structure that arises in the analysis of reverse has at most two individuals.) 2 One way to obtain a bounded structure is to map individuals into abstract individuals named by the de nite values of the unary predicate symbols.... In PAGE 22: ...11 In structure S2 from Figure 2, the canonical name of individual u1 is ufxg;fy;t;isg, and the canonical name of u is u;;fx;y;t;isg. In structure S5, which arises after the rst abstract interpretation of statement st3 in Table2 , the canonical name of u1 is ufx;yg;ft;isg, and the canonical name of u is u;;fx;y;t;isg. 2 For any two bounded structures S; S0 2 B-STRUCT[P], it is possible to check whether S v S0 holds in time linear in the (explicit) sizes of S and S0, using the following two-phase procedure: 1.... In PAGE 24: ...formula structure st2: t = y; t0(v) = y(v) S0 12 sm u K t;y;x - st3: y = x; y0(v) = x(v) S0 13 sm u K t;y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S0 14 sm u K t;y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S0 15 quot;! # n smis u K t;y;x - Table 9: The bounded structures that actually arise for the last four blocks of Table2 when t embedc is applied at each step. De nition 4.... In PAGE 24: ... In Section 2, we did not wish to complicate the discussion with the issue of mapping structures into bounded structures. For this reason, the last four blocks of Table2 are deliberately inconsistent with equation (45). The bounded structures that actually arise when t embedc is applied at each step are shown in Table 9.... In PAGE 26: ...ures in which apos; evaluates to a de nite value, i.e., focus apos;(S) = maximal 0 @ 8 lt; :S0 S0 2 3-STRUCT[P] S0 v S for all Z : [[ apos;]]S0 3 (Z) 6 = 1=2 9 = ; 1 A 2 Example 5.3 The upper part of Figure 7 illustrates the application of focus to the formula apos;st4 x (v) and the structure S5 that we have in reverse just after the rst application of statement st3: y = x and just before the rst application of statement st4: x = x- gt;n in Table2 . This results in three structures: The structure S5;f;0, in which apos;st4 x (v) evaluates to 0 for all individuals.... In PAGE 34: ... Thus, in S6;2 u:1 is no longer a summary node. There are important di erences between the structures S6;0; S6;1, and S6;2 that result from the improved transformer for statement st4 : x = x- gt;n and the structure S6 that is the result of the simple version of the transformer (see the fourth entry of Table2 ): x points to a summary node in S6, whereas in none of S6;0; S6;1, and S6;2 does x point to a summary node. 2 5.... ..."

Cited by 342

### Table 2: The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more).

1999

"... In PAGE 7: ...3 allows us to simplify drastically the argument that the shape-analysis framework is correct, because the correctness of the abstract semantics falls out directly from the Embedding Theorem. Table2 illustrates the steps of an abstract interpretation of reverse on the structure S2 from Figure 2. The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v).... In PAGE 7: ... The value of a predicate p(v) after a statement executes is obtained by evaluating a predicate- update formula p0(v). The appropriate predicate-update formulae for each statement are shown in the second column of Table2 . Table 2 lists a predicate-update formula p0(v) only if predicate p is a ected by the execution of the statement.... In PAGE 7: ... Thus, after st1 program-variable y does not point to any element. Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st1: y = NULL; y0(v) = 0 S3 sm u K u1 x... In PAGE 8: ...Table2 : The simple abstract interpretation of reverse applied to structure S2 shown in Figure 2 (which represents lists of length two or more). statement formula structure st2: t = y; t0(v) = y(v) S4 sm u K u1 x st3: y = x; y0(v) = x(v) S5 sm u K u1 x;y st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S6 sm u K u1 y x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S7 sm u K u1 y x - st2: t = y; t0(v) = y(v) S8 sm u K u1 y;t x - st3: y = x; y0(v) = x(v) S9 sm u K u1 t y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S10 sm u K u1 t y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S11 sm u - K u1 t y;x -... In PAGE 9: ... By de ning appropriate instrumentation predicates, it is possible to emulate some previous shape-analysis algorithms. The shape-analysis algorithm illustrated in Table2 is essentially that of Chase et al. [CWZ90].... In PAGE 21: ... For three-valued structures, the analog of equation (43) does not hold, even for those structures that are tight embeddings of concrete structures from 2-CSTRUCT[P; F]. For example, for the abstract execution of the rst statement in Table2 (st1 : y = NULL), which transforms structure S2 to S3, we have [[ apos;is]]S3 3 ([v 7! u]) = 1=2, whereas the predicate-update formula yields [[ apos;st is]]S2 3 ([v 7! u]) = 0. In fact, this is the origin of the Instrumentation Principle (Observation 2.... In PAGE 22: ... Therefore, the maximal number of individuals in a structure is 25 = 32; however, because sm cannot have the value 1, the maximal number of individuals in a structure is really only 16. (On the other hand, Table2 shows that each structure that arises in the analysis of reverse has at most two individuals.) 2 One way to obtain a bounded structure is to map individuals into abstract individuals named by the de nite values of the unary predicate symbols.... In PAGE 22: ...11 In structure S2 from Figure 2, the canonical name of individual u1 is ufxg;fy;t;isg, and the canonical name of u is u;;fx;y;t;isg. In structure S5, which arises after the rst abstract interpretation of statement st3 in Table2 , the canonical name of u1 is ufx;yg;ft;isg, and the canonical name of u is u;;fx;y;t;isg. 2 For any two bounded structures S; S0 2 B-STRUCT[P], it is possible to check whether S v S0 holds in time linear in the (explicit) sizes of S and S0, using the following two-phase procedure: 1.... In PAGE 24: ...formula structure st2: t = y; t0(v) = y(v) S0 12 sm u K t;y;x - st3: y = x; y0(v) = x(v) S0 13 sm u K t;y;x - st4: x = x- gt;n; x0(v) = 9v1 : x(v1) ^ n(v1; v) S0 14 sm u K t;y;x - st5: y- gt;n = t; n0(v1; v2) = (n(v1; v2) ^ :y(v1)) _ (y(v1) ^ t(v2)) is0(v) = 9v1; v2 : (is(v) ^ n0(v1; v) ^ n0(v2; v) ^ v1 6 = v2)_ (t(v) ^ n(v1; v) ^ :y(v1)) S0 15 quot;! # n smis u K t;y;x - Table 9: The bounded structures that actually arise for the last four blocks of Table2 when t embedc is applied at each step. De nition 4.... In PAGE 24: ... In Section 2, we did not wish to complicate the discussion with the issue of mapping structures into bounded structures. For this reason, the last four blocks of Table2 are deliberately inconsistent with equation (45). The bounded structures that actually arise when t embedc is applied at each step are shown in Table 9.... In PAGE 26: ...ures in which apos; evaluates to a de nite value, i.e., focus apos;(S) = maximal 0 @ 8 lt; :S0 S0 2 3-STRUCT[P] S0 v S for all Z : [[ apos;]]S0 3 (Z) 6 = 1=2 9 = ; 1 A 2 Example 5.3 The upper part of Figure 7 illustrates the application of focus to the formula apos;st4 x (v) and the structure S5 that we have in reverse just after the rst application of statement st3: y = x and just before the rst application of statement st4: x = x- gt;n in Table2 . This results in three structures: The structure S5;f;0, in which apos;st4 x (v) evaluates to 0 for all individuals.... In PAGE 34: ... Thus, in S6;2 u:1 is no longer a summary node. There are important di erences between the structures S6;0; S6;1, and S6;2 that result from the improved transformer for statement st4 : x = x- gt;n and the structure S6 that is the result of the simple version of the transformer (see the fourth entry of Table2 ): x points to a summary node in S6, whereas in none of S6;0; S6;1, and S6;2 does x point to a summary node. 2 5.... ..."

Cited by 342

### Table 1. Property checking on abstracted fabric

"... In PAGE 3: ... Abstracted switch fabric Based on this abstracted model, we checked the five properties described above. The CPU time (elapse time), memory usage and nodes allocated for property checking are shown in Table1 . This experiment as well as all the re- sults in this paper were done on SUN Sparc 20 workstation (55MHz/256MB).... In PAGE 4: ... Table 5 collects the number of latches among the origi- nal fabric, the abstracted fabric and one abstracted fabric unit (all including few additional latches used for the envi- ronment state machine). From previous experiments, we found that property checking is almost impossible using the original fabric, and it is very slow using the abstracted mod- el as shown in Table1 . However, using the abstracted fabric unit, acceptable CPU time of property checking is achieved.... ..."