PROGRAM STRUCTURE TREES - Software Systems Lab

One possibility is to analyze different parts of a program with different
accuracy, such that only interesting regions are analyzed precisely.
Other regions could be analyzed roughly and, if required, be refined
later.
Another possiblity is to hide the complexity of a program, by considering
only the overall effect of a region on the program state, but
not simulating every single change that the execution of a program
region implies. As the complexity of a lot of algorithms is related to the
number of analyzed program states, reducing the number of program
states might improve runtime significantly.
5.1 The control flow automaton
Static program analisis often uses a control flow automaton (CFA) to
represent a program, in contrast to the CFGs that are more widespread
in optimizing compilers.
A control flow automaton is a graph G=(V, E) with a set of vertives V
and a set of edges E. Every vertice represents a program state. Transitions
in between program states are defined by the edges, that connect
two states applying an operation. The operations can be either a set of
calculations or a assume operation.
5.2 Convert an CFG to an CFA
To convert an CFG to an CFA as seen in 5 it is necessary to find the
program states and transitions in an CFG. In a CFG the program state
is changed by the operations executed in the basic blocks. Before and
after the operations in a basic block, there is a defined program state.
Therefore we can create for every basic block BB two new program
states c 1, c 2 one defining the state before and one after the execution of
BB. The transition between these two program states can be defined as
execution of the operations contained in the basic block. If a terminating
branch statement exists in the basic block, the conditions can be applied
as assume operations on the transitions from c 2 to the next program
states.
8