a³ release 18.04

New targets

  • StackAnalyzer, ValueAnalyzer, and TimingProfiler are now available for S12Z.
  • TimeWeaver is now available for PowerPC, ARM and TriCore.
  • StackAnalyzer, ValueAnalyzer, TimingProfiler, and TimeWeaver for ARM now support 64-bit ARMv8. For the purposes of licensing and pricing, the tools for 64-bit ARM are distinct from those for 32-bit ARM.

Improved analysis queue

  • Queued analyses can now be aborted, and new ones added to the queue.
  • It is now possible to abort the iterative decoding to inspect the intermediate result graph.

Improved DWARF handling

DWARF debug information is now extracted faster while using less memory, with additional improvements to the reader’s stability, the search function, and the reporting of array index conflicts for heuristics. Also, annotations for areas and calls can now be generated directly from within the DWARF view.


  • Trace extraction and conversion are now faster, with improved handling of interrupts and added support for traces executed in 64-bit address space.
  • Unresolved computed control-flow transitions can now be resolved automatically using the present trace data.
  • Reverse-mapping export has been implemented from trace segment costs to their originating trace input location.
  • The survival graph and the call graph have been improved and extended with additional information.
  • Raw trace data can now be exported from the GUI for further processing.

C++ Call Target Analyzer

Added support for automatically including all specified header files at the beginning of each processed source file.

Qualification Support Kits

  • Parallel execution of test cases is now supported, customizable via the new option “Number of concurrent test cases”. The default is 1, and the special value “auto” parallelizes the execution across all CPU cores.
  • The test case for the StackAnalyzer option “Do not analyze values of memory cells” has been removed, as the option no longer exists.
  • The naming pattern for accepted QSK packages in the Qualification dialog has been fixed.
  • New compiler-specific StackAnalyzer QSKs for ARM with GCC 4.9.4 and PowerPC with GCC 3.3.2.

Portable version

The portable version for Linux now comes as a ZIP file just like under Windows. For both OSes, the top-level directory within is now named just like the file itself. This prevents different builds from overwriting each other upon unzip. Under Linux, the ZIP file also contains the install script, should you later decide to install the software rather than running it from the unzipped directory.


  • Improved handling of include paths and path replacements for source files.
  • Support for Machine Settings Files has been removed. You can still transfer an MSF configuration to this new release by importing the MSF file in an older release and saving the APX.
  • The stack analysis option “Do not analyze values of memory cells” has been removed from the GUI. Its effect can be achieved by declaring modifiable regions in the address space as volatile.


  • Timing contributions in processor cycles are now only shown if no clock rate has been specified. Otherwise, only contributions in μs are shown, while contributions in cycles can be viewed by right-clicking on the table header.
  • Numerous improvements to TimeWeaver:
    • Raw trace data can now be exported for further processing from the trace segment statistics view.
    • The trace segment view now provides the calling context for each trace segment.
    • Improved look and feel of the trace segment distribution and survival graph.
    • The call and control-flow graph now includes trace statistics for each edge and analysis context.


Improved performance of interactive value analysis results.

Information view

  • Area and calls annotations can now be generated from within the DWARF debug information view.
  • Improved search in DWARF debug information.


  • In addition to trace partitioning, value partitioning is now available.
    # user register, overwrites
    instruction 0x10e0 begin partitioning: user("r") = [ 1, 2, 3 ];
    # user register, restrict (only the given values allowed)
    instruction 0x10e0 begin partitioning: restrict user("r") = [ 1, 2, 3 ];
    # normal register, intersects
    instruction 0x10e0 begin partitioning: reg("r") = [ 1, 2, 3 ];
    # memory cell, intersects
    instruction 0x10f0 begin partitioning: mem(0x100000, 1) = [ 1, 2, 3 ];
    Further details have been added to the manual.
  • You can now choose whether the contents of memory cells specified by area contains data annotations should be joined or overwritten.

    By default the contents are joined. This is useful if the decoder encounters several area contains data annotations for the same area in different annotation files. This can happen e.g. if an analysis depends on several collect-initialization analyses.


    # join area contents (default)
    area "globalFunPtr" contains data: 0x1234;
    area "globalFunPtr" contains data: 0x5678;
    # the content of globalFunPtr is now either 0x1234 or 0x5678 
    # overwrite area contents
    area "globalHndlPtr" contains data: 0x1234;
    area "globalHndlPtr" contains { data: 0x5678; mode: overwrite; }
    # the content of globalHndlPtr is now 0x5678
  • The suppress message annotation applied to a routine or loop now affects all locations (i.e. instructions) within that routine or loop.
  • The annotation “begin partitioning: trace;” may now also be applied to loops.
  • The annotation “takes: X cycles” for loops may now also be applied to (normal, non-recursive) routines.
    routine "testFunction" {
           takes: 1234 cycles;


  • AIS2 annotations generated by CompCert are now extracted by default to the section __compcert_ais_annotations of the input executable.
  • Improved switch table decoding for CompCert.
  • Improved reporting of applied “copy area” annotations:
    exec2crl.spec: Info: In "ISR1_hwcheck.ais", line 15, column 1:
    Copying 1140 bytes starting at 0x8003d3 contained in section '.text' to 0x804df5.
  • Improved handling or copy area for non-byte architectures.
  • Improved stack pointer guessing.
  • Improved handling of area contains data annotations that overwrite their contents.
  • TimeWeaver can now automatically resolve unresolved computed control-flow transitions using the present trace data.
  • ARM:
    • improved return detection
    • improved computed branch resolution for switch tables
    • improved handling of switch tables via tbb and tbh
    • improved mode switch for bx pc
    • improved detection of library functions that violate the calling conventions
    • support for the CSDB instruction (Cache Speculation Side-channels Counter-Measure)
  • SPARC:
    • improved decoding of computed control-flow transitions (e.g. switch and call tables)
    • “window” stack usage/effect annotations are applied correctly
  • TriCore: improved switch table decoding.
  • V850:
    • improved SDA guessing for GHS
    • improved switch table decoding for GHS
  • PowerPC: improved switch table decoding for GHS.

Stack and value analysis

  • Improved precision:
    • of the relational domain and branch splitting
    • for complex sub-register operations
    • for stack analysis of PowerPC programs that use 32-bit execution on 64-bit hardware
    • for imprecise stack pointer values. The analysis now keeps information about stack relative memory cells in a more symbolic way to even have knowledge e.g. about parameters passed via stack cells for unknown stack pointer cases. This helps raise precision for short call-string lengths.
  • Improved reporting of
    • array index conflicts for DWARF heuristics
    • width ranges in textual reports:
      instruction 0x800009fe reads from [0x00000000..0x10000fff, 0xf0001000..0xffffffff]:[4..5] (imprecise in 1 context (25.0%))
    • memory accesses with different access widths per context, with the optional width_minimal attribute now added to the XML report for the combined context-insensitive output
    • memory areas, now printing the annotation location in addition to area type and content:
      * memory areas considered as constant:
      In "struct.ais", line 3, column 34:
      1: [0x000011a4..0x000011a7]

      [0x000011a4]:4 contains 0x00, 0x00, 0x11, 0xa8
      The annotation is also linked from contradiction warnings:
      eva-tricore: Warning #3088: In "manager.c", line 12:
      In routine 'Init.L1', at address 0xc6560:
      In context '0xa6550->"Init", 0xc6550->"Init.L1"[123]':
      In "memory_content.ais", line 100, column 42:
      Write access to [0x7c54]:4 ('Data[12].DataField') in constant memory contradicts user annotation.

      Annotated value:
      * [0x00000001..0x0000001f]

      Contradicting computed value:
      * [0x00000000]
  • Improved sharpening at conditional branches where the condition depends on the output carry of an addition.
  • Improved handling of loops with integer type casts via shifts or other complex counter updates.
  • Improved loop bound analysis.

Trace conversion

  • TimeWeaver now supports more trace formats.
  • The trace extraction is now faster and generalized across all supported trace formats.
  • Support for traces executed in a 64-bit address space.
  • Improved extraction for traces of preemptive software.
  • Improved handling of interrupts.
  • The trace converter now complains if timestamps are too coarse to get usable results.
  • PowerPC: fixed handling of the isel instruction for Lauterbach NEXUS export traces.

TimeWeaver analysis

Implemented reverse-mapping export from trace segment costs to their originating trace input location.

Cache and pipeline analysis

  • Infineon XMC4500:
    • improved handling of imprecise memory accesses
    • added timing configuration for memory accesses to core-private peripherals
  • C16x:
    • improved handling of the SCXT instruction
    • better handling of explicit assignments to the registers CPUCON1, CPUCON2, CP, SP, STKUN, STKOV, VECSEG, TFR, and PSW
  • e200: more precise WCET analysis for MPC5777M, SPC58NE84, and SPC58NN84.
  • MPC755(s), MPC7448(s), and PPC750: improved analysis of eciwx and ecowx.
  • RH850: improved handling of artificial program ends in TimingProfiler.

C++ Call Target Analyzer

Support for automatically including all specified header files at the beginning of each processed source file.


Improved reporting of source code line numbers in XML reports.