a³ release 21.10

Improved TriCore configuration

Improved value analysis

Improved statistics

New target

StackAnalyzer, TimingProfiler, and ValueAnalyzer are now available for MIPS32.

Windows support

  • From this release on, a³ requires at least Windows 10.
  • Binaries larger than 2 GB are now supported under Windows.

General improvements

TargetLink 5.1 logo
  • Improved handling of XTC with multiple CPU elements.
  • Added support for TargetLink 5.0 and 5.1.

Qualification Support Kits

  • New compiler-specific QSKs:
    • aiT for TriCore with Tasking VX 6.2r2p3
    • aiT for TriCore with Tasking VX 6.3r1p2
    • StackAnalyzer for TriCore with Tasking VX 6.3r1p2
  • New test cases:
    qk_ais2_program_point_offset_assemblyall architectures
    qk_ais2_instruction_scope_nestingall architectures
    qk_setting_size_limit_register_relative_infoARM, e200, e300, LEON3, M68020,
    MPC5xx, MPC755, PPC750, PPC,
    TriCore, V850, x86
  • The following test cases have been reworked to cover multiple different offset indices, including the wildcard index:
    • qk_ais2_program_point_offset_access
    • qk_ais2_program_point_offset_branch_pp
    • qk_ais2_program_point_offset_call
    • qk_ais2_program_point_offset_computed
    • qk_ais2_program_point_offset_conditional
  • To consistently check for “exit with” in all annotation scopes that are now supported, the following test cases have been replaced:
    • qk_ais2_register_values
    • qk_ais2_memory_values
    • qk_ais2_user_register_values
    • qk_ais2_destroy_values
    with the following new test cases:
    • qk_ais2_enter_with
    • qk_ais2_exit_with
    • qk_ais2_destroy
  • The test case qk_setting_additional_executables has been updated to check for real executable overlay.


  • The Disassembly view now also shows assembly labels.
  • In context-sensitive statistics views, you can now select the active context used for the interactive value analysis results.
  • The option value for “Target” is now exported to AIS as predefined attribute target_type.
  • Improved GUI performance for projects with many analysis items.

Visualization and results

  • All percentages in statistics views are now rounded to two decimal places.
  • Improved visualization of C++ template functions in graphs.
  • In the Graph view, when switching to “exclusive” and back, the selected node will stay selected and centered.
  • The analysis results are now written to the XML results file incrementally, upon completion of each analysis.

Information views

  • Improved call annotations generated by Symbols view.
  • Improved tooltips for Statistics views.
  • The WCET-per-context view now allows sorting by routine name from the context menu of the corresponding column.


  • The value of PSW.IO at the analysis begin can now be specified in the GUI.
  • When “Generic TriCore v1.6.x” is selected with no specific core specified under hardware options, the analysis now automatically assumes the value of the register CORE_ID to be [0,1,2,3,4,6].


  • Improved handling of:
    • user-specified labels
    • complex area specifications and the match functor in particular
    • target not analyzed” annotations for code-duplicated call sites
  • Improved order in which annotations are resolved.
  • Improved AIS2 attribute redefinition checks.
  • The symbol suffix @static is no longer silently discarded when resolving symbolic program points. Annotations that still use this kind of symbol format need to be adjusted. That is,
    routine "main@static" { ... }
    should now be written as:
    routine "main" { ... }
  • Now supporting annotations of the form
    routine <pp1> calls to <pp2> exit with: ...;
  • Now allowing symbolic expressions to be used wherever symbol constants are expected. Examples:
    routine if(analysisType() == "stack_analysis", "handle1", "handle2") infeasible;
    loop "main.L1" bound: 0 .. switch(attribute("analysis_configuration"):
         "Core0" => 15,
         "Core1" => 10,
          default => 0);
  • Improved partial evaluation of sets of values to delay computation to value analysis phase, e.g. by using reg-functor or other kinds of expressions that depend on analysis context. Example:
    routine <pp> enter with:
        user("data") = [ mem(reg("r0") + (4 * var("i")), 4) for "i" : 0 to 3 ];
  • Extended consistency checks for “area contains data” annotations.
  • New annotation markers for “area contains data” annotations pointing to computed control flow instructions whose targets have been resolved with the annotated memory contents and to load/store instructions that access the annotated memory region.
  • Introducing wildcard offset for program-point offset specifications, allowing all instructions of a specific type to be annotated at once:
    instruction "handleUpdate" -> computed(*) {
        calls: *("handleMsg"[]);
  • Now supporting nested instruction scopes to avoid repetitions of program-point specifications. For example,
    instruction "main" -> return(1) { ... }
    instruction "main" -> return(1) -> -1 instruction { ... }
    can now be combined into:
    instruction "main" -> return(1) {
        instruction -> -1 instruction { ... }
  • Introducing the new program-point specifications
    -> assembly("name", <offset>)
    -> assembly(match("name_regex"), <offset>).
  • New AIS2 functor number_of_elements that provides information about the number of elements of a set or interval.


  • Binaries larger than 2 GB are now supported under Windows.
  • Improved handling of “area copy” when copying parts of sections.
  • The decoder now emits a warning if a control flow transition points to a global variable.

Value analysis

  • Improved handling of sub-registers.
  • Improved handling of register modifications that target only sub-registers.
  • The interactive value analysis now shows the types of values stored in registers and memory cells based on the type information obtained from DWARF debug info.

Control-flow, stack, and value analysis

  • ARM:
    • Improved automatic resolution of computed control-flow transitions.
    • The decoder now properly applies the ARM EABI mapping symbols to automatically detect the used instruction set (ARM or THUMB).
    • Improved handling of “area contains data” and “enter/exit with” annotations when providing function pointers via address("<symbol>").
    • Improved decoding of the MSR instruction.
      For example, “msr control_0b1000, r4” is now decoded as “msr control, r4”.
  • C28: Improved stack frame creation handling.
  • SPARC: Improved automatic switch table decoding.
  • TriCore:
    • Improved precision for interleaved step-wise division operations.
    • Improved handling of automatic stack annotations for complex control-flow modifications.
    • Improved switch table decoding for GCC.
    • Introducing the new program-point construct
      to determine the address of an ISR. Here, <pipn> refers to the pending interrupt priority number of the associated ISR.
    • Improved handling of trapv and trapsv.
  • x86:
    • Improved automatic decoding of computed control-flow transitions (x86-64).
    • Support for decoding 32-bit x86 code contained in 64-bit ELF binaries.

Cache and pipeline analysis

  • Pipeline analysis now shows the total amount of configured cache-locked code and data.
  • Improved resource accesses pipeline analysis mode.
  • ARM Cortex-R5F:
    • Support for misaligned memory accesses.
    • Support for 64-bit writes to EMIF.
    • Improved handling of return stack for speculative execution.
  • ColdFire: Improved MC5307 pipeline model.
  • e200: Improved handling of cache locked memory regions.


  • Added support for ARM ULINK Pro traces.
  • Improved import of Lauterbach FLOW export traces.
  • Added support for Lauterbach Trace32 ASCII trace exports with enabled System.Option MMUSPACES ON.
    For other traces where the address-space ID (i.e. the process ID) is encoded in the address, TimeWeaver now offers the following attribute to determine and mask out the process ID:
    attribute "trace_process_id_mask": <expr>;
    For example, for an ARM Cortex-A53 with 64-bit addresses where the upper 16 bits store the process ID:
    attribute "trace_process_id_mask": 0xffff000000000000;
  • Improved handling of conditional calls.
  • Improved return from interrupt handling for ARM.
  • Clarified error message in case of a conflict between analyzed and traced loop bounds.