Developing a High-Speed Static Analysis Tool Based on DFI

BreakAI is developing a C/C++ static analysis tool based on DFI. We aim to use interprocedural value-flow analysis to support checks relevant to MISRA and analyze code faster than Coverity while preserving detection capability.

A DFI-Based Analysis Foundation

DFI (Interprocedural Value-Flow Analysis Framework) tracks how values in variables and memory flow through assignments, reads, and function calls. It extends LLVM intermediate representation (IR) to model pointer aliasing and treats value-flow queries as graph-reachability problems. Processing nodes in the opposite direction of SSA def-use chains enables efficient reachability queries using tree traversal.

On this foundation, we plan to develop checks for writes through pointers, reads before initialization, and escaping addresses of local variables. Where value-flow information alone is insufficient, we plan to combine it with reasoning about path conditions and object lifetimes.

Speedup Goal and Validation

Our research goal is a speedup of at least 100×, analyzing the same entire codebase with equivalent detection capability and equivalent hardware, without relying on incremental analysis. We are exploring ways to reduce computations that do not affect analysis results and avoid repeated work across function calls.

DFI’s published research does not establish an equivalent-capability comparison against a complete MISRA checker or Coverity. The 100× figure is also not an achieved BreakAI result. We will compare missed defects, false positives, and analysis time for each target check, and evaluate analysis-engine performance and end-to-end time separately.