SA4U: Practical Static Analysis for Unit Type Error Detection

TL;DR

SA4U is a practical static analysis tool that detects unit type errors in UAS firmware by analyzing simulation traces and protocol definitions, successfully identifying previously undetected bugs without requiring code modifications.

Contribution

SA4U introduces a novel static analysis approach that deduces unit types without modifications or annotations, improving bug detection in UAS firmware.

Findings

Identified 14 new bugs in open-source firmware

No firmware modifications or annotations needed

Effective detection of unit type errors in real-world scenarios

Abstract

Unit type errors, where values with physical unit types (e.g., meters, hours) are used incorrectly in a computation, are common in today's unmanned aerial system (UAS) firmware. Recent studies show that unit type errors represent over 10% of bugs in UAS firmware. Moreover, the consequences of unit type errors are severe. Over 30% of unit type errors cause UAS crashes. This paper proposes SA4U: a practical system for detecting unit type errors in real-world UAS firmware. SA4U requires no modifications to firmware or developer annotations. It deduces the unit types of program variables by analyzing simulation traces and protocol definitions. SA4U uses the deduced unit types to identify when unit type errors occur. SA4U is effective: it identified 14 previously undetected bugs in two popular open-source firmware (ArduPilot & PX4.)