SA4U: Practical Static Analysis for Unit Type Error Detection

Unit type errors, where values with physical unit types (e.g., meters, hours) are used incorrectly in a computation, are common in to- day’s unmanned aerial system (UAS) firmware. Recent studies show that unit type errors represent over 10% of bugs in UAS firmware. Moreover, the consequences of unit type errors are severe, despite their simplicity. Over 30% of unit type errors cause UAS crashes. This paper proposes SA4U: a practical system for detecting unit type errors in real-world UAS firmware. SA4U requires no modifications to firmware or developer annotations. It deduces the unit types of program variables by analyzing simulation traces and protocol definitions. SA4U uses the deduced unit types to identify when unit conversion errors occur. SA4U is effective: it identified 14 previously undetected errors in two popular open-source firmware (ArduPilot & PX4.)