I have been working with analysing a fairly restricted programming language that manipulates these structures. This approach seems common for research in this area, see [CCG96] and [CC96], although some work with fairly unrestricted versions of languages such as C, for example in [HHN94].
Originally only one recursive function could be analysed, but this has now been extended to allow a number of mutually recursive functions. These functions take one parameter and it is assumed that the first is called with the root path name. Each function may make possibly recursive calls to other functions using the syntax `FunctionName(w.g)' where g is any generator.
Only reads and writes to one structure are considered, although this can be extended either by analysing each structure separately if they are disjoint or combining them into one structure if they share data. The basic statements of the code are reads and writes to various parts of the structure. A typical statement is `Struct(w.a) = Struct(w.b)' where w is a variable and a and b are directions, and denotes the copying of an item of data from w.b to w.a, within the structure Struct.
Code that manipulates the pointers of a structure can not yet be handled, although some checking can potentially be done, we can verify that a particular piece of code does not violate the description given.
One point should be made about these static control programs: if we do not allow some run-time dependencies in the code, we may as well run the program and trace its dataflow directly. Therefore we had better be able to deal with variable sized structures. We allow conditional statements of the form `if (w == NULL) then ...'. This restricts the type of analysis that can be done. For example, any dataflow analysis has the potential to become inaccurate when we cannot decide statically if a statement is executed or not. We can still find sets of nodes accessed by a particular statement and deduce coarser grained parallelism.
We should mention something of the fuzzy approach given in [CC96]. Here the authors deal with the problem of statements that may or may not be executed at run-time, in the context of attempting dataflow analysis. Although the exact source of a particular item of data may not be possible to find they can trim the set of potential sources. This is done by identifying potential sources that will be overwritten before the item of data is read. We can apply this kind of approach, by noting that the execution of a statement can imply that certain other statements must have been executed earlier.