\documentclass[11pt]{article}
\usepackage{ifthen}
\usepackage{alltt}
% \usepackage{indentfirst}
\usepackage{latexsym}
\usepackage[pdftex]{graphicx}
\usepackage{gdefs}
% \usepackage{logdef}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsfonts}
\usepackage{setspace}
\usepackage{rotating}
\usepackage{stmaryrd}
\usepackage{longtable}
\usepackage{hhline}
\usepackage{refs}
\usepackage{graph}
\usepackage{changebar}
\usepackage{array}
\usepackage{wrapfig}
\usepackage[small,compact]{titlesec}
\usepackage{listings}
\usepackage{verbatim}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{example}[theorem]{Example}
\newtheorem{observation}[theorem]{Observation}
\newtheorem{challenge}[theorem]{Challenge}
\newtheorem{principle}[theorem]{Principle}
\newtheorem{Alg}[theorem]{Algorithm}
\newtheorem{fact}[theorem]{Fact}
\newenvironment{prevthe}[1]%
{\par\noindent{\bf Theorem~\ref{The:#1}.\/}\begin{it}}%
{\end{it}}
\newenvironment{prevlem}[1]%
{\par\noindent{\bf Lemma~\ref{Lem:#1}.\/}\begin{it}}%
{\end{it}}
\newenvironment{proof}{\par\noindent %
{\em Proof:\/}\begin{rm}}{\end{rm}}
\newcommand{\qed}{\mbox{$\Box$}}

\usepackage{tweaklist}

\renewcommand{\itemhook}{\setlength{\topsep}{0pt}%
  \setlength{\itemsep}{0pt}%
  \setlength{\parsep}{0ex}%
}

% this sets the spacings in the enumerate environment
\renewcommand{\enumhook}{\setlength{\topsep}{0pt}%
  \setlength{\itemsep}{0pt}%
  \setlength{\parsep}{0ex}%
}

% this sets the spacings in the description environment
\renewcommand{\descripthook}{\setlength{\topsep}{0pt}%
  \setlength{\itemsep}{0pt}%
  \setlength{\parsep}{0ex}%
}

\setlength{\topmargin}{0.0in}
\setlength{\headheight}{0.0in}
\setlength{\headsep}{0.0in}
\setlength{\textwidth}{6.5in}
\setlength{\oddsidemargin}{0.0in}
\setlength{\evensidemargin}{0.0in}
\setlength{\textheight}{9.0in}

\setcounter{topnumber}{5}
\def\topfraction{0.99}
\def\textfraction{0.05}
\def\floatpagefraction{0.9}
\setcounter{bottomnumber}{5}
\def\bottomfraction{0.99}
\setcounter{totalnumber}{10}
\def\dbltopfraction{0.99}
\def\dblfloatpagefraction{0.8}
\setcounter{dbltopnumber}{5}

\setlength{\marginparwidth}{.95in}
\let\oldmarginpar\marginpar
\renewcommand\marginpar[1]{\-\oldmarginpar[\raggedleft\footnotesize #1]%
{\raggedright\footnotesize #1}}

\let\oldthebibliography=\thebibliography
  \let\endoldthebibliography=\endthebibliography
  \renewenvironment{thebibliography}[1]{%
    \begin{oldthebibliography}{#1}%
      \setlength{\parskip}{0ex}%
      \setlength{\itemsep}{0ex}%
  }%
  {%
    \end{oldthebibliography}%
  }

\lstset{
	basicstyle=\itshape,
	xleftmargin=3em,
	literate={->}{$\rightarrow$}{2}
	{α}{$\alpha$}{1}
	{δ}{$\delta$}{1}
}

\newcommand{\eqncenter}[1]{
{\centering 

#1

}}
\newcommand{\ITE}[3]{#1 \: ? \:  #2 : #3}
\newcommand{\ITEAligned}[3]{%
  \begin{array}{cl}%
    \multicolumn{2}{l}{{#1}} \\%
      \hspace*{2.0ex} ? & #2 \\%
      \hspace*{2.0ex} : & #3%
   \end{array}}

\newcommand{\rotxc}[1]{\begin{sideways}#1\end{sideways}}
\newcommand{\invert}[1]{\rotxc{\rotxc{#1}}}

\newcounter{LineNumber}[figure]
\newcommand{\theHLineNumber}[0]{\arabic{figure}.\arabic{LineNumber}}
%\newcounter{LineNumber}
\newcommand{\beginLineNumber}{\setcounter{LineNumber}{0}[0]\=\+\kill}
\newcommand{\beginLLineNumber}{\setcounter{LineNumber}{0}[00]\=\+\kill}
\newcommand{\beginLLLineNumber}{\setcounter{LineNumber}{0}[000]\=\+\kill}
\newcommand{\continueLLineNumber}{[00]\=\+\kill}
\newcommand{\stopLLineNumber}{\-}
\newcommand{\LNum}{\<\refstepcounter{LineNumber}[\theLineNumber]}
\newcommand{\PLNum}[1]{\<\refstepcounter{LineNumber}[{#1}\theLineNumber]}


% Struts for use in tabular and array
\newcommand\strutA{\rule{0pt}{3.5ex}}
\newcommand\strutT{\rule{0pt}{2.6ex}}
\newcommand\strutB{\rule[-1.2ex]{0pt}{0pt}}
\newcommand\strutC{\rule[-4ex]{0pt}{0pt}}

% Frequent sets
\newcommand{\bbZ}{\mathbb{Z}}
\newcommand{\bbQ}{\mathbb{Q}}
\newcommand{\bbN}{\mathbb{N}}
\newcommand{\bbR}{\mathbb{R}}
\newcommand{\bbM}{\mathbb{M}}
\newcommand{\bbB}{\mathbb{B}}
\newcommand{\calE}{\mathcal{E}}
\newcommand{\calG}{\mathcal{G}}
\newcommand{\calL}{\mathcal{L}}
\newcommand{\calP}{\mathcal{P}}
\newcommand{\calR}{\mathcal{R}}
\newcommand{\calS}{\mathcal{S}}
\newcommand{\calX}{\mathcal{X}}
\newcommand{\Z}{\mathbb{Z}}
\newcommand{\Ss}{\mathcal{S}}
\newcommand{\SSs}{\mathcal{SS}}

% Common brackets
\newcommand{\p}[1]{\left({#1}\right)}
\newcommand{\abs}[1]{\left|{#1}\right|}
\newcommand{\norm}[1]{\left\|{#1}\right\|}
\newcommand{\sq}[1]{\left[{#1}\right]}
\newcommand{\set}[1]{\left\{ {#1} \right\}}
\newcommand{\floor}[1]{\left\lfloor{#1}\right\rfloor}
\newcommand{\ceil}[1]{\left\lceil{#1}\right\rceil}
\newcommand{\vocab}[1]{\llparenthesis #1 \rrparenthesis}

%Math symbols
\newcommand{\defeq}{\overset{\underset{\text{def}}{}}{=}}
\newcommand{\Forall}[1]{\forall {#1}\!:}
\newcommand{\Exists}[1]{\exists {#1}\!:}
\DeclareMathOperator{\lnulunion}{\curlyvee}
\DeclareMathOperator{\lnulintersect}{\curlywedge}
\DeclareMathOperator{\extend}{\otimes}
\DeclareMathOperator{\combine}{\oplus}
\DeclareMathOperator{\tensor}{\odot}
\DeclareMathOperator*{\Extend}{\bigotimes}
\DeclareMathOperator*{\Combine}{\bigoplus}
\DeclareMathOperator*{\CombinePair}{{\bigoplus_p}}
\DeclareMathOperator*{\CombineTensor}{{\textstyle{{\displaystyle \bigoplus}_{\T}}}}
\DeclareMathOperator{\Tensor}{\bigodot}
\DeclareMathOperator{\concat}{||}

\newcommand{\Readout}{\ensuremath{{\cal R}}}
\newcommand{\DeTensor}{\ensuremath{{\lightning}}}
\newcommand{\transpose}[1]{#1^t}
\newcommand{\stranspose}[1]{#1^{\OpEval{t}}}
\newcommand{\TDeTensor}{\ensuremath{{\DeTensor}^{(t,\cdot)}}}
\newcommand{\srZero}{\underline{0}}
\newcommand{\srOne}{\underline{1}}
\newcommand{\couple}{\mathcal{C}}
\newcommand{\OpEval}[1]{\llparenthesis{#1}\rrparenthesis}

% Variable names
\newcommand{\var}[1]{\ensuremath{\mathit{#1}}}
\newcommand{\proc}[1]{\ensuremath{\text{\textsc{#1}}}}
\newcommand{\startState}{\textrm{startState}}
\newcommand{\accept}{\textrm{acceptState}}
\newcommand{\reject}{\textrm{rejectState}}
\newcommand{\newState}{\textrm{newState}}
\newcommand{\Ans}{\textrm{Ans}}
\newcommand{\stateTranslationTable}{\textrm{stateTranslationTable}}
\newcommand{\callStateProxy}{\textrm{callStateProxy}}
\newcommand{\callStatesAtLevel}{\textrm{callStatesAtLevel}}
\newcommand{\callStatesAfterZero}{\textrm{callStatesAfterZero}}
\newcommand{\callStatesAfterOne}{\textrm{callStatesAfterOne}}
\newcommand{\topLevelVar}{\textrm{topLevelVar}}
\newcommand{\visited}{\textrm{visited}}
\newcommand{\even}{\textrm{even}}
\newcommand{\odd}{\textrm{odd}}
\newcommand{\Bool}{\textrm{Bool}}
\newcommand{\true}{\textrm{true}}
\newcommand{\false}{\textrm{false}}
\newcommand{\each}{\textrm{each}}
\newcommand{\internalTransSet}{\textrm{internalTransSet}}
\newcommand{\callTransSet}{\textrm{callTransSet}}
\newcommand{\returnTransSet}{\textrm{returnTransSet}}
\DeclareMathOperator{\eqeq}{\textrm{==}}
\DeclareMathOperator{\unionEqual}{\textrm{$\cup$=\,}}
\newcommand{\OBDD}{\textrm{OBDD}}
\newcommand{\unsigned}{\textrm{unsigned}}
\newcommand{\Eq}{\textrm{Eq}}
\newcommand{\Id}{\textrm{Id}}
\newcommand{\expr}{\ensuremath{\mathit{exp}}}
\newcommand{\exprt}{\ensuremath{\mathit{expt}}}
\newcommand{\Procs}{\textrm{Procs}}
\newcommand{\Coeff}{\textrm{Coeff}}
\newcommand{\Reg}{\textrm{Reg}}
\newcommand{\Rhs}{\textrm{Rhs}}
\newcommand{\Project}{\textrm{Project}}

% paper-specific
\newcommand{\wsum}{\displaystyle\Combine\limits_{i \in \bbN}}
\newcommand{\newtonmethod}{Newton's method}
\newcommand{\fixpoint}{fix-point}
\newcommand{\wali}{WALi}
\newcommand{\semiring}{semiring}
\newcommand{\semirings}{semirings}
\newcommand{\D}{\mathcal{D}}
\newcommand{\T}{\mathcal{T}}
\newcommand{\differentialOp}[1]{\ensuremath{\D_{#1}}}
\newcommand{\differential}[3]{\ensuremath{{\D_{#1}}{#2}|_{#3}}}
\newcommand{\differentialT}[3]{\ensuremath{{\D^\T_{#1}}{#2}|_{#3}}}
\newcommand{\Differential}[2]{\ensuremath{\D{#1}|_{#2}}}
\newcommand{\DifferentialT}[2]{\ensuremath{\D^\T{#1}|_{#2}}}
\newcommand{\LinearCorrectionTerm}[2]{\ensuremath{\textrm{LinearCorrectionTerm}(#1,#2)}}
\newcommand{\NewY}{\ensuremath{\vec{Y}}}
\newcommand{\NewYOne}{\ensuremath{Y_1}}
\newcommand{\NewYTwo}{\ensuremath{Y_2}}
\newcommand{\OldY}{\ensuremath{\underline{\nu}}}
\newcommand{\OldYOne}{\ensuremath{\underline{\nu}_1}}
\newcommand{\OldYTwo}{\ensuremath{\underline{\nu}_2}}
\newcommand{\NewZ}{\ensuremath{\vec{Z}}}
\newcommand{\NewZOne}{\ensuremath{Z_1}}
\newcommand{\NewZTwo}{\ensuremath{Z_2}}
\newcommand{\SDV}{\textrm{SDV}}
\newcommand{\LHS}{\textrm{LHS}}
\newcommand{\RHS}{\textrm{RHS}} 

\renewcommand{\join}{\sqcup}
\renewcommand{\Bigjoin}{\bigsqcup}
\renewcommand{\meet}{\sqcap}
\renewcommand{\Bigmeet}{\bigsqcap}
\newcommand{\tval}{\textit{val}}

\newcommand{\Omit}[1]{}

\newcommand{\asm}[1]{\texttt{#1}}

\title{Interprocedural Dataflow Analysis, Part III: \\
       Newtonian Program Analysis Via Tensor Product \\
       CS701 \\
}

\author{Thomas Reps}
\date{}

\sloppy
\allowdisplaybreaks[1]

\begin{document}           % End of preamble and beginning of text.

\maketitle
\begin{abstract}
In this lecture, we summarize the interprocedural-dataflow-analysis
method of Esparza et al., which generalizes Newton's method
from a numerical-analysis algorithm for finding roots of real-valued
functions to a method for finding fixed-points of systems of equations
over semirings. As in its real-valued counterpart, each iteration of
the method of Esparza et al.\ solves a simpler ``linearized'' problem.

We then move on to a recent method of Reps et al., which attempts to
provide an improved technique for solving the linearized problems
produced during successive rounds of Newton's method for semirings.
\end{abstract}

\section{Newtonian Program Analysis (NPA)}

In previous lectures, we described how interprocedural dataflow-analysis
problems could be formalized as path problems in which there are
two operators, extend (denoted by $\extend$) and combine (denoted by $\combine$).
Technically, we are dealing with a \emph{semiring}, which can be defined
as follows:

\begin{definition}
\label{De:SemiringSimple}
A \textbf{semiring} $\calS = (D, \combine, \extend, \srZero, \srOne)$
consists of a set of \textbf{elements} $D$ equipped with two binary operations:
\textbf{combine} ($\combine$) and \textbf{extend} ($\extend$).
$\combine$ and $\extend$ are associative, and have identity elements
$\srZero$ and $\srOne$, respectively.
$\combine$ is commutative, and $\extend$ distributes over $\combine$.
(A semiring is sometimes called a \textbf{weight domain},
in which case elements are called \textbf{weights}.)
\end{definition}

If fact, we need the semiring to have some additional
properties---chiefly so that it makes sense to define a
\textbf{Kleene-star operator} in the following way:
$\vphantom{a}^* \colon D \rightarrow D$ is the operation $a^* = \wsum a^i$,
where $a^i$ denotes the $i^{th}$ term in the sequence
$a^0 = \srOne$ and $a^{i+1} = a^{i} \extend a$.
See \appref{Definitions} for the technical details.

Our focus is on semirings in which $\combine$ is
\textbf{\emph{idempotent}} (i.e., for all $a \in D$, $a \combine a = a$).
In an idempotent semiring, the order on elements is defined by
$a \sqsubseteq b$ iff $a \combine b = b$.
(Idempotence would be expected in the context of dataflow analysis
because an idempotent semiring is a join semilattice $(D, \combine)$
in which the join operation is $\combine$.)

A semiring is \textbf{\emph{commutative}} if
for all $a,b \in D$, $a \extend b = b \extend a$.
We work with \textbf{\emph{non-commutative}} semirings, and
henceforth use the term ``semiring''---and symbol $\calS$---to mean an
\textbf{\emph{idempotent, non-commutative, ($\omega$-continuous) semiring}}.

To simplify notation, we sometimes abbreviate $a \extend b$ as $a b$,
and we assume the following precedences for operators:
$\vphantom{}^* > \extend > \combine$.
We also sometimes use $a \in \calS$ rather than $a \in D$.

\paragraph*{Newton's Method for Root Finding.}
The jumping-off point for Esparza et al.\ is the observation that
the algorithms for solving program-analysis problems are based
on \textbf{\emph{Kleene iteration}}---i.e., the technique for finding the least
fixed-point of $\vec{X} = \vec{f}(\vec{X})$ via the sequence
$\vec{\kappa}^{(0)} = \srZero$; $\vec{\kappa}^{(i+i)} = \vec{f}(\vec{\kappa}^{(i)})$---whereas
in numerical problems, the workhorse for successive-approximation algorithms
is Newton's method.
The advantage of Newton's method in numerical problems is that when it
converges, it converges much faster than Kleene iteration.

\begin{figure}
\centering
\includegraphics[width=9.0cm]{figures/newton-numerical.eps}
\caption{The principle behind Newton's method.}
\label{Fi:NewtonNumerical}
\end{figure}

\figref{NewtonNumerical} shows how Newton's method can (sometimes)
help identify where a root of an expression lies.
(Newton's method is not guaranteed to converge to a root.)
The general principle is to create a linear model of the function---in this
case the tangent line---and solve the problem for the linear model
to obtain the next approximation to the root.

\paragraph*{Newton's Method for Program Analysis.}
Esparza et al.\ \cite{ICALP:EKL08,JACM:EKL10} have given a
generalization of Newton's method that finds the least fixed-point of
a system of equations over a semiring.
In this section, we summarize their NPA method for the case of idempotent,
non-commutative, $\omega$-continuous semirings.
Compared to the numerical setting, they have two points that they need to finesse:
\begin{enumerate}
  \item
    With numerical functions, the linear model is defined using derivatives and limits.
    We have no such entities in semirings.
  \item
    Newton's method is for root-finding (i.e., find $x$ such that $f(x) = 0$), whereas
    in program analysis we are interested in finding a fixed-point (i.e., find $x$ such
    that $f(x) = x$).
    Although one can easily convert a fixed-point problem into a
    root-finding problem---find $x$ such that $f(x) - x = 0$---this
    approach creates a new problem because there is no analogue of a
    subtraction operation in a semiring.
\end{enumerate}

The method of Esparza et al., which they call
\textbf{\emph{Newtonian Program Analysis (NPA)}},
is also an iterative successive-approximation method,
but uses the following scheme:\footnote{
  For reasons that are immaterial to this discussion, Esparza et al.\ start
  the iteration via $\vec{\nu}^{(0)} = \B{f_1(\bot), \ldots, f_n(\bot)}$
  rather than $\vec{\nu}^{(0)} = \vec{\bot}$.
  Our goal here is to bring out the essential similarities between
  Kleene iteration and NPA.
}
\begin{equation}
  \label{Eq:Intro::NewtonIteration}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{.4ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{.4ex}}|@{\hspace{0ex}}}
    \hline
    \vec{\nu}^{(0)}   & = & \vec{\bot} \strutT \\
    \vec{\nu}^{(i+1)} & = & \vec{f}(\vec{\nu}^{(i)}) \sqcup \LinearCorrectionTerm{\vec{f}}{\vec{\nu}^{(i)}} \\
    \hline
  \end{array}
\end{equation}
where $\LinearCorrectionTerm{\vec{f}}{\vec{\nu}^{(i)}}$ is a
correction term---a function of $\vec{f}$ and the current approximation
$\vec{\nu}^{(i)}$---that nudges the next approximation
$\vec{\nu}^{(i+1)}$ in the right direction at each step.
The sense in which the correction term is ``linear'' will be discussed
shortly, but it is that linearity property that makes it proper to say
that \eqref{Intro::NewtonIteration} is a form of Newton's method.

\begin{figure}
\centering
\begin{tabular}{@{\hspace{0ex}}c@{\hspace{8.0ex}}c@{\hspace{0ex}}}
  \includegraphics[height=2.1in]{figures/overview-program.eps}
  &
  \includegraphics[height=2.1in]{figures/overview-program-newton.eps}
  \\
  (a) & (b)
\end{tabular}
\caption{(a) Graphical depiction of the equation system given in
  \eqref{Overview::RunningExample} as an interprocedural control-flow
  graph.  The three edges labeled ``$X_2$'' represent calls to procedure
  $X_2$.
  (b) Linearized equation system over $\NewY$ obtained from
  \eqref{Overview::RunningExample} via \eqref{Overview::DeltaI}.
}
\label{Fi:OverviewProgramNewton}
\end{figure}

\begin{example}\label{Exa:Overview::Program}
Consider the following program scheme, where $X_1$ represents the main
procedure, $X_2$ represents a subroutine, and $s_a$, $s_b$,
$s_c$, and $s_d$ represent four program statements:

\begin{center}
\begin{tabular}{ll}
  \begin{minipage}{2.0cm}
    $X_1()~\{$ \\
    $~~~~~~s_a;$     \\
    $~~~~~~X_2()$ \\
    $\}$
  \end{minipage}
  &
  \begin{minipage}{4.0cm}
    $X_2()~\{$           \\
    $~~~~~~\textrm{if}~(\star)~~s_d$ \\
    $~~~~~~\textrm{else}~\{$ \\
    $~~~~~~~~~~~~s_b;$ $X_2();$ $X_2();$ $s_c$         \\
    $~~~~~~\}$               \\
    $\}$
  \end{minipage}
\end{tabular}
\end{center}

Suppose that we have a semiring that captures a suitable abstraction
of the program's actions (such as the relational weight domain).
Let $a$, $b$, $c$, and $d$ denote the semiring elements
that abstract statements $s_a$, $s_b$, $s_c$, and $s_d$, respectively.
The (abstract) actions of procedures $X_1$ and $X_2$ can be expressed as
the following set of recursive equations:
\begin{equation}
  \label{Eq:Overview::RunningExample}
  \begin{array}{@{\hspace{0ex}}r@{\hspace{0.5ex}}c@{\hspace{0.5ex}}l@{\hspace{6.0ex}}r@{\hspace{0.5ex}}c@{\hspace{0.5ex}}l@{\hspace{0ex}}}
      X_1 & = & a \extend X_2
    &
      X_2 & = &  d \combine b \extend X_2 \extend X_2 \extend c.
  \end{array}
\end{equation}
An equation system can also be viewed as a representation
of a program's interprocedural control-flow graph (CFG).
See \figref{OverviewProgramNewton}(a).
\end{example}

In general, let $\calS = (D, \combine, \extend, \srZero, \srOne)$
be a semiring and $a_1, \ldots, a_{k+1} \in D$ be semiring elements.
Let $\calX$ be a finite set of variables $X_1, \ldots, X_k$.
A \textbf{\emph{monomial}} is a finite expression
$a_1 X_1 a_2 \ldots a_k X_k a_{k+1}$, where $k \ge 0$.
Monomials of the form $X_1 a_2$, $a_1 X_1$, and $a_1 X_1 a_2$
are \textbf{\emph{left-linear}}, \textbf{\emph{right-linear}}, and
\textbf{\emph{linear}}, respectively.
(A semiring constant $a_1$ is considered to be left-linear, right-linear,
and linear.)
A \textbf{\emph{polynomial}} is a finite expression
of the form $m_1 \combine \ldots \combine m_p$,
where $p \ge 1$ and $m_1, \ldots, m_p$ are monomials.
A system of polynomial equations has the form
\[
  \begin{array}{@{\hspace{0ex}}r@{\hspace{0.5ex}}c@{\hspace{0.5ex}}l@{\hspace{3.0ex}}c@{\hspace{2.0ex}}r@{\hspace{0.5ex}}c@{\hspace{0.5ex}}l@{\hspace{0ex}}}
    X_1 & = & f_1(X_1, \ldots, X_n)
        & \cdots & 
    X_n & = & f_n(X_1, \ldots, X_n),
  \end{array}
\]
or equivalently, $\vec{X} = \vec{f}(\vec{X})$, where
$\vec{X} = \B{X_1, \ldots, X_n}$ and
$\vec{f} = \lambda \vec{X}.\B{f_1(\vec{X}), \ldots, f_n(\vec{X})}$.
For instance, for \eqref{Overview::RunningExample},
$\vec{f} \eqdef \lambda \vec{X}. \B{a \extend X_2, d \combine b \extend X_2 \extend X_2 \extend c}$.

Kleene iteration is the well-known technique for finding the least
fixed-point of $\vec{X} = \vec{f}(\vec{X})$ via the sequence
$\vec{\kappa}^{(0)} = \srZero$;
$\vec{\kappa}^{(i+i)} = \vec{f}(\vec{\kappa}^{(i)})$.
Esparza et al.\ \cite{ICALP:EKL08,JACM:EKL10} devised an alternative
method, called NPA, for finding the least fixed-point of $\vec{X} = \vec{f}(\vec{X})$.
With NPA, one solves the following sequence of problems for $\vec{\nu}$:
\begin{equation}
  \label{Eq:Overview::NewtonIteration}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{.4ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{.4ex}}|@{\hspace{0ex}}}
    \hline
    \vec{\nu}^{(0)} & = & (f_1(\vec{\srZero}), \ldots, f_n(\vec{\srZero})) \strutT \\
    \vec{\nu}^{(i+1)} & = & \NewY^{(i)} \\
    \hline
  \end{array}
\end{equation}
where $\NewY^{(i)}$ is the value of $\NewY$ in the least solution of
\begin{equation}
  \label{Eq:Overview::DeltaI}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{.4ex}}c@{\hspace{.4ex}}|@{\hspace{0ex}}}
    \hline
    \NewY = \vec{f}(\vec{\nu}^{(i)}) \combine \Differential{\vec{f}}{\vec{\nu}^{(i)}}(\NewY)  \strutT\strutB \\
    \hline
  \end{array}
\end{equation}
and $\Differential{\vec{f}}{\vec{\nu}^{(i)}}(\NewY)$ is the
\textbf{\emph{multivariate differential}} of $\vec{f}$ at $\vec{\nu}^{(i)}$,
defined below (see \defref{MultivariateDifferential}).
\eqrefs{Overview::NewtonIteration}{Overview::DeltaI} resemble Kleene
iteration, except that on each iteration $\vec{f}(\vec{\nu}^{(i)})$ is
``corrected'' by the amount
$\Differential{\vec{f}}{\vec{\nu}^{(i)}}(\NewY)$.

There is a close analogy between NPA and the use of Newton's method in
numerical analysis to solve a system of polynomial equations
$\vec{f}(\vec{X}) = \vec{0}$.
In both cases, one creates a linear approximation of $\vec{f}$ around
the point $(\vec{\nu}^{(i)}, \vec{f}(\vec{\nu}^{(i)}))$, and then uses
the solution of the linear system in the next approximation of
$\vec{X}$.
The sequence $\vec{\nu}^{(0)}, \vec{\nu}^{(1)}, \ldots, \vec{\nu}^{(i)}, \ldots$
is called the \textbf{\emph{Newton sequence}} for $\vec{X} = \vec{f}(\vec{X})$.
The process of solving \eqrefs{Overview::NewtonIteration}{Overview::DeltaI}
for $\vec{\nu}^{(i+1)}$, given $\vec{\nu}^{(i)}$, is called a
\textbf{\emph{Newton step}} or one \textbf{\emph{Newton round}}.
For polynomial equations over a semiring, the linear approximation of
$\vec{f}$ is created as follows:

\begin{definition}\label{De:MultivariateDifferential}\cite{ICALP:EKL08,JACM:EKL10}
Let $f_i(\vec{X})$ be a component function of $\vec{f}(\vec{X})$.
The \textbf{differential} of $f_i(\vec{X})$ with respect to $X_j$
at $\vec{\underline{\nu}}$, denoted by
$\differential{X_j}{f_i}{\vec{\underline{\nu}}}(\NewY)$, is defined as follows:
\begin{equation}
  \label{Eq:DifferentialOfACoordinateFunction}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{.5ex}}l@{\hspace{.5ex}}|@{\hspace{0ex}}}
    \hline
    \differential{X_j}{f_i}{\vec{\underline{\nu}}}(\NewY) = \strutT \\
    \qquad
    \left\{\begin{array}{@{\hspace{0ex}}c@{\hspace{2.0ex}}l@{\hspace{0ex}}}
      \srZero   & \textrm{if}~f_i = s \in \Ss \\
      \srZero   & \textrm{if}~f_i = X_k~\textrm{and}~k \neq j \\
      Y_j & \textrm{if}~f_i = X_j \\
      \Combine\limits_{k \in K} \differential{X_j}{g_k}{\vec{\underline{\nu}}}(\NewY)
          & \textrm{if}~f_i = \Combine\limits_{k \in K} g_k \\
      \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{.5ex}}l@{\hspace{0ex}}}
                 & \differential{X_j}{g}{\vec{\underline{\nu}}}(\NewY) \extend h(\vec{\underline{\nu}}) \\
        \combine & g(\vec{\underline{\nu}}) \extend \differential{X_j}{h}{\vec{\underline{\nu}}}(\NewY)
      \end{array}\right)
          & \textrm{if}~f_i = g \extend h
    \end{array}\right. \\
    \hline
  \end{array}
\end{equation}
Let $\vec{f}$ be a multivariate polynomial function defined by
$\vec{f} \eqdef \lambda \vec{X}.(f_1(\vec{X}), \ldots, f_n(\vec{X}))$.
The \textbf{multivariate differential} of $\vec{f}$ at $\vec{\underline{\nu}}$,
denoted by $\Differential{\vec{f}}{\vec{\underline{\nu}}}(\NewY)$, is defined
as follows:
\[
  \begin{array}{@{\hspace{0ex}}|@{\hspace{.35ex}}r@{\hspace{.5ex}}c@{\hspace{.5ex}}l@{\hspace{.35ex}}|@{\hspace{0ex}}}
    \hline
    \Differential{\vec{f}}{\vec{\underline{\nu}}}(\NewY)
      & = & \left\langle\begin{array}{@{\hspace{0ex}}c@{\hspace{0ex}}}
              \differential{X_1}{f_1}{\vec{\underline{\nu}}}(\NewY) \combine \ldots \combine \differential{X_n}{f_1}{\vec{\underline{\nu}}}(\NewY), \strutT \\
              \vdots \\
              \differential{X_1}{f_n}{\vec{\underline{\nu}}}(\NewY) \combine \ldots \combine \differential{X_n}{f_n}{\vec{\underline{\nu}}}(\NewY)
            \end{array}\right\rangle \\
    \hline
  \end{array}
\]
$\Differential{f_i}{\vec{\underline{\nu}}}(\NewY)$ denotes the
$i^{\textrm{th}}$ component of
$\Differential{\vec{f}}{\vec{\underline{\nu}}}(\NewY)$.
\end{definition}

The fourth case in \eqref{DifferentialOfACoordinateFunction}
generalizes the differential of a binary combine, i.e.,
\[
  \differential{X_j}{g_1}{\vec{\underline{\nu}}}(\NewY) \combine \differential{X_j}{g_2}{\vec{\underline{\nu}}}(\NewY) \textrm{\qquad if}~f_i = g_1 \combine g_2,
\]
to infinite combines.
Note how the fifth case, for ``$g \extend h$'', resembles the
product rule from differential calculus
\begin{equation}
  \label{Eq:ProductRuleDiffCalc}
  \frac{d}{dx}(g * h) = \frac{dg}{dx}*h + g * \frac{dg}{dx},
\end{equation}
and in particular the differential form of the product rule:
\[
  d(g * h) = dg*h + g*dh.
\]

We refer to the creation of \eqref{Overview::DeltaI} from
$\vec{X} = \vec{f}(\vec{X})$ as the \textbf{\emph{NPA linearizing transformation}}.

\begin{example}\label{Exa:Overview::LinearEquationSystem}
For \eqref{Overview::RunningExample}, the multivariate differential
of $\vec{f}$ at the value $\vec{\underline{\nu}} = \B{\OldYOne, \OldYTwo}$ is
\begin{eqnarray}
    \Differential{\vec{f}}{(\OldYOne, \OldYTwo)}(\NewY)
      & = & \left\langle\begin{array}{@{\hspace{0ex}}c@{\hspace{0ex}}}
              \differential{X_1}{f_1}{(\OldYOne, \OldYTwo)}(\NewY) \combine \differential{X_2}{f_1}{(\OldYOne, \OldYTwo)}(\NewY), \\
              \differential{X_1}{f_2}{(\OldYOne, \OldYTwo)}(\NewY) \combine \differential{X_2}{f_2}{(\OldYOne, \OldYTwo)}(\NewY)
            \end{array}\right\rangle \nonumber \\
      & = & \left\langle\begin{array}{@{\hspace{0ex}}l@{\hspace{0ex}}}
              \srZero \combine a \extend \NewYTwo,
              \srZero \combine \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                                          & b \extend \NewYTwo \extend \OldYTwo \extend c \\
                                 \combine & b \extend \OldYTwo \extend \NewYTwo \extend c
                               \end{array}\right)
            \end{array}\right\rangle \nonumber \\
      & = & \left\langle\begin{array}{@{\hspace{0ex}}l@{\hspace{0ex}}}
              a \extend \NewYTwo,
              \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                         & b \extend \NewYTwo \extend \OldYTwo \extend c \\
                \combine & b \extend \OldYTwo \extend \NewYTwo \extend c
              \end{array}\right)
            \end{array}\right\rangle
      \label{Eq:DifferentialExample}
\end{eqnarray}
From \eqref{Overview::DeltaI}, we then obtain the following linearized
system of equations, which is also depicted graphically in
\figref{OverviewProgramNewton}(b):
\begin{equation}
  \label{Eq:Overview::LCFLSystem}
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \B{\NewYOne, \NewYTwo}
               & = & \left\langle\begin{array}{@{\hspace{0ex}}l@{\hspace{0ex}}}
                       \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                                  & a \extend \OldYTwo \\
                         \combine & a \extend \NewYTwo
                       \end{array}\right),
                       \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                                  & d \\
                         \combine & b \extend \OldYTwo \extend \OldYTwo \extend c \\
                         \combine & b \extend \NewYTwo \extend \OldYTwo \extend c \\
                         \combine & b \extend \OldYTwo \extend \NewYTwo \extend c
                       \end{array}\right)
                     \end{array}\right\rangle
  \end{array}
\end{equation}
On the $i+1^{\textit{st}}$ Newton round, we need to solve \eqref{Overview::LCFLSystem}
for $\B{\NewYOne, \NewYTwo}$ with $\B{\OldYOne, \OldYTwo}$ set to the
value $\B{\nu_1^{(i)},\nu_2^{(i)}}$ obtained on the $i^{\textit{th}}$ round,
and then perform the assignment
$\B{\nu_1^{(i+1)},\nu_2^{(i+1)}} \gets \B{\NewYOne, \NewYTwo}$.
\end{example}

It is instructive to consider why the second component in \eqref{DifferentialExample}
has the form that it has:
\[
           b \extend \NewYTwo \extend \OldYTwo \extend c
  \combine b \extend \OldYTwo \extend \NewYTwo \extend c.
\]
Consider differentiating the numeric expression ``$fXgXh$'' with respect to $X$.
You'll probably immediately say $fXgXh = fghX^2$, and therefore the derivative is
$2fghX$.
But let's go more by what \eqref{ProductRuleDiffCalc} says:
\begin{eqnarray*}
  \frac{d}{dX}(fXgXh) & = & f*\frac{dX}{dX}*g*X*h + f*X*g*\frac{dX}{dX}*h \\
                      & = & f*1*g*X*h + f*X*g*1*h \\
                      & = & fgXh + fXgh
\end{eqnarray*}
If multiplication is not commutative (which is the case with a semiring's
$\extend$ operation), then you cannot simplify the last line to $2fghX$.

Note that \eqref{Overview::LCFLSystem} is a linear problem in that each summand
has just a single occurrence of a $Y_i$.
\figref{OverviewProgramNewton}(b) gives a graphical depiction of the linearized
problem.

\paragraph*{A Misconception on My Part.}
While Prathmesh Prabhu, a student in CS704, was presenting the experiment that
he and two other students had done with NPA  as a class project, I formulated the
following analogy in my mind:
\begin{eqnarray*}
       \textrm{Polynomial} & \rightarrow & \textrm{Linear} \\
  \textrm{Interprocedural} & \rightarrow & \textrm{Intraprocedural}
\end{eqnarray*}
In other words, I was thinking that solving each linearized problem
corresponds to solving an \textbf{\emph{intra}}procedural dataflow-analysis
problem---a topic that has a fifty-year history
\cite{UNPUB:VW63,kn:Kildall73,kn:KU76,kn:GW76,kn:tar1}.
In particular, Tarjan's path-expression method \cite{kn:tar2} finds a
regular expression for each of the variables in a set of mutually
recursive left-linear equations.
The regular expressions are then evaluated using an appropriate
interpretation of the regular operators $+$, $\cdot$, and $\,^*$.
Moreover, Prathmesh's study indicated that
(i) NPA was not an improvement over conventional methods
for interprocedural dataflow analysis, and
(ii) 98\% of the time was spent performing classical fixed-point
iteration to solve the linearized problem.
Why not just apply a fast intraprocedural solver?

Prathmesh's reply set me back;
he pointed out what we mentioned above, namely, when
Newton's method is used in numerical-analysis problems,
\textbf{\emph{commutativity of multiplication}} is relied on to rearrange an
expression of the form ``$c*X + X*d$'' in the linearized problem into
one of the form ``$c*X + d*X$,'' which equals ``$(c+d)*X$.''
In contrast, in interprocedural dataflow analysis, a dataflow value is
typically an abstract transformer (i.e., it represents a function from
sets of states to sets of states) \cite{kn:CC78,kn:SP81}.
Consequently, the ``multiplication'' operation is typically the reversal
of function composition---$v_1 * \, v_2 \eqdef v_2 \composition v_1$---which
is not a commutative operation.
When NPA is used with a non-commutative semiring,
an expression ``$c*X + X*d$'' in the linearized problem
cannot be rearranged:
coefficients can appear on both sides of variables.

From a formal-languages perspective, the linearized equation systems
that arise in numerical analysis correspond to path problems described
by \textbf{\emph{regular languages}}.
However, when expressions of the form ``$c*X + X*d$'' cannot be
rearranged, the linearized equation systems correspond to path problems
described by \textbf{\emph{linear context-free languages (LCFLs)}}.
Conventional intraprocedural dataflow-analysis algorithms solve only
regular-language path problems, and hence cannot, in general, be
applied to the linearized equation systems considered on each round of NPA.
Consequently, we are stuck performing classical fixed-point iteration
on the LCFL equation systems.
(Applying NPA's linearization transformation to one of the LCFL
equation systems just results in the same LCFL equation system, and so
one would not make any progress.)

On the face of it, it seems impossible, therefore, that Tarjan's method
could help in any way:
formal-language theory tells us that LCFL $\supsetneq$ Regular.
In particular, the canonical example of a non-regular language,
$\{b^i c^i \,|\, i \in \bbN \}$, is an LCFL.

However, the remainder of the lecture describes how---despite this obstacle---there
are non-commutative semirings for which we can transform the problem so that Tarjan's
method applies.
Moreover, one of the families of semirings for which our transformation applies
is the set of \textbf{\emph{predicate-abstraction domains}} \cite{CAV:GS97},
which are the foundation of most of today's software model
checkers.

\paragraph*{A Promising Step: Pairing.}
A left-linear equation system corresponds to a left-linear grammar, and
hence a regular language.
The fact that Tarjan's path-expression method \cite{kn:tar2} provides
a fast method for solving left-linear equation systems led us to pose
the following question:
\begin{equation*}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{0.5ex}}p{6.0in}@{\hspace{0.5ex}}|@{\hspace{0ex}}}
    \hline
    \strutB Is it possible to ``regularize'' the LCFL equation
    system $L$ that arises on each Newton round---i.e.,
    transform $L$ into a left-linear equation system $L_\Reg$? \\
    \hline
  \end{array}
\end{equation*}
If the extend ($\extend$) operation of the semiring is commutative, it
is trivial to turn an LCFL equation system into a left-linear equation
system.
However, in dataflow-analysis problems, we rarely have a commutative
extend operation;
thus, our goal is to find a way to regularize a
\textbf{\emph{non-commutative}} LCFL equation system.

On the face of it, this line of attack seems unlikely to pan out;
after all, if we read the $\NewYTwo$ component of \eqref{Overview::LCFLSystem}
as a grammar,
\begin{equation*}
%  \label{Eq:LCFLGrammar}
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \NewYTwo & ::=  & d \\
             & \mid & b ~ \OldYTwo ~ \OldYTwo ~ c \\
             & \mid & b ~ \NewYTwo ~ \OldYTwo ~ c \\
             & \mid & b ~ \OldYTwo ~ \NewYTwo ~ c,
  \end{array}
\end{equation*}
it resembles the language $\calL = \{b^i c^i \,|\, i \in \bbN \}$,
which is the canonical example of an LCFL that is not regular.
$\calL$ can be defined via the linear context-free grammar
\begin{equation}
  \label{Eq:Overview::CanonicalLCFG}
  S ::= \epsilon \mid b ~ S ~ c
\end{equation}
in which the second production allows matching $b$'s and $c$'s to be
accumulated on the left and right sides of nonterminal $S$.
Moreover, if grammar (\ref{Eq:Overview::CanonicalLCFG}) is extended to
have $K$ matching rules
\begin{equation}
  \label{Eq:Overview::CanonicalLCFGExtended}
  S ::= \epsilon \mid b_j ~ S ~ c_j~~~~1 \leq j \leq K
\end{equation}
the generated strings have bilateral symmetry, e.g.,
\[
  \ldots \underbrace{b_2 \underbrace{b_1 c_1} c_2} \ldots
\]
Any solution to the problem of regularizing a non-commutative
LCFL equation system has to accommodate such mirrored correlation
patterns.

The challenge is to devise a way to accumulate matching quantities on
both the left and right sides, whereas in a regular language, we can
only accumulate values on one side.
This observation suggests the strategy of using \textbf{\emph{pairs}}
in which left-side and right-side values are accumulated separately
but concurrently, so that the desired correlation is maintained.
Toward this end, we define extend and combine on pairs as follows:
\begin{align}
  \label{Eq:PairedExtend}
  (a_1,b_1) \extend_p (a_2,b_2) & = (a_2 \extend a_1, b_1 \extend b_2) \\
  \label{Eq:PairedCombine}
  (a_1,b_1) \combine_p (a_2,b_2) & = (a_1 \combine a_2, b_1 \combine b_2)
\end{align}
Note the order-reversal in the first component of the right-hand side
of \eqref{PairedExtend}: ``$a_2 \extend a_1$.''

Given a pair $(a, b)$, we can read out a normal value via the
operation $\Readout(a, b) \eqdef a \extend b$.
Because of the order-reversal in \eqref{PairedExtend}, we have
\[
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \Readout( (a_1,b_1) \extend_p (a_2,b_2) )
       & = & \Readout((a_2 \extend a_1, b_1 \extend b_2)) \\
       & = & \underbrace{a_2 \extend \underbrace{a_1 \extend b_1} \extend b_2}.
  \end{array}
\]
The braces highlight the fact that we have achieved the desired
mirrored matching of (i) $a_1$ with $b_1$, and (ii) $a_2$ with $b_2$.

\begin{example}\label{Exa:Overview::PairingEquationSystem}
Using $\extend_p$ and $\combine_p$, we can transform a linear equation (and
more generally a set of linear equations) by pairing semiring values that
appear to the left of a variable with the values that appear to the
right of the variable, placing the pair to the variable's right.
For instance, the equation for $\NewYTwo$ in \eqref{Overview::LCFLSystem}
is transformed into
\begin{equation}
  \label{Eq:Overview::RegularizedViaPairs}
  \NewZTwo = \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                   & (\srOne, d) \\
        \combine_p & (\srOne, b \extend \OldYTwo \extend \OldYTwo \extend c) \\
        \combine_p & \NewZTwo \extend_p (b, \OldYTwo \extend c) \\
        \combine_p & \NewZTwo \extend_p (b \extend \OldYTwo, c)
      \end{array}\right)
\end{equation}
where $\NewZTwo$ is now a variable that takes on \textbf{pairs} of semiring values.
After collecting terms, we have an equation of the form
\begin{eqnarray}
  \label{Eq:ZTwoRegExp}
  \NewZTwo & = & A \combine_p \NewZTwo \extend_p B, \\
  \label{Eq:PairedA}
  \textrm{where} \quad A & = & (\srOne, d \combine b \extend \OldYTwo \extend \OldYTwo \extend c), \\
  \label{Eq:PairedB}
  \textrm{and}   \quad B & = & (b \combine b \extend \OldYTwo, \OldYTwo \extend c \combine c).
\end{eqnarray}
\eqref{ZTwoRegExp} is similar to the equation over formal languages
\[
  \NewZTwo = A + (\NewZTwo \cdot B),
\]
for which the regular expression $A \cdot B^*$ is a
closed-form solution for $\NewZTwo$.
Similarly, the solution of \eqref{ZTwoRegExp} for $\NewZTwo$ over
paired semiring values is given by
\begin{equation}
  \label{Eq:PairedClosedForm}
  \NewZTwo = A \extend_p B^{*_{p}},
\end{equation}
where $B^{*_{p}}$ denotes $\CombinePair\limits_{i \in \bbN~~} B^i$ (in which
the repeated ``multiplication'' operation in $B^i$ is $\extend_p$).
If the answer obtained for $\NewZTwo$ is the pair $(w_1, w_2)$, we can read
out the value for $\NewZTwo$ as $\Readout((w_1, w_2)) = w_1 \extend w_2$.
\end{example}

The algorithm demonstrated above can be stated as follows:

\begin{Alg}\label{Alg:StrawmanSolution}
To solve a linear equation system $L$,
\begin{enumerate}
  \item
    \label{It:Strawman:Convert}
    Convert $L$ into a left-linear equation system $L_\Reg$
    (with weights that consist of pairs of semiring values).
  \item
    \label{It:Strawman:Solve}
    Find the least solution of equation system $L_\Reg$.
  \item
    \label{It:Strawman:Readout}
    Apply the readout operation $\Readout$ to the least solution of
    $L_\Reg$ to obtain a solution to $L$.
\end{enumerate}
\end{Alg}

In our example, for step (\ref{It:Strawman:Solve}) we expressed the
least solution of \eqref{ZTwoRegExp} in closed form, as a regular
expression (\eqref{PairedClosedForm}), which means that the solution for
$\NewZTwo$ can be obtained merely by evaluating the regular expression.
In general, when equation system $L_\Reg$ has a larger number of variables,
for step (\ref{It:Strawman:Solve}) we can use Tarjan's path-expression
method \cite{kn:tar2}, which finds a regular expression for each of
the variables in a set of mutually recursive left-linear equations.

This approach has a lot of promise for Newtonian program analysis
because the structure of $L_\Reg$---\textbf{\emph{and hence of the
corresponding regular expressions}}---remains fixed from round to
round.
Consequently, we only need to perform the expensive step of regular-expression
construction via Tarjan's method once, before the first round.
The actions taken for step (\ref{It:Strawman:Solve}) on each Newton
round are as follows:
(i) in each regular expression, replace the constant-valued leaves $\{
\OldY_i \}$, which represent previous-round values, with updated
constants, and
(ii) reevaluate the regular expression.

In our example, the original linearized system of
\eqref{Overview::LCFLSystem}, transformed to left-linear form, is
\begin{equation*}
  \B{\NewZOne, \NewZTwo} = \B{(\srOne, a \extend \OldYTwo) \combine_p \NewZTwo \extend_p (a, \srOne),
                             A \combine_p \NewZTwo \extend_p B
                           },
\end{equation*}
for which we have the closed-form solution
\begin{equation}
  \label{Eq:Overview::ClosedFormSolution}
  \B{\NewZOne, \NewZTwo} =
      \left\langle\begin{array}{@{\hspace{0ex}}l@{\hspace{0ex}}}
        (\srOne, a \extend \OldYTwo) \combine_p A \extend_p B^{*_{p}} \extend_p (a, \srOne), \\
        A \extend_p B^{*_{p}}
      \end{array}\right\rangle.
\end{equation}
To solve the original system of equations given in
\eqref{Overview::RunningExample},
\begin{enumerate}
  \item
    First, set $\OldYTwo$ to $\srZero$ in
    \eqref{Overview::ClosedFormSolution} and evaluate the right-hand side:
    \begin{equation}
      \label{Eq:Overview::ClosedFormRoundZero}
      \B{\NewZOne, \NewZTwo} =
          \left\langle\begin{array}{@{\hspace{0ex}}l@{\hspace{0ex}}}
            (\srOne, \srZero) \combine_p (\srOne,d) \extend_p (b,c)^{*_{p}} \extend_p (a, \srOne), \\
            (\srOne,d) \extend_p (b,c)^{*_{p}}
          \end{array}\right\rangle.
    \end{equation}
  \item
    Then, until convergence, repeat the following steps:
    \begin{enumerate}
      \item
        Apply $\Readout$ to the value obtained for $\NewZTwo$ to
        obtain the value of $\OldYTwo$ to use during the next round.
      \item
        Use that value in \eqrefs{PairedA}{PairedB},
        and evaluate the right-hand side of 
        \eqref{Overview::ClosedFormSolution} to obtain new values for
        $\NewZOne$ and $\NewZTwo$.
    \end{enumerate}
\end{enumerate}

\begin{figure}
  \centering
  \includegraphics[height=5.0cm]{figures/example-for-pairing.eps}
  \caption{A path problem that has exactly two paths.}
  \label{Fi:ExampleForPairing}
\end{figure}

\paragraph{Pairing Fails to Deliver.}
Unfortunately, the method given as \algref{StrawmanSolution}
is not guaranteed to produce the desired least-fixed-point
solution to an LCFL equation system $L$.
The reason is that the read-out operation $\Readout$ does not, in
general, distribute over $\combine_p$.
Consider the equation system
\[
  X_1 = \srOne \qquad\quad X_2 = a_1 X_1 b_1 \combine a_2 X_1 b_2,
\]
which is depicted graphically in \figref{ExampleForPairing}.
This system corresponds to a graph with two paths.
The least solution for $X_2$ is $a_1 b_1 \combine a_2 b_2$,
where $a_1 b_1$ and $a_2 b_2$ are the contributions from the two paths.
However, when treated as a paired-semiring-value problem, we have
\[
  Z_1 = (\srOne, \srOne) \qquad\qquad Z_2 = Z_1 \extend_p ((a_1, b_1) \combine_p (a_2, b_2)).
\]
The least solution for $Z_2$ is $(a_1,b_1) \combine_p (a_2,b_2)$,
whose readout value is $\Readout( (a_1,b_1) \combine_p (a_2,b_2) )$.
However, the latter does not equal $a_1 b_1 \combine a_2 b_2$.
\begin{equation}
  \label{Eq:ReadoutPairNondistributive}
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \Readout( (a_1,b_1) \combine_p (a_2,b_2) )
      & = & \Readout( (a_1 \combine a_2, b_1 \combine b_2) ) \\
      & = & (a_1 \combine a_2) \extend \, (b_1 \combine b_2) \\
      & = & a_1 b_1 \combine a_2 b_1 \combine a_1 b_2 \combine a_2 b_2 \\
      & \sqsupseteq & a_1 b_1 \combine a_2 b_2 \\
      & = & \Readout( (a_1,b_1) ) \combine \Readout( (a_2,b_2) ).
  \end{array}
\end{equation}
In other words, using combines of pairs leads to cross-terms, such as
$a_2 b_1$ and $a_1 b_2$, and consequently answers obtained by (i)
solving \eqref{ZTwoRegExp} over paired semiring values for the
combine-over-all-values answer, and (ii) applying $\Readout$ to the
result, could return an overapproximation ($\sqsupset$) of the
least solution of the original LCFL equation system $L$.

\paragraph*{A Different Kind of Pairing.}
In light of the example presented above, the prospects for harnessing
Tarjan's path-expression method for use during NPA look rather bleak.
However, there is still one glimmer of hope:
\begin{equation*}
  \begin{array}{@{\hspace{0ex}}|@{\hspace{0.5ex}}p{6.0in}@{\hspace{0.5ex}}|@{\hspace{0ex}}}
    \hline
    A transformation of the linearized problem to left-linear form
    is not actually forced to use \textbf{\emph{pairing}}:
    given a ``coupled value'' $c = (a, b)$, we never need to
    recover from $c$ the value of either $a$ or $b$ alone;
    we only need to be able to obtain the value $a \extend b$. \\
    \hline
  \end{array}
\end{equation*}
Thus, by using some other binary operator to couple values together,
it may still be possible to perform a transformation similar to the
conversion of the equation for $\NewYTwo$ in
\eqref{Overview::LCFLSystem} into
\eqref{Overview::RegularizedViaPairs}.
Of course, the final answer read out of the solution to the
left-linear problem must not have contributions from undesired
cross-terms.

Thus, we must ask the question,
\begin{quote}
  Is there an operation to couple two values, $a$ and $b$,
  that returns a ``blended'' value in which
  $a$ and $b$ are hidden, but the product
  $a \extend b$ is recoverable.
\end{quote}
For instance, in the RSA cryptography, the product $ab$ of two primes
$a$ and $b$ is a kind of ``blended'' value that hides $a$ and $b$
(unless a great deal of computational effort is expended), but
one can trivially recover the product $ab$.

It turns out that the answer to our question is ``yes'' (!), at
least for some semirings of interest.
We will explain the principle for the IFDS framework \cite{POPL:RHS95}
and predicate-abstraction domains \cite{CAV:GS97} before giving a
more abstract definition of the required properties.

The semiring values for both the IFDS framework and predicate abstraction can
be represented as Boolean matrices.
$N \times N$ Boolean matrices support an operation called the
\textbf{\emph{Kronecker product}}, denoted by $\tensor$, defined
as follows:
\[
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    R \tensor S
    & = &
    \left[\begin{array}{ccc}
        r_{1,1}S & \cdots & r_{1,N}S \\
        \vdots  & \ddots & \vdots  \\
        r_{N,1}S & \cdots & r_{N,N}S
    \end{array}\right]
  \end{array}
\]
which yields an $N^2 \times N^2$ binary matrix whose entries are
\[
  (R \tensor S)[(a-1)N + b,(a'-1)N + b'] = R(a,a') \land S(b,b').
\]

Let's consider why the Kronecker product of two Boolean matrices $A$ and $B$
allows their product $A \times B$ to be recovered later:
\begin{eqnarray}
  A \tensor B
  & = &
  \left[\begin{array}{cc}
    a_{1,1} & a_{1,2} \\
    a_{2,1} & a_{2,2}
  \end{array}\right]
  \tensor
  \left[\begin{array}{cc}
    b_{1,1} & b_{1,2} \\
    b_{2,1} & b_{2,2}
  \end{array}\right]
  \nonumber
  \\
  & = &
  \left[\begin{array}{cc|cc}
    a_{1,1}b_{1,1} & a_{1,1}b_{1,2} & a_{1,2}b_{1,1} & a_{1,2}b_{1,2} \\
    a_{1,1}b_{2,1} & a_{1,1}b_{2,2} & a_{1,2}b_{1,1} & a_{1,2}b_{2,2} \\
    \hline
    a_{2,1}b_{1,1} & a_{2,1}b_{1,2} & a_{2,2}b_{1,1} & a_{2,2}b_{1,2} \\
    a_{2,1}b_{2,1} & a_{2,1}b_{2,2} & a_{2,2}b_{2,1} & a_{2,2}b_{2,2}
  \end{array}\right]
  \label{Eq:ATensorB}
  \\
  \nonumber
  \\
  A \times B
  & = &
  \left[\begin{array}{cc}
    a_{1,1} & a_{1,2} \\
    a_{2,1} & a_{2,2}
  \end{array}\right]
  \times
  \left[\begin{array}{cc}
    b_{1,1} & b_{1,2} \\
    b_{2,1} & b_{2,2}
  \end{array}\right]
  \nonumber
  \\
  & = &
  \left[\begin{array}{cc}
    a_{1,1}b_{1,1} \lor a_{1,2}b_{2,1} & a_{1,1}b_{1,2} \lor a_{1,2}b_{2,2} \\
    a_{2,1}b_{1,1} \lor a_{2,2}b_{2,1} & a_{2,1}b_{1,2} \lor a_{2,2}b_{2,2}
  \end{array}\right]
  \label{Eq:ATimesB}
\end{eqnarray}
You can see the each of the summands in \eqref{ATimesB} is found in
\eqref{ATensorB}.
It is not too difficult to create an expression that computes
$A \times B$ from $A \tensor B$.
(Hint: It involves multiplying $A \tensor B$ on both the left-hand
and right-hand sides by suitable non-square matrices.)
Moreover, it turns out that this ``readout'' operations distributes
over the $\combine$ operation for Boolean matrices, which is
component-wise ``or.''
This latter property is crucial to avoiding the kinds of cross-terms
that cropped up when we tried to use pairing.

We define the desired ``coupling'' operation in terms of two primitives:
\textbf{\emph{transpose}} and \textbf{\emph{tensor product}}:

\begin{definition}\label{De:TransposeAndTensorProduct}
Let $\calS = (D, \combine, \extend, \srZero, \srOne)$ be a semiring.
$\calS$ has a \textbf{transpose} operation, denoted by $\transpose{\cdot}: D \to D$,
if for all elements $a, a_1, a_2 \in D$ the following properties hold:
\begin{align}
  \label{Eq:TransposeExtend}
  \transpose{(a_1 \extend a_2)} & = \transpose{a_2} \extend \transpose{a_1} \\
  \label{Eq:TransposeCombine}
  \transpose{(a_1 \combine a_2)} & = \transpose{a_1} \combine \transpose{a_2} \\
  \label{Eq:TransposeInverse}
  \transpose{(\transpose{a})} & = a.
\end{align}
A \textbf{tensor-product} semiring over $\calS$ is defined to be another semiring
$\calS_{\T} = (D_{\T}, \combine_{\T}, \extend_{\T}, \srZero_{\T}, \srOne_{\T})$, where
$\calS$ and $\calS_{\T}$ support a \textbf{tensor-product} operation, denoted by
$\tensor: D \times D \to D_{\T}$, such that for all
$a, a_1, a_2, b_1, b_2, c_1, c_2 \in D$, the following properties hold:
\begin{align}
  \label{Eq:TPZero}
  \srZero \tensor a & = a \tensor \srZero ~~=~~ \srZero_{\T} \\
  \label{Eq:TPLeftDistributivity}
  a_1 \tensor \, (b_2 \combine c_2) & = (a_1 \tensor b_2) \combine_{\T} (a_1 \tensor c_2) \\
  \label{Eq:TPRightDistributivity}
  (b_1 \combine c_1) \tensor \, a_2 & = (b_1 \tensor a_2) \combine_{\T} (c_1 \tensor a_2) \\
  \label{Eq:TPGeneralizedPairing}
  (a_1 \tensor b_1) \extend_{\T} (a_2 \tensor b_2) & = (a_1 \extend a_2) \tensor \, (b_1 \extend b_2).
\end{align}
A tensor-product semiring defined over a semiring with transpose has a
\textbf{(sequential) detensor-transpose} operation, denoted by
$\TDeTensor: D_{\T} \to D$, if for all elements $a_1, a_2 \in D$ and
$p_1, p_2 \in D_{\T}$ the following properties hold:
\begin{align}
  \label{Eq:TDeTensorPropOne}
  \TDeTensor(a_1 \tensor \, a_2) & = (\transpose{a_1} \extend a_2) \\
  \label{Eq:TDeTensorPropTwo}
  \TDeTensor(p_1 \combine_{\T} p_2) & = \TDeTensor(p_1) \combine \TDeTensor(p_2).
\end{align}
We assume that
\eqrefsppAnd{TransposeCombine}{TPLeftDistributivity}{TPRightDistributivity}{TDeTensorPropTwo}
also hold for infinite combines.

For brevity, we say that $\calS$ is an \textbf{admissible semiring} if
(i) $\calS$ has a transpose operation,
(ii) $\calS$ has an associated tensor-product semiring $\calS_{\T}$, and
(iii) $\calS_{\T}$ has a sequential detensor-transpose operation.
Henceforth, we consider only admissible semirings.

The operation to \textbf{couple} pairs of values from an admissible semiring,
denoted by $\couple: D \times D \to D_{\T}$, is defined as follows:
\[
  \couple(a, b) \eqdef (\transpose{a} \tensor b).
\]
\end{definition}

Note that by \eqrefs{TransposeExtend}{TPGeneralizedPairing},
\begin{equation}
  \label{Eq:TensoredCouplingExtend}
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \couple(a_1,b_1) \extend_{\T} \couple(a_2,b_2)
       & = & (\transpose{a_1} \tensor b_1) \extend_{\T} (\transpose{a_2} \tensor b_2) \\
       & = & (\transpose{a_1} \extend \transpose{a_2}) \tensor \, (b_1 \extend b_2) \\
       & = & \transpose{(a_2 \extend a_1)} \tensor \, (b_1 \extend b_2) \\
       & = & \couple(a_2 \extend a_1, b_1 \extend b_2)
  \end{array}
\end{equation}
The order-reversal vis {\`a} vis $\extend_{\T}$ and $\extend$
in \eqref{TensoredCouplingExtend} will substitute for the
order-reversal vis {\`a} vis $\extend_p$ and $\extend$
in \eqref{PairedExtend}.

The operator that plays the role of $\Readout$ is $\TDeTensor$.
The superscript in $\TDeTensor$ serves as a reminder
that \eqref{TDeTensorPropOne} performs an additional transpose on the first
argument of a coupled value $(\transpose{a} \tensor b)$,
so that $\TDeTensor(\transpose{a} \tensor b)$ becomes
$\transpose{(\transpose{a})} \extend b$ $= a \extend b$.
Consequently,
\[
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \TDeTensor(\couple(a_2 \extend a_1, b_1 \extend b_2))
        & = & \TDeTensor(\transpose{(a_2 \extend a_1)} \tensor \, (b_1 \extend b_2)) \\
        & = & \transpose{(\transpose{(a_2 \extend a_1)})} \extend \, (b_1 \extend b_2) \\
        & = & \underbrace{a_2 \extend \underbrace{a_1 \extend b_1} \extend b_2}
  \end{array}
\]
which has the desired matching of $a_1$ with $b_1$ and $a_2$ with $b_2$.
Moreover, in contrast with \eqref{ReadoutPairNondistributive}, by
\eqref{TDeTensorPropTwo}, $\TDeTensor$ does not produce cross-terms:
\[
  \begin{array}{@{\hspace{0ex}}r@{\hspace{1.0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
    \TDeTensor((\transpose{a_1} \tensor b_1) \combine_{\T} (\transpose{a_2} \tensor b_2))
        & = & \TDeTensor(\transpose{a_1} \tensor b_1) \combine_{\T} \TDeTensor(\transpose{a_2} \tensor b_2) \\
        & = & a_1 b_1 \combine a_2 b_2.
  \end{array}
\]

\begin{figure}
\centering
\begin{tabular}{@{\hspace{0ex}}c@{\hspace{0ex}}}
  \includegraphics[height=1.8in]{figures/overview-program-newton-tensor.eps}
\end{tabular}
\caption{Graphical representation of the linearized equation system
  over $\NewZ$ obtained from \eqref{Overview::RunningExample}
  using tensor-product-based coupling.
}
\label{Fi:OverviewProgramNewtonTensor}
\end{figure}

\begin{example}\label{Exa:Overview::TensoredLinearEquationSystem}
Using tensor-product-based coupling, the $\NewYTwo$ component of
\eqref{Overview::LCFLSystem} would be transformed into
\begin{equation}
  \label{Eq:Overview::RegularizedViaTensoredPairs}
  \NewZTwo = \left(\begin{array}{@{\hspace{0ex}}c@{\hspace{1.0ex}}l@{\hspace{0ex}}}
                     & (\transpose{\srOne} \tensor \, (d \combine b \extend \OldYTwo \extend \OldYTwo \extend c)) \\
        \combine_{\T} & \NewZTwo \extend_{\T} (\transpose{b} \tensor \, (\OldYTwo \extend c)) \\
        \combine_{\T} & \NewZTwo \extend_{\T} (\transpose{(b \extend \OldYTwo)} \tensor c)
      \end{array}\right)
\end{equation}
which is depicted in \figref{OverviewProgramNewtonTensor}.
After collecting terms, we have
\begin{eqnarray}
  \label{Eq:TensoredEquation}
  \NewZTwo & = & A \combine_{\T} (\NewZTwo \extend_{\T} B), \\
  \nonumber
  \textrm{where} \quad A & = & (\transpose{\srOne} \tensor \, (d \combine b \extend \OldYTwo \extend \OldYTwo \extend c)) \\
  \label{Eq:TensoredBValue}
  \textrm{and}   \quad B & = &              (\transpose{b} \tensor (\OldYTwo \extend c))
                               \combine_{\T} (\transpose{(b \extend \OldYTwo)} \tensor c)
\end{eqnarray}
which has the solution
\begin{equation}
  \label{Eq:PairedClosedForm}
  \NewZTwo = A \extend_{\T} B^{*_{\T}}.
\end{equation}
The (untensored) value for $X_2$ is then obtained as $X_2 = \TDeTensor(\NewZTwo)$.
\end{example}


{\small
  \bibliography{cs701}
  \bibliographystyle{plain}
}

\appendix

\input{definitions}

\end{document}
