| PPL
    1.2
    | 
The Parma Polyhedra Library (PPL) is a modern C++ library for the manipulation of numerical information that can be represented by points in some  -dimensional vector space. For instance, one of the key domains the PPL supports is that of rational convex polyhedra (Section Convex Polyhedra). Such domains are employed in several systems for the analysis and verification of hardware and software components, with applications spanning imperative, functional and logic programming languages, synchronous languages and synchronization protocols, real-time and hybrid systems. Even though the PPL library is not meant to target a particular problem, the design of its interface has been largely influenced by the needs of the above class of applications. That is the reason why the library implements a few operators that are more or less specific to static analysis applications, while lacking some other operators that might be useful when working, e.g., in the field of computational geometry.
-dimensional vector space. For instance, one of the key domains the PPL supports is that of rational convex polyhedra (Section Convex Polyhedra). Such domains are employed in several systems for the analysis and verification of hardware and software components, with applications spanning imperative, functional and logic programming languages, synchronous languages and synchronization protocols, real-time and hybrid systems. Even though the PPL library is not meant to target a particular problem, the design of its interface has been largely influenced by the needs of the above class of applications. That is the reason why the library implements a few operators that are more or less specific to static analysis applications, while lacking some other operators that might be useful when working, e.g., in the field of computational geometry.
The main features of the library are the following:
x + 2*y + 5*z <= 7 when you mean it;In the following section we describe all the domains available to the PPL user. More detailed descriptions of these domains and the operations provided will be found in subsequent sections.
In the final section of this chapter (Section Using the Library), we provide some additional advice on the use of the library.
A semantic geometric descriptor is a subset of  . The PPL provides several classes of semantic GDs. These are identified by their C++ class name, together with the class template parameters, if any. These classes include the simple classes:
. The PPL provides several classes of semantic GDs. These are identified by their C++ class name, together with the class template parameters, if any. These classes include the simple classes:
C_Polyhedron ,NNC_Polyhedron ,BD_Shape<T> ,Octagonal_Shape<T> ,Box<ITV> , andGrid ,where:
T is a numeric type chosen among mpz_class, mpq_class, signed char, short, int, long, long long (or any of the C99 exact width integer equivalents int8_t, int16_t, and so forth); andITV is an instance of the Interval  template class.Other semantic GDs, the compound classes, can be constructed (also recursively) from all the GDs classes. These include:
where PSET, D1 and D2 can be any semantic GD classes and R is the reduction operation to be applied to the component domains of the product class.
A uniform set of operations is provided for creating, testing and maintaining each of the semantic GDs. However, as many of these depend on one or more syntactic GDs, we first describe the syntactic GDs.
A syntactic geometric descriptor is for defining, modifying and inspecting a semantic GD. There are three kinds of syntactic GDs: basic GDs, constraint GDs and generator GDs. Some of these are generic and some specific. A generic syntactic GD can be used (in the appropriate context) with any semantic GD; clearly, different semantic GDs will usually provide different levels of support for the different subclasses of generic GDs. In contrast, the use of a specific GD may be restricted to apply to a given subset of the semantic GDs (i.e., some semantic GDs provide no support at all for them).
The following basic GDs currently supported by the PPL are:
These classes, which are all generic syntactic GDs, are used to build the constraint and generator GDs as well as support many generic operations on the semantic GDs.
The PPL currently supports the following classes of generic constraint GDs:
Each linear constraint can be further classified to belong to one or more of the following syntactic subclasses:
 );
); );
); );
); );
); );
); );
); );
); ).
).Note that the subclasses are not disjoint.
Similarly, each linear congruence can be classified to belong to one or more of the following syntactic subclasses:
 );
); );
); );
); ).
).The library also supports systems, i.e., finite collections, of either linear constraints or linear congruences (but see the note below).
Each semantic GD provides optimal support for some of the subclasses of generic syntactic GDs listed above: here, the word "optimal" means that the considered semantic GD computes the best upward approximation of the exact meaning of the linear constraint or congruence. When a semantic GD operation is applied to a syntactic GD that is not optimally supported, it will either indicate its unsuitability (e.g., by throwing an exception) or it will apply an upward approximation semantics (possibly not the best one).
For instance, the semantic GD of topologically closed convex polyhedra provides optimal support for non-strict linear inequality and equality constraints, but it does not provide optimal support for strict inequalities. Some of its operations (e.g., add_constraint and add_congruence) will throw an exception if supplied with a non-trivial strict inequality constraint or a proper congruence; some other operations (e.g., refine_with_constraint or refine_with_congruence) will compute an over-approximation.
Similarly, the semantic GD of rational boxes (i.e., multi-dimensional intervals) having integral values as interval boundaries provides optimal support for all interval constraints: even though the interval constraint  cannot be represented exactly, it will be optimally approximated by the constraint
 cannot be represented exactly, it will be optimally approximated by the constraint  .
.
The PPL currently supports two classes of generator GDs:
Rays, lines and parameters are specific of the mentioned semantic GDs and, therefore, they cannot be used by other semantic GDs. In contrast, as already mentioned above, points are basic geometric descriptors since they are also used in generic PPL operations.
is_empty(), is_universe(), is_topologically_closed(), is_discrete(), is_bounded(), contains_integer_point()
test for the named properties of the semantic GD.
total_memory_in_bytes(), external_memory_in_bytes()
return the total and external memory size in bytes.
OK()
checks that the semantic GD has a valid internal representation. (Some GDs provide this method with an optional Boolean argument that, when true, requires to also check for non-emptiness.)
space_dimension(), affine_dimension()
return, respectively, the space and affine dimensions of the GD.
add_space_dimensions_and_embed(), add_space_dimensions_and_project(), expand_space_dimension(), remove_space_dimensions(), fold_space_dimensions(), map_space_dimensions()
modify the space dimensions of the semantic GD; where, depending on the operation, the arguments can include the number of space dimensions to be added or removed a variable or set of variables denoting the actual dimensions to be used and a partial function defining a mapping between the dimensions.
contains(), strictly_contains(), is_disjoint_from()
compare the semantic GD with an argument semantic GD of the same class.
topological_closure_assign(), intersection_assign(), upper_bound_assign(), difference_assign(), time_elapse_assign(), widening_assign(), concatenate_assign(), m_swap()
modify the semantic GD, possibly with an argument semantic GD of the same class.
constrains(), bounds_from_above(), bounds_from_below(), maximize(), minimize().
These find information about the bounds of the semantic GD where the argument variable or linear expression define the direction of the bound.
affine_image(), affine_preimage(), generalized_affine_image(), generalized_affine_preimage(), bounded_affine_image(), bounded_affine_preimage().
These perform several variations of the affine image and preimage operations where, depending on the operation, the arguments can include a variable representing the space dimension to which the transformation will be applied and linear expressions with possibly a relation symbol and denominator value that define the exact form of the transformation.
are the ascii input and output operations.
add_constraint(), add_constraints(), add_recycled_constraints(), add_congruence(), add_congruences(), add_recycled_congruences().
These methods assume that the given semantic GD provides optimal support for the argument syntactic GD: if that is not the case, an invalid argument exception is thrown.
For add_recycled_constraints() and add_recycled_congruences(), the only assumption that can be made on the constraint GD after return (successful or exceptional) is that it can be safely destroyed.  
refine_with_constraint(), refine_with_constraints(), refine_with_congruence(), refine_with_congruences().
If the argument constraint GD is optimally supported by the semantic GD, the methods behave the same as the corresponding add_* methods listed above. Otherwise the constraint GD is used only to a limited extent to refine the semantic GD; possibly not at all. Notice that, while repeating an add operation is pointless, this is not true for the refine operations. For example, in those cases where 
raises an exception, a fragment of the form
may give more precise results than a single
constraints(), minimized_constraints(), congruences(), minimized_congruences().
Returns the indicated system of constraint GDs satisfied by the semantic GD.
can_recycle_constraint_systems(), can_recycle_congruence_systems().
Return true if and only if the semantic GD can recycle the indicated constraint GD.
relation_with().
This takes a constraint GD as an argument and returns the relations holding between the semantic GD and the constraint GD. The possible relations are: IS_INCLUDED(), SATURATES(), STRICTLY_INTERSECTS(), IS_DISJOINT() and NOTHING(). This operator also can take a polyhedron generator GD as an argument and returns the relation SUBSUMES() or NOTHING() that holds between the generator GD and the semantic GD.  
The Parma Polyhedra Library, for those cases where an exact result cannot be computed within the specified complexity limits, computes an upward approximation of the exact result. For semantic GDs this means that the computed result is a possibly strict superset of the set of points of  that constitutes the exact result. Notice that the PPL does not provide direct support to compute downward approximations (i.e., possibly strict subsets of the exact results). While downward approximations can often be computed from upward ones, the required algorithms and the conditions upon which they are correct are outside the current scope of the PPL. Beware, in particular, of the following possible pitfall: the library provides methods to compute upward approximations of set-theoretic difference, which is antitone in its second argument. Applying a difference method to a second argument that is not an exact representation or a downward approximation of reality, would yield a result that, of course, is not an upward approximation of reality. It is the responsibility of the library user to provide the PPL's method with approximations of reality that are consistent with respect to the desired results.
 that constitutes the exact result. Notice that the PPL does not provide direct support to compute downward approximations (i.e., possibly strict subsets of the exact results). While downward approximations can often be computed from upward ones, the required algorithms and the conditions upon which they are correct are outside the current scope of the PPL. Beware, in particular, of the following possible pitfall: the library provides methods to compute upward approximations of set-theoretic difference, which is antitone in its second argument. Applying a difference method to a second argument that is not an exact representation or a downward approximation of reality, would yield a result that, of course, is not an upward approximation of reality. It is the responsibility of the library user to provide the PPL's method with approximations of reality that are consistent with respect to the desired results.
The Parma Polyhedra Library provides support for approximating integer computations using the geometric descriptors it provides. In this section we briefly explain these facilities.
When a geometric descriptor is used to approximate integer quantities, all the points with non-integral coordinates represent an imprecision of the description. Of course, removing all these points may be impossible (because of convexity) or too expensive. The PPL provides the operator drop_some_non_integer_points to possibly tighten a descriptor by dropping some points with non-integer coordinates, using algorithms whose complexity is bounded by a parameter. The set of dimensions that represent integer quantities can be optionally specified. It is worth to stress the role of some in the operator name: in general no optimality guarantee is provided.
The Parma Polyhedra Library provides services that allow to compute correct approximations of bounded arithmetic as available in widespread programming languages. Supported bit-widths are 8, 16, 32 and 64 bits, with some limited support for 128 bits. Supported representations are binary unsigned and two's complement signed. Supported overflow behaviors are:
 bounded integer, the computation happens modulo
 bounded integer, the computation happens modulo  . In turn, this signifies that the computation happens as if the unbounded arithmetic result was computed and then wrapped. For unsigned integers, the wrapping function is simply
. In turn, this signifies that the computation happens as if the unbounded arithmetic result was computed and then wrapped. For unsigned integers, the wrapping function is simply  , most conveniently defined as
, most conveniently defined as 
![\[ \mathrm{wrap}^\mathrm{u}_w(x) \defeq x - 2^w \lfloor x/2^w \rfloor. \]](form_19.png) 
![\[ \mathrm{wrap}^\mathrm{s}_w(x) \defeq \begin{cases} \mathrm{wrap}^\mathrm{u}_w(x), &\text{if $\mathrm{wrap}^\mathrm{u}_w(x) < 2^{w-1}$;} \\ \mathrm{wrap}^\mathrm{u}_w(x) - 2^w, &\text{otherwise.} \end{cases} \]](form_20.png) 
One possibility for precisely approximating the semantics of programs that operate on bounded integer variables is to follow the approach described in [SK07]. The idea is to associate space dimensions to the unwrapped values of bounded variables. Suppose j is a  , unsigned program variable associated to a space dimension labeled by the variable
, unsigned program variable associated to a space dimension labeled by the variable  . If
. If  is constrained by some numerical abstraction to take values in a set
 is constrained by some numerical abstraction to take values in a set  , then the program variable
, then the program variable j can only take values in  . There are two reasons why this is interesting: firstly, this allows for the retention of relational information by using a single numerical abstraction tracking multiple program variables. Secondly, the integers modulo
. There are two reasons why this is interesting: firstly, this allows for the retention of relational information by using a single numerical abstraction tracking multiple program variables. Secondly, the integers modulo  form a ring of equivalence classes on which addition and multiplication are well defined. This means, e.g., that assignments with affine right-hand sides and involving only variables with the same bit-width and representation can be safely modeled by affine images. While upper bounds and widening can be used without any precaution, anything that can be reconducted to intersection requires a preliminary wrapping phase, where the dimensions corresponding to bounded integer types are brought back to their natural domain. This necessity arises naturally for the analysis of conditionals and conversion operators, as well as in the realization of domain combinations.
 form a ring of equivalence classes on which addition and multiplication are well defined. This means, e.g., that assignments with affine right-hand sides and involving only variables with the same bit-width and representation can be safely modeled by affine images. While upper bounds and widening can be used without any precaution, anything that can be reconducted to intersection requires a preliminary wrapping phase, where the dimensions corresponding to bounded integer types are brought back to their natural domain. This necessity arises naturally for the analysis of conditionals and conversion operators, as well as in the realization of domain combinations.
The PPL provides a general wrapping operator that is parametric with respect to the set of space dimensions (variables) to be wrapped, the width, representation and overflow behavior of all these variables. An optional constraint system can, when given, improve the precision. This constraint system, which must only depend on variables with respect to which wrapping is performed, is assumed to represent the conditional or looping construct guard with respect to which wrapping is performed. Since wrapping requires the computation of upper bounds and due to non-distributivity of constraint refinement over upper bounds, passing a constraint system in this way can be more precise than refining the result of the wrapping operation afterwards. The general wrapping operator offered by the PPL also allows control of the complexity/precision ratio by means of two additional parameters: an unsigned integer encoding a complexity threshold, with higher values resulting in possibly improved precision; and a Boolean controlling whether space dimensions should be wrapped individually, something that results in much greater efficiency to the detriment of precision, or collectively.
Note that the PPL assumes that any space dimension subject to wrapping is being used to capture the value of bounded integer values. As a consequence the library is free to drop, from the involved numerical abstraction, any point having a non-integer coordinate that corresponds to a space dimension subject to wrapping. It must be stressed that freedom to drop such points does not constitute an obligation to remove all of them (especially because this would be extraordinarily expensive on some numerical abstractions). The PPL provides operators for the more systematic removal of points with non-integral coordinates.
The wrapping operator will only remove some of these points as a by-product of its main task and only when this comes at a negligible extra cost.
In this section we introduce convex polyhedra, as considered by the library, in more detail. For more information about the definitions and results stated here see [BRZH02b], [Fuk98], [NW88], and [Wil93].
We denote by  the
 the  vector space on the field of real numbers
 vector space on the field of real numbers  , endowed with the standard topology. The set of all non-negative reals is denoted by
, endowed with the standard topology. The set of all non-negative reals is denoted by  . For each
. For each  ,
,  denotes the
 denotes the  component of the (column) vector
 component of the (column) vector  . We denote by
. We denote by  the vector of
 the vector of  , called the origin, having all components equal to zero. A vector
, called the origin, having all components equal to zero. A vector  can be also interpreted as a matrix in
 can be also interpreted as a matrix in  and manipulated accordingly using the usual definitions for addition, multiplication (both by a scalar and by another matrix), and transposition, denoted by
 and manipulated accordingly using the usual definitions for addition, multiplication (both by a scalar and by another matrix), and transposition, denoted by  .
.
The scalar product of  , denoted
, denoted  , is the real number
, is the real number 
![\[ \vect{v}^\transpose \vect{w} = \sum_{i=0}^{n-1} v_i w_i. \]](form_38.png) 
For any  , the Minkowski's sum of
, the Minkowski's sum of  and
 and  is:
 is: 
For each vector  and scalar
 and scalar  , where
, where  , and for each relation symbol
, and for each relation symbol  , the linear constraint
, the linear constraint  defines:
 defines:
 ;
; ;
; .
.Note that each hyperplane  can be defined as the intersection of the two closed affine half-spaces
 can be defined as the intersection of the two closed affine half-spaces  and
 and  . Also note that, when
. Also note that, when  , the constraint
, the constraint  is either a tautology (i.e., always true) or inconsistent (i.e., always false), so that it defines either the whole vector space
 is either a tautology (i.e., always true) or inconsistent (i.e., always false), so that it defines either the whole vector space  or the empty set
 or the empty set  .
.
The set  is a not necessarily closed convex polyhedron (NNC polyhedron, for short) if and only if either
 is a not necessarily closed convex polyhedron (NNC polyhedron, for short) if and only if either  can be expressed as the intersection of a finite number of (open or closed) affine half-spaces of
 can be expressed as the intersection of a finite number of (open or closed) affine half-spaces of  or
 or  and
 and  . The set of all NNC polyhedra on the vector space
. The set of all NNC polyhedra on the vector space  is denoted
 is denoted  .
.
The set  is a closed convex polyhedron (closed polyhedron, for short) if and only if either
 is a closed convex polyhedron (closed polyhedron, for short) if and only if either  can be expressed as the intersection of a finite number of closed affine half-spaces of
 can be expressed as the intersection of a finite number of closed affine half-spaces of  or
 or  and
 and  . The set of all closed polyhedra on the vector space
. The set of all closed polyhedra on the vector space  is denoted
 is denoted  .
.
When ordering NNC polyhedra by the set inclusion relation, the empty set  and the vector space
 and the vector space  are, respectively, the smallest and the biggest elements of both
 are, respectively, the smallest and the biggest elements of both  and
 and  . The vector space
. The vector space  is also called the universe polyhedron.
 is also called the universe polyhedron.
In theoretical terms,  is a lattice under set inclusion and
 is a lattice under set inclusion and  is a sub-lattice of
 is a sub-lattice of  .
.
 of NNC polyhedra. Unless an explicit distinction is made, these operators are provided with the same specification when applied to the domain
 of NNC polyhedra. Unless an explicit distinction is made, these operators are provided with the same specification when applied to the domain  of topologically closed polyhedra. The implementation maintains a clearer separation between the two domains of polyhedra (see Topologies and Topological-compatibility): while computing polyhedra in
 of topologically closed polyhedra. The implementation maintains a clearer separation between the two domains of polyhedra (see Topologies and Topological-compatibility): while computing polyhedra in  may provide more precise results, polyhedra in
 may provide more precise results, polyhedra in  can be represented and manipulated more efficiently. As a rule of thumb, if your application will only manipulate polyhedra that are topologically closed, then it should use the simpler domain
 can be represented and manipulated more efficiently. As a rule of thumb, if your application will only manipulate polyhedra that are topologically closed, then it should use the simpler domain  . Using NNC polyhedra is only recommended if you are going to actually benefit from the increased accuracy.
. Using NNC polyhedra is only recommended if you are going to actually benefit from the increased accuracy.An NNC polyhedron  is bounded if there exists a
 is bounded if there exists a  such that:
 such that: 
![\[ \cP \sseq \bigl\{\, \vect{x} \in \Rset^n \bigm| - \lambda \leq x_j \leq \lambda \text{ for } j = 0, \ldots, n-1 \,\bigr\}. \]](form_65.png) 
A bounded polyhedron is also called a polytope.
NNC polyhedra can be specified by using two possible representations, the constraints (or implicit) representation and the generators (or parametric) representation.
In the sequel, we will simply write ``equality'' and ``inequality'' to mean ``linear equality'' and ``linear inequality'', respectively; also, we will refer to either an equality or an inequality as a constraint.
By definition, each polyhedron  is the set of solutions to a constraint system, i.e., a finite number of constraints. By using matrix notation, we have
 is the set of solutions to a constraint system, i.e., a finite number of constraints. By using matrix notation, we have 
![\[ \cP \defeq \{\, \vect{x} \in \Rset^n \mid A_1 \vect{x} = \vect{b}_1, A_2 \vect{x} \geq \vect{b}_2, A_3 \vect{x} > \vect{b}_3 \,\}, \]](form_66.png) 
 where, for all  ,
,  and
 and  , and
, and  are the number of equalities, the number of non-strict inequalities, and the number of strict inequalities, respectively.
 are the number of equalities, the number of non-strict inequalities, and the number of strict inequalities, respectively.
Let  be a finite set of vectors. For all scalars
 be a finite set of vectors. For all scalars  , the vector
, the vector  is said to be a linear combination of the vectors in
 is said to be a linear combination of the vectors in  . Such a combination is said to be
. Such a combination is said to be
 ;
; ;
;We denote by  (resp.,
 (resp.,  ,
,  ,
,  ) the set of all the linear (resp., positive, affine, convex) combinations of the vectors in
) the set of all the linear (resp., positive, affine, convex) combinations of the vectors in  .
.
Let  , where
, where  . We denote by
. We denote by  the set of all convex combinations of the vectors in
 the set of all convex combinations of the vectors in  such that
 such that  for some
 for some  (informally, we say that there exists a vector of
 (informally, we say that there exists a vector of  that plays an active role in the convex combination). Note that
 that plays an active role in the convex combination). Note that  so that, if
 so that, if  ,
, 
![\[ \convexhull(P) = \NNChull(P, \emptyset) = \NNChull(P, P) = \NNChull(P, C). \]](form_89.png) 
 It can be observed that  is an affine space,
 is an affine space,  is a topologically closed convex cone,
 is a topologically closed convex cone,  is a topologically closed polytope, and
 is a topologically closed polytope, and  is an NNC polytope.
 is an NNC polytope.
Let  be an NNC polyhedron. Then
 be an NNC polyhedron. Then
 is called a point of
 is called a point of  ;
; is called a closure point of
 is called a closure point of  if it is a point of the topological closure of
 if it is a point of the topological closure of  ;
; , where
, where  , is called a ray (or direction of infinity) of
, is called a ray (or direction of infinity) of  if
 if  and
 and  , for all points
, for all points  and all
 and all  ;
; is called a line of
 is called a line of  if both
 if both  and
 and  are rays of
 are rays of  .
.A point of an NNC polyhedron  is a vertex if and only if it cannot be expressed as a convex combination of any other pair of distinct points in
 is a vertex if and only if it cannot be expressed as a convex combination of any other pair of distinct points in  . A ray
. A ray  of a polyhedron
 of a polyhedron  is an extreme ray if and only if it cannot be expressed as a positive combination of any other pair
 is an extreme ray if and only if it cannot be expressed as a positive combination of any other pair  and
 and  of rays of
 of rays of  , where
, where  ,
,  and
 and  for all
 for all  (i.e., rays differing by a positive scalar factor are considered to be the same ray).
 (i.e., rays differing by a positive scalar factor are considered to be the same ray).
Each NNC polyhedron  can be represented by finite sets of lines
 can be represented by finite sets of lines  , rays
, rays  , points
, points  and closure points
 and closure points  of
 of  . The 4-tuple
. The 4-tuple  is said to be a generator system for
 is said to be a generator system for  , in the sense that
, in the sense that 
![\[ \cP = \linearhull(L) + \conichull(R) + \NNChull(P, C), \]](form_109.png) 
 where the symbol '  ' denotes the Minkowski's sum.
' denotes the Minkowski's sum.
When  is a closed polyhedron, then it can be represented by finite sets of lines
 is a closed polyhedron, then it can be represented by finite sets of lines  , rays
, rays  and points
 and points  of
 of  . In this case, the 3-tuple
. In this case, the 3-tuple  is said to be a generator system for
 is said to be a generator system for  since we have
 since we have 
![\[ \cP = \linearhull(L) + \conichull(R) + \convexhull(P). \]](form_113.png) 
 Thus, in this case, every closure point of  is a point of
 is a point of  .
.
For any  and generator system
 and generator system  for
 for  , we have
, we have  if and only if
 if and only if  . Also
. Also  must contain all the vertices of
 must contain all the vertices of  although
 although  can be non-empty and have no vertices. In this case, as
 can be non-empty and have no vertices. In this case, as  is necessarily non-empty, it must contain points of
 is necessarily non-empty, it must contain points of  that are not vertices. For instance, the half-space of
 that are not vertices. For instance, the half-space of  corresponding to the single constraint
 corresponding to the single constraint  can be represented by the generator system
 can be represented by the generator system  such that
 such that  ,
,  ,
,  , and
, and  . It is also worth noting that the only ray in
. It is also worth noting that the only ray in  is not an extreme ray of
 is not an extreme ray of  .
.
A constraints system  for an NNC polyhedron
 for an NNC polyhedron  is said to be minimized if no proper subset of
 is said to be minimized if no proper subset of  is a constraint system for
 is a constraint system for  .
.
Similarly, a generator system  for an NNC polyhedron
 for an NNC polyhedron  is said to be minimized if there does not exist a generator system
 is said to be minimized if there does not exist a generator system  for
 for  such that
 such that  ,
,  ,
,  and
 and  .
.
Any NNC polyhedron  can be described by using a constraint system
 can be described by using a constraint system  , a generator system
, a generator system  , or both by means of the double description pair (DD pair)
, or both by means of the double description pair (DD pair)  . The double description method is a collection of well-known as well as novel theoretical results showing that, given one kind of representation, there are algorithms for computing a representation of the other kind and for minimizing both representations by removing redundant constraints/generators.
. The double description method is a collection of well-known as well as novel theoretical results showing that, given one kind of representation, there are algorithms for computing a representation of the other kind and for minimizing both representations by removing redundant constraints/generators.
Such changes of representation form a key step in the implementation of many operators on NNC polyhedra: this is because some operators, such as intersections and poly-hulls, are provided with a natural and efficient implementation when using one of the representations in a DD pair, while being rather cumbersome when using the other.
As indicated above, when an NNC polyhedron  is necessarily closed, we can ignore the closure points contained in its generator system
 is necessarily closed, we can ignore the closure points contained in its generator system  (as every closure point is also a point) and represent
 (as every closure point is also a point) and represent  by the triple
 by the triple  . Similarly,
. Similarly,  can be represented by a constraint system that has no strict inequalities. Thus a necessarily closed polyhedron can have a smaller representation than one that is not necessarily closed. Moreover, operators restricted to work on closed polyhedra only can be implemented more efficiently. For this reason the library provides two alternative ``topological kinds'' for a polyhedron, NNC and C. We shall abuse terminology by referring to the topological kind of a polyhedron as its topology.
 can be represented by a constraint system that has no strict inequalities. Thus a necessarily closed polyhedron can have a smaller representation than one that is not necessarily closed. Moreover, operators restricted to work on closed polyhedra only can be implemented more efficiently. For this reason the library provides two alternative ``topological kinds'' for a polyhedron, NNC and C. We shall abuse terminology by referring to the topological kind of a polyhedron as its topology.
In the library, the topology of each polyhedron object is fixed once for all at the time of its creation and must be respected when performing operations on the polyhedron.
Unless it is otherwise stated, all the polyhedra, constraints and/or generators in any library operation must obey the following topological-compatibility rules:
Wherever possible, the library provides methods that, starting from a polyhedron of a given topology, build the corresponding polyhedron having the other topology.
The space dimension of an NNC polyhedron  (resp., a C polyhedron
 (resp., a C polyhedron  ) is the dimension
) is the dimension  of the corresponding vector space
 of the corresponding vector space  . The space dimension of constraints, generators and other objects of the library is defined similarly.
. The space dimension of constraints, generators and other objects of the library is defined similarly.
Unless it is otherwise stated, all the polyhedra, constraints and/or generators in any library operation must obey the following (space) dimension-compatibility rules:
 where
 where  and
 and  , is dimension-compatible with a polyhedron having space dimension
, is dimension-compatible with a polyhedron having space dimension  if and only if
 if and only if  ;
; is dimension-compatible with a polyhedron having space dimension
 is dimension-compatible with a polyhedron having space dimension  if and only if
 if and only if  ;
;While the space dimension of a constraint, a generator or a system thereof is automatically adjusted when needed, the space dimension of a polyhedron can only be changed by explicit calls to operators provided for that purpose.
A finite set of points  is affinely independent if, for all
 is affinely independent if, for all  , the system of equations
, the system of equations 
![\[ \sum_{i = 1}^k \lambda_i \vect{x}_i = \vect{0}, \quad \sum_{i = 1}^k \lambda_i = 0 \]](form_135.png) 
 implies that, for each  ,
,  .
.
The maximum number of affinely independent points in  is
 is  .
.
A non-empty NNC polyhedron  has affine dimension
 has affine dimension  , denoted by
, denoted by  , if the maximum number of affinely independent points in
, if the maximum number of affinely independent points in  is
 is  .
.
We remark that the above definition only applies to polyhedra that are not empty, so that  . By convention, the affine dimension of an empty polyhedron is 0 (even though the ``natural'' generalization of the definition above would imply that the affine dimension of an empty polyhedron is
. By convention, the affine dimension of an empty polyhedron is 0 (even though the ``natural'' generalization of the definition above would imply that the affine dimension of an empty polyhedron is  ).
).
 of an NNC polyhedron
 of an NNC polyhedron  must not be confused with the space dimension
 must not be confused with the space dimension  of
 of  , which is the dimension of the enclosing vector space
, which is the dimension of the enclosing vector space  . In particular, we can have
. In particular, we can have  even though
 even though  and
 and  are dimension-compatible; and vice versa,
 are dimension-compatible; and vice versa,  and
 and  may be dimension-incompatible polyhedra even though
 may be dimension-incompatible polyhedra even though  .
.An NNC polyhedron is called rational if it can be represented by a constraint system where all the constraints have rational coefficients. It has been shown that an NNC polyhedron is rational if and only if it can be represented by a generator system where all the generators have rational coefficients.
The library only supports rational polyhedra. The restriction to rational numbers applies not only to polyhedra, but also to the other numeric arguments that may be required by the operators considered, such as the coefficients defining (rational) affine transformations.
In this section we briefly describe operations on NNC polyhedra that are provided by the library.
For any pair of NNC polyhedra  , the intersection of
, the intersection of  and
 and  , defined as the set intersection
, defined as the set intersection  , is the biggest NNC polyhedron included in both
, is the biggest NNC polyhedron included in both  and
 and  ; similarly, the convex polyhedral hull (or poly-hull) of
; similarly, the convex polyhedral hull (or poly-hull) of  and
 and  , denoted by
, denoted by  , is the smallest NNC polyhedron that includes both
, is the smallest NNC polyhedron that includes both  and
 and  . The intersection and poly-hull of any pair of closed polyhedra in
. The intersection and poly-hull of any pair of closed polyhedra in  is also closed.
 is also closed.
In theoretical terms, the intersection and poly-hull operators defined above are the binary meet and the binary join operators on the lattices  and
 and  .
.
For any pair of NNC polyhedra  , the convex polyhedral difference (or poly-difference) of
, the convex polyhedral difference (or poly-difference) of  and
 and  is defined as the smallest convex polyhedron containing the set-theoretic difference of
 is defined as the smallest convex polyhedron containing the set-theoretic difference of  and
 and  .
.
In general, even though  are topologically closed polyhedra, their poly-difference may be a convex polyhedron that is not topologically closed. For this reason, when computing the poly-difference of two C polyhedra, the library will enforce the topological closure of the result.
 are topologically closed polyhedra, their poly-difference may be a convex polyhedron that is not topologically closed. For this reason, when computing the poly-difference of two C polyhedra, the library will enforce the topological closure of the result.
Viewing a polyhedron as a set of tuples (its points), it is sometimes useful to consider the set of tuples obtained by concatenating an ordered pair of polyhedra. Formally, the concatenation of the polyhedra  and
 and  (taken in this order) is the polyhedron
 (taken in this order) is the polyhedron  such that
 such that 
![\[ \cR \defeq \Bigl\{\, (x_0, \ldots, x_{n-1}, y_0, \ldots, y_{m-1})^\transpose \in \Rset^{n+m} \Bigm| (x_0, \ldots, x_{n-1})^\transpose \in \cP, (y_0, \ldots, y_{m-1})^\transpose \in \cQ \,\Bigl\}. \]](form_156.png) 
 Another way of seeing it is as follows: first embed polyhedron  into a vector space of dimension
 into a vector space of dimension  and then add a suitably renamed-apart version of the constraints defining
 and then add a suitably renamed-apart version of the constraints defining  .
.
The library provides two operators for adding a number  of space dimensions to an NNC polyhedron
 of space dimensions to an NNC polyhedron  , therefore transforming it into a new NNC polyhedron
, therefore transforming it into a new NNC polyhedron  . In both cases, the added dimensions of the vector space are those having the highest indices.
. In both cases, the added dimensions of the vector space are those having the highest indices.
The operator add_space_dimensions_and_embed embeds the polyhedron  into the new vector space of dimension
 into the new vector space of dimension  and returns the polyhedron
 and returns the polyhedron  defined by all and only the constraints defining
 defined by all and only the constraints defining  (the variables corresponding to the added dimensions are unconstrained). For instance, when starting from a polyhedron
 (the variables corresponding to the added dimensions are unconstrained). For instance, when starting from a polyhedron  and adding a third space dimension, the result will be the polyhedron
 and adding a third space dimension, the result will be the polyhedron 
![\[ \cQ = \bigl\{\, (x_0, x_1, x_2)^\transpose \in \Rset^3 \bigm| (x_0, x_1)^\transpose \in \cP \,\bigr\}. \]](form_162.png) 
In contrast, the operator add_space_dimensions_and_project projects the polyhedron  into the new vector space of dimension
 into the new vector space of dimension  and returns the polyhedron
 and returns the polyhedron  whose constraint system, besides the constraints defining
 whose constraint system, besides the constraints defining  , will include additional constraints on the added dimensions. Namely, the corresponding variables are all constrained to be equal to 0. For instance, when starting from a polyhedron
, will include additional constraints on the added dimensions. Namely, the corresponding variables are all constrained to be equal to 0. For instance, when starting from a polyhedron  and adding a third space dimension, the result will be the polyhedron
 and adding a third space dimension, the result will be the polyhedron 
![\[ \cQ = \bigl\{\, (x_0, x_1, 0)^\transpose \in \Rset^3 \bigm| (x_0, x_1)^\transpose \in \cP \,\bigr\}. \]](form_163.png) 
The library provides two operators for removing space dimensions from an NNC polyhedron  , therefore transforming it into a new NNC polyhedron
, therefore transforming it into a new NNC polyhedron  where
 where  .
.
Given a set of variables, the operator remove_space_dimensions removes all the space dimensions specified by the variables in the set. For instance, letting  be the singleton set
 be the singleton set  , then after invoking this operator with the set of variables
, then after invoking this operator with the set of variables  the resulting polyhedron is
 the resulting polyhedron is 
![\[ \cQ = \bigl\{ (3, 2)^\transpose \bigr\} \sseq \Rset^2. \]](form_167.png) 
Given a space dimension  less than or equal to that of the polyhedron, the operator
 less than or equal to that of the polyhedron, the operator remove_higher_space_dimensions removes the space dimensions having indices greater than or equal to  . For instance, letting
. For instance, letting  defined as before, by invoking this operator with
 defined as before, by invoking this operator with  the resulting polyhedron will be
 the resulting polyhedron will be 
![\[ \cQ = \bigl\{ (3, 1)^\transpose \bigr\} \sseq \Rset^2. \]](form_170.png) 
The operator map_space_dimensions provided by the library maps the dimensions of the vector space  according to a partial injective function
 according to a partial injective function  such that
 such that  with
 with  . Dimensions corresponding to indices that are not mapped by
. Dimensions corresponding to indices that are not mapped by  are removed.
 are removed.
If  , i.e., if the function
, i.e., if the function  is undefined everywhere, then the operator projects the argument polyhedron
 is undefined everywhere, then the operator projects the argument polyhedron  onto the zero-dimension space
 onto the zero-dimension space  ; otherwise the result is
; otherwise the result is  given by
 given by 
![\[ \cQ \defeq \Bigl\{\, \bigl(v_{\rho^{-1}(0)}, \ldots, v_{\rho^{-1}(m-1)}\bigr)^\transpose \Bigm| (v_0, \ldots, v_{n-1})^\transpose \in \cP \,\Bigr\}. \]](form_176.png) 
The operator expand_space_dimension provided by the library adds  new space dimensions to a polyhedron
 new space dimensions to a polyhedron  , with
, with  , so that dimensions
, so that dimensions  ,
,  ,
,  ,
,  of the result
 of the result  are exact copies of the
 are exact copies of the  -th space dimension of
-th space dimension of  . More formally,
. More formally, 
![\[ \cQ \defeq \sset{ \vect{u} \in \Rset^{n+m} }{ \exists \vect{v}, \vect{w} \in \cP \st u_i = v_i \\ \qquad \mathord{} \land \forall j = n, n+1, \ldots, n+m-1 \itc u_j = w_i \\ \qquad \mathord{} \land \forall k = 0, \ldots, n-1 \itc k \neq i \implies u_k = v_k = w_k }. \]](form_181.png) 
This operation has been proposed in [GDDetal04].
The operator fold_space_dimensions provided by the library, given a polyhedron  , with
, with  , folds a set of space dimensions
, folds a set of space dimensions  , with
, with  and
 and  for each
 for each  , into space dimension
, into space dimension  , where
, where  . The result is given by
. The result is given by 
![\[ \cQ \defeq \biguplus_{d = 0}^m \cQ_d \]](form_188.png) 
where
![\[ \cQ_m \defeq \sset{ \vect{u} \in \Rset^{n-m} }{ \exists \vect{v} \in \cP \st u_{i'} = v_i \\ \qquad \mathord{} \land \forall k = 0, \ldots, n-1 \itc k \neq i \implies u_{k'} = v_k } \]](form_189.png) 
 and, for  ,
,  ,
,  ,
, 
![\[ \cQ_d \defeq \sset{ \vect{u} \in \Rset^{n-m} }{ \exists \vect{v} \in \cP \st u_{i'} = v_{j_d} \\ \qquad \mathord{} \land \forall k = 0, \ldots, n-1 \itc k \neq i \implies u_{k'} = v_k }, \]](form_193.png) 
 and, finally, for  ,
,  ,
,  ,
, 
![\[ k' \defeq k - \card \{\, j \in J \mid k > j \,\}, \]](form_196.png) 
 (  denotes the cardinality of the finite set
 denotes the cardinality of the finite set  ).
).
This operation has been proposed in [GDDetal04].
For each relation  , we denote by
, we denote by  the image under
 the image under  of the set
 of the set  ; formally,
; formally, 
![\[ \phi(S) \defeq \bigl\{\, \vect{w} \in \Rset^m \bigm| \exists \vect{v} \in S \st (\vect{v}, \vect{w}) \in \phi \,\bigr\}. \]](form_202.png) 
 Similarly, we denote by  the preimage under
 the preimage under  of
 of  , that is
, that is 
![\[ \phi^{-1}(S') \defeq \bigl\{\, \vect{v} \in \Rset^n \bigm| \exists \vect{w} \in S' \st (\vect{v}, \vect{w}) \in \phi \,\bigr\}. \]](form_205.png) 
 If  , then the relation
, then the relation  is said to be space dimension preserving.
 is said to be space dimension preserving.
The relation  is said to be an affine relation if there exists
 is said to be an affine relation if there exists  such that
 such that 
![\[ \forall \vect{v} \in \Rset^n, \vect{w} \in \Rset^m \itc (\vect{v}, \vect{w}) \in \phi \iff \bigland_{i=1}^{\ell} \bigl( \langle \vect{c}_i, \vect{w} \rangle \relsym_i \langle \vect{a}_i, \vect{v} \rangle + b_i \bigr), \]](form_208.png) 
 where  ,
,  ,
,  and
 and  , for each
, for each  .
.
As a special case, the relation  is an affine function if and only if there exist a matrix
 is an affine function if and only if there exist a matrix  and a vector
 and a vector  such that,
 such that, 
![\[ \forall \vect{v} \in \Rset^n, \vect{w} \in \Rset^m \itc (\vect{v}, \vect{w}) \in \phi \iff \vect{w} = A\vect{v} + \vect{b}. \]](form_216.png) 
The set  of NNC polyhedra is closed under the application of images and preimages of any space dimension preserving affine relation. The same property holds for the set
 of NNC polyhedra is closed under the application of images and preimages of any space dimension preserving affine relation. The same property holds for the set  of closed polyhedra, provided the affine relation makes no use of the strict relation symbols
 of closed polyhedra, provided the affine relation makes no use of the strict relation symbols  and
 and  . Images and preimages of affine relations can be used to model several kinds of transition relations, including deterministic assignments of affine expressions, (affinely constrained) nondeterministic assignments and affine conditional guards.
. Images and preimages of affine relations can be used to model several kinds of transition relations, including deterministic assignments of affine expressions, (affinely constrained) nondeterministic assignments and affine conditional guards.
A space dimension preserving relation  can be specified by means of a shorthand notation:
 can be specified by means of a shorthand notation:
 of unprimed variables is used to represent the space dimensions of the domain of
 of unprimed variables is used to represent the space dimensions of the domain of  ;
; of primed variables is used to represent the space dimensions of the range of
 of primed variables is used to represent the space dimensions of the range of  ;
; , if in the syntactic specification of the relation the primed variable
, if in the syntactic specification of the relation the primed variable  only occurs (if ever) with coefficient 0, then it is assumed that the specification also contains the constraint
 only occurs (if ever) with coefficient 0, then it is assumed that the specification also contains the constraint  .
.As an example, assuming  , the notation
, the notation  , where the primed variable
, where the primed variable  does not occur, is meant to specify the affine relation defined by
 does not occur, is meant to specify the affine relation defined by 
![\[ \forall \vect{v} \in \Rset^3, \vect{w} \in \Rset^3 \itc (\vect{v}, \vect{w}) \in \phi \iff (w_0 - w_2 \geq 2 v_0 - v_1) \land (w_1 = v_1). \]](form_227.png) 
 The same relation is specified by  , since
, since  occurs with coefficient 0.
 occurs with coefficient 0.
The library allows for the computation of images and preimages of polyhedra under restricted subclasses of space dimension preserving affine relations, as described in the following.
Given a primed variable  and an unprimed affine expression
 and an unprimed affine expression  , the affine function
, the affine function  is defined by
 is defined by 
![\[ \forall \vect{v} \in \Rset^n \itc \phi(\vect{v}) = A\vect{v} + \vect{b}, \]](form_232.png) 
where
![\[ A = \begin{pmatrix} 1 & & 0 & 0 & \cdots & \cdots & 0 \\ & \ddots & & \vdots & & & \vdots \\ 0 & & 1 & 0 & \cdots & \cdots & 0 \\ a_0 & \cdots & a_{k-1} & a_k & a_{k+1} & \cdots & a_{n-1} \\ 0 & \cdots & \cdots & 0 & 1 & & 0 \\ \vdots & & & \vdots & & \ddots & \\ 0 & \cdots & \cdots & 0 & 0 & & 1 \end{pmatrix}, \qquad \vect{b} = \begin{pmatrix} 0 \\ \vdots \\ 0 \\ b \\ 0 \\ \vdots \\ 0 \end{pmatrix} \]](form_233.png) 
 and the  (resp.,
 (resp.,  ) occur in the
) occur in the  st row in
st row in  (resp., position in
 (resp., position in  ). Thus function
). Thus function  maps any vector
 maps any vector  to
 to 
![\[ \Bigl(v_0, \ldots, \bigl(\textstyle{\sum_{i=0}^{n-1}} a_i v_i + b\bigr), \ldots, v_{n-1}\Bigr)^\transpose. \]](form_240.png) 
The affine image operator computes the affine image of a polyhedron  under
 under  . For instance, suppose the polyhedron
. For instance, suppose the polyhedron  to be transformed is the square in
 to be transformed is the square in  generated by the set of points
 generated by the set of points  . Then, if the primed variable is
. Then, if the primed variable is  and the affine expression is
 and the affine expression is  (so that
 (so that  ,
,  ), the affine image operator will translate
), the affine image operator will translate  to the parallelogram
 to the parallelogram  generated by the set of points
 generated by the set of points  with height equal to the side of the square and oblique sides parallel to the line
 with height equal to the side of the square and oblique sides parallel to the line  . If the primed variable is as before (i.e.,
. If the primed variable is as before (i.e.,  ) but the affine expression is
) but the affine expression is  (so that
 (so that  ), then the resulting polyhedron
), then the resulting polyhedron  is the positive diagonal of the square.
 is the positive diagonal of the square.
The affine preimage operator computes the affine preimage of a polyhedron  under
 under  . For instance, suppose now that we apply the affine preimage operator as given in the first example using primed variable
. For instance, suppose now that we apply the affine preimage operator as given in the first example using primed variable  and affine expression
 and affine expression  to the parallelogram
 to the parallelogram  ; then we get the original square
; then we get the original square  back. If, on the other hand, we apply the affine preimage operator as given in the second example using primed variable
 back. If, on the other hand, we apply the affine preimage operator as given in the second example using primed variable  and affine expression
 and affine expression  to
 to  , then the resulting polyhedron is the stripe obtained by adding the line
, then the resulting polyhedron is the stripe obtained by adding the line  to polyhedron
 to polyhedron  .
.
Observe that provided the coefficient  of the considered variable in the affine expression is non-zero, the affine function is invertible.
 of the considered variable in the affine expression is non-zero, the affine function is invertible.
Given a primed variable  and two unprimed affine expressions
 and two unprimed affine expressions  and
 and  , the bounded affine relation
, the bounded affine relation  is defined as
 is defined as 
![\[ \forall \vect{v} \in \Rset^n, \vect{w} \in \Rset^n \itc (\vect{v}, \vect{w}) \in \phi \iff \bigl( \langle \vect{a}, \vect{v} \rangle + b \leq w_k \leq \langle \vect{c}, \vect{v} \rangle + d \bigr) \land \Bigl( \bigland_{0 \leq i < n, i \neq k} w_i = v_i \Bigr). \]](form_256.png) 
Let  be the set of floating point numbers representables in a certain format
 be the set of floating point numbers representables in a certain format  and let
 and let  be the set of real intervals with bounds in
 be the set of real intervals with bounds in  . We can define a floating-point interval linear form
. We can define a floating-point interval linear form  as:
 as: 
![\[\left<\vect{\alpha}, \vect{x}\right> + \beta = \alpha_0x_0 + \ldots + \alpha_{n-1}x_{n-1} + \beta,\]](form_261.png) 
where  ,
,  for each
 for each  .
.
Given a such linear form  and a primed variable
 and a primed variable  the affine form image operator computes the bounded affine image of a polyhedron
 the affine form image operator computes the bounded affine image of a polyhedron  under
 under  , where
, where  and
 and  are the upper and lower bound of
 are the upper and lower bound of  respectively.
 respectively.
Similarly, the generalized affine relation  , where
, where  and
 and  are affine expressions and
 are affine expressions and  is a relation symbol, is defined as
 is a relation symbol, is defined as 
![\[ \forall \vect{v} \in \Rset^n, \vect{w} \in \Rset^n \itc (\vect{v}, \vect{w}) \in \phi \iff \bigl( \langle \vect{c}, \vect{w} \rangle + d \relsym \langle \vect{a}, \vect{v} \rangle + b \bigr) \land \Bigl( \bigland_{0 \leq i < n, c_i = 0} w_i = v_i \Bigr). \]](form_273.png) 
 When  and
 and  , then the above affine relation becomes equivalent to the single-update affine function
, then the above affine relation becomes equivalent to the single-update affine function  (hence the name given to this operator). It is worth stressing that the notation is not symmetric, because the variables occurring in expression
 (hence the name given to this operator). It is worth stressing that the notation is not symmetric, because the variables occurring in expression  are interpreted as primed variables, whereas those occurring in
 are interpreted as primed variables, whereas those occurring in  are unprimed; for instance, the transfer relations
 are unprimed; for instance, the transfer relations  and
 and  are not equivalent in general.
 are not equivalent in general.
The operator unconstrain computes the cylindrification [HMT71] of a polyhedron with respect to one of its variables. Formally, the cylindrification  of an NNC polyhedron
 of an NNC polyhedron  with respect to variable index
 with respect to variable index  is defined as follows:
 is defined as follows: 
![\[ \cQ = \bigl\{\, \vect{w} \in \Rset^n \bigm| \exists \vect{v} \in \cP \st \forall j \in \{0, \ldots, n-1\} \itc j \neq i \implies w_j = v_j \,\bigr\}. \]](form_282.png) 
Cylindrification is an idempotent operation; in particular, note that the computed result has the same space dimension of the original polyhedron. A variant of the operator above allows for the cylindrification of a polyhedron with respect to a finite set of variables.
The time-elapse operator has been defined in [HPR97]. Actually, the time-elapse operator provided by the library is a slight generalization of that one, since it also works on NNC polyhedra. For any two NNC polyhedra  , the time-elapse between
, the time-elapse between  and
 and  , denoted
, denoted  , is the smallest NNC polyhedron containing the set
, is the smallest NNC polyhedron containing the set 
![\[ \bigl\{\, \vect{p} + \lambda \vect{q} \in \Rset^n \bigm| \vect{p} \in \cP, \vect{q} \in \cQ, \lambda \in \nonnegRset \,\bigr\}. \]](form_285.png) 
Note that the above set might not be an NNC polyhedron.
The positive time-elapse operator has been defined in [BFM11,BFM13]. The operator provided by the library works on NNC polyhedra. For any two NNC polyhedra  , the positive time-elapse between
, the positive time-elapse between  and
 and  , denoted
, denoted  , is the NNC polyhedron containing exactly the set
, is the NNC polyhedron containing exactly the set 
![\[ \bigl\{\, \vect{p} + \lambda \vect{q} \in \Rset^n \bigm| \vect{p} \in \cP, \vect{q} \in \cQ, \lambda \in \Rset^{>0} \,\bigr\}, \]](form_287.png) 
 where  denotes the set of strictly positive reals. Notice that, differently from the case of the time-elapse operator, the set
 denotes the set of strictly positive reals. Notice that, differently from the case of the time-elapse operator, the set  is always an NNC polyhedron, if
 is always an NNC polyhedron, if  and
 and  are.
 are.
The exact version of the time-elapse operator  defined in Section Time-Elapse Operator, which may not be an NNC polyhedron, can be computed as the union of two NNC polyhedra, according to the following equation:
 defined in Section Time-Elapse Operator, which may not be an NNC polyhedron, can be computed as the union of two NNC polyhedra, according to the following equation:  .
.
Let  be NNC polyhedra. Then:
 be NNC polyhedra. Then:
 is meet-preserving with respect to
 is meet-preserving with respect to  using context
 using context  if
 if  ;
; is an enlargement of
 is an enlargement of  if
 if  .
. is a simplification with respect to
 is a simplification with respect to  if
 if  , where
, where  and
 and  are the cardinalities of minimized constraint representations for
 are the cardinalities of minimized constraint representations for  and
 and  , respectively.
, respectively.Notice that an enlargement need not be a simplification, and vice versa; moreover, the identity function is (trivially) a meet-preserving enlargement and simplification.
The library provides a binary operator (simplify_using_context) for the domain of NNC polyhedra that returns a polyhedron which is a meet-preserving enlargement simplification of its first argument using the second argument as context.
The concept of meet-preserving enlargement and simplification also applies to the other basic domains (boxes, grids, BD and octagonal shapes). See below for a definition of the concept of meet-preserving simplification for powerset domains.
The library provides operators for checking the relation holding between an NNC polyhedron and either a constraint or a generator.
Suppose  is an NNC polyhedron and
 is an NNC polyhedron and  an arbitrary constraint system representing
 an arbitrary constraint system representing  . Suppose also that
. Suppose also that  is a constraint with
 is a constraint with  and
 and  the set of points that satisfy
 the set of points that satisfy  . The possible relations between
. The possible relations between  and
 and  are as follows.
 are as follows.
 is disjoint from
 is disjoint from  if
 if  ; that is, adding
; that is, adding  to
 to  gives us the empty polyhedron.
 gives us the empty polyhedron. strictly intersects
 strictly intersects  if
 if  and
 and  ; that is, adding
; that is, adding  to
 to  gives us a non-empty polyhedron strictly smaller than
 gives us a non-empty polyhedron strictly smaller than  .
. is included in
 is included in  if
 if  ; that is, adding
; that is, adding  to
 to  leaves
 leaves  unchanged.
 unchanged. saturates
 saturates  if
 if  , where
, where  is the hyperplane induced by constraint
 is the hyperplane induced by constraint  , i.e., the set of points satisfying the equality constraint
, i.e., the set of points satisfying the equality constraint  ; that is, adding the constraint
; that is, adding the constraint  to
 to  leaves
 leaves  unchanged.
 unchanged.The polyhedron  subsumes the generator
 subsumes the generator  if adding
 if adding  to any generator system representing
 to any generator system representing  does not change
 does not change  .
.
The library provides two widening operators for the domain of polyhedra. The first one, that we call H79-widening, mainly follows the specification provided in the PhD thesis of N. Halbwachs [Hal79], also described in [HPR97]. Note that in the computation of the H79-widening  of two polyhedra
 of two polyhedra  it is required as a precondition that
 it is required as a precondition that  (the same assumption was implicitly present in the cited papers).
 (the same assumption was implicitly present in the cited papers).
The second widening operator, that we call BHRZ03-widening, is an instance of the specification provided in [BHRZ03a]. This operator also requires as a precondition that  and it is guaranteed to provide a result which is at least as precise as the H79-widening.
 and it is guaranteed to provide a result which is at least as precise as the H79-widening.
Both widening operators can be applied to NNC polyhedra. The user is warned that, in such a case, the results may not closely match the geometric intuition which is at the base of the specification of the two widenings. The reason is that, in the current implementation, the widenings are not directly applied to the NNC polyhedra, but rather to their internal representations. Implementation work is in progress and future versions of the library may provide an even better integration of the two widenings with the domain of NNC polyhedra.
 and
 and  (where
 (where  ) are identified by program variables
) are identified by program variables p and q, respectively, then the call q.H79_widening_assign(p) will assign the polyhedron  to variable
 to variable q. Namely, it is the bigger polyhedron  which is overwritten by the result of the widening. The smaller polyhedron is not modified, so as to lead to an easier coding of the usual convergence test (
 which is overwritten by the result of the widening. The smaller polyhedron is not modified, so as to lead to an easier coding of the usual convergence test (  can be coded as
 can be coded as p.contains(q)). Note that, in the above context, a call such as p.H79_widening_assign(q) is likely to result in undefined behavior, since the precondition  will be missed (unless it happens that
 will be missed (unless it happens that  ). The same observation holds for all flavors of widenings and extrapolation operators that are implemented in the library and for all the language interfaces.
). The same observation holds for all flavors of widenings and extrapolation operators that are implemented in the library and for all the language interfaces.When approximating a fixpoint computation using widening operators, a common tactic to improve the precision of the final result is to delay the application of widening operators. The usual approach is to fix a parameter  and only apply widenings starting from the
 and only apply widenings starting from the  -th iteration.
-th iteration.
The library also supports an improved widening delay strategy, that we call widening with tokens [BHRZ03a]. A token is a sort of wild card allowing for the replacement of the widening application by the exact upper bound computation: the token is used (and thus consumed) only when the widening would have resulted in an actual precision loss (as opposed to the potential precision loss of the classical delay strategy). Thus, all widening operators can be supplied with an optional argument, recording the number of available tokens, which is decremented when tokens are used. The approximated fixpoint computation will start with a fixed number  of tokens, which will be used if and when needed. When there are no tokens left, the widening is always applied.
 of tokens, which will be used if and when needed. When there are no tokens left, the widening is always applied.
Besides the two widening operators, the library also implements several extrapolation operators, which differ from widenings in that their use along an upper iteration sequence does not ensure convergence in a finite number of steps.
In particular, for each of the two widenings there is a corresponding limited extrapolation operator, which can be used to implement the widening ``up to'' technique as described in [HPR97]. Each limited extrapolation operator takes a constraint system as an additional parameter and uses it to improve the approximation yielded by the corresponding widening operator. Note that a convergence guarantee can only be obtained by suitably restricting the set of constraints that can occur in this additional parameter. For instance, in [HPR97] this set is fixed once and for all before starting the computation of the upward iteration sequence.
The bounded extrapolation operators further enhance each one of the limited extrapolation operators described above by intersecting the result of the limited extrapolation operation with the box obtained as a result of applying the CC76-widening to the smallest boxes enclosing the two argument polyhedra.
The PPL provides support for computations on non-relational domains, called boxes, and also the interval domains used for their representation.
An interval in  is a pair of bounds, called lower and upper. Each bound can be either (1) closed and bounded, (2) open and bounded, or (3) open and unbounded. If the bound is bounded, then it has a value in
 is a pair of bounds, called lower and upper. Each bound can be either (1) closed and bounded, (2) open and bounded, or (3) open and unbounded. If the bound is bounded, then it has a value in  . For each vector
. For each vector  and scalar
 and scalar  , and for each relation symbol
, and for each relation symbol  , the constraint
, the constraint  is said to be a interval constraint if there exist an index
 is said to be a interval constraint if there exist an index  such that, for all
 such that, for all  ,
,  . Thus each interval constraint that is not a tautology or inconsistent has the form
. Thus each interval constraint that is not a tautology or inconsistent has the form  ,
,  ,
,  ,
,  or
 or  , with
, with  .
.
Letting  be a sequence of
 be a sequence of  intervals and
 intervals and  be the vector in
 be the vector in  with 1 in the
 with 1 in the  'th position and zeroes in every other position; if the lower bound of the
'th position and zeroes in every other position; if the lower bound of the  'th interval in
'th interval in  is bounded, the corresponding interval constraint is defined as
 is bounded, the corresponding interval constraint is defined as  , where
, where  is the value of the bound and
 is the value of the bound and  is
 is  if it is a closed bound and
 if it is a closed bound and  if it is an open bound. Similarly, if the upper bound of the
 if it is an open bound. Similarly, if the upper bound of the  'th interval in
'th interval in  is bounded, the corresponding interval constraint is defined as
 is bounded, the corresponding interval constraint is defined as  , where
, where  is the value of the bound and
 is the value of the bound and  is
 is  if it is a closed bound and
 if it is a closed bound and  if it is an open bound.
 if it is an open bound.
A convex polyhedron  is said to be a box if and only if either
 is said to be a box if and only if either  is the set of solutions to a finite set of interval constraints or
 is the set of solutions to a finite set of interval constraints or  and
 and  . Therefore any
. Therefore any  -dimensional box
-dimensional box  in
 in  where
 where  can be represented by a sequence of
 can be represented by a sequence of  intervals
 intervals  in
 in  and
 and  is a closed polyhedron if every bound in the intervals in
 is a closed polyhedron if every bound in the intervals in  is either closed and bounded or open and unbounded.
 is either closed and bounded or open and unbounded.
The library provides a widening operator for boxes. Given two sequences of intervals defining two  -dimensional boxes, the CC76-widening applies, for each corresponding interval and bound, the interval constraint widening defined in [CC76]. For extra precision, this incorporates the widening with thresholds as defined in [BCCetal02] with
-dimensional boxes, the CC76-widening applies, for each corresponding interval and bound, the interval constraint widening defined in [CC76]. For extra precision, this incorporates the widening with thresholds as defined in [BCCetal02] with  as the set of default threshold values.
 as the set of default threshold values.
The PPL provides support for computations on numerical domains that, in selected contexts, can achieve a better precision/efficiency ratio with respect to the corresponding computations on a ``fully relational'' domain of convex polyhedra. This is achieved by restricting the syntactic form of the constraints that can be used to describe the domain elements.
For each vector  and scalar
 and scalar  , and for each relation symbol
, and for each relation symbol  , the linear constraint
, the linear constraint  is said to be a bounded difference if there exist two indices
 is said to be a bounded difference if there exist two indices  such that:
 such that:
 and
 and  ;
; , for all
, for all  .
.A convex polyhedron  is said to be a bounded difference shape (BDS, for short) if and only if either
 is said to be a bounded difference shape (BDS, for short) if and only if either  can be expressed as the intersection of a finite number of bounded difference constraints or
 can be expressed as the intersection of a finite number of bounded difference constraints or  and
 and  .
.
For each vector  and scalar
 and scalar  , and for each relation symbol
, and for each relation symbol  , the linear constraint
, the linear constraint  is said to be an octagonal if there exist two indices
 is said to be an octagonal if there exist two indices  such that:
 such that:
 ;
; , for all
, for all  .
.A convex polyhedron  is said to be an octagonal shape (OS, for short) if and only if either
 is said to be an octagonal shape (OS, for short) if and only if either  can be expressed as the intersection of a finite number of octagonal constraints or
 can be expressed as the intersection of a finite number of octagonal constraints or  and
 and  .
.
Note that, since any bounded difference is also an octagonal constraint, any BDS is also an OS. The name ``octagonal'' comes from the fact that, in a vector space of dimension 2, a bounded OS can have eight sides at most.
By construction, any BDS or OS is always topologically closed. Under the usual set inclusion ordering, the set of all BDSs (resp., OSs) on the vector space  is a lattice having the empty set
 is a lattice having the empty set  and the universe
 and the universe  as the smallest and the biggest elements, respectively. In theoretical terms, it is a meet sub-lattice of
 as the smallest and the biggest elements, respectively. In theoretical terms, it is a meet sub-lattice of  ; moreover, the lattice of BDSs is a meet sublattice of the lattice of OSs. The least upper bound of a finite set of BDSs (resp., OSs) is said to be their bds-hull (resp., oct-hull).
; moreover, the lattice of BDSs is a meet sublattice of the lattice of OSs. The least upper bound of a finite set of BDSs (resp., OSs) is said to be their bds-hull (resp., oct-hull).
As far as the representation of the rational inhomogeneous term of each bounded difference or octagonal constraint is concerned, several rounding-aware implementation choices are available, including:
The user interface for BDSs and OSs is meant to be as similar as possible to the one developed for the domain of closed polyhedra: in particular, all operators on polyhedra are also available for the domains of BDSs and OSs, even though they are typically characterized by a lower degree of precision. For instance, the bds-difference and oct-difference operators return (the smallest) over-approximations of the set-theoretical difference operator on the corresponding domains. In the case of (generalized) images and preimages of affine relations, suitable (possibly not-optimal) over-approximations are computed when the considered relations cannot be precisely modeled by only using bounded differences or octagonal constraints.
For the domains of BDSs and OSs, the library provides a variant of the widening operator for convex polyhedra defined in [CH78]. The implementation follows the specification in [BHMZ05a,BHMZ05b], resulting in an operator which is well-defined on the corresponding domain (i.e., it does not depend on the internal representation of BDSs or OSs), while still ensuring convergence in a finite number of steps.
The library also implements an extension of the widening operator for intervals as defined in [CC76]. The reader is warned that such an extension, even though being well-defined on the domain of BDSs and OSs, is not provided with a convergence guarantee and is therefore an extrapolation operator.
In this section we introduce rational grids as provided by the library. See also [BDHetal05] for a detailed description of this domain.
The library supports two representations for the grids domain; congruence systems and grid generator systems. We first describe linear congruence relations which form the elements of a congruence system.
For any  ,
,  denotes the congruence
 denotes the congruence  .
.
Let  . For each vector
. For each vector  and scalars
 and scalars  , the notation
, the notation  stands for the linear congruence relation in
 stands for the linear congruence relation in  defined by the set of vectors
 defined by the set of vectors 
![\[ \bigl\{\, \vect{v} \in \Rset^n \bigm| \exists \mu \in \Zset \st \langle \vect{a}, \vect{v} \rangle = b + \mu f \,\bigr\}; \]](form_345.png) 
 when  , the relation is said to be proper;
, the relation is said to be proper;  (i.e., when
 (i.e., when  ) denotes the equality
) denotes the equality  .
.  is called the frequency or modulus and
 is called the frequency or modulus and  the base value of the relation. Thus, provided
 the base value of the relation. Thus, provided  , the relation
, the relation  defines the set of affine hyperplanes
 defines the set of affine hyperplanes 
![\[ \big\{\, \bigl(\langle \vect{a}, \vect{x} \rangle = b + \mu f\bigr) \bigm| \mu \in \Zset \,\bigr\}; \]](form_350.png) 
 if  ,
,  defines the universe
 defines the universe  and the empty set, otherwise.
 and the empty set, otherwise.
The set  is a rational grid if and only if either
 is a rational grid if and only if either  is the set of vectors in
 is the set of vectors in  that satisfy a finite system
 that satisfy a finite system  of congruence relations in
 of congruence relations in  or
 or  and
 and  .
.
We also say that   is described by
 is described by  and that
 and that   is a congruence system for
 is a congruence system for  .
.
The grid domain  is the set of all rational grids described by finite sets of congruence relations in
 is the set of all rational grids described by finite sets of congruence relations in  .
.
If the congruence system  describes the
 describes the  , the empty grid, then we say that
, the empty grid, then we say that  is inconsistent. For example, the congruence systems
 is inconsistent. For example, the congruence systems  meaning that
 meaning that  and
 and  , for any
, for any  , meaning that the value of an expression must be both even and odd are both inconsistent since both describe the empty grid.
, meaning that the value of an expression must be both even and odd are both inconsistent since both describe the empty grid.
When ordering grids by the set inclusion relation, the empty set  and the vector space
 and the vector space  (which is described by the empty set of congruence relations) are, respectively, the smallest and the biggest elements of
 (which is described by the empty set of congruence relations) are, respectively, the smallest and the biggest elements of  . The vector space
. The vector space  is also called the universe grid.
 is also called the universe grid.
In set theoretical terms,  is a lattice under set inclusion.
 is a lattice under set inclusion.
Let  be a finite set of vectors. For all scalars
 be a finite set of vectors. For all scalars  , the vector
, the vector  is said to be a integer combination of the vectors in
 is said to be a integer combination of the vectors in  .
.
We denote by  (resp.,
 (resp.,  ) the set of all the integer (resp., integer and affine) combinations of the vectors in
) the set of all the integer (resp., integer and affine) combinations of the vectors in  .
.
Let  be a grid. Then
 be a grid. Then
 is called a grid point of
 is called a grid point of  ;
; , where
, where  , is called a parameter of
, is called a parameter of  if
 if  and
 and  , for all points
, for all points  and all
 and all  ;
; is called a grid line of
 is called a grid line of  if
 if  and
 and  , for all points
, for all points  and all
 and all  .
.We can generate any rational grid in  from a finite subset of its points, parameters and lines; each point in a grid is obtained by adding a linear combination of its generating lines to an integral combination of its parameters and an integral affine combination of its generating points.
 from a finite subset of its points, parameters and lines; each point in a grid is obtained by adding a linear combination of its generating lines to an integral combination of its parameters and an integral affine combination of its generating points.
If  are each finite subsets of
 are each finite subsets of  and
 and 
![\[ \cL = \linearhull(L) + \inthull(Q) + \intaffinehull(P) \]](form_375.png) 
 where the symbol '  ' denotes the Minkowski's sum, then
' denotes the Minkowski's sum, then  is a rational grid (see Section 4.4 in [Sch99] and also Proposition 8 in [BDHetal05]). The 3-tuple
 is a rational grid (see Section 4.4 in [Sch99] and also Proposition 8 in [BDHetal05]). The 3-tuple  is said to be a grid generator system for
 is said to be a grid generator system for  and we write
 and we write  .
.
Note that the grid  if and only if the set of grid points
 if and only if the set of grid points  . If
. If  , then
, then  where, for some
 where, for some  ,
,  .
.
A minimized congruence system  for
 for  is such that, if
 is such that, if  is another congruence system for
 is another congruence system for  , then
, then  . Note that a minimized congruence system for a non-empty grid has at most
. Note that a minimized congruence system for a non-empty grid has at most  congruence relations.
 congruence relations.
Similarly, a minimized grid generator system  for
 for  is such that, if
 is such that, if  is another grid generator system for
 is another grid generator system for  , then
, then  and
 and  . Note that a minimized grid generator system for a grid has no more than a total of
. Note that a minimized grid generator system for a grid has no more than a total of  grid lines, parameters and points.
 grid lines, parameters and points.
As for convex polyhedra, any grid  can be described by using a congruence system
 can be described by using a congruence system  for
 for  , a grid generator system
, a grid generator system  for
 for  , or both by means of the double description pair (DD pair)
, or both by means of the double description pair (DD pair)  . The double description method for grids is a collection of theoretical results very similar to those for convex polyhedra showing that, given one kind of representation, there are algorithms for computing a representation of the other kind and for minimizing both representations.
. The double description method for grids is a collection of theoretical results very similar to those for convex polyhedra showing that, given one kind of representation, there are algorithms for computing a representation of the other kind and for minimizing both representations.
As for convex polyhedra, such changes of representation form a key step in the implementation of many operators on grids such as, for example, intersection and grid join.
The space dimension of a grid  is the dimension
 is the dimension  of the corresponding vector space
 of the corresponding vector space  . The space dimension of congruence relations, grid generators and other objects of the library is defined similarly.
. The space dimension of congruence relations, grid generators and other objects of the library is defined similarly.
A non-empty grid  has affine dimension
 has affine dimension  , denoted by
, denoted by  , if the maximum number of affinely independent points in
, if the maximum number of affinely independent points in  is
 is  . The affine dimension of an empty grid is defined to be 0. Thus we have
. The affine dimension of an empty grid is defined to be 0. Thus we have  .
.
In general, the operations on rational grids are the same as those for the other PPL domains and the definitions of these can be found in Section Operations on Convex Polyhedra. Below we just describe those operations that have features or behavior that is in some way special to the grid domain.
As for convex polyhedra (see Single-Update Affine Functions), the library provides affine image and preimage operators for grids: given a variable  and linear expression
 and linear expression  , these determine the affine transformation
, these determine the affine transformation  that transforms any point
 that transforms any point  in a grid
 in a grid  to
 to 
![\[ \Bigl(v_0, \ldots, \bigl(\textstyle{\sum_{i=0}^{n-1}} a_i v_i + b\bigr), \ldots, v_{n-1}\Bigr)^\transpose. \]](form_240.png) 
The affine image operator computes the affine image of a grid  under
 under  . For instance, suppose the grid
. For instance, suppose the grid  to be transformed is the non-relational grid in
 to be transformed is the non-relational grid in  generated by the set of grid points
 generated by the set of grid points  . Then, if the considered variable is
. Then, if the considered variable is  and the linear expression is
 and the linear expression is  (so that
 (so that  ,
,  ), the affine image operator will translate
), the affine image operator will translate  to the grid
 to the grid  generated by the set of grid points
 generated by the set of grid points  which is the grid generated by the grid point
 which is the grid generated by the grid point  and parameters
 and parameters  ; or, alternatively defined by the congruence system
; or, alternatively defined by the congruence system  . If the considered variable is as before (i.e.,
. If the considered variable is as before (i.e.,  ) but the linear expression is
) but the linear expression is  (so that
 (so that  ), then the resulting grid
), then the resulting grid  is the grid containing all the points whose coordinates are integral multiples of 3 and lie on line
 is the grid containing all the points whose coordinates are integral multiples of 3 and lie on line  .
.
The affine preimage operator computes the affine preimage of a grid  under
 under  . For instance, suppose now that we apply the affine preimage operator as given in the first example using variable
. For instance, suppose now that we apply the affine preimage operator as given in the first example using variable  and linear expression
 and linear expression  to the grid
 to the grid  ; then we get the original grid
; then we get the original grid  back. If, on the other hand, we apply the affine preimage operator as given in the second example using variable
 back. If, on the other hand, we apply the affine preimage operator as given in the second example using variable  and linear expression
 and linear expression  to
 to  , then the resulting grid will consist of all the points in
, then the resulting grid will consist of all the points in  where the
 where the  coordinate is an integral multiple of 3.
 coordinate is an integral multiple of 3.
Observe that provided the coefficient  of the considered variable in the linear expression is non-zero, the affine transformation is invertible.
 of the considered variable in the linear expression is non-zero, the affine transformation is invertible.
Similarly to convex polyhedra (see Generalized Affine Relations), the library provides two other grid operators that are generalizations of the single update affine image and preimage operators for grids. The generalized affine image operator  , where
, where  and
 and  are affine expressions and
 are affine expressions and  , is defined as
, is defined as 
![\[ \forall \vect{v} \in \Rset^n, \vect{w} \in \Rset^n \itc (\vect{v}, \vect{w}) \in \phi \iff \bigl( \langle \vect{c}, \vect{w} \rangle + d \equiv_f \langle \vect{a}, \vect{v} \rangle + b \bigr) \land \Bigl( \bigland_{0 \leq i < n, c_i = 0} w_i = v_i \Bigr). \]](form_407.png) 
 Note that, when  and
 and  , so that the transfer function is an equality, then the above operator is equivalent to the application of the standard affine image of
, so that the transfer function is an equality, then the above operator is equivalent to the application of the standard affine image of  with respect to the variable
 with respect to the variable  and the affine expression
 and the affine expression  .
.
Let  be any non-empty grid and
 be any non-empty grid and  be a linear expression. Then if, for some
 be a linear expression. Then if, for some  , all the points in
, all the points in  satisfy the congruence
 satisfy the congruence  , then the maximum
, then the maximum  such that this holds is called the frequency of
 such that this holds is called the frequency of  with respect to
 with respect to  .
.
The frequency operator provided by the library returns both the frequency  and a value
 and a value  where
 where  and
 and 
![\[ \lvert\mathrm{val}\rvert = \min\Bigl\{\, \bigl\lvert\langle \vect{a}, \vect{v} \rangle + b \bigr\rvert \Bigm| \vect{v} \in \cL \,\Bigr\}. \]](form_414.png) 
Observe that the above definition is also applied to other simple objects in the library like polyhedra, octagonal shapes, bd-shapes and boxes and in such cases the definition of frequency can be simplified. For instance, the frequency for an object  is defined if and only if there is a unique value
 is defined if and only if there is a unique value  such that
 such that  saturates the equality
 saturates the equality  ; in this case the frequency is
; in this case the frequency is  and the value returned is
 and the value returned is  .
.
For any two grids  , the time-elapse between
, the time-elapse between  and
 and  , denoted
, denoted  , is the grid
, is the grid 
![\[ \bigl\{\, \vect{p} + \mu \vect{q} \in \Rset^n \bigm| \vect{p} \in \cL_1, \vect{q} \in \cL_2, \mu \in \Zset \,\bigr\}. \]](form_419.png) 
The library provides operators for checking the relation holding between a grid and a congruence, a grid generator, a constraint or a (polyhedron) generator.
Suppose  is a grid and
 is a grid and  an arbitrary congruence system representing
 an arbitrary congruence system representing  . Suppose also that
. Suppose also that  is a congruence relation with
 is a congruence relation with  . The possible relations between
. The possible relations between  and
 and  are as follows.
 are as follows.
 is disjoint from
 is disjoint from  if
 if  ; that is, adding
; that is, adding  to
 to  gives us the empty grid.
 gives us the empty grid. strictly intersects
 strictly intersects  if
 if  and
 and  ; that is, adding
; that is, adding  to
 to  gives us a non-empty grid strictly smaller than
 gives us a non-empty grid strictly smaller than  .
. is included in
 is included in  if
 if  ; that is, adding
; that is, adding  to
 to  leaves
 leaves  unchanged.
 unchanged. saturates
 saturates  if
 if  is included in
 is included in  and
 and  , i.e.,
, i.e.,  is an equality congruence.
 is an equality congruence.For the relation between  and a constraint, suppose that
 and a constraint, suppose that  is a constraint with
 is a constraint with  and
 and  the set of points that satisfy
 the set of points that satisfy  . The possible relations between
. The possible relations between  and
 and  are as follows.
 are as follows.
 is disjoint from
 is disjoint from  if
 if  .
. strictly intersects
 strictly intersects  if
 if  and
 and  .
. is included in
 is included in  if
 if  .
. saturates
 saturates  if
 if  is included in
 is included in  and
 and  is
 is  .
.A grid  subsumes a grid generator
 subsumes a grid generator  if adding
 if adding  to any grid generator system representing
 to any grid generator system representing  does not change
 does not change  .
.
A grid  subsumes a (polyhedron) point or closure point
 subsumes a (polyhedron) point or closure point  if adding the corresponding grid point to any grid generator system representing
 if adding the corresponding grid point to any grid generator system representing  does not change
 does not change  . A grid
. A grid  subsumes a (polyhedron) ray or line
 subsumes a (polyhedron) ray or line  if adding the corresponding grid line to any grid generator system representing
 if adding the corresponding grid line to any grid generator system representing  does not change
 does not change  .
.
The operator wrap_assign provided by the library, allows for the wrapping of a subset of the set of space dimensions so as to fit the given bounded integer type and have the specified overflow behavior. In order to maximize the precision of this operator for grids, the exact behavior differs in some respects from the other simple classes of geometric descriptors.
Suppose  is a grid and
 is a grid and  a subset of the set of space dimensions
 a subset of the set of space dimensions  . Suppose also that the width of the bounded integer type is
. Suppose also that the width of the bounded integer type is  so that the range of values
 so that the range of values  if the type is unsigned and
 if the type is unsigned and  otherwise. Consider a space dimension
 otherwise. Consider a space dimension  and a variable
 and a variable  for dimension
 for dimension  .
.
If the value in  for the variable
 for the variable  is a constant in the range
 is a constant in the range  , then it is unchanged. Otherwise the result
, then it is unchanged. Otherwise the result  of the operation on
 of the operation on  will depend on the specified overflow behavior.
 will depend on the specified overflow behavior.
 has no value for the variable
 has no value for the variable  in the range
 in the range  , then
, then  is set empty. If
 is set empty. If  has exactly one value
 has exactly one value  in
 in  , then
, then  is set equal to
 is set equal to  . Otherwise,
. Otherwise,  .
. for
 for  in the grid
 in the grid  , the wrapped value can be any value
, the wrapped value can be any value  where
 where  . Therefore
. Therefore  is obtained by adding the parameter
 is obtained by adding the parameter  , where
, where  , to the generator system for
, to the generator system for  .
. already satisfies the congruence
 already satisfies the congruence  , for some
, for some  , then
, then  is set equal to
 is set equal to  where
 where  and
 and  . Otherwise,
. Otherwise,  is obtained by adding the parameter
 is obtained by adding the parameter  , where
, where  , to the generator system for
, to the generator system for  .
.The library provides grid widening operators for the domain of grids. The congruence widening and generator widening follow the specifications provided in [BDHetal05]. The third widening uses either the congruence or the generator widening, the exact rule governing this choice at the time of the call is left to the implementation. Note that, as for the widenings provided for convex polyhedra, all the operations provided by the library for computing a widening  of grids
 of grids  require as a precondition that
 require as a precondition that  .
.
 , the resulting grid will be assigned to overwrite the store containing the bigger grid
, the resulting grid will be assigned to overwrite the store containing the bigger grid  . The smaller grid
. The smaller grid  is not modified. The same observation holds for all flavors of widenings and extrapolation operators that are implemented in the library and for all the language interfaces.
 is not modified. The same observation holds for all flavors of widenings and extrapolation operators that are implemented in the library and for all the language interfaces.This is as for widening with tokens for convex polyhedra.
Besides the widening operators, the library also implements several extrapolation operators, which differ from widenings in that their use along an upper iteration sequence does not ensure convergence in a finite number of steps.
In particular, for each grid widening that is provided, there is a corresponding limited extrapolation operator, which can be used to implement the widening ``up to'' technique as described in [HPR97]. Each limited extrapolation operator takes a congruence system as an additional parameter and uses it to improve the approximation yielded by the corresponding widening operator. Note that, as in the case for convex polyhedra, a convergence guarantee can only be obtained by suitably restricting the set of congruence relations that can occur in this additional parameter.
The PPL provides the finite powerset construction; this takes a pre-existing domain and upgrades it to one that can represent disjunctive information (by using a finite number of disjuncts). The construction follows the approach described in [Bag98], also summarized in [BHZ04] where there is an account of generic widenings for the powerset domain (some of which are supported in the pointset powerset domain instantiation of this construction described in Section The Pointset Powerset Domain).
The domain is built from a pre-existing base-level domain  which must include an entailment relation `
 which must include an entailment relation `  ', meet operation `
', meet operation `  ', a top element `
', a top element `  ' and bottom element `
' and bottom element `  '.
'.
A set  is called non-redundant with respect to `
 is called non-redundant with respect to `  ' if and only if
' if and only if  and
 and  . The set of finite non-redundant subsets of
. The set of finite non-redundant subsets of  (with respect to `
 (with respect to `  ') is denoted by
') is denoted by  . The function
. The function  , called Omega-reduction, maps a finite set into its non-redundant counterpart; it is defined, for each
, called Omega-reduction, maps a finite set into its non-redundant counterpart; it is defined, for each  , by
, by 
![\[ \nonredmap(\cS) \defeq \cS \setdiff \{\, d \in \cS \mid d = \false \text{ or } \exists d' \in \cS \st d \sentails d' \,\}. \]](form_466.png) 
 where  denotes
 denotes  .
.
As the intended semantics of a powerset domain element  is that of disjunction of the semantics of
 is that of disjunction of the semantics of  , the finite set
, the finite set  is semantically equivalent to the non-redundant set
 is semantically equivalent to the non-redundant set  ; and elements of
; and elements of  will be called disjuncts. The restriction to the finite subsets reflects the fact that here disjunctions are implemented by explicit collections of disjuncts. As a consequence of this restriction, for any
 will be called disjuncts. The restriction to the finite subsets reflects the fact that here disjunctions are implemented by explicit collections of disjuncts. As a consequence of this restriction, for any  such that
 such that  ,
,  is the (finite) set of the maximal elements of
 is the (finite) set of the maximal elements of  .
.
The finite powerset domain over a domain  is the set of all finite non-redundant sets of
 is the set of all finite non-redundant sets of  and denoted by
 and denoted by  . The domain includes an approximation ordering `
. The domain includes an approximation ordering `  ' defined so that, for any
' defined so that, for any  and
 and  ,
,  if and only if
 if and only if 
![\[ \forall d_1 \in \cS_1 \itc \exists d_2 \in \cS_2 \st d_1 \entails d_2. \]](form_477.png) 
 Therefore the top element is  and the bottom element is the emptyset.
 and the bottom element is the emptyset.
omega_reduce(), e.g., before performing the output of a powerset element. Note that all the documented operators automatically perform Omega-reductions on their arguments, when needed or appropriate.In this section we briefly describe the generic operations on Powerset Domains that are provided by the library for any given base-level domain  .
.
Given the sets  and
 and  , the meet and upper bound operators provided by the library returns the set
, the meet and upper bound operators provided by the library returns the set  and Omega-reduced set union
 and Omega-reduced set union  respectively.
 respectively.
Given the powerset element  and the base-level element
 and the base-level element  , the add disjunct operator provided by the library returns the powerset element
, the add disjunct operator provided by the library returns the powerset element  .
.
If the given powerset element is not empty, then the collapse operator returns the singleton powerset consisting of an upper-bound of all the disjuncts.
The pointset powerset domain provided by the PPL is the finite powerset domain (defined in Section The Powerset Construction) whose base-level domain  is one of the classes of semantic geometric descriptors listed in Section Semantic Geometric Descriptors.
 is one of the classes of semantic geometric descriptors listed in Section Semantic Geometric Descriptors.
In addition to the operations described for the generic powerset domain in Section Operations on the Powerset Construction, the PPL provides all the generic operations listed in Generic Operations on Semantic Geometric Descriptors. Here we just describe those operations that are particular to the pointset powerset domain.
Let  ,
,  and
 and  be Omega-reduced elements of a pointset powerset domain over the same base-level domain. Then:
 be Omega-reduced elements of a pointset powerset domain over the same base-level domain. Then:
 is powerset meet-preserving with respect to
 is powerset meet-preserving with respect to  using context
 using context  if the meet of
 if the meet of  and
 and  is equal to the meet of
 is equal to the meet of  and
 and  ;
; is a powerset simplification with respect to
 is a powerset simplification with respect to  if
 if  .
. is a disjunct meet-preserving simplification with respect to
 is a disjunct meet-preserving simplification with respect to  if, for each
 if, for each  , there exists
, there exists  such that, for each
 such that, for each  ,
,  is a meet-preserving enlargement and simplification of
 is a meet-preserving enlargement and simplification of  using context
 using context  .
.The library provides a binary operator (simplify_using_context) for the pointset powerset domain that returns a powerset which is a powerset meet-preserving, powerset simplification and disjunct meet-preserving simplification of its first argument using the second argument as context.
Notice that, due to the powerset simplification property, in general a meet-preserving powerset simplification is not an enlargement with respect to the ordering defined on the powerset lattice. Because of this, the operator provided by the library is only well-defined when the base-level domain is not itself a powerset domain.
Given the pointset powersets  over the same base-level domain and with the same space dimension, then we say that
 over the same base-level domain and with the same space dimension, then we say that  geometrically covers
 geometrically covers  if every point (in some disjunct) of
 if every point (in some disjunct) of  is also a point in a disjunct of
 is also a point in a disjunct of  . If
. If  geometrically covers
 geometrically covers  and
 and  geometrically covers
 geometrically covers  , then we say that they are geometrically equal.
, then we say that they are geometrically equal.
Given the pointset powerset  over a base-level semantic GD domain
 over a base-level semantic GD domain  , then the pairwise merge operator takes pairs of distinct elements in
, then the pairwise merge operator takes pairs of distinct elements in  whose upper bound (denoted here by
 whose upper bound (denoted here by  ) in
) in  (using the PPL operator
 (using the PPL operator upper_bound_assign() for  ) is the same as their set-theoretical union and replaces them by their union. This replacement is done recursively so that, for each pair
) is the same as their set-theoretical union and replaces them by their union. This replacement is done recursively so that, for each pair  of distinct disjuncts in the result set, we have
 of distinct disjuncts in the result set, we have  .
.
The library implements a generalization of the extrapolation operator for powerset domains proposed in [BGP99]. The operator BGP99_extrapolation_assign is made parametric by allowing for the specification of any PPL extrapolation operator for the base-level domain. Note that, even when the extrapolation operator for the base-level domain  is known to be a widening on
 is known to be a widening on  , the
, the BGP99_extrapolation_assign operator cannot guarantee the convergence of the iteration sequence in a finite number of steps (for a counter-example, see [BHZ04]).
The PPL library provides support for the specification of proper widening operators on the pointset powerset domain. In particular, this version of the library implements an instance of the certificate-based widening framework proposed in [BHZ03b].
A finite convergence certificate for an extrapolation operator is a formal way of ensuring that such an operator is indeed a widening on the considered domain. Given a widening operator on the base-level domain  , together with the corresponding convergence certificate, the BHZ03 framework is able to lift this widening on
, together with the corresponding convergence certificate, the BHZ03 framework is able to lift this widening on  to a widening on the pointset powerset domain; ensuring convergence in a finite number of iterations.
 to a widening on the pointset powerset domain; ensuring convergence in a finite number of iterations.
Being highly parametric, the BHZ03 widening framework can be instantiated in many ways. The current implementation provides the templatic operator BHZ03_widening_assign<Certificate, Widening> which only exploits a fraction of this generality, by allowing the user to specify the base-level widening function and the corresponding certificate. The widening strategy is fixed and uses two extrapolation heuristics: first, the upper bound operator for the base-level domain is tried; second, the BGP99 extrapolation operator is tried, possibly applying pairwise merging. If both heuristics fail to converge according to the convergence certificate, then an attempt is made to apply the base-level widening to the upper bound of the two arguments, possibly improving the result obtained by means of the difference operator for the base-level domain. For more details and a justification of the overall approach, see [BHZ03b] and [BHZ04].
The library provides several convergence certificates. Note that, for the domain of Polyhedra, while Parma_Polyhedra_Library::BHRZ03_Certificate the "BHRZ03_Certificate" is compatible with both the BHRZ03 and the H79 widenings, H79_Certificate is only compatible with the latter. Note that using different certificates will change the results obtained, even when using the same base-level widening operator. It is also worth stressing that it is up to the user to see that the widening operator is actually compatible with a given convergence certificate. If such a requirement is not met, then an extrapolation operator will be obtained.
This section describes the PPL abstract domains that are used for approximating floating point computations in software analysis. We follow the approch described in [Min04] and more detailedly in [Min05]. We will denote by  the set of all floating point variables in the analyzed program. We will also denote by
 the set of all floating point variables in the analyzed program. We will also denote by  the set of floating point numbers in the format used by the analyzer (that is, the machine running the PPL) and by
 the set of floating point numbers in the format used by the analyzer (that is, the machine running the PPL) and by  the set of floating point numbers in the format used by the machine that is expected to run the analyzed program. Recall that floating point numbers include the infinities
 the set of floating point numbers in the format used by the machine that is expected to run the analyzed program. Recall that floating point numbers include the infinities  and
 and  .
.
Generic concrete floating point expressions on  are represented by the
 are represented by the Floating_Point_Expression  abstract class. Its concrete derivate classes are:
Cast_Floating_Point_Expression ,Constant_Floating_Point_Expression ,Variable_Floating_Point_Expression ,Opposite_Floating_Point_Expression , that is the negation (unary minus) of a floating point expression,Sum_Floating_Point_Expression , that is the sum of two floating point expressions,Difference_Floating_Point_Expression , that is the difference of two floating point expressions,Multiplication_Floating_Point_Expression , that is the product of two floating point expressions, andDivision_Floating_Point_Expression , that is the division of two floating point expressions.The set of all the possible values in  of a floating point expression at a given program point in a given abstract store can be overapproximated by a linear form with interval coefficients, that is a linear expression of this kind:
 of a floating point expression at a given program point in a given abstract store can be overapproximated by a linear form with interval coefficients, that is a linear expression of this kind:
![\[ i + \sum_{v \in \cV}i_{v}v, \]](form_504.png) 
where all  are free floating point variables and
 are free floating point variables and  and all
 and all  are elements of
 are elements of  , defined as the set of all intervals with boundaries in
, defined as the set of all intervals with boundaries in  . This operation is called linearization and is performed by the method linearize of floating point expression classes.
. This operation is called linearization and is performed by the method linearize of floating point expression classes.
Even though the intervals may be open, we will always use closed intervals in the documentation for the sake of simplicity, with the exception of unbounded intervals that have  boundaries. We denote the set of all linear forms on
 boundaries. We denote the set of all linear forms on  by
 by  .
.
The Linear_Form  class provides common algebraic operations on linear forms: you can add or subtract two linear forms, and multiply or divide a linear form by a scalar. We are writing only about interval linear forms in this section, so our scalars will always be intervals with floating point boundaries. The operations on interval linear forms are intuitively defined as follows:
![\[ \left(i + \sum_{v \in V}i_{v}v\right) \aslf \left(i' + \sum_{v \in V}i'_{v}v\right) \defeq \left(i \asifp i'\right) + \sum_{v \in V}\left(i_{v} \asifp i'_{v}\right)v, \]](form_510.png) 
![\[ \left(i + \sum_{v \in V}i_{v}v\right) \adlf \left(i' + \sum_{v \in V}i'_{v}v\right) \defeq \left(i \adifp i'\right) + \sum_{v \in V}\left(i_{v} \adifp i'_{v}\right)v, \]](form_511.png) 
![\[ i \amlf \left(i' + \sum_{v \in V}i'_{v}v\right) \defeq \left(i \amifp i'\right) + \sum_{v \in V}\left(i \amifp i'_{v}\right)v, \]](form_512.png) 
![\[ \left(i + \sum_{v \in V}i_{v}v\right) \adivlf i' \defeq \left(i \adivifp i'\right) + \sum_{v \in V}\left(i_{v} \adivifp i'\right)v. \]](form_513.png) 
Where  and
 and  are the corresponding operations on intervals. Note that these operations always round the interval's lower bound towards
 are the corresponding operations on intervals. Note that these operations always round the interval's lower bound towards  and the upper bound towards
 and the upper bound towards  in order to obtain a correct overapproximation.
 in order to obtain a correct overapproximation.
A (composite) floating point abstract store is used to associate each floating point variable with its currently known approximation. The store is composed by two parts:
 associating each variable with its current approximating interval, and
 associating each variable with its current approximating interval, and associating each variable with its current approximating linear form.
 associating each variable with its current approximating linear form.An interval abstract store is represented by a Box  with floating point boundaries, while a linear form abstract store is a map of the Standard Template Library. The linearize method requires both stores as its arguments. Please see the documentation of floating point expression classes for more information.
The linearization of a floating point expression  in the composite abstract store
 in the composite abstract store  will be denoted by
 will be denoted by  . There are two ways a linearization attempt can fail:
. There are two ways a linearization attempt can fail:
 or
 or  , and
, and .
.Three of the other abstract domains of the PPL ( BD_Shape , Octagonal_Shape , and Polyhedron ) provide a few optimized methods to be used in the analysis of floating point computations. They are recognized by the fact that they take interval linear forms and/or an interval abstract stores as their parameters.
Please see the methods' documentation for more information.
When adopting the double description method for the representation of convex polyhedra, the implementation of most of the operators may require an explicit conversion from one of the two representations into the other one, leading to algorithms having a worst-case exponential complexity. However, thanks to the adoption of lazy and incremental computation techniques, the library turns out to be rather efficient in many practical cases.
In earlier versions of the library, a number of operators were introduced in two flavors: a lazy version and an eager version, the latter having the operator name ending with _and_minimize. In principle, only the lazy versions should be used. The eager versions were added to help a knowledgeable user obtain better performance in particular cases. Basically, by invoking the eager version of an operator, the user is trading laziness to better exploit the incrementality of the inner library computations. Starting from version 0.5, the lazy and incremental computation techniques have been refined to achieve a better integration: as a consequence, the lazy versions of the operators are now almost always more efficient than the eager versions.
One of the cases when an eager computation might still make sense is when the well-known fail-first principle comes into play. For instance, if you have to compute the intersection of several polyhedra and you strongly suspect that the result will become empty after a few of these intersections, then you may obtain a better performance by calling the eager version of the intersection operator, since the minimization process also enforces an emptiness check. Note anyway that the same effect can be obtained by interleaving the calls of the lazy operator with explicit emptiness checks.
_and_minimize) of these operators is deprecated; this is in preparation of their complete removal, which will occur starting from version 0.11.For future versions of the PPL library all practical instantiations for the disjuncts for a pointset_powerset and component domains for the partially_reduced_product domains will be fully supported. However, for version 0.10, these compound domains should not themselves occur as one of their argument domains. Therefore their use comes with the following warning.
Pointset_Powerset<PSET> and Partially_Reduced_Product<D1, D2, R> should only be used with the following instantiations for the disjunct domain template PSET and component domain templates D1 and D2: C_Polyhedron, NNC_Polyhedron, Grid, Octagonal_Shape<T>, BD_Shape<T>, Box<T>.The PPL library is mainly a collection of so-called ``concrete data types'': while providing the user with a clean and friendly interface, these types are not meant to — i.e., they should not — be used polymorphically (since, e.g., most of the destructors are not declared virtual). In practice, this restriction means that the library types should not be used as public base classes to be derived from. A user willing to extend the library types, adding new functionalities, often can do so by using containment instead of inheritance; even when there is the need to override a protected method, non-public inheritance should suffice.
Most operators of the library depend on one or more parameters that are declared ``const'', meaning that they will not be changed by the application of the considered operator. Due to the adoption of lazy computation techniques, in many cases such a const-correctness guarantee only holds at the semantic level, whereas it does not necessarily hold at the implementation level. For a typical example, consider the extraction from a polyhedron of its constraint system representation. While this operation is not going to change the polyhedron, it might actually invoke the internal conversion algorithm and modify the generators representation of the polyhedron object, e.g., by reordering the generators and removing those that are detected as redundant. Thus, any previously computed reference to the generators of the polyhedron (be it a direct reference object or an indirect one, such as an iterator) will no longer be valid. For this reason, code fragments such as the following should be avoided, as they may result in undefined behavior:
 As a rule of thumb, if a polyhedron plays any role in a computation (even as a const parameter), then any previously computed reference to parts of the polyhedron may have been invalidated. Note that, in the example above, the computation of the constraint system could have been placed after the uses of the iterator i and the reference p. Anyway, if really needed, it is always possible to take a copy of, instead of a reference to, the parts of interest of the polyhedron; in the case above, one may have taken a copy of the generator system by replacing the second line of code with the following: 
The same observations, modulo syntactic sugar, apply to the operators defined in the C interface of the library.
C. Ancourt. Génération automatique de codes de transfert pour multiprocesseurs à mémoires locales. PhD thesis, Université de Paris VI, Paris, France, March 1991.
J. M. Bjorndalen and O. Anshus. Lessons learned in benchmarking - Floating point benchmarks: Can you trust them? In Proceedings of the Norsk informatikkonferanse 2005 (NIK 2005), pages 89-100, Bergen, Norway, 2005. Tapir Akademisk Forlag.
R. Bagnara. Data-Flow Analysis for Constraint Logic-Based Languages. PhD thesis, Dipartimento di Informatica, Università di Pisa, Pisa, Italy, March 1997. Printed as Report TD-1/97.
R. Bagnara. A hierarchy of constraint systems for data-flow analysis of constraint logic-based languages. Science of Computer Programming, 30(1-2):119-155, 1998.
B. Blanchet, P. Cousot, R. Cousot, J. Feret, L. Mauborgne, A. Miné, D. Monniaux, and X. Rival. Design and implementation of a special-purpose static program analyzer for safety-critical real-time embedded software. In T. Æ. Mogensen, D. A. Schmidt, and I. Hal Sudborough, editors, The Essence of Computation, Complexity, Analysis, Transformation. Essays Dedicated to Neil D. Jones [on occasion of his 60th birthday], volume 2566 of Lecture Notes in Computer Science, pages 85-108. Springer-Verlag, Berlin, 2002.
R. Bagnara, K. Dobson, P. M. Hill, M. Mundell, and E. Zaffanella. A linear domain for analyzing the distribution of numerical values. Report 2005.06, School of Computing, University of Leeds, UK, 2005.
R. Bagnara, K. Dobson, P. M. Hill, M. Mundell, and E. Zaffanella. A practical tool for analyzing the distribution of numerical values, 2006. Available at http://www.comp.leeds.ac.uk/hill/Papers/papers.html.
R. Bagnara, K. Dobson, P. M. Hill, M. Mundell, and E. Zaffanella. Grids: A domain for analyzing the distribution of numerical values. In G. Puebla, editor, Logic-based Program Synthesis and Transformation, 16th International Symposium, volume 4407 of Lecture Notes in Computer Science, pages 219-235, Venice, Italy, 2007. Springer-Verlag, Berlin.
M. Benerecetti, M. Faella, and S. Minopoli. Towards efficient exact synthesis for linear hybrid systems. In Proceedings of 2nd International Symposium on Games, Automata, Logics and Formal Verification (GandALF 2011), volume 54 of Electronic Proceedings in Theoretical Computer Science, pages 263-277, Minori, Amalfi Coast, Italy, 2011.
M. Benerecetti, M. Faella, and S. Minopoli. Automatic synthesis of switching controllers for linear hybrid systems: Safety control. Theoretical Computer Science, 493:116-138, 2013.
A. Bemporad, K. Fukuda, and F. D. Torrisi. Convexity recognition of the union of polyhedra. Report AUT00-13, Automatic Control Laboratory, ETHZ, Zurich, Switzerland, 2000.
A. Bemporad, K. Fukuda, and F. D. Torrisi. Convexity recognition of the union of polyhedra. Computational Geometry: Theory and Applications, 18(3):141-154, 2001.
T. Bultan, R. Gerber, and W. Pugh. Model-checking concurrent systems with unbounded integer variables: Symbolic representations, approximations, and experimental results. ACM Transactions on Programming Languages and Systems, 21(4):747-789, 1999.
R. Bagnara, P. M. Hill, E. Mazzi, and E. Zaffanella. Widening operators for weakly-relational numeric abstractions. Report arXiv:cs.PL/0412043, 2004. Extended abstract. Contribution to the International workshop on “Numerical & Symbolic Abstract Domains” (NSAD'05, Paris, January 21, 2005). Available at http://arxiv.org/ and http://bugseng.com/products/ppl/.
R. Bagnara, P. M. Hill, E. Mazzi, and E. Zaffanella. Widening operators for weakly-relational numeric abstractions. Quaderno 399, Dipartimento di Matematica, Università di Parma, Italy, 2005. Available at http://www.cs.unipr.it/Publications/.
R. Bagnara, P. M. Hill, E. Mazzi, and E. Zaffanella. Widening operators for weakly-relational numeric abstractions. In C. Hankin and I. Siveroni, editors, Static Analysis: Proceedings of the 12th International Symposium, volume 3672 of Lecture Notes in Computer Science, pages 3-18, London, UK, 2005. Springer-Verlag, Berlin.
R. Bagnara, P. M. Hill, E. Ricci, and E. Zaffanella. Precise widening operators for convex polyhedra. In R. Cousot, editor, Static Analysis: Proceedings of the 10th International Symposium, volume 2694 of Lecture Notes in Computer Science, pages 337-354, San Diego, California, USA, 2003. Springer-Verlag, Berlin.
R. Bagnara, P. M. Hill, E. Ricci, and E. Zaffanella. Precise widening operators for convex polyhedra. Quaderno 312, Dipartimento di Matematica, Università di Parma, Italy, 2003. Available at http://www.cs.unipr.it/Publications/.
R. Bagnara, P. M. Hill, E. Ricci, and E. Zaffanella. Precise widening operators for convex polyhedra. Science of Computer Programming, 58(1-2):28-56, 2005.
R. Bagnara, P. M. Hill, and E. Zaffanella. A new encoding and implementation of not necessarily closed convex polyhedra. Quaderno 305, Dipartimento di Matematica, Università di Parma, Italy, 2002. Available at http://www.cs.unipr.it/Publications/.
R. Bagnara, P. M. Hill, and E. Zaffanella. A new encoding of not necessarily closed convex polyhedra. In M. Carro, C. Vacheret, and K.-K. Lau, editors, Proceedings of the 1st CoLogNet Workshop on Component-based Software Development and Implementation Technology for Computational Logic Systems, pages 147-153, Madrid, Spain, 2002. Published as TR Number CLIP4/02.0, Universidad Politécnica de Madrid, Facultad de Informática.
R. Bagnara, P. M. Hill, and E. Zaffanella. A new encoding and implementation of not necessarily closed convex polyhedra. In M. Leuschel, S. Gruner, and S. Lo Presti, editors, Proceedings of the 3rd Workshop on Automated Verification of Critical Systems, pages 161-176, Southampton, UK, 2003. Published as TR Number DSSE-TR-2003-2, University of Southampton.
R. Bagnara, P. M. Hill, and E. Zaffanella. Widening operators for powerset domains. In B. Steffen and G. Levi, editors, Verification, Model Checking and Abstract Interpretation: Proceedings of the 5th International Conference (VMCAI 2004), volume 2937 of Lecture Notes in Computer Science, pages 135-148, Venice, Italy, 2003. Springer-Verlag, Berlin.
R. Bagnara, P. M. Hill, and E. Zaffanella. Widening operators for powerset domains. Quaderno 349, Dipartimento di Matematica, Università di Parma, Italy, 2004. Available at http://www.cs.unipr.it/Publications/.
R. Bagnara, P. M. Hill, and E. Zaffanella. Not necessarily closed convex polyhedra and the double description method. Formal Aspects of Computing, 17(2):222-257, 2005.
R. Bagnara, P. M. Hill, and E. Zaffanella. The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems. Quaderno 457, Dipartimento di Matematica, Università di Parma, Italy, 2006. Available at http://www.cs.unipr.it/Publications/. Also published as arXiv:cs.MS/0612085, available from http://arxiv.org/.
R. Bagnara, P. M. Hill, and E. Zaffanella. Widening operators for powerset domains. Software Tools for Technology Transfer, 8(4/5):449-466, 2006. In the printed version of this article, all the figures have been improperly printed (rendering them useless). See [BHZ07c].
R. Bagnara, P. M. Hill, and E. Zaffanella. Applications of polyhedral computations to the analysis and verification of hardware and software systems. Quaderno 458, Dipartimento di Matematica, Università di Parma, Italy, 2007. Available at http://www.cs.unipr.it/Publications/. Also published as arXiv:cs.CG/0701122, available from http://arxiv.org/.
R. Bagnara, P. M. Hill, and E. Zaffanella. An improved tight closure algorithm for integer octagonal constraints. Quaderno 467, Dipartimento di Matematica, Università di Parma, Italy, 2007. Available at http://www.cs.unipr.it/Publications/. Also published as arXiv:0705.4618v2 [cs.DS], available from http://arxiv.org/.
R. Bagnara, P. M. Hill, and E. Zaffanella. Widening operators for powerset domains. Software Tools for Technology Transfer, 9(3/4):413-414, 2007. Erratum to [BHZ06b] containing all the figures properly printed.
R. Bagnara, P. M. Hill, and E. Zaffanella. An improved tight closure algorithm for integer octagonal constraints. In F. Logozzo, D. Peled, and L. Zuck, editors, Verification, Model Checking and Abstract Interpretation: Proceedings of the 9th International Conference (VMCAI 2008), volume 4905 of Lecture Notes in Computer Science, pages 8-21, San Francisco, USA, 2008. Springer-Verlag, Berlin.
R. Bagnara, P. M. Hill, and E. Zaffanella. The Parma Polyhedra Library: Toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems. Science of Computer Programming, 72(1-2):3-21, 2008.
R. Bagnara, P. M. Hill, and E. Zaffanella. Applications of polyhedral computations to the analysis and verification of hardware and software systems. Theoretical Computer Science, 410(46):4672-4691, 2009.
R. Bagnara, P. M. Hill, and E. Zaffanella. Exact join detection for convex polyhedra and other numerical abstractions. Quaderno 492, Dipartimento di Matematica, Università di Parma, Italy, 2009. Available at http://www.cs.unipr.it/Publications/. A corrected and improved version (corrected an error in the statement of condition (3) of Theorem 3.6, typos corrected in statement and proof of Theorem 6.8) has been published in [BHZ09c].
R. Bagnara, P. M. Hill, and E. Zaffanella. Exact join detection for convex polyhedra and other numerical abstractions. Report arXiv:cs.CG/0904.1783, 2009. Available at http://arxiv.org/ and http://bugseng.com/products/ppl/.
R. Bagnara, P. M. Hill, and E. Zaffanella. Weakly-relational shapes for numeric abstractions: Improved algorithms and proofs of correctness. Formal Methods in System Design, 35(3):279-323, 2009.
R. Bagnara, P. M. Hill, and E. Zaffanella. Exact join detection for convex polyhedra and other numerical abstractions. Computational Geometry: Theory and Applications, 43(5):453-473, 2010.
F. Besson, T. P. Jensen, and J.-P. Talpin. Polyhedral analysis for synchronous languages. In A. Cortesi and G. Filé, editors, Static Analysis: Proceedings of the 6th International Symposium, volume 1694 of Lecture Notes in Computer Science, pages 51-68, Venice, Italy, 1999. Springer-Verlag, Berlin.
V. Balasundaram and K. Kennedy. A technique for summarizing data access and its use in parallelism enhancing transformations. In B. Knobe, editor, Proceedings of the ACM SIGPLAN'89 Conference on Programming Language Design and Implementation (PLDI), volume 24(7) of ACM SIGPLAN Notices, pages 41-53, Portland, Oregon, USA, 1989. ACM Press.
R. Bagnara, F. Mesnard, A. Pescetti, and E. Zaffanella. The automatic synthesis of linear ranking functions: The complete unabridged version. Quaderno 498, Dipartimento di Matematica, Università di Parma, Italy, 2010. Superseded by [BMPZ12a].
R. Bagnara, F. Mesnard, A. Pescetti, and E. Zaffanella. The automatic synthesis of linear ranking functions: The complete unabridged version. Report arXiv:cs.PL/1004.0944v2, 2012. Available at http://arxiv.org/ and http://bugseng.com/products/ppl/. Improved version of [BMPZ10].
R. Bagnara, F. Mesnard, A. Pescetti, and E. Zaffanella. A new look at the automatic synthesis of linear ranking functions. Information and Computation, 215:47-67, 2012.
R. Bagnara, E. Ricci, E. Zaffanella, and P. M. Hill. Possibly not closed convex polyhedra and the Parma Polyhedra Library. In M. V. Hermenegildo and G. Puebla, editors, Static Analysis: Proceedings of the 9th International Symposium, volume 2477 of Lecture Notes in Computer Science, pages 213-229, Madrid, Spain, 2002. Springer-Verlag, Berlin.
R. Bagnara, E. Ricci, E. Zaffanella, and P. M. Hill. Possibly not closed convex polyhedra and the Parma Polyhedra Library. Quaderno 286, Dipartimento di Matematica, Università di Parma, Italy, 2002. See also [BRZH02c]. Available at http://www.cs.unipr.it/Publications/.
R. Bagnara, E. Ricci, E. Zaffanella, and P. M. Hill. Errata for technical report “Quaderno 286”. Available at http://www.cs.unipr.it/Publications/, 2002. See [BRZH02b].
P. Cousot and R. Cousot. Static determination of dynamic properties of programs. In B. Robinet, editor, Proceedings of the Second International Symposium on Programming, pages 106-130, Paris, France, 1976. Dunod, Paris, France.
P. Cousot and R. Cousot. Systematic design of program analysis frameworks. In Proceedings of the Sixth Annual ACM Symposium on Principles of Programming Languages, pages 269-282, San Antonio, TX, USA, 1979. ACM Press.
P. Cousot and R. Cousot. Comparing the Galois connection and widening/narrowing approaches to abstract interpretation. In M. Bruynooghe and M. Wirsing, editors, Proceedings of the 4th International Symposium on Programming Language Implementation and Logic Programming, volume 631 of Lecture Notes in Computer Science, pages 269-295, Leuven, Belgium, 1992. Springer-Verlag, Berlin.
P. Cousot and N. Halbwachs. Automatic discovery of linear restraints among variables of a program. In Conference Record of the Fifth Annual ACM Symposium on Principles of Programming Languages, pages 84-96, Tucson, Arizona, 1978. ACM Press.
N. V. Chernikova. Algorithm for finding a general formula for the non-negative solutions of system of linear equations. U.S.S.R. Computational Mathematics and Mathematical Physics, 4(4):151-158, 1964.
N. V. Chernikova. Algorithm for finding a general formula for the non-negative solutions of system of linear inequalities. U.S.S.R. Computational Mathematics and Mathematical Physics, 5(2):228-233, 1965.
N. V. Chernikova. Algorithm for discovering the set of all solutions of a linear programming problem. U.S.S.R. Computational Mathematics and Mathematical Physics, 8(6):282-293, 1968.
G. B. Dantzig. Linear Programming and Extensions. Princeton University Press, Princeton, NJ, 1963.
P. Feautrier, J.-F. Collard, and C. Bastoul. PIP/PipLib: A Solver for Parametric Integer Programming Problems, 5.0 edition, July 2007. Distributed with PIP/PipLib 1.4.0.
P. Feautrier. Parametric integer programming. RAIRO Recherche Opérationnelle, 22(3):243-268, 1988.
K. Fukuda and A. Prodon. Double description method revisited. In M. Deza, R. Euler, and Y. Manoussakis, editors, Combinatorics and Computer Science, 8th Franco-Japanese and 4th Franco-Chinese Conference, Brest, France, July 3-5, 1995, Selected Papers, volume 1120 of Lecture Notes in Computer Science, pages 91-111. Springer-Verlag, Berlin, 1996.
K. Fukuda. Polyhedral computation FAQ. Swiss Federal Institute of Technology, Lausanne and Zurich, Switzerland, available at http://www.ifor.math.ethz.ch/~fukuda/polyfaq/polyfaq.html, 1998.
D. Gopan, F. DiMaio, N. Dor, T. W. Reps, and M. Sagiv. Numeric domains with summarized dimensions. In K. Jensen and A. Podelski, editors, Tools and Algorithms for the Construction and Analysis of Systems, 10th International Conference, TACAS 2004, volume 2988 of Lecture Notes in Computer Science, pages 512-529, Barcelona, Spain, 2004. Springer-Verlag, Berlin.
E. Gawrilow and M. Joswig. polymake: A framework for analyzing convex polytopes. In G. Kalai and G. M. Ziegler, editors, Polytopes - Combinatorics and Computation, pages 43-74. Birkhäuser, 2000.
E. Gawrilow and M. Joswig. polymake: An approach to modular software design in computational geometry. In Proceedings of the 17th Annual Symposium on Computational Geometry, pages 222-231, Medford, MA, USA, 2001. ACM.
D. Goldfarb and J. K. Reid. A practical steepest-edge simplex algorithm. Mathematical Proramming, 12(1):361-371, 1977.
P. Granger. Static analysis of linear congruence equalities among variables of a program. In S. Abramsky and T. S. E. Maibaum, editors, TAPSOFT'91: Proceedings of the International Joint Conference on Theory and Practice of Software Development, Volume 1: Colloquium on Trees in Algebra and Programming (CAAP'91), volume 493 of Lecture Notes in Computer Science, pages 169-192, Brighton, UK, 1991. Springer-Verlag, Berlin.
P. Granger. Static analyses of congruence properties on rational numbers (extended abstract). In P. Van Hentenryck, editor, Static Analysis: Proceedings of the 4th International Symposium, volume 1302 of Lecture Notes in Computer Science, pages 278-292, Paris, France, 1997. Springer-Verlag, Berlin.
N. Halbwachs. Détermination Automatique de Relations Linéaires Vérifiées par les Variables d'un Programme. Thèse de 3ème cycle d'informatique, Université scientifique et médicale de Grenoble, Grenoble, France, March 1979.
N. Halbwachs. Delay analysis in synchronous programs. In C. Courcoubetis, editor, Computer Aided Verification: Proceedings of the 5th International Conference (CAV'93), volume 697 of Lecture Notes in Computer Science, pages 333-346, Elounda, Greece, 1993. Springer-Verlag, Berlin.
T. A. Henzinger and P.-H. Ho. A note on abstract interpretation strategies for hybrid automata. In P. J. Antsaklis, W. Kohn, A. Nerode, and S. Sastry, editors, Hybrid Systems II, volume 999 of Lecture Notes in Computer Science, pages 252-264. Springer-Verlag, Berlin, 1995.
L. Huelsbergen, D. Hahn, and J. Larus. Exact dependence analysis using data access descriptors. Technical Report 945, Department of Computer Science, University of Wisconsin, Madison, 1990.
N. Halbwachs, A. Kerbrat, and Y.-E. Proy. POLyhedra INtegrated Environment. Verimag, France, version 1.0 of POLINE edition, September 1995. Documentation taken from source code.
V. Van Dongen H. Le Verge and D. K. Wilde. Loop nest synthesis using the polyhedral library. Publication interne 830, IRISA, Campus de Beaulieu, Rennes, France, 1994.
L. Henkin, J. D. Monk, and A. Tarski. Cylindric Algebras: Part I. North-Holland, Amsterdam, 1971.
N. Halbwachs, Y.-E. Proy, and P. Raymond. Verification of linear hybrid systems by means of convex approximations. In B. Le Charlier, editor, Static Analysis: Proceedings of the 1st International Symposium, volume 864 of Lecture Notes in Computer Science, pages 223-237, Namur, Belgium, 1994. Springer-Verlag, Berlin.
N. Halbwachs, Y.-E. Proy, and P. Roumanoff. Verification of real-time systems using linear relation analysis. Formal Methods in System Design, 11(2):157-185, 1997.
T. A. Henzinger, J. Preussig, and H. Wong-Toi. Some lessons from the hytech experience. In Proceedings of the 40th Annual Conference on Decision and Control, pages 2887-2892. IEEE Computer Society Press, 2001.
B. Jeannet. Convex Polyhedra Library, release 1.1.3c edition, March 2002. Documentation of the “New Polka” library.
J. Jaffar, M. J. Maher, P. J. Stuckey, and R. H. C. Yap. Beyond finite domains. In A. Borning, editor, Principles and Practice of Constraint Programming: Proceedings of the Second International Workshop, volume 874 of Lecture Notes in Computer Science, pages 86-94, Rosario, Orcas Island, Washington, USA, 1994. Springer-Verlag, Berlin.
L. Khachiyan, E. Boros, K. Borys, K. Elbassioni, and V. Gurvich. Generating all vertices of a polyhedron is hard. Discrete and Computational Geometry, 2006. Invited contribution.
H. W. Kuhn. Solvability and consistency for linear equations and inequalities. American Mathematical Monthly, 63:217-232, 1956.
92 H. Le Verge. A note on Chernikova's algorithm. Publication interne 635, IRISA, Campus de Beaulieu, Rennes, France, 1992.
V. Loechner. PolyLib: A library for manipulating parameterized polyhedra. Available at http://icps.u-strasbg.fr/~loechner/polylib/, March 1999. Declares itself to be a continuation of [Wil93].
V. Loechner and D. K. Wilde. Parameterized polyhedra and their vertices. International Journal of Parallel Programming, 25(6):525-549, 1997.
F. Masdupuy. Array operations abstraction using semantic analysis of trapezoid congruences. In Proceedings of the 6th ACM International Conference on Supercomputing, pages 226-235, Washington, DC, USA, 1992. ACM Press.
F. Masdupuy. Array Indices Relational Semantic Analysis Using Rational Cosets and Trapezoids. Thèse d'informatique, École Polytechnique, Palaiseau, France, December 1993.
A. Miné. A new numerical abstract domain based on difference-bound matrices. In O. Danvy and A. Filinski, editors, Proceedings of the 2nd Symposium on Programs as Data Objects (PADO 2001), volume 2053 of Lecture Notes in Computer Science, pages 155-172, Aarhus, Denmark, 2001. Springer-Verlag, Berlin.
A. Miné. The octagon abstract domain. In Proceedings of the Eighth Working Conference on Reverse Engineering (WCRE'01), pages 310-319, Stuttgart, Germany, 2001. IEEE Computer Society Press.
A. Miné. A few graph-based relational numerical abstract domains. In M. V. Hermenegildo and G. Puebla, editors, Static Analysis: Proceedings of the 9th International Symposium, volume 2477 of Lecture Notes in Computer Science, pages 117-132, Madrid, Spain, 2002. Springer-Verlag, Berlin.
A. Miné. Relational abstract domains for the detection of floating-point run-time errors. In D. Schmidt, editor, Programming Languages and Systems: Proceedings of the 13th European Symposium on Programming, volume 2986 of Lecture Notes in Computer Science, pages 3-17, Barcelona, Spain, 2004. Springer-Verlag, Berlin.
A. Miné. Weakly Relational Numerical Abstract Domains. PhD thesis, École Polytechnique, Paris, France, March 2005.
T. S. Motzkin, H. Raiffa, G. L. Thompson, and R. M. Thrall. The double description method. In H. W. Kuhn and A. W. Tucker, editors, Contributions to the Theory of Games - Volume II, number 28 in Annals of Mathematics Studies, pages 51-73. Princeton University Press, Princeton, New Jersey, 1953.
T. Nakanishi and A. Fukuda. Modulo interval arithmetic and its application to program analysis. Transactions of Information Processing Society of Japan, 42(4):829-837, 2001.
T. Nakanishi, K. Joe, C. D. Polychronopoulos, and A. Fukuda. The modulo interval: A simple and practical representation for program analysis. In Proceedings of the 1999 International Conference on Parallel Architectures and Compilation Techniques, pages 91-96, Newport Beach, California, USA, 1999. IEEE Computer Society.
G. Nelson and D. C. Oppen. Fast decision algorithms based on Union and Find. In Proceedings of the 18th Annual Symposium on Foundations of Computer Science (FOCS'77), pages 114-119, Providence, RI, USA, 1977. IEEE Computer Society Press. The journal version of this paper is [NO80].
G. Nelson and D. C. Oppen. Fast decision procedures based on congruence closure. Journal of the ACM, 27(2):356-364, 1980. An earlier version of this paper is [NO77].
S. P. K. Nookala and T. Risset. A library for Z-polyhedral operations. Publication interne 1330, IRISA, Campus de Beaulieu, Rennes, France, 2000.
G. L. Nemhauser and L. A. Wolsey. Integer and Combinatorial Optimization. Wiley Interscience Series in Discrete Mathematics and Optimization. John Wiley & Sons, 1988.
V. R. Pratt. Two easy theories whose combination is hard. Memo sent to Nelson and Oppen concerning a preprint of their paper [NO77], September 1977.
C. H. Papadimitriou and K. Steiglitz. Combinatorial Optimization: Algorithms and Complexity. Dover Publications, second edition, 1998.
P. Quinton, S. Rajopadhye, and T. Risset. On manipulating Z-polyhedra. Technical Report 1016, IRISA, Campus Universitaire de Bealieu, Rennes, France, July 1996.
P. Quinton, S. Rajopadhye, and T. Risset. On manipulating Z-polyhedra using a canonic representation. Parallel Processing Letters, 7(2):181-194, 1997.
F. Quilleré, S. V. Rajopadhye, and D. Wilde. Generation of efficient nested loops from polyhedra. International Journal of Parallel Programming, 28(5):469-498, 2000.
T. W. Reps, G. Balakrishnan, and J. Lim. Intermediate-representation recovery from low-level code. In J. Hatcliff and F. Tip, editors, Proceedings of the 2006 ACM SIGPLAN Workshop on Partial Evaluation and Semantics-based Program Manipulation, pages 100-111, Charleston, South Carolina, USA, 2006. ACM Press.
E. Ricci. Rappresentazione e manipolazione di poliedri convessi per l'analisi e la verifica di programmi. Laurea dissertation, University of Parma, Parma, Italy, July 2002. In Italian.
A. Schrijver. Theory of Linear and Integer Programming. Wiley Interscience Series in Discrete Mathematics and Optimization. John Wiley & Sons, 1999.
R. E. Shostak. Deciding linear inequalities by computing loop residues. Journal of the ACM, 28(4):769-779, 1981.
A. Simon and A. King. Taming the wrapping of integer arithmetic. In H. Riis Nielson and G. Filé, editors, Static Analysis: Proceedings of the 14th International Symposium, volume 4634 of Lecture Notes in Computer Science, pages 121-136, Kongens Lyngby, Denmark, 2007. Springer-Verlag, Berlin.
D. Srivastava. Subsumption and indexing in constraint query languages with linear arithmetic constraints. Annals of Mathematics and Artificial Intelligence, 8(3-4):315-343, 1993.
R. Sen and Y. N. Srikant. Executable analysis using abstract interpretation with circular linear progressions. In Proceedings of the 5th IEEE/ACM International Conference on Formal Methods and Models for Co-Design (MEMOCODE 2007), pages 39-48, Nice, France, 2007. IEEE Computer Society Press.
R. Sen and Y. N. Srikant. Executable analysis with circular linear progressions. Technical Report IISc-CSA-TR-2007-3, Department of Computer Science and Automation, Indian Institute of Science, Bangalore, India, 2007.
J. Stoer and C. Witzgall. Convexity and Optimization in Finite Dimensions I. Springer-Verlag, Berlin, 1970.
H. S. Warren, Jr. Hacker's Delight. Addison-Wesley Longman Publishing Co., Inc., Boston, MA, USA, 2003.
H. Weyl. Elementare theorie der konvexen polyeder. Commentarii Mathematici Helvetici, 7:290-306, 1935. English translation in [Wey50].
H. Weyl. The elementary theory of convex polyhedra. In H. W. Kuhn, editor, Contributions to the Theory of Games - Volume I, number 24 in Annals of Mathematics Studies, pages 3-18. Princeton University Press, Princeton, New Jersey, 1950. Translated from [Wey35] by H. W. Kuhn.
D. K. Wilde. A library for doing polyhedral operations. Master's thesis, Oregon State University, Corvallis, Oregon, December 1993. Also published as IRISA Publication interne 785, Rennes, France, 1993.