Scaling Bounded Model Checking by Transforming Programs with Arrays

Model checkers often face a state space explosion while verifying properties in programs with loops iterating over arrays. We present an abstraction which helps BMCs scale up and verify properties on arrays. Our technique transforms an array-manipulating C program to an array-free and loop-free program. The transformed program can then be verified by any bounded model checker without running into a state space explosion. Our technique is effective for programs with loops iterating over arrays by incrementing (or decrementing) the loop iteration variables, and accessing arrays by expressions whose values match the value of the loop iteration variable. Our technique can verify array invariants defined in terms of a single element of the array. It is sound in all cases including those that use other values because the values are over-approximated.