Property Checking Array Programs Using Loop Shrinking

Abstract

Abstract. Most verification tools find it difficult to prove properties of programs containing loops that process arrays of large or unknown size. These methods either fail to abstract the array at the right granularity and are therefore limited in precision or scalability, or they attempt to synthesize an appropriate invariant that is quantified over the elements of the array, a task known to be difficult. In this paper, we present a different approach based on a notion called loop shrinkability, in which an array processing loop is transformed to a loop of much smaller bound that processes only a few non-deterministically chosen elements of the array. The result is a finite state program with a drastically reduced state space that can be analyzed by bounded model checkers. We show that the proposed transformation is an over-approximation, i.e. if the transformed program is correct, so is the original. In addition, when applicable, the method is impervious to the size or existence of the bound of the array. As an assessment of usefulness, we tested a tool based on our method on the ArraysReach category of SV-COMP 2017 benchmarks. After excluding programs with feature not handled by our tool, we could successfully verify 87 of the 93 remaining programs.

Putting the Squeeze on Array Programs: Loop Verification via Inductive Rank Reduction

“…Similar reductions were applied to array programs-a particular form of parameterized systems but with unbounded data-as we consider in this work. For example, in [33], shrinkable loops are identified as loops that traverse large or unbounded arrays but may be soundly replaced by a bounded number of nondeterministically chosen iterations; and in [37], abstraction is used to replace reasoning about unbounded arrays and quantified properties by reasoning about a bounded number of array cells.…”

Quantified Invariants via Syntax-Guided Synthesis

“…There are also techniques that abstract an array to a fixed number of elements, e.g. k-distinguished cell abstraction [32,33] and k-shrinkability [24,29]. Such abstractions usually reduce array modifying loops with unknown bounds to a known, small bound.…”

SynRG: Syntax Guided Synthesis of Expressions with Alternating Quantifiers

“…Our motivating examples are based on synthesizing invariants for arrays. However, there are methods for verifying array programs without using loop invariants: Abstraction of the array to a fixed number of elements is used to reduce array modifying loops with unknown bounds to loops with a known, small bound [16,22,25]. An imprecise approach involves abstracting the array so that all array elements appear in a single memory location [4].…”