Putting static analysis to work for verification
Tal Lev-Ami, Thomas Reps, Mooly Sagiv, Reinhard Wilhelm · 2000
A method for finding bugs in code is presented. For given small numbers j and k, the code of a procedure is translated into a rela-tional formula whose models represent all execution traces that involve at most j heap cells and k loop iterations. This formula is conjoined with the negation of the procedure's specification. The models of the resulting formula, obtained using a constraint solver, are counterexamples: executions of the code that violate the specification.