Bounded model checking (BMC)

Bounded model checking is the pragmatic compromise of formal verification: instead of asking 'can this property EVER fail in any of infinitely many cycles?', it asks 'can it fail within the next k cycles?' for some fixed depth k. The tool unrolls the design's logic k times in a row — like laying out k photocopies of the circuit end to end — turns the whole thing into one enormous Boolean formula, and hands it to a SAT solver. If the solver finds a satisfying assignment, that *is* your bug, complete with the exact input sequence; if not, the property is safe at least up to depth k.

BMC is brilliant at finding bugs quickly and shallowly — most real design bugs reveal themselves within a few dozen cycles, and BMC will produce the shortest possible counterexample. Its limitation is that 'no bug within k cycles' is not a full proof; a deeper bug at cycle k+1 could still lurk. To upgrade BMC into a complete proof, engineers add *k-induction* (showing that if the property holds for k consecutive cycles it must hold for the next), or push k until they reach the design's diameter — the longest shortest-path through its state space — beyond which no new states exist.