Efficient control state-space search

We develop algorithms for exploring the reachable state-space of hardware designs that can be partitioned into control and data. The core procedure is a symbolic algorithm that tries to visit as many controller states as is computationally feasible. Here, we describe heuristics for making this traversal efficient. Experiments demonstrate that our approach is capable of achieving significantly greater coverage of the control state-space than conventional symbolic reachability analysis.