1. A method comprising: generating a model of a software program in which, at each cycle of the model, a program counter and at most one non-program-counter variable change value; and symbolic model checking of said model using disjunctive partitioning at least for each said variable.