10. In a computer system, a method of modeling behavior of a computer program: generating a Boolean abstraction of the computer program, wherein the generating comprises deriving an initial plurality of predicates; wherein a predicate is derived from at least one of a conditional statement, an assertion, or a run-time safety check of the computer program; performing a state reachability analysis of the computer program, wherein performing the state reachability analysis comprises defining an upper bound for a set of reachable observable states in the computer program wherein the reachable observable states comprise an evaluation of a state of the predicate at a statement in the computer program; defining a lower bound for the set of reachable observable states in the computer program; using the upper bound and the lower bound to form a static coverage metric of the computer program, which measures an amount of test coverage; forming a behavior model of the computer program using the upper and lower bound, wherein forming the behavior model comprises outputting a set of oaths that covers states in the lower bound for the set of reachable observable states in the computer program; performing symbolic execution, wherein the symbolic execution determines whether the paths are feasible and generates inputs for the computer program to cover a path out of the paths when the path is feasible and comprises performing test generation of reachable states based at least in part on the behavior model wherein a percentage of reachable observable states are covered by a generated test; and adding new predicates to the initial plurality of predicates to increase percentage of reachable observable states covered by a generated test.
10. In a computer system, a method of modeling behavior of a computer program: generating a Boolean abstraction of the computer program, wherein the generating comprises deriving an initial plurality of predicates; wherein a predicate is derived from at least one of a conditional statement, an assertion, or a run-time safety check of the computer program; performing a state reachability analysis of the computer program, wherein performing the state reachability analysis comprises defining an upper bound for a set of reachable observable states in the computer program wherein the reachable observable states comprise an evaluation of a state of the predicate at a statement in the computer program; defining a lower bound for the set of reachable observable states in the computer program; using the upper bound and the lower bound to form a static coverage metric of the computer program, which measures an amount of test coverage; forming a behavior model of the computer program using the upper and lower bound, wherein forming the behavior model comprises outputting a set of oaths that covers states in the lower bound for the set of reachable observable states in the computer program; performing symbolic execution, wherein the symbolic execution determines whether the paths are feasible and generates inputs for the computer program to cover a path out of the paths when the path is feasible and comprises performing test generation of reachable states based at least in part on the behavior model wherein a percentage of reachable observable states are covered by a generated test; and adding new predicates to the initial plurality of predicates to increase percentage of reachable observable states covered by a generated test. 19. The method of claim 10 wherein performing test generation comprises: 1) generating paths to cover the lower bound for the set of reachable observable states in the computer program; 2) symbolically executing the generated paths to generate test data to cover the paths; and 3) running the computer program against the generated test data.