Skip to content
SPECIFICTION
Get listed

CBMC

diffblue.github.io

Free plan WindowsmacOSLinuxSelf-hosted
Visit diffblue.github.io
Spec score 8.1 #8 of 34 in Formal Verification Tools

What it is

CBMC is a bounded model checker for C and C++ programs. It explores execution paths to check assertions, including array bounds, pointer safety, exceptions, and some undefined behavior such as signed integer overflow. Its analysis unwinds loops before sending the resulting equation to a decision procedure, and inputs may need a bounded size. The repository lists C89, C99, most of C11, C17, C23, GCC and Visual Studio extensions, and SystemC through Scoot; the listed input languages also include Java bytecode. CBMC supports contracts and can produce counterexamples. Its incremental SMT2 backend works with SMT-LIB 2.6-compliant solvers, with Z3 and CVC5 as examples. Distribution options include Homebrew instructions for macOS, Ubuntu DEB packages, Windows MSI installers, and Docker images. goto-cc can replace gcc or cl.exe in Makefiles to collect project models. The guide discusses routine development and continuous integration use. CBMC is free under the 4-clause BSD license.

Spec sheet

Purpose
CBMC is a bounded model checker for C and C++ programs that explores possible execution paths and checks assertions.Read 4 Oct 2026 · diffblue.github.io
Platforms
The installation guide points to installation instructions for macOS, Ubuntu, Windows, and Docker.Read 4 Oct 2026 · diffblue.github.io
Support
The repository asks users encountering problems to file a bug report as a GitHub issue.Read 4 Oct 2026 · github.com
License
The repository identifies CBMC as licensed under the 4-clause BSD license.Read 4 Oct 2026 · github.com
Bounded analysis
CBMC may require restricting inputs to a bounded size, and its verification unwinds loops before passing the resulting equation to a decision procedure.Read 4 Oct 2026 · diffblue.github.io
Build integration
goto-cc can replace gcc or cl.exe in Makefiles to collect project models for verification.Read 4 Oct 2026 · diffblue.github.io
Continuous integration
The user guide describes using CBMC as part of routine software development and continuous integration.Read 4 Oct 2026 · diffblue.github.io
Distribution
The release page provides macOS Homebrew instructions, Ubuntu DEB packages, Windows MSI installers, and Docker container images.Read 4 Oct 2026 · github.com
Language support
The repository states support for C89, C99, most of C11, C17, C23, many GCC and Visual Studio extensions, and SystemC using Scoot.Read 4 Oct 2026 · github.com
Related tools
The user guide names CBMC Viewer and CBMC Starter Kit as third-party tools for summarizing findings and adding verification to a project.Read 4 Oct 2026 · diffblue.github.io
Release guidance
The repository says released versions are tested and intended for production use, while develop versions are not recommended for production use.Read 4 Oct 2026 · github.com
Safety checks
It can check array bounds, pointer safety, exceptions, user-specified assertions, and some undefined behavior such as signed integer overflow.Read 4 Oct 2026 · github.com
Solver support
CBMC supports an incremental SMT2 backend that can use an SMT-LIB 2.6 compliant solver, with examples for Z3 and CVC5.Read 4 Oct 2026 · diffblue.github.io

Plans and prices

CBMC Free 4-clause BSD licensed open-source software Read 4 Oct 2026 · github.com

Every CBMC plan and price →

Strong points and limits

Strong points

  • Checks bounds, pointer safety, exceptions, and assertions
  • Supports contracts and counterexamples
  • Works with several SMT-LIB 2.6-compliant solvers
  • Provides macOS, Ubuntu, Windows, and Docker distribution options

Limits

  • Inputs may need to be bounded
  • Loop analysis unwinds loops before solving
  • Develop versions are not recommended for production

Who it suits

CBMC suits developers verifying C or C++ programs, including teams incorporating checks into continuous integration. It may also fit projects using its listed input languages, contracts, or supported solver backend.

Verdict

CBMC provides bounded checking for a broad set of C-family use cases, with counterexamples and solver options. Its loop unwinding and possible input bounds are important constraints to account for.

Where Specifiction places it

Alternatives to CBMCAll alternatives →