Alloy Analyzer vs Why3

Alloy Analyzer is a free model-checking tool for describing systems in the Alloy language and exploring the structures those descriptions permit. It searches for structures that satisfy constraints and for counterexamples to properties. Models can represent collections of structures that change over time, including security configurations and switching network topologies. The Analyzer presents results graphically, with appearance options that can be tailored to a domain. Alloy 6 adds mutable state, temporal logic, and temporal model checking; that checking requires NuSMV or nuXmv to be installed and available in PATH. The self-contained executable includes the Pardinus/Kodkod model finder, SAT solvers, the standard Alloy library, tutorial examples, and source code. The same JAR can be used as an API in other applications. Sterling adds a web-based visualizer with graph and table views, customizable and extendable with JavaScript. Alloy is self-hosted, supports Linux, macOS, Windows, and API use, and is maintained by volunteers.

Why3 is a platform for deductive program verification. It uses WhyML to express programs and specifications, then works with external automated or interactive theorem provers to discharge verification conditions. WhyML supports preconditions, postconditions, assertions, and loop invariants, alongside logical theories and data structures such as arrays, queues, and hash tables. External provers need to be installed and configured separately. Why3 can be extended with support for new provers and used as a software library through its OCaml API. WhyML programs can be extracted automatically into correct-by-construction OCaml programs, and WhyML is also used as an intermediate language for verification of C, Java, Rust, and Ada. TryWhy3 provides a JavaScript version that runs in a browser. Installation options include Opam, Docker, source compilation, and listed Debian, Fedora, and Ubuntu packages. Its graphical interface saves proof attempts and transformations in an XML file and can replay obsolete attempts. Why3 is free and open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference is a work in progress, and many features remain very limited.