Boogie vs Why3
Boogie
github.comWhy3
why3.orgSide by side
| Figure | Boogie | Why3 |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 1 |
| Spec score · Formal Verification Tools | 8.1 (#7) | 8.0 (#12) |
| Installation | Releases are packaged as a .NET global tool and can be installed with dotnet tool install --global boogie. | Why3 can be installed via Opam, run from a Docker image, or compiled from source. |
| Integrations | The repository lists VCC and HAVOC for C, and Dafny, Chalice, Spec#, and Move verifiers as projects built on Boogie. | The project lists EasyCrypt, Frama-C, and SPARK 2014 among projects that use Why3. |
| License | Boogie is licensed under the MIT License. | TryWhy3 is distributed under the GNU Lesser General Public License version 2.1 with a special linking exception. |
| Purpose | Boogie is an intermediate modeling and verification language used as a layer for building program verifiers for other languages. | Why3 is a platform for deductive program verification that uses WhyML and external theorem provers to discharge verification conditions. |
| Support | The project directs users to its GitHub issue tracker to ask questions and report issues. | The project provides a user mailing list, a Zulip chat, and a bug tracking system. |
Plans
In their own words
Boogie
Boogie is a modeling language and tool for building program verifiers for other languages. It accepts Boogie language input, can optionally infer invariants, and generates verification conditions for an SMT solver. Z3 is the default solver; CVC5 and Yices2 support is experimental. The Civl extension lets users model concurrent and distributed systems. Boogie is self-hosted and distributed as a.NET global tool through NuGet. It requires.NET and a supported SMT solver, and the NuGet listing identifies version 3.5.7 as targeting.NET 8.0 or higher. The project uses the MIT License and is free at free. The repository names VCC and HAVOC for C, along with Dafny, Chalice, Spec#, and Move verifiers, as projects built on Boogie. Yices2 has a stated constraint: it works for unquantified fragments such as arrays, arithmetic, and bitvectors, but not for quantifiers, generalized arrays, or datatypes. Users can ask questions or report issues through the project issue tracker, and contributions are accepted through pull requests.
Why3
Why3 is a platform for deductive program verification. It uses WhyML to express programs and specifications, then works with external automated or interactive theorem provers to discharge verification conditions. WhyML supports preconditions, postconditions, assertions, and loop invariants, alongside logical theories and data structures such as arrays, queues, and hash tables. External provers need to be installed and configured separately. Why3 can be extended with support for new provers and used as a software library through its OCaml API. WhyML programs can be extracted automatically into correct-by-construction OCaml programs, and WhyML is also used as an intermediate language for verification of C, Java, Rust, and Ada. TryWhy3 provides a JavaScript version that runs in a browser. Installation options include Opam, Docker, source compilation, and listed Debian, Fedora, and Ubuntu packages. Its graphical interface saves proof attempts and transformations in an XML file and can replay obsolete attempts. Why3 is free and open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference is a work in progress, and many features remain very limited.