CBMC vs SeaHorn

CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows. It checks memory safety, including array bounds and pointer use, along with several forms of undefined behavior and user-specified assertions. Its language range includes C89, C99, most of C11 and C17, and extensions from GCC, Clang, and Visual Studio. CBMC verifies by unwinding program loops and passing the resulting equation to a decision procedure. It can check C and C++ I/O equivalence with languages such as Verilog, and generate test cases for branch, decision, path, and MC/DC coverage. Listed language features include arrays, dynamic memory, nondeterminism, assumptions, assertions, and selected C++ features such as classes, templates, and STL containers. A MiniSat-based bit-vector solver is included; Boolector, CVC5, and Z3 are supported but must be installed separately. CBMC is free at free under a BSD 4-clause license. The Windows and macOS distributions are command-line tools without a GUI.

SeaHorn is a free, open-source framework for automated analysis of C and other LLVM-based programs, developed mainly for research in automated verification. It is not an out-of-the-box static analyzer. Its frontend prepares LLVM IR bitcode, and its middle end converts optimized bitcode into verification conditions written as Constrained Horn Clauses. Backend engines use SMT-based model checking, including PDR/IC3 techniques, and CRAB can provide numerical invariants through abstract interpretation. SeaHorn supports abstract interpretation, context-sensitive pointer analysis, bounded model checking, constrained-Horn-clause software model checking, and termination or non-termination analysis. For C programs with assertions, `sea pf` translates the program, generates and solves verification conditions, displays invariants for safe results, or saves a counterexample for violations. `sea inspect` reports program structure and can produce memory or call-graph data. The framework also checks generated clauses for inconsistent code fragments using path coverage. Docker is described as the easiest starting point, with a nightly image refreshed daily. Building requires LLVM, Z3, and Boost, whose exact versions change. SeaHorn runs on Linux, macOS, or self-hosted systems under a modified BSD license.