CBMC vs NuSMV

CBMC is a bounded model checker for C and C++ programs. It explores execution paths to check assertions, including array bounds, pointer safety, exceptions, and some undefined behavior such as signed integer overflow. Its analysis unwinds loops before sending the resulting equation to a decision procedure, and inputs may need a bounded size. The repository lists C89, C99, most of C11, C17, C23, GCC and Visual Studio extensions, and SystemC through Scoot; the listed input languages also include Java bytecode. CBMC supports contracts and can produce counterexamples. Its incremental SMT2 backend works with SMT-LIB 2.6-compliant solvers, with Z3 and CVC5 as examples. Distribution options include Homebrew instructions for macOS, Ubuntu DEB packages, Windows MSI installers, and Docker images. goto-cc can replace gcc or cl.exe in Makefiles to collect project models. The guide discusses routine development and continuous integration use. CBMC is free under the 4-clause BSD license.

NuSMV is a self-hosted software tool for formally verifying finite state systems. It checks systems against CTL specifications and supports LTL and PSL model checking. NuSMV 2 combines BDD-based model checking with SAT-based bounded model checking. Its SMV input language supports hierarchical descriptions, reusable components and finite data types, including booleans, scalars, bit vectors and fixed arrays. Other capabilities include an interactive text shell, invariant analysis and partitioning methods; the SAT component can connect to the Minisat solver. The project describes uses in industrial design verification, custom verification tools and research into formal verification techniques. NuSMV runs on Linux, macOS and Windows, and version 2 is open source under LGPL v2.1. The project directs general questions and bug reports to its users mailing list, with a separate list for announcements. Its FAQ says there is no current tutorial for developers extending the tool. It also warns that processes are deprecated because they can behave incorrectly with relational constructs such as TRANS, INIT or INVAR.