CBMC vs Why3

CBMC is a bounded model checker for C and C++ programs. It explores execution paths to check assertions, including array bounds, pointer safety, exceptions, and some undefined behavior such as signed integer overflow. Its analysis unwinds loops before sending the resulting equation to a decision procedure, and inputs may need a bounded size. The repository lists C89, C99, most of C11, C17, C23, GCC and Visual Studio extensions, and SystemC through Scoot; the listed input languages also include Java bytecode. CBMC supports contracts and can produce counterexamples. Its incremental SMT2 backend works with SMT-LIB 2.6-compliant solvers, with Z3 and CVC5 as examples. Distribution options include Homebrew instructions for macOS, Ubuntu DEB packages, Windows MSI installers, and Docker images. goto-cc can replace gcc or cl.exe in Makefiles to collect project models. The guide discusses routine development and continuous integration use. CBMC is free under the 4-clause BSD license.

Why3 is a platform for deductive program verification. It uses WhyML to express programs and specifications, then works with external automated or interactive theorem provers to discharge verification conditions. WhyML supports preconditions, postconditions, assertions, and loop invariants, alongside logical theories and data structures such as arrays, queues, and hash tables. External provers need to be installed and configured separately. Why3 can be extended with support for new provers and used as a software library through its OCaml API. WhyML programs can be extracted automatically into correct-by-construction OCaml programs, and WhyML is also used as an intermediate language for verification of C, Java, Rust, and Ada. TryWhy3 provides a JavaScript version that runs in a browser. Installation options include Opam, Docker, source compilation, and listed Debian, Fedora, and Ubuntu packages. Its graphical interface saves proof attempts and transformations in an XML file and can replay obsolete attempts. Why3 is free and open source under GNU LGPL 2.1 with a special linking exception. Loop invariant inference is a work in progress, and many features remain very limited.