CBMC vs Z3

CBMC is a bounded model checker for C and C++ programs. It explores execution paths to check assertions, including array bounds, pointer safety, exceptions, and some undefined behavior such as signed integer overflow. Its analysis unwinds loops before sending the resulting equation to a decision procedure, and inputs may need a bounded size. The repository lists C89, C99, most of C11, C17, C23, GCC and Visual Studio extensions, and SystemC through Scoot; the listed input languages also include Java bytecode. CBMC supports contracts and can produce counterexamples. Its incremental SMT2 backend works with SMT-LIB 2.6-compliant solvers, with Z3 and CVC5 as examples. Distribution options include Homebrew instructions for macOS, Ubuntu DEB packages, Windows MSI installers, and Docker images. goto-cc can replace gcc or cl.exe in Makefiles to collect project models. The guide discusses routine development and continuous integration use. CBMC is free under the 4-clause BSD license.

Z3 is a theorem prover and satisfiability modulo theories (SMT) solver used in software verification and analysis. SMT-LIB2 is its default input format, and it supports the SMT-LIB format. The project documents bindings or APIs for C, C++, .NET, Java, Go, OCaml, Python, Julia, and JavaScript/TypeScript. Z3 can be built with CMake, vcpkg, or Bazel, and the repository links to pre-built binaries for stable and nightly releases. A project wiki also links to a page for trying Z3 in a browser. It supports proof artifacts and counterexamples, and listed input languages include SMT-LIB2, Rust, Smalltalk, and several of the languages with documented APIs. Z3 is MIT licensed, with downloads and source code available at no charge. Python is required to build it; additional toolchains are needed for Java, .NET, OCaml, and Julia APIs. The README says MSVC builds enable Control Flow Guard and Address Space Layout Randomization by default.