CBMC

CBMC is a bounded model checker for C and C++ software, available for Linux, macOS, and Windows. It checks memory safety, including array bounds and pointer use, along with several forms of undefined behavior and user-written assertions. Its language support covers C89, C99, most of C11 and C17, and many extensions from GCC, Clang, and Visual Studio. CBMC verifies programs by unwinding loops and sending the resulting equation to a decision procedure. It can also check I/O equivalence between C or C++ and languages such as Verilog, and generate tests for branch, decision, path, and MC/DC coverage. Supported features include arrays, dynamic memory, assumptions, assertions, and selected C++ elements such as classes and templates. A MiniSat-based bit-vector solver is included; Boolector, CVC5, and Z3 are available as external options that must be installed separately. CBMC is free under a BSD 4-clause license. The macOS and Windows distributions are command-line tools without a graphical interface.

CBMC brings bounded checking and test generation to C and C++ workflows, with support for multiple platforms and language extensions. Its command-line interface on macOS and Windows, and separate setup for external solvers, are worth considering before choosing it.

CBMC suits developers who need to check C or C++ programs for memory errors, undefined behavior, or user-specified assertions. It is also relevant for teams checking I/O equivalence with languages such as Verilog or generating coverage tests.

CBMC is a free bounded model checker for C and C++ developers who need to verify specific program properties or generate tests. It is a strong fit for command-line workflows and a poor one for teams that expect a graphical interface.

Overview

CBMC unwinds program loops and sends the resulting equation to a decision procedure. It checks properties of bounded program behavior, including memory safety, several forms of undefined behavior, and assertions supplied by the user. That makes it useful for targeted verification, but the bounded method is an important consideration when choosing it.

It can also check I/O equivalence between C or C++ and languages such as Verilog, a specialized capability for software and hardware interface work. CBMC is released under a BSD 4-clause license, which disclaims warranties and liability.

Key features

• Memory and behavior checks: CBMC checks array bounds, safe pointer use, several kinds of undefined behavior, and user-written assertions. These checks make it relevant when those defect classes are a priority, rather than as a general-purpose development environment.
• C and C++ support: It supports C89, C99, most of C11 and C17, and many extensions from GCC, Clang, and Visual Studio. Supported features include multidimensional and dynamically sized arrays, pointers, dynamic memory, nondeterminism, assumptions, and assertions; C++ support includes classes, templates, and selected STL containers. The breadth is useful, though support for only most of newer C standards and selected containers may matter in projects relying on less common features.
• Test generation: CBMC can generate tests for branch, decision, path, and MC/DC coverage criteria. That adds value for developers who need tests tied to defined coverage goals.
• Solver choices: A MiniSat-based bit-vector solver is included, while Boolector, CVC5, and Z3 are supported as external solvers. Those external tools must be installed separately, adding a setup step for users who need them.

Pricing

The CBMC plan costs nothing and includes the command-line tool under the BSD 4-clause license. There is no free trial because the software is free; there are no paid tiers or seat and quota limits described. This is a straightforward choice for individual developers and teams comfortable with the license terms, which disclaim warranties and liability.

Platforms

CBMC supports Linux, macOS, and Windows. Debian and Ubuntu packages and Fedora's dnf package manager provide Linux installation options. The Windows release is an x64 command-line binary run from the Visual Studio Command Prompt; the macOS distribution is also command-line only. Neither provides a GUI, so users wanting graphical inspection should look elsewhere.

Who it's for

CBMC is best suited to C and C++ developers who need bounded checks for memory safety, undefined behavior, or assertions, and to teams generating coverage-oriented tests. Its cross-language I/O equivalence checks may also suit work involving Verilog. It is less appropriate for users who require a GUI or want an analysis workflow that does not rely on loop unwinding.

Pros and cons

• Pros: Free under a BSD 4-clause license; checks memory safety, undefined behavior, and assertions; supports a broad range of C and C++ features; generates tests for several coverage criteria; offers cross-language I/O equivalence checking.
• Cons: macOS and Windows releases have no GUI; Windows requires the Visual Studio Command Prompt; external solvers need separate installation; verification relies on loop unwinding.

Alternatives

For a wider set of options, browse C and C++ Static Analysis Tools.

• Parasoft SOAtest is a paid alternative with a free plan and trial, and offers custom pricing based on business needs; consider it if its broader platform availability is a better fit.
• Squish is a paid alternative with a free trial and no free plan; consider it if its testing offering better suits your needs.
• Infer is free and offers static analysis for supported programming languages; choose it if static analysis is a closer match than bounded checking.
• MATLAB Grader is free with a MATLAB license current under maintenance, and LMS integration requires a qualifying academic license; it may fit MATLAB-centered work better.
• Clang Static Analyzer is a free, open-source analyzer for C, C++, and Objective-C; choose it if that analyzer is the better fit for your code analysis needs.
• Qodana has a free Community plan billed free per active contributor per month, with one team and 30 days of detailed historical data; consider it if those team-oriented terms better suit your workflow.
• Semgrep Code offers a free edition with code and supply chain coverage, up to 10 repositories, a maximum of 10 contributors, and 60 AI credits; consider it if those repository and contributor limits fit your needs.
• Flawfinder is free for anyone to use under GPL-2.0+; consider it if that tool is a better match for your needs.

Verdict

Choose CBMC if you need free, targeted verification or coverage-oriented test generation for C and C++ and are comfortable working at the command line. Its property checks and language coverage are the main reasons to pick it; look elsewhere if you need a GUI or a workflow that avoids loop unwinding.