Boogie

Boogie is an intermediate language and verification tool for developers building verifiers for other languages. It is best suited to teams comfortable working with contracts, deductive verification and SMT solvers; it is less direct than a ready-made checker for application code.

Overview

Boogie sits between a verifier and a solver. It accepts Boogie IVL input, can optionally infer invariants, then generates verification conditions for an SMT solver. That makes it a focused foundation for verification workflows rather than a general-purpose program checker.

Projects built on Boogie include Dafny, Chalice, Spec# and Move verifiers; VCC and HAVOC use it for C. These integrations show its role as infrastructure for language-specific verification. If you want to verify code without building or adopting a verifier that targets Boogie, this layer may be more than you need.

Key features

• Deductive verification with contracts: Boogie generates proof obligations from Boogie IVL input. This suits verifier builders who need contract-based reasoning, but requires expressing the work in Boogie's intermediate language.
• Optional invariant inference: The tool can infer invariants when requested, a useful capability in a verification workflow. It does not remove the need to model the program and its properties in Boogie IVL.
• SMT solver integration: Z3 is the default solver. CVC5 and Yices2 support is experimental, so projects that depend on those alternatives should account for a less mature integration. Yices2 works with unquantified fragments such as arrays, arithmetic and bitvectors, but not quantifiers, generalized arrays or datatypes.
• Concurrency modeling: The Civl extension lets users model concurrent and distributed systems. It is relevant when those systems are the verification target, not a substitute for a ready-made checker in a source language.
• Self-hosted distribution: Boogie is distributed as a .NET global tool through NuGet. The NuGet package targets .NET 8.0 or higher, and using the tool requires .NET and a supported SMT solver; users must manage that environment themselves.

Pricing

Boogie is free and MIT-licensed. Its sole plan, Boogie, costs free and includes the MIT-licensed tool, with .NET and a supported SMT solver required. There are no paid tiers or seat and usage caps to weigh; the practical cost is setting up and maintaining the required local dependencies.

Platforms

Boogie supports Linux, macOS and Windows, with self-hosted deployment. Its .NET global-tool distribution makes it a fit for users able to install and manage .NET and an SMT solver on their chosen platform.

Who it's for

Boogie is a strong fit for developers and researchers building program verifiers, or extending a workflow that already uses its IVL and solver model. Its contract support and Civl extension also make it relevant to teams modeling concurrent or distributed systems. For users who want to verify application code directly, a language-specific verifier built on Boogie is likely the more practical route.

Pros and cons

• Pro: Verification-condition generation, contract support and optional invariant inference give verifier builders a defined deductive workflow.
• Pro: The MIT license and free plan allow self-hosted use without a software charge.
• Pro: Civl extends its relevance to concurrent and distributed-system models.
• Con: Boogie IVL is an intermediate language, so using the tool directly requires working below the level of most application languages.
• Con: .NET and a supported SMT solver are prerequisites, and CVC5 and Yices2 remain experimental options.

Alternatives

For other tools in this category, see Formal Verification Tools. Choose Lean if you want a free tool available on Linux, macOS, Windows and the web. Rocq is another free option, available across desktop platforms and the web, with an extension listing as well.

If you need a solver rather than a verification layer, Z3 is a free, MIT-licensed option. cvc5 is also free and open source, though optional GPL-licensed dependencies affect the license of a combined work; Boogie's CVC5 support, by contrast, is experimental.

HOL4, PVS, Why3 and Alloy Analyzer are other options to compare. PVS offers a free noncommercial plan and a commercial plan with custom pricing; its Allegro runtime requires acceptance of a click-through license.

Verdict

Choose Boogie if you are building a verifier around Boogie IVL and want a free, MIT-licensed deductive layer with default Z3 support. Its main advantage is that focused verification role; look elsewhere if you need a direct checker for your programming language or cannot take on the .NET and solver setup.