Questions tagged [frama-c]

Frama-C is an Open Source suite of tools dedicated to the analysis of C source code.

Frama-C offers ready-to-use analyses for C programs: call graph, value analysis, functional dependencies, Program Dependence Graph, runtime monitoring, etc. It also allows the verification of functional properties, temporal logic, and much more. Results can be expressed in plain text, in SARIF, or in Frama-C's graphical interface.

Each analysis is implemented as a plug-in, and plug-ins inside the platform can use the results of one another. Frama-C is Open Source and extensible: new analyses can be implemented in OCaml as additional plug-ins that take advantage of existing ones. They communicate using the ACSL specification language, which also enables describing what the program is supposed to do.

Most provided analyses in Frama-C are sound: used within a delimited perimeter, all the behaviors that can happen at run-time are included in the behaviors statically predicted by Frama-C. Notwithstanding the possibility of bugs, plug-ins must be used as documented for the property to hold. This makes it possible to use Frama-C for the formal verification of C programs.

447 questions
3
votes
1 answer

assume statement modelling in FramaC

I want to use user assertion of value analysis plugin of Frama-C (Neon version), however I have some problem to come up with the suitable model of assume statement, which is very useful for me to apply particular constraints, for example, here is my…
3
votes
2 answers

alt-ergo does not run on windows via cygwin

I am trying to run a test file on frama-c with the alt-ergo prover. However,I am getting the followng error with alt-ergo. All the other frama-c checks are fine. I know that the issue is not with the test…
Quantico
  • 2,398
  • 7
  • 35
  • 59
3
votes
1 answer

How to get Data & Control Dependency Slice using Frama-c

I was trying to do two things Get a dynamic backward slice based on a criteria. Map the slices statements back to the actual source code. Problem 1: The slice returned by Frama-C doesn't return the exact statements that were relevant for the…
3
votes
1 answer

Frama-C and XML parser

I'm developing a plugin in Frama-C. I want to parse an xml file. I installed the package libxml-light-ocaml-dev but I get an error "Unbound module Xml" in compiling. I don't know how to proceed to make the package visible to Frama-C. Or should I use…
Amiramet
  • 59
  • 2
3
votes
1 answer

Print ACSL Annotations with Frama-C script

I am learning how to develop a Frama-C plugin. After reading the Frama-C Developer manual and doing the CFG plugin example, I tried to do a basic script that prints all annotations in a C file. I came up with this: open Cil_types class print_annot…
user2291590
  • 218
  • 1
  • 2
  • 9
3
votes
0 answers

Specification of Access Functions in ACSL

I have a problem specifiying the access to internal state variables, i.e. those local to a module that are accessed by getters and setters only. I have tried to use the getter function in the specification of the function contract of the setter…
dordow
  • 115
  • 6
3
votes
1 answer

Type check and code pattern detection, Frama-C

I'm discovering the Frama-C software and I was wondering if it is possible to detect some code pattern such as a doubled if tests or for example that a call to a given function is always followed by another. Or maybe somethings using the variables…
3
votes
1 answer

Analyzing large projects with Frama-C

I want to analyze a file from a large project to create a Program Dependence Graph using Frama-C, but keep getting odd errors such as: /usr/include/bits/fcntl-linux.h:305:[kernel] user error: Length of array is zero. This extension is…
Squatch
  • 33
  • 4
3
votes
1 answer

Verification issue using the Jessie plug-in and Frama-C

I'm new to Frama-C and I want to learn the ACSL syntax properly. I have this dummy example and the Jessie plug-in cannot verify line nr 9 and 12. Am I missing something? The function to be verified (equal) will check if the two arrays (a and b) have…
3
votes
2 answers

Do I get 3-address code in Frama-c

I just started developing a frama-c plugin that is doing some kind of alias analysis. I'm using the Dataflow.Backwards analysis and now I have to go through the different assignment statements and collect some stuff about the lvalues. Does frama-c…
Martin Schäf
  • 365
  • 1
  • 12
3
votes
1 answer

ACSL specification for a possibly infinite C function

I am trying to specify the behavior of external functions, more precisely, their termination. The ACSL documentation says that the \terminates p; property specifies that if the predicate p holds, then the function is guaranteed to terminate, but…
Anne
  • 1,270
  • 6
  • 15
3
votes
1 answer

Compilation error in ocamlgraph

I am trying to install ocamlgraph as a requirement for frama-c. When I am installing ocamlgraph and run make, I am getting the following compilation errors: ocamlopt.opt -c -I src -I lib -for-pack Graph src/delaunay.ml /tmp/camlasmc2c286.s:…
2
votes
1 answer

ACSL set logic / frama-c syntax error

I am using the Nitrogen version of Frama-c on Mac, and can't seem able to use the "set" logic, as documented in the ACSL manual, e.g., I can't declare a ghost variable as in "//@ ghost set someSet;". The frama-c program always complains…
edrdo
  • 133
  • 5
2
votes
2 answers

what's the meaning of the circle node in pdgs which is generated by frama-c

I use frama-c tool to analyse the code below. int main (int argc, char *argv[]) { int i,a; for (i = 0; i < 100; i += 1) { a=0; if (a==0) { continue; } else { …
user1283336
  • 297
  • 3
  • 8
2
votes
1 answer

Defining hardware "storage" for processing by Frama-C EVA

The general structure of the headers for STM32 peripherals inside CMSIS, typedef struct { __IO uint32 REGn; // ... } SOC_PER_TypeDef; #define SOC_PER_BASE 0x40003000 #define SOC_PER ((SOC_PER_TypeDef *)…
artless noise
  • 21,212
  • 6
  • 68
  • 105