Frama-C
What it is
Frama-C is a plug-in platform for analyzing C programs and checking for potential bugs. Its analyzers share a kernel, program representation, and ACSL specification language, so results can be combined sequentially or in parallel. Eva applies abstract interpretation to report supported possible runtime errors, including invalid memory access and integer overflow. It analyzes sequential code and does not support recursive calls. WP uses ACSL contracts and weakest-precondition reasoning to check functional correctness across possible executions, with external provers or proof assistants. E-ACSL translates executable annotations into C code for runtime checks, although some ACSL constructs cannot be translated. The main distribution includes Eva, WP, E-ACSL, and other analyzers; some specialized plug-ins are separate, proprietary, archived, or have limited support. Frama-C is free, self-hosted software for Linux, macOS, and Windows, available under the LGPL with dual licensing possible for other uses. It is used in teaching, research, and industry, including safety- and security-critical work. Support options include technical assistance, training, tutorials, and customization.
For and against
For
- Free software for Linux, macOS, and Windows.
- Eva reports supported potential runtime errors.
- WP checks ACSL contracts across possible executions.
- Analysis results can be combined.
- Supports development of additional plug-ins.
Against
- Eva does not support recursive calls.
- Eva analyzes sequential code only.
- Some ACSL constructs cannot be translated by E-ACSL.
- Some specialized plug-ins are separate or proprietary.
The verdict
Frama-C combines multiple analyzers for C, from runtime-error analysis to contract-based verification and runtime checks. Its limits vary by plug-in, so users should consider the specific analyzer and code patterns they need.
Who it suits
It suits developers, researchers, and educators analyzing C programs with formal methods. Its verification capabilities may also interest teams working on safety- or security-critical software.
On the record
- ACSL
- Frama-C uses ACSL annotations to specify function contracts and verify conformance to functional specifications.frama-c.com · read 3 Oct 2026
- Additional analyzers
- The main distribution includes Eva, WP, E-ACSL, and other plug-ins; some specialized plug-ins are proprietary, separately distributed, archived, or have limited support.frama-c.com · read 4 Oct 2026
- Architecture
- Plug-ins share a kernel, program representation, and ACSL specification language, allowing analyzers to combine results sequentially or in parallel.frama-c.com · read 4 Oct 2026
- Audience
- The site describes use in teaching, experimental research, and industrial applications, including safety- and security-critical software.frama-c.com · read 4 Oct 2026
- Eva analysis
- Eva uses abstract interpretation to analyze C programs and report possible runtime errors within the undefined behaviors supported by its analysis.frama-c.com · read 3 Oct 2026
- Eva limits
- Eva currently does not support recursive calls and analyzes only sequential code.frama-c.com · read 3 Oct 2026
- Extensibility
- The platform supports development of plug-ins that add analyses or modify existing ones.frama-c.com · read 4 Oct 2026
- Formal methods
- The platform combines formal-methods-based analyses, most of which the site describes as sound.frama-c.com · read 4 Oct 2026
- Functional verification
- The WP plug-in uses ACSL specifications and weakest-precondition reasoning to prove functional correctness, with SMT solvers and user-provided annotations.frama-c.com · read 4 Oct 2026
- Integrations
- WP uses SMT solvers including Alt-Ergo, CVC5, and Z3.frama-c.com · read 4 Oct 2026
- Intended users
- The site describes Frama-C as used in teaching, experimental research, and industrial applications, including certification work for DO-178, IEC 60880, and Common Criteria EAL 6–7.frama-c.com · read 3 Oct 2026
- Licensing
- Frama-C is available under LGPL and can be dual-licensed for other uses.frama-c.com · read 3 Oct 2026
- Maker
- The platform is co-developed at CEA LIST and the Inria Saclay–Île-de-France Toccata team, in common with LRI-CNRS and Université Paris-Sud 11.frama-c.com · read 3 Oct 2026
- Plugin ecosystem
- The plugin catalog lists Eva, WP, E-ACSL, and other analyzers in the main distribution, alongside separately distributed and proprietary plugins.frama-c.com · read 3 Oct 2026
- Purpose
- Frama-C is a framework for modular analysis of C programs using collaborative program analysis plug-ins.frama-c.com · read 4 Oct 2026
- Runtime checking
- E-ACSL translates executable ACSL annotations into C code for runtime checking, but only supports an executable subset of ACSL.frama-c.com · read 4 Oct 2026
- Runtime errors
- The Eva plug-in uses abstract interpretation to analyze possible program behaviors and report supported undefined behaviors, including invalid memory accesses and integer overflows.frama-c.com · read 4 Oct 2026
- Security use
- The site says Frama-C has been used for certification purposes including DO-178, IEC 60880, and Common Criteria EAL 6-7.frama-c.com · read 4 Oct 2026
