Frama-C implementation