Don't sweat the small stuff: formal verification of C code without the pain
Types, bytes, and separation logic