frama-c[.byte] - a static analyzer for C programs
frama-c-gui[.byte] - the graphical interface of frama-c
is a suite of tools dedicated to the analysis of source code
written in C. It gathers several static analysis techniques in a single
collaborative framework. This framework can be extended by additional plugins
placed in the $FRAMAC_PLUGIN
directory. The command
- frama-c --plugins
will provide the full list of the plugins that are currently installed.
is the graphical user interface of frama-c
features the same options as the command-line version.
ocaml bytecode versions of the command-line and graphical user interface
By default, Frama-C recognizes .c
files as C files needing pre-processing
files as C files having been already pre-processed. Some plugins
may extend the list of recognized files. Pre-processing can be customized
through the -cpp-command
Options taking an additional parameter can also be written under the form
This form is mandatory when param
starts with a dash ('-').
Most options that take no parameter have a corresponding
option which has the opposite effect.
- gives a short usage notice.
- prints the list of options recognized by Frama-C's
- -verbose n
- Sets verbosity level (default is 1). Setting it to 0 will
output less progress messages. This level can also be set on a per-
plugin basis, with option -plugin-verbose
n. Verbosity level of the kernel can be controlled with option
- -debug n
- Sets debugging level (default is 0, meaning no debugging
messages). This option has the same per-plugin (and kernel)
specializations as -verbose.
Options controlling Frama-C's kernel
- Sets verbosity and debugging level to 0.
- -absolute-valid-range <min-max>
- considers that all numerical addresses in the range
min-max are valid. Bounds are parsed as ocaml integer constants. By
default, all numerical addresses are considered invalid.
- -add-path p1[,p2[...,pn]]
- adds directories <p1> through
<pn> to the list of directories in which plugins are
- merges function definitions modulo renaming. Defaults to
- allows duplication of small blocks during normalization of
tests and loops. Otherwise, normalization uses labels and gotos. Bigger
blocks and blocks with non-trivial control flow are never duplicated.
Defaults to yes.
- reads ACSL annotations. This is the default. Annotations
are pre-processed by default. Use -no-pp-annot if you don't want to
expand macros in annotations.
- -big-ints-hex max
- integers larger than max are displayed in
hexadecimal (by default, all integers are displayed in decimal)
- performs integrity checks on the internal AST (for
- generates contracts for assembly code written according to
gcc's extended syntax. Defaults to yes.
- automatically marks contracts generated from asm as valid.
Defaults to no.
- enables (partial) C11 compatibility, e.g. typedef
redefinitions. Defaults to no.
- allows implicit cast between the value returned by a
function and the lvalue it is assigned to. Otherwise, a temporary variable
is used and the cast is made explicit. Defaults to yes.
- folds all syntactically constant expressions in the code
before analyses. Defaults to no.
- variables with const qualifier must be actually
constant. Defaults to yes. The opposite option is
- When analyzing an annotation, the default behavior (the
-no version of this option) when a typechecking error occurs is to
reject the source file as is the case for typechecking errors within the C
code. With this option on, the typechecker will only output a warning and
discard the annotation but typechecking will continue (errors in C code
are still fatal, though).
- -cpp-command cmd
- Uses cmd as the command to pre-process C files.
Defaults to the CPP environment variable or to
- gcc -C -E -I.
- if it is not set. In order to preserve ACSL annotations,
the preprocessor must keep comments (the -C option for gcc).
%1 and %2 can be used in cmd to denote
the original source file and the pre-processed file respectively.
- -cpp-extra-args args
- Gives additional arguments to the pre-processor. This is
only useful when -preprocess-annot is set. Pre-processing
annotations is done in two separate pre-processing stages. The first one
is a normal pass on the C code which retains macro definitions. These are
then used in the second pass during which annotations are pre-processed.
args are used only for the first pass, so that arguments that
should not be used twice (such as additional include directives or macro
definitions) must thus go there instead of -cpp-command.
- indicates that the chosen preprocessor complies to some
Frama-C requirements, such as accepting the same set of options as GNU
cpp, and accepting architecture-specific options such as -m32/-m64.
Default values depend on the installed preprocessor at configure time. See
- -custom-annot-char c
- uses character c for starting ACSL annotations.
- When on, load all the dynamic plugins found in the search
path (see -print-plugin-path for more information on the default
search path). Otherwise, only plugins requested by -load-module
will be loaded. Default behavior is on.
- -enums repr
- Choose the way the representation of enumerated types is
determined. frama-c -enums help gives the list of available
options. Default is gcc-enums
- -float-digits n
- When outputting floating-point numbers, display n
digits. Defaults to 12.
- Floating point operations flush to zero.
- display floats as hexadecimal.
- display floats with the standard OCaml routine.
- display float intervals as [
- forces right-to-left evaluation order for arguments of
function calls. Otherwise the evaluation order is left unspecified, as in
the C standard. Defaults to no.
- adds -I$FRAMAC_SHARE/libc to the options
given to the cpp command. If -cpp-frama-c-compliant is not
false, also adds -nostdinc to prevent an inconsistent mix of system
and Frama-C header files. Defaults to yes.
- -implicit-function-declaration <action>
- warns or aborts when a function is called before it has
been declared. <action> can be one of ignore,
warn, or error. Defaults to warn.
- Implicit initialization of locals sets padding bits to 0.
If false, padding bits are left uninitialized (defaults to yes).
- Do not output a journal of the current session. See
- On by default, dumps a journal of all the actions performed
during the current Frama-C session in the form of an ocaml script that can
be replayed with -load-script. The name of the script can be set
with the -journal-name option.
- -journal-name name
- Set the name of the journal file (without the .ml
extension). Defaults to frama_c_journal.
- Tries to preserve comments when pretty-printing the source
code (defaults to no).
- When -simplify-cfg is set, keeps switch statements.
Defaults to no.
- See -remove-unused-specified-functions
- -kernel-log kind:file
- copies log messages from the Frama-C's kernel to
file. kind specifies which kinds of messages to be copied
(e.g. w for warnings, e for errors, etc.). See
-kernel-help for more details. Can also be set on a per-plugin
basis, with option -plugin-log.
- Indicates that the entry point is called during program
execution. This implies in particular that global variables cannot be
assumed to have their initial values. The default is -no-lib-entry:
the entry point is also the starting point of the program and globals have
their initial value.
- -load file
- loads the (previously saved) state contained in
- -load-module m1[,m2[...,mn]]
- loads the ocaml modules
<m1> through <mn>. These modules
must be .cmxs files for the native code version of Frama-c
and .cmo or.cma files for the bytecode version
(see the Dynlink section of the OCaml manual for more information). All
modules which are present in the plugin search paths are automatically
- -load-script s1[,s2,[...,sn]]
- loads the ocaml scripts
<s1> through <sn>. The scripts
must be .ml files. They must be compilable relying only on
the OCaml standard library and Frama-C's API. If some custom compilation
step is needed, compile them outside of Frama-C and use
- -machdep machine
- uses machine as the current machine-dependent
configuration (size of the various integer types, endiandness, ...). The
list of currently supported machines is available through -machdep
help option. Default is x86_32
- -main f
- Sets f as the entry point of the analysis. Defaults
to 'main'. By default, it is considered as the starting point of the
program under analysis. Use -lib-entry if f is supposed to
be called in the middle of an execution.
- prints an obfuscated version of the code (where original
identifiers are replaced by meaningless ones) and exits. The
correspondence table between original and new symbols is kept at the
beginning of the result.
- -ocode file
- redirects pretty-printed code to file instead of
- During the normalization phase, some variables may get
renamed when different variables with the same name can co-exist (e.g. a
global variable and a formal parameter). When this option is on, a message
is printed each time this occurs. Defaults to no.
- pre-processes annotations. This is currently only possible
when using gcc (or GNU cpp) pre-processor. The default is to pre-process
annotations when the default pre-processor is identified as GNU or
GNU-like. See also -cpp-frama-c-compliant
- pretty-prints the source code as normalized by CIL
(defaults to no).
- expands #include directives in the
pretty-printed CIL code for files in the Frama-C standard library
(defaults to no).
- outputs the directory where the Frama-C kernel library is
- alias of -print-share-path
- outputs the directory where Frama-C searches its plugins
(can be overridden by the FRAMAC_PLUGIN variable and the
- outputs the directory where Frama-C stores its data (can be
overridden by the FRAMAC_SHARE variable)
- transforms throw and try/catch statements
into normal C functions. Defaults to no, unless the input source language
has an exception mechanism.
- -remove-projects p1,...,pn
- removes the given projects p1,...,pn.
@all_but_current removes all projects but the current one.
- keeps function prototypes that have an ACSL specification
but are not used in the code. This is the default. Functions having the
attribute FRAMAC_BUILTIN are always kept.
- For multidimensional arrays or arrays that are fields
inside structs, assumes that all accesses must be in bound (set by
default). The opposite option is -unsafe-arrays.
- -save file
- Saves Frama-C's state into file after analyses have
- -session s
- sets s as the directory in which session files are searched.
- the current project becomes the default one (and so future
-then sequences are applied on it). Defaults to no.
- removes break, continue and switch statements before
analyses. Defaults to no.
- simplifies trivial loops such as do ... while (0)
loops. Defaults to yes.
- allows one to compose analyzes: a first run of Frama-C will
occur with the options before -then and a second run will be done
with the options after -then on the current project from the first
- like -then, but the second group of actions
is executed on the last project created by a program transformer.
- -then-on prj
- Similar to -then except that the second run is
performed in project prj. If no such project exists, Frama-C exits
with an error.
- like -then-last, but also removes the
previous current project.
- -time file
- appends user time and date in the given file when
- forces typechecking of the source files. This option is
only relevant if no further analysis is requested (as typechecking will
implicitly occur before the analysis is launched).
- -ulevel n
- syntactically unroll loops n times before the
analysis. This can be quite costly and some plugins (e.g. the value
analysis) provide more efficient ways to perform the same thing. See their
respective manuals for more information. This can also be activated on a
per-loop basis via the loop pragma unroll <m> directive. A
negative value for n will inhibit such pragmas.
- ignores UNROLL loop pragmas disabling unrolling.
- outputs ACSL formulas with utf8 characters. This is the
default. When given the -no-unicode option, Frama-C will use the
ASCII version instead. See the ACSL manual for the correspondence.
- see -safe-arrays
- checks that read/write accesses occurring in an unspecified
order (according to the C standard's notion of sequence points) are
performed on separate locations. With -no-unspecified-access,
assumes that it is always the case (this is the default).
- outputs the version string of Frama-C.
- -warn-decimal-float <freq>
- warns when a floating-point constant cannot be exactly
represented (e.g. 0.1). <freq> can be one of
none, once, or all
- generates alarms when signed downcasts may exceed the
destination range (defaults to no).
- generates alarms for signed operations that overflow
(defaults to yes).
- generates alarms when unsigned downcasts may exceed the
destination range (defaults to no).
- generates alarms for unsigned operations that overflow
(defaults to no).
For each plugin
, the command
- frama-c -plugin-help
will give the list of options that are specific to the plugin.
- Successful execution
- Invalid user input
- User interruption (kill or equivalent)
- Unimplemented feature
- 4 5 6
- Internal error
- Unknown error
Exit status greater than 2 can be considered as a bug (or a feature request for
the case of exit status 3) and may be reported on Frama-C's BTS (see below).
It is possible to control the places where Frama-C looks for its files through
the following variables.
- The directory where kernel's compiled interfaces are
- The directory where Frama-C can find standard plugins. If
you wish to have plugins in several places, use -add-path
Frama-C user manual
- The directory where Frama-C data (e.g. its version of the
standard library) is installed.