.\"
.\"
.\"  This file is part of Frama-C.
.\"
.\"  Copyright (C) 2007-2010
.\"    CEA   (Commissariat  l'nergie atomique et aux nergies
.\"           alternatives)
.\"    INRIA (Institut National de Recherche en Informatique et en
.\"           Automatique)
.\"
.\"  you can redistribute it and/or modify it under the terms of the GNU
.\"  Lesser General Public License as published by the Free Software
.\"  Foundation, version 2.1.
.\"
.\"  It is distributed in the hope that it will be useful,
.\"  but WITHOUT ANY WARRANTY; without even the implied warranty of
.\"  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\"  GNU Lesser General Public License for more details.
.\"
.\"  See the GNU Lesser General Public License version v2.1
.\"  for more details (enclosed in the file licenses/LGPLv2.1).
.\"
.\"

.TH FRAMA-C 1 2010-04-12

.SH NAME
frama-c[.byte] \- a static analyzer for C programs
.P
frama-c-gui[.byte] \- the graphical interface of frama-c

.SH SYNOPSIS
.B frama-c
[
.I options
]
.I files

.SH DESCRIPTION
.B frama-c
is a suite of tools dedicated to the analysis of source code written in C.
It gathers several static analysis techniques in a single collaborative
framework. This framework can be extended by additional plugins placed in the
.B $FRAMAC_PLUGIN
directory. The command
.IP
frama\-c \-help
.PP
will provide the full list of the plugins that are currently installed.
.P
.B frama-c-gui
is the graphical user interface of
.BR frama-c .
It features the same options as the command-line version.
.P
.BR frama-c.byte\  and\  frama-c-gui.byte\  are
the ocaml bytecode versions of the command-line and graphical user interface
respectively.

By default, Frama-C recognizes
.B .c
files as C files needing pre-processing and
.B .i
files as C files having been already pre-processed. Some plugins may extend
the list of recognized files. Pre-processing can be customized through the
.B -cpp-command
and
.B -cpp-extra-args
options.

.SH OPTIONS

.B Syntax
.P
Options taking an additional parameter can also be written under the form
.IP
.RI - option = param
.PP
This option is mandatory when
.I param
starts with a dash ('-')
.P
Most options that takes no parameter have a corresponding
.IP
.RI -no -option
.PP
option which has the opposite effect.
.P
.B Help options
.TP
.B \-help
gives a short usage notice and the list of installed plugins.
.TP
.BI \-kernel\-help
prints the list of options recognized by Frama-C's kernel
.TP
.BI \-verbose\  n
Sets verbosity level (default is 1). Setting it to 0 will output less
progress messages. This level can also be set on a per \fIplugin\fP basis,
with option \fB-\fP\fIplugin\fP\fB-verbose\fP \fIn\fP.
Verbosity level of the kernel can be controlled with option
\fB-kernel\-verbose\fP \fIn\fP. Level of debug is controlled by the
.BI \-debug\ n
option, which has the same per plugin specializations.
The default debugging level is 0.
.TP
.B -quiet
Sets verbosity and debugging level to 0.
.P
.B Options controlling Frama-C's kernel
.TP
.BI \-absolute\-valid\-range\  <min-max>
considers that all numerical addresses in the range
.I min-max
are valid. Bounds are parsed as ocaml integer constants. By default,
all numerical addresses are considered invalid.
.TP
.BI \-add\-path\  p1[,p2[...,pn]]
adds directories
.IR <p1>\  through
.IR <pn>\  to
the list of directories in which plugins are searched
.TP
.B [-no]-annot
reads ACSL annotation. This is the default. Annotation are not pre-processed
by default. Use
.B -pp-annot
for that.
.TP
.B [-no]-constfold
folds all syntactically constant expressions in the code before the
analyzes. Defaults to no.
.TP
.B [-no]-continue-annot-error
When analyzing an annotation, the default behavior (the
.B -no
version of this option) when a typechecking error occurs is to reject the
source file as is the case for typechecking errors within the C code. With
this option on, the typechecker will only output a warning and discard the
annotation but typechecking will continue.
.TP
.BI -cpp-command\  cmd
Uses
.I cmd
as the command to pre-process C files. Defaults to the
.B CPP
environment variable or to
.IP
gcc \-C \-E \-I.
.IP
if it is not set. In order to preserve ACSL annotations, the preprocessor must
keep comments (the
.B -E
option for gcc).
.TP
.BI -cpp-extra-args\  args
Gives additional arguments to the pre-processor. This is only useful when
.B -preprocess-annot
is set. Pre-processing annotations is done in two separate pre-processing
stages. The first one is a normal pass on the C code which retains macro
definitions. These
are then used in the second pass during which annotations are pre-processed.
.I args
are used only for the first pass, so that arguments that should not be used
twice (such as additional include directives or macro definitions) must thus
go there instead of
.BR -cpp-command .
.TP
.B [-no]-dynlink
When on, load all the dynamic plug-ins found in the search path (see
.B -print-plugin-path
for more information on the default search path). Otherwise, only plugins
requested by
.B -load-modules
will be loaded. Default behavior is on.
.TP
.BI -float-digits\  n
When outputting floating-point numbers, display
.I n
digits. Defaults to 12.
.TP
.B -float-flush-to-zero
Floating point operations flush to zero
.TP
.B -float-hex
display floats as hexadecimal
.TP
.B -float-relative
display float interval as [
.IR lower_bound ++ width\  ]
.TP
.B -journal-disable
Do not output a journal of the current session. See
.BR -journal-enable .
.TP
.B -journal-enable
On by default, dumps a journal of all the actions performed during the current
Frama-C session in the form of an ocaml script that can be replayed with
.BR -load-script .
The name of the script can be set with the
.B -journal-name
option.
.TP
.BI -journal-name\  name
Set the name of the journal file (without the
.I .ml
extension). Defaults to frama_c_journal.
.TP
.B [-no]-keep-comments
Tries to preserve comments when pretty-printing the source code (defaults to
no).
.TP
.B [-no]-keep-switch
When
.B -simplify-cfg
is set, keeps switch statements. Defaults to no.
.TP
.B [-no]-lib-entry
Indicates that the entry point is called during program execution. This
implies in particular that global variables can not be assumed to have their
initial values. The default is
.BR -no-lib-entry :
the entry point is also the starting point of the program and globals have
their initial value.
.TP
.BI -load\  file
load the (previously saved) state contained in
.IR file .
.TP
.BI -load-module\  m1[,m2[...,mn]]
loads the ocaml modules
.IR <m1> through
.IR <mn> .
These modules must be
.BR .cmxs files
for the native code version of Frama-c and
.BR .cmo or .cma files
for the bytecode version (see the Dynlink section of Ocaml manual for more
information). All modules which are present in the plugin search paths are
automatically loaded.
.TP
.BI -load-script\  s1[,s2,[...,sn]]
loads the ocaml scripts
.IR <s1>\  through
.IR <sn> .
The scripts must be
.BR .ml files.
They must be compilable relying only on Ocaml standard library and
Frama-C's API. If some custom compilation step is needed, compile them
outside of Frama-C and use
.B -load-module
instead.
.TP
.BI -machdep\  machine
uses
.I machine
as the current machine-dependent configuration (size of the various
integer types, endiandness, ...). The list of currently supported machines is
available through
.B -machdep help
option.
.TP
.BI -main\  f
Sets
.I f
as the entry point of the analysis. Defaults to 'main'. By default, it is
considered as the starting point of the program under analysis. Use
.B -lib-entry
if
.I f
is supposed to be called in the middle of an execution.
.TP
.B -obfuscate
prints an obfuscated version of the code (where original identifiers are
replaced by meaningless one) and exits. The correspondance table between
original and new symbols is kept at the beginning of the result.
.TP
.BI -ocode\  file
redirects pretty-printed code to
.I file
instead of standard output.
.TP
.B [-no]-orig-name
During the normalization phase, some variables may get renamed when different
variable with the same name can co-exist (e.g. a global variable and a formal
parameter). When this option is on, a message is printed each time this occurs.
Defaults to no.
.TP
.B [-no]-overflow
arithmetic operations may overflow (this is the default option). The
.B -no-overflow
version assumes that the result of all arithmetic operations is within the
bounds of the associated type.
.TP
.B [-no]-pp-annot
pre-process annotations. This is currently only possible when using gcc (or
GNU cpp) pre-processor. The default is to not pre-process annotations.
.TP
.B [-no]-print
pretty-prints the source code as normalized by CIL (defaults to no).
.TP
.B -print-libpath
outputs the directory where Frama-C kernel library is installed
.TP
.B -print-path
alias of
.B -print-share-path
.TP
.B -print-plugin-path
outputs the directory where Frama-C searches its plugins (can be overidden by the
.B FRAMAC_PLUGIN
variable and the
.B -add-path
option)
.TP
.B -print-share-path
outputs the directory where Frama-C stores its data (can be overidden by the
.B FRAMAC_SHARE
variable)
.TP
.B -safe-arrays
For structure fields that are arrays, assumes that all accesses must be in bound
(set by default). The opposite option is
.B -unsafe-arrays
.TP
.BI -save\  file
Saves Frama-C's state into
.I file
after the analyzes have taken place.
.TP
.B [-no]-simplify-cfg
removes break, continue and switch statement before the analyzes. Defaults to
no.
.TP
.BI -time\  file
outputs user time and date in the given
.I file
when Frama-C exits.
.TP
.B -typecheck
forces typechecking of the source files. This option is only relevant if no
further analysis is requested (as typechecking will implicitely occurs before
the analysis is launched).
.TP
.BI -ulevel\  n
syntactically unroll loops
.I n
times before the analysis. This can be quite costly and some plugins (e.g.
the value analysis) provide more efficient ways to perform the same thing.
See their respective manuals for more information.
.TP
.B [-no]-unicode
outputs ACSL formulas with utf8 characters. This is the default. When given the
.B -no-unicode
option, Frama-C will use the ASCII version instead. See the ACSL manual for
the correspondance.
.TP
.B -unsafe-arrays
see
.B -safe-arrays
.TP
.B [-no]-unspecified-access
checks the that read/write accesses occuring in unspecified order (according to
the C standard's notion of sequence point) are performed on separate locations.
This  is the default. With
.B -no-unspecified-access ,
assumes that it is always the case.
.TP
.B \-version
outputs the version string of Frama-C
.P
.B Plugins specific options
.P
For each
.IR plugin ,
the command
.IP
.RI frama-c\ - plugin -help
.PP
will give the list of options that are specific to the plugin.

.SH ENVIRONMENT VARIABLES
It is possible to control the places where Frama-C looks for its files
through the following variables.
.TP
.B FRAMAC_LIB
The directory where kernel's compiled interfaces are installed
.TP
.B FRAMAC_PLUGIN
The directory where Frama-C can find standard plug-ins. If you wish to have
plugins in several places, use \fB-add-path\fP instead.
.TP
.B FRAMAC_SHARE
The directory where Frama-C datas are installed.

.SH SEE ALSO
.IR Frama-C\ homepage ,
http://frama-c.com