C program proofs with Frama-C and its weakest-precondition plugin [pdf]allan-blanchard.fr·88 pts·andrewchambers·11