Gravar-mail: Formal verification with Frama-C: a case study in the space software domain