Verification of C programs with VCC