Invariants live in your code.
Put preconditions, postconditions, and data invariants beside the code they describe. They become obligations the compiler checks.
fn increment(n: usize) -> usize
where n < usize::MAX
ensures result > n
{
n + 1
}
Evergreen: A Provably Safe Systems Language
In short
The architecture embeds preconditions, postconditions, and data invariants directly alongside relevant operational instructions. These embedded specifications are systematically transformed into formal obligations that are rigorously evaluated and verified during the compilation phase. For instance, a demonstrated increment routine requires an input unsigned integer to sit below its type maximum, while confirming the returned calculation strictly exceeds the initial input value.
Key points
- Program invariants are embedded directly within source logic rather than maintained exter…: Program invariants are embedded directly within source logic rather than maintained externally.
- Built-in compiler verification prevents code from passing without satisfying all stated p…: Built-in compiler verification prevents code from passing without satisfying all stated preconditions.
- Functions require inputs to fall beneath defined maximum limits to avoid unsafe operation…: Functions require inputs to fall beneath defined maximum limits to avoid unsafe operations.