Generate a proof of the predicate. Start at the end and work backwards, create a predicate for each instruction. Use theorem prover to prove safety predicate. Validating the Safety Proofs Extract native code and compute safety predicate. Check that supplied proof proves safety predicate.
Proofs are about three times the size of the code.
Read only the packet and scratch memory. Write only scratch memory. Branch only forward. Do not modify reserved of callee-saved registers. SFI'd code PCC outperforms all.