The code producer is responsible for generating a proof that a given piece of code adheres to the safety policy. The code consumer can verify that the proof does in fact verify the code. Set of axioms to validate the safety predicate. VC generator based on abstract model of safe program execution. In this example, the abstract machine is DEC Alpha machine language.
Transition function defines execution of the machine.
Unsafe operations are reflected as absent transitions in the state machine. Precondition specified by code consumer. Generate a proof of the predicate. Start at the end and work backwards, create a predicate for each instruction. Use theorem prover to prove safety predicate.