A systems programming language for environments where failure is not an option.
Blood synthesizes five cutting-edge programming language innovations:
- Content-Addressed Code (Unison) — Code identity via BLAKE3-256 hashes
- Generational Memory Safety (Vale) — Fat pointer refs with generation tracking, no GC
- Hybrid Ownership Model (Hylo + Rust + Vale) — Mutable value semantics with escape-analyzed allocation, no borrow checker
- Algebraic Effects (Koka) — All side effects typed and composable
- Multiple Dispatch (Julia) — Type-stable open extensibility
Pre-release — research compiler. No version tag yet. See KNOWN_LIMITATIONS.md for the honest status of each component.
The safety-critical framing below describes what Blood is designed for, not what it is certified or ready for. No qualification, no toolchain assessment, no DO-178C artifacts exist. Treat it as a design target.
Verify rather than trust this page: ./tools/health.sh measures the repository and
fails if a claim here has drifted from reality. The numbers above were wrong for months
before that check existed.
The self-hosted compiler passes 713/713 golden tests, and 28 of the 30 real programs in corpus/ compile. It compiles itself through a three-generation byte-identical bootstrap, and the resulting binary has no Rust runtime dependency — the seed is self-sufficient and requires only LLVM 18 on the host.
| Component | Status | Details |
|---|---|---|
| Lexer & Parser | ✅ Working | 90% of normative grammar claims verified in code |
| Type Inference | ✅ Working | Algorithm W, bidirectional, 100% of normative claims verified |
| Type Checking | ✅ Working | Linearity, effects, exhaustiveness, generic impls |
| Code Generation | LLVM IR emission. Known gap: aggregate escape analysis disabled | |
| Effects System | ✅ Working | Deep/shallow handlers, perform/resume, snapshots, per-op resume |
| Memory Model | Generational refs for heap/region. &str stale detection disabled pending snapshot liveness analysis (GAP-1) |
|
| Runtime | ✅ Working | 197KB Blood-native runtime (no Rust). Memory, effects, VFT |
| Multiple Dispatch | Compile-time dispatch works. Runtime dispatch (fingerprint-based) is deferred | |
| Fibers / Concurrency | ❌ Not integrated | pthread-based spawn; no M:N scheduler, no mutex/channel primitives wired |
| Safety Checks | ✅ Default | Definite init, linearity, bounds, dangling ref rejection all enabled |
| Content Addressing | 🔶 Partial | BLAKE3 hashing, codebase storage. Hashes are stable only for definitions with no references — anything that calls another function re-hashes when unrelated code changes (GAP-11). VFT dispatch wiring not hooked up |
| Formal Proofs | ✅ Complete (for what they cover) | 22 theory files, 214 Qed., 0 Admitted., 0 Axiom. Covers a core calculus formalization — there is no mechanized link to the compiler artifact |
Legend: ✅ Working |
Spec coverage: 7 of 16 spec files fully implemented and tested, 3 partially implemented (Concurrency, Diagnostics, Stdlib), 1 untested (WCET/Real-time). See KNOWN_LIMITATIONS.md for the full breakdown and known soundness gaps.
Tutorial | Specification | Known Limitations | Contributing
In engineering, regulations "written in blood" are those born from catastrophic failures — rules that exist because someone died or systems failed in ways that can never be allowed again.
Blood is for avionics, medical devices, financial infrastructure, autonomous vehicles, nuclear control systems. Systems where failure is not an option.
If you're an avionics, medical, or financial engineer evaluating alternatives to C and Rust:
- Algebraic effects — every function's I/O, state mutations, and failure modes appear in its type signature. Auditors can mechanically verify which subsystems touch hardware or network — no grep, no manual review.
- Content-addressed code — builds are reproducible by construction. The same source hash always produces the same binary, satisfying DO-178C and IEC 62443 traceability requirements without a separate build-provenance toolchain.
- No borrow checker — domain experts write correct systems code without a PL PhD. Generational references enforce memory safety at runtime with deterministic, bounded overhead.
- Generational memory safety — no GC pauses, no use-after-free, no dangling pointers. Safety without the Rust learning curve or lifetime annotation burden.
- Multiple dispatch — extend a safety-critical codebase by adding implementations, not by modifying certified modules. Open/closed principle enforced at the language level.
- No Hidden Costs — Every abstraction has predictable, visible cost
- Failure is Data — All errors tracked in the type system via effects
- Zero-Cost When Provable — Compile-time proofs eliminate runtime checks
- Effects are Universal — IO, state, exceptions, async — one unified mechanism
- Interop is First-Class — C FFI designed from day one
This is a monorepo containing both the Blood language project and the Rust bootstrap compiler.
blood/
├── stdlib/ # Standard library (Blood source)
│ ├── core/ # Core types (Option, String, Box, etc.)
│ ├── collections/ # Vec, HashMap, LinkedList, etc.
│ ├── effects/ # Effect system primitives
│ ├── sync/ # Concurrency primitives
│ └── ...
├── src/
│ ├── bootstrap/ # Rust bootstrap compiler (Rust)
│ │ ├── bloodc/src/ # Compiler source (Rust)
│ │ └── Cargo.toml # Workspace manifest
│ └── selfhost/ # Self-hosted compiler (written in Blood)
├── docs/ # Language specification & documentation
│ ├── spec/ # Core language specifications
│ ├── design/ # Design evaluations and decisions
│ ├── planning/ # Roadmaps, status, decisions
│ ├── internal/ # Compiler internals
│ └── ...
├── examples/ # Blood language examples
└── tools/ # Development & debugging tools
See src/bootstrap/README.md for Rust-compiler-specific details.
effect Error<E> {
op raise(err: E) -> !
}
effect IO {
op read_file(path: Path) -> Bytes
}
fn load_config(path: Path) -> Config / {IO, Error<ParseError>} {
let data = read_file(path)
parse_config(data)
}
fn main() / {IO, Error<AppError>} {
let config = with ParseErrorHandler handle {
load_config("config.toml")
}
run_app(config)
}
# Build the compiler from the bootstrap seed (requires LLVM 18)
cd src/selfhost
./build_selfhost.sh build first_gen
# Compile and run a program
build/first_gen run ../../examples/fizzbuzz.blood
# Development workflow: edit source, rebuild incrementally, test
./build_selfhost.sh build second_gen # Incremental self-compilation
./build_selfhost.sh test golden second_gencd src/bootstrap
cargo build --release
cargo run -- run ../../examples/fizzbuzz.bloodSee the Specification for language details.
| Document | Description |
|---|---|
| SPECIFICATION.md | Core language specification |
| MEMORY_MODEL.md | Synthetic Safety Model (generational references) |
| DISPATCH.md | Multiple dispatch and type stability |
| GRAMMAR.md | Complete surface syntax grammar |
| FORMAL_SEMANTICS.md | Operational semantics and type rules |
| Document | Description |
|---|---|
| CONTENT_ADDRESSED.md | Content-addressed storage and VFT |
| CONCURRENCY.md | Fiber model and scheduler |
| FFI.md | Foreign function interface |
| STDLIB.md | Standard library design |
| DIAGNOSTICS.md | Error messages and diagnostics |
| Document | Description |
|---|---|
| ROADMAP.md | Implementation plan and milestones |
| DECISIONS.md | Architecture decision records |
| KNOWN_LIMITATIONS.md | Honest gap enumeration (current) |
Licensed under either of
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
We welcome contributions! See KNOWN_LIMITATIONS.md for the current state and CONTRIBUTING.md for areas that need help.
- Bug reports: Open an issue with reproduction steps
- Feature requests: Open a discussion first
- Code contributions: Fork, branch, and submit a PR
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.