Aether enforces safety, security, and reliability as structural invariants before a single byte of machine code is generated. A program that violates a declared property cannot be compiled. There is no runtime check. There is no advisory warning. The program does not compile. Uncompromising? That’s the feature.
Four U.S. provisional applications filed with the USPTO (July–August 2026), converting to full applications through 2027 — building toward a single certification pass for systems where a bug is a recall: implantable devices, battery management, avionics.Provisionals, not granted patents; priority attaches on the Office’s receipt. Patent-pending.
In planes, cars, medical devices, and defense systems, a single software fault can cost lives. Today that software is trusted because it was tested a lot — but as Edsger Dijkstra put it, testing can reveal that a bug is present, never that none remain. We took that personally.
Plenty of tools claim to make software safer. What sets this apart: we took the compiler’s own output, ran it on a real microcontroller (the kind inside a car or a drone), and measured the physical behaviour with lab instruments. The predictions the compiler made up front matched what the hardware actually did.
We told the compiler to build a lookup that takes the same amount of time no matter what secret it is handling. On the chip it ran identically for every input — a would-be eavesdropper learns nothing from the timing. A normal version of the same lookup gave the secret away by running faster or slower.
240 clock cycles, flat across all 20 test inputs, zero spread; the ordinary version varied ~116%.
That “same-time” behaviour did not crack when we starved the chip of power (down toward its brown-out point) or heated it up. The protection is built into the shape of the code, not a lucky condition.
Timing spread stayed ~0.08% across a 3.3 V→~2.4 V supply sweep and to ~65 °C.
We asked the compiler to predict the electrical charge a 60-second mission would draw from the battery — before running it. The meter agreed with the prediction to within about one and a half percent.
358.42 mC projected vs 353.43 mC measured; ±10% tolerance fixed before the run.
We set a power ceiling the device was not allowed to exceed. In practice its worst peak stayed eleven times below that ceiling, and the compiler’s power math matched the meter.
Worst measured peak ~91 mW vs a declared 1000 mW envelope; power (V×I) tracked to within 2%.
In real-time systems the device must always react to an urgent signal within a fixed deadline. We proved — by inspecting every program the compiler produces — that this reaction time can never exceed a small fixed bound, no matter how large the program.
Worst-case interrupt latency bounded at 27 cycles (~1.69 µs), from an audit of all 821 emitted files plus a measured 16-cycle entry cost.
Rebuilt from the same source, weeks apart and across a major version change, the compiler produced byte-for-byte identical output — twenty times in a row. That makes the evidence auditable: anyone can rebuild and get exactly the same thing.
All 356 emitted artifacts hashed identical across 20 consecutive passes; instruction stream unchanged across a v7.3→v8 version bump (fixtures tested).
Industries where certification is mandatory and expensive:
These teams spend heavily proving their software is safe. Aether aims to turn a slow, after-the-fact testing bill into proof produced automatically at build time.
Proven: the results above are real measurements of the compiler’s own output on real hardware, each recorded with a fixed method and a reproducible build.
Scope, stated plainly: the compiler-determined results — constant-time (240 cycles flat, zero spread), the naive-C timing leak (+120 cycles), and cycle-count flatness (~1%) — were re-measured on a second, independent NUCLEO-F411RE board on 2026-07-24, under pass/fail criteria fixed and wet-signed before the run, and they replicated across both parts, so those properties are no longer single-board. The absolute analog magnitudes (current, energy) still carry normal part-to-part variation: on the second board one energy comparison was method-limited and one cold-temperature current reading differed by ~12.5%, so those remain single-board for absolute value. This is a strong two-board proof-of-concept — not yet a temperature-qualified multi-part characterization across parts, and not independently certified. We do not claim all five re-measured results agree.
Not claimed: Aether has not been formally qualified or certified under any of the safety standards it maps to; the compiler references those frameworks as evidence, which is not the same as third-party certification. Some capabilities are still specification-only. The company is early-stage and pre-revenue. Four US provisional applications were submitted to the USPTO in July–August 2026 (filing dates attach on the Office’s receipt); these are provisionals, not granted patents, and confer no enforceable rights yet.
We would rather show exactly what is and isn’t done than oversell it — the same discipline that makes the compiler refuse to lie is how we run the company.
In contested environments, adversaries exploit three software attack vectors. Aether addresses all three at compile time — before the binary exists.
Aether emits machine-verifiable certification manifest blocks during a single compilation — up to 21 in one program, drawn from a catalog of 39 block types. The standalone verifier (aether-verify) independently re-checks the manifest chain and attestation token — without the compiler or source code — and parses the core manifest block types individually. The output is deterministic: all 356 emitted artifacts hashed byte-identical across 20 consecutive build-and-execute passes (2026-07-10). Manifests are compile-time evidence artifacts, not third-party certifications.
Beginning 2026-07-17 and continuing through 2026-07-20, the compiler's physical-domain outputs were measured on hardware — a Nordic Power Profiler Kit II in series with an STM32F411 (ARM Cortex-M4) on a NUCLEO-F411RE board, at the reset-default 16 MHz clock. Most results below were first recorded as a single datapoint on one board of one silicon part, taken with AI assistance at the inventor's direction under a methodology fixed before the measurement. On 2026-07-24 the compiler-determined subset — constant-time (240 cycles flat), the naive-C timing leak, and cycle-count flatness — was re-measured on a second, independent NUCLEO-F411RE board under pass/fail criteria fixed and wet-signed before the run, and those results replicated across the two parts; the absolute analog magnitudes (current, energy) still carry normal part-to-part variation and remain single-board for absolute value, and one energy comparison on the second board was method-limited. None is yet a certified measurement or a temperature-qualified multi-part characterization across parts. What began as four verbatim-compiler-emitted results has since been strengthened and extended: the constant-time property is now measured directly on the compiler's OWN emitted lookup, cycle-exact (240 cycles flat across all 20 query positions, no match-vs-absent leak) — the earlier hand-assembled caveat is retired — and a single program carrying six typed constraints at once (energy, WCET, power, interrupt-latency, constant-time, and a Secret classification) was accepted by the compiler in one pass and measured end-to-end on that one binary. A separate static audit further bounds the worst-case interrupt latency of every emitted program to 27 cycles. The constant-time behaviour was further observed to hold as the supply was starved toward the part's brown-out floor and at elevated temperature, the declared power envelope tracked measured power to within 2%, and the emitted code was byte-identical across a major version bump — evidence that the numbers describe the compiler's own output rather than one lucky build. Each number is recorded with full chain of custody in a dated rig log; where a result is still bound only to a hand-assembled instance, it says so.
Aether's manifests reference the certification frameworks used across NATO member nations and major regulatory jurisdictions. These references are compile-time evidence — Aether has not been qualified or certified under these standards, and manifest emission is not a substitute for tool qualification (e.g. DO-330, ISO 26262).
Aether-Lang.org Inc. exists to raise the bar for what “verified” means in embedded safety-critical software. We build compile-time certification tools that structurally prove correctness before code is deployed — producing machine-verifiable evidence of every safety, security, and reliability invariant a system depends on.
Our discipline is that honesty is central: our tools refuse to compile code whose invariants cannot be proven, we document what we don’t yet do, and we treat auditable evidence as more valuable than confident claims.
We serve aerospace, automotive, medical device, and defense engineering teams whose work protects human lives, and we believe the software their systems depend on should be structurally correct by construction — not correct-by-testing-that-hopefully-caught-everything.
Add a sidecar declaration file alongside your existing C/C++ firmware. Aether enforces the properties you declare and produces a machine-verifiable certification manifest in under one millisecond per operation.