BERK — a systems language, strong and fast
A truly bilingual (Turkish/English) syntax. C/C++ performance across 18 MCU families plus desktop and WebAssembly. Determinism is a declared, machine-checked effect — no unsafe or FFI in your code; the standard-library boundary is a measured trust base (1,689 natives, all contracted). Designed to produce certification evidence; not yet qualified.
16 effects, machine-checked
Not one IO marker — sixteen effects: saf/pure, deterministik,
sınırlı/WCET, tahsis_yok/no-alloc, panik_yok,
özyineleme_yok, sabit_zaman/constant-time, sertifikalanabilir…
Determinism is a declared guarantee the machine checks. sertifikalanabilir/certifiable is not a certification claim;
it is a compiler-checked profile: fallback_safe + deterministic (→ bounded) + no_panic.
- ✓Transitive purity — a saf function that calls an impure one loses the guarantee, computed by fixpoint over the call graph
- ✓sınırlı — forbids the unbounded iken loop, so WCET stays provable
- ✓Contracts, not monads — a precondition violated by a constant argument is a compile error; at runtime a deterministic, traceable trap, not a panic
- ✓berk kontrol — the same gate for CI; a violated contract stops the program before it runs
// the same program, in two languages fonksiyon ana() -> sayı yap // TR yazdır("Merhaba") son function main() -> int do // EN print("Hello") end // effects are declared on the function saf fonksiyon topla(v: liste) -> sayı yap döndür indirge(v) // bit-for-bit son // one API — Cortex-M, RISC-V, ESP32… 18 MCU families, same code kullan embedded::bal::gpio gpio_yaz(PA5, YÜKSEK)
// Hardware as a first-class language concept — NO unsafe, NO FFI in user code yazmaç GPIOA_MODER: u32 @ 0x4002_0000 // register alan MODER5: GPIOA_MODER[10..12] // typed bitfield MODER5 <- 0b01 // atomic, volatile, bounds-checked kesme TIM2_IRQ önceliği 3 yap // interrupt + priority in-language son
Hardware as a first-class, safe language concept
C is register-transparent but unsafe; Rust is safe but needs unsafe + crates. BERK combines both: no unsafe, no FFI in your code — pure-BERK bare-metal; the native boundary is inventoried and contracted (1,689/1,689).
- ✓Typed registers + bitfields — access is guaranteed-volatile by the type, bounds-checked
- ✓Interrupts as language constructs — vector table and priority in-language
- ✓18 MCU families behind one safe HAL — Cortex-M, RISC-V, ESP32…; plus desktop and WebAssembly. Scope: the HAL definitions of the 18 families live in the stdlib and are verified by BAL pure-logic tests (plus 4 platform-binding tests) — no on-board runs on these families. The only board-measured target is the STM32F746G-DISCO (Cortex-M7, through separate bare-metal packages)
- ✓Go-simple memory — value semantics + regions (bölge); no-heap and no-panic are compiler-enforced, region-escape caught at compile time
A signed, verifiable ecosystem
12 licensed sector packages
Sector packages for certification-critical institutions: avionics, ADAS, railway, medical devices, space, telecom, robotics, MILS partitioning, DDS, protocols, radar and spectral_plus. They are not in the public registry; they are delivered in person under license. Every version carries a SHA256 checksum and an ed25519 signature, and bpm verifies both on the receiving machine before install — trust is in the signature, not the host.
78 public packages, 11 layers
The public registry at packages.berk-systems.com holds 78 signed packages (305 published versions): domain libraries (ai, bio, finance, ros) · scientific & numerical (exact, linalg, optim, stats …) · text & pattern processing · civil DSP & audio (spectral, audio) · data formats · graphics, imaging & geometry (cad, cad3d, mesh, vision …) · physics & engineering · cryptography & post-quantum (pqc) · networking, web & databases · embedded, industrial & RTOS · system tools & GUI. Each package ships with bilingual training docs.
Toolchain
Interpreter and LLVM/AOT compiler, REPL, LSP language server, a DAP debugger (breakpoints, step execution; "BERK Debug" in VS Code), linter, formatter, the bpm package manager, the berk kontrol CI gate, berkdoc, a VS Code extension published on the Visual Studio Marketplace (berk-lang 1.0.0) and an in-browser playground.
Why "BERK"?
In Old Turkic, berk means strong, robust, solid — and lightning. It unites the durability of a safe, correct compiler with LLVM-fast, C++-level execution. Internationally, BERK stands for Beyond-Efficient Runtime Kernel.
Not a claim, an inventory: the trust base in numbers
Measured on 10 November 2026 (scripts/tcb_envanter.py, the full test package and the criterion gates in the repository). Your BERK code has no
unsafe; the language's standard-library boundary is an inventoried, fully contracted trust base.
- ✓Defined behaviour — array bounds checks, the
boşunit type, the overflow policy and the deterministic executor are identical in the interpreter, in native AOT and in LLVM wasm32 (Phase A parity gate 82/82; 222 programs identical in wasm32, 20 deliberately out of scope; 204 programs bit-identical across N runs on three engines) - ✓Trust base — 1,689 native declarations, 1,689 contracted, 0 without a contract; FFI registry 3,055 → 515 (only the declared surface is callable)
- ✓Single-kernel maths — qualified and bare
sin/cos/tan/pow/exp/logshare one portable kernel, bit-identical on 1,999 samples (previously: libm drift); no platform libm on reachable paths (static gate); floatmin/maxfollow IEEE 754-2019 maximumNumber/minimumNumber, identical in both engines - ✓72-hour fuzzing — the fourth run (6–9 November 2026, one binary, seven stages, 72 hours uninterrupted): lexer, parser, type checker and WASM generator 0 defects; the 5 root causes found in the interpreter, IR and differential stages were fixed with red→green criteria; a 6-hour verification run compared 39,700 programs across three engines with 0 differences
- ✓The silent-wrong class is closed — silent 0 stubs, fake success, binding to the wrong module, panic paths → either a real body or an explicit error (HTTP status is checked, SQL parameter counts are checked)
- ✓What we do not claim — 792 target-hardware declarations have no symbol binding on any target; the “72 hours, zero defects” criterion is not yet met (a fifth run on the fixed binary is pending); the first ASan/UBSan measurement (209 programs, Linux) reported 0 findings but leaks are counted separately and remain open; the self-contained WASM back-end generates only an embedded subset (the whole language goes through LLVM wasm32); there is no formal qualification