Require and Assert.

docs/control-structures.rst

@@ -396,12 +396,19 @@ Currently, Solidity automatically generates a runtime exception in the following
 #. If your contract receives Ether via a public getter function.
 #. If you call a zero-initialized variable of internal function type.
 #. If a ``.transfer()`` fails.
+#. If you call ``assert`` with an argument that evaluates to false.
 
 While a user-provided exception is generated in the following situations:
 #. Calling ``throw``.
+#. Calling ``require`` with an argument that evaluates to ``false``.
 
-Internally, Solidity performs a revert operation (instruction ``0xfd``) when a user-provided exception is thrown. In contrast, it performs an invalid operation
-(instruction ``0xfe``) if a runtime exception is encountered. In both cases, this causes
+Internally, Solidity performs a revert operation (instruction ``0xfd``) when a user-provided exception is thrown or the condition of
+a ``require`` call is not met. In contrast, it performs an invalid operation
+(instruction ``0xfe``) if a runtime exception is encountered or the condition of an ``assert`` call is not met. In both cases, this causes
 the EVM to revert all changes made to the state. The reason for this is that there is no safe way to continue execution, because an expected effect
 did not occur. Because we want to retain the atomicity of transactions, the safest thing to do is to revert all changes and make the whole transaction
 (or at least call) without effect.
+
+If contracts are written so that ``assert`` is only used to test internal conditions and ``require``
+is used in case of malformed input, a formal analysis tool that verifies that the invalid
+opcode can never be reached can be used to check for the absence of errors assuming valid inputs.