For example:
https://github.com/yairchu/red-black-tree/blob/master/AvlTre... -- in lines 13..21, an AVLTree type is defined -- with its invariants encoded in the type system. If there's a mistake in these 9 lines, you may get a wrong program. But the nice thing is that if you get just these 9 lines right -- then the hundreds of lines below it that implement an AVL tree cannot get the AVL invariants wrong.
The same is also true for Red Black Trees: https://github.com/yairchu/red-black-tree/blob/master/RedBla...
Lines 26..36 inclusive encode the RBTree type such that the invariants are enforced by the type-checker.
In case this is unclear: the type-checker enforcing the correctness of the invariants is at compile-time. A running program is a correct program, at least from the invariants' perspective.