2026-04-02·10 min read·sota.io team

Deploy Modula-3 to Europe — Luca Cardelli 🇮🇹 (Olivetti Research Cambridge 1988), the Type-Safe Language That Invented Garbage Collection and Taught Java Everything, on EU Infrastructure in 2026

In 1988, a small team of computer scientists at two research laboratories — one in Palo Alto, one in Cambridge, England — published a language specification that would quietly reshape the programming world. The language was Modula-3. Within a decade, its three most radical ideas — automatic garbage collection in a statically typed language, interfaces as a first-class abstraction, and threads with mutexes built into the standard library — would appear in the most widely used programming language ever created: Java.

James Gosling, Java's creator, named Modula-3 explicitly when describing Java's intellectual debts. "From Modula-3," he noted in the Java Language Specification, came the thread model, the exception structure, and — most fundamentally — the proof that a systems language could be both statically typed and garbage-collected without becoming impractically slow.

The European half of Modula-3's design came from Olivetti Research Centre in Cambridge, England, where Luca Cardelli 🇮🇹 — born in Montecatini Terme, Tuscany, Italy — was the principal type theorist. Cardelli had previously earned his MSc and PhD at the University of Edinburgh 🏴󠁧󠁢󠁳󠁣󠁴󠁷, one of Europe's leading computer science departments, before moving to the Cambridge research lab of Italy's most famous technology company: Olivetti.

Luca Cardelli and Olivetti Research Cambridge

Luca Cardelli 🇮🇹 is one of the most cited and consequential programming language researchers in European computing history. Born in Italy, educated in Edinburgh, he spent his career on the EU side of the Atlantic — first at Olivetti Research Centre in Cambridge 🇬🇧, then at Digital Equipment Corporation's Systems Research Center, then at Microsoft Research Cambridge 🇬🇧, where he remained for over two decades.

His intellectual contributions span three decades:

Modula-3 (1988): type-safe systems language with GC, interfaces, threads
Fun and Cardelli-Wegner (1985): foundational paper on subtype polymorphism — "On Understanding Types, Data Abstraction, and Polymorphism" — the theoretical basis of object-oriented type systems everywhere
F-calculus and System F<: (1994): the core type theory behind generics in Java, C#, Scala, and TypeScript
Mobile ambients (1998, with Andrew Gordon 🇬🇧): process calculus that influenced mobile computing security
Strand type system (2011): influenced Rust's ownership types

Olivetti (Ivrea, Turin 🇮🇹) — the company behind Olivetti Research Cambridge — is one of Italy's most storied technology companies. Founded in 1908 by Camillo Olivetti, it pioneered programmable calculators (Programma 101, 1965, the world's first personal computer), mainframes, and personal computers before IBM. The Cambridge research arm, operating in the 1980s and 1990s, represented a direct pipeline between Italian industry and the English university town that had produced Alan Turing, Maurice Wilkes, and the first stored-program computer.

The Modula-3 design committee:

Luca Cardelli 🇮🇹 (Olivetti Research Centre, Cambridge 🇬🇧 / DEC SRC)
James Donahue (DEC SRC, Palo Alto, USA)
Lucille Glassman (DEC SRC)
Mick Jordan 🇬🇧 (Olivetti Research Centre, Cambridge 🇬🇧)
Bill Kalsow (DEC SRC)
Greg Nelson (DEC SRC)

The language's intellectual DNA was shaped by the Cambridge contingent: Cardelli brought European type theory; Jordan brought the systems perspective of British industrial research. The result was a language that sat precisely at the intersection of theoretical rigour and practical deployability.

Language Features

Modula-3 is the third generation of Niklaus Wirth's Modula lineage — Modula-2 was the second — but it replaced Wirth's focus on minimalism with Cardelli's insistence on soundness. The result is a language where the type system genuinely cannot lie:

Type Safety and Garbage Collection

(* Modula-3 is garbage-collected and type-safe by default *)
(* No dangling pointers. No buffer overflows. No use-after-free. *)

MODULE Hello;

IMPORT IO, Fmt;

TYPE
  Person = OBJECT
    name: TEXT;
    age: INTEGER;
  METHODS
    greet(): TEXT
  END;

  PersonImpl = Person OBJECT OVERRIDES
    greet := Greet
  END;

PROCEDURE Greet(self: Person): TEXT =
BEGIN
  RETURN "Hello, " & self.name & "! You are " & Fmt.Int(self.age) & " years old.";
END Greet;

VAR
  p: Person := NEW(PersonImpl, name := "Cardelli", age := 70);

BEGIN
  IO.Put(p.greet() & "\n");
END Hello.

The garbage collector means that NEW(PersonImpl, ...) allocates on the heap and the memory is automatically reclaimed. In 1988, this was radical: the conventional wisdom was that GC and static typing were incompatible at systems performance levels. Cardelli and the SRC team proved the conventional wisdom wrong, and Java inherited the proof.

Interfaces — Before Java

Modula-3's OBJECT TYPE hierarchy with opaque types pioneered what Java would later call interfaces:

(* Define an interface via opaque partial reveal *)
INTERFACE Database;

TYPE
  T <: REFANY;  (* opaque type - caller sees only T, not the implementation *)

PROCEDURE Connect(host: TEXT; port: INTEGER): T;
PROCEDURE Query(db: T; sql: TEXT): TEXT;
PROCEDURE Close(db: T);

END Database.

(* Implementation module — the concrete type is private *)
MODULE Database;

REVEAL
  T = REF RECORD
    socket: INTEGER;
    host: TEXT;
    (* internal fields hidden from callers *)
  END;

PROCEDURE Connect(host: TEXT; port: INTEGER): T =
VAR conn: T;
BEGIN
  conn := NEW(T, host := host, socket := 0);
  (* establish connection... *)
  RETURN conn;
END Connect;

(* ... *)

END Database.

The caller sees only the opaque T type — they cannot access internal fields, cannot cast to implementation types, cannot break abstraction barriers. This information hiding is enforced at compile time, not convention. Java's interface keyword and TypeScript's structural types both trace their lineage to this Modula-3 pattern, developed by Cardelli at Olivetti Research Cambridge.

First-Class Threads and Mutexes

Modula-3 standardised concurrent programming before Java's synchronized existed:

MODULE ConcurrentCounter;

IMPORT Thread, Mutex;

TYPE
  Counter = OBJECT
    mu: MUTEX;
    value: INTEGER := 0;
  METHODS
    increment();
    get(): INTEGER;
  END;

  CounterImpl = Counter OBJECT OVERRIDES
    increment := Increment;
    get := Get;
  END;

PROCEDURE Increment(self: Counter) =
BEGIN
  LOCK self.mu DO
    INC(self.value);
  END;
END Increment;

PROCEDURE Get(self: Counter): INTEGER =
BEGIN
  LOCK self.mu DO
    RETURN self.value;
  END;
END Get;

(* Spawn a thread *)
PROCEDURE Worker(arg: REFANY): REFANY =
VAR c: Counter := arg;
BEGIN
  FOR i := 1 TO 1000 DO c.increment() END;
  RETURN NIL;
END Worker;

BEGIN
  VAR c := NEW(CounterImpl, mu := NEW(MUTEX));
  VAR t1 := Thread.Fork(NEW(Thread.Closure, apply := Worker, arg := c));
  VAR t2 := Thread.Fork(NEW(Thread.Closure, apply := Worker, arg := c));
  Thread.Join(t1);
  Thread.Join(t2);
  (* c.get() = 2000, guaranteed by LOCK semantics *)
END ConcurrentCounter.

MUTEX, LOCK, and Thread.Fork are in the standard library — not a third-party package, not an OS-specific import. The Modula-3 specification defines their semantics precisely, including deadlock prevention rules that the compiler can partially enforce. Java's synchronized, wait(), and notify() are direct descendants of this design.

Exception Handling

MODULE SafeDatabase;

IMPORT Database, IO;

EXCEPTION ConnectionFailed(TEXT);
EXCEPTION QueryError(TEXT);

PROCEDURE FetchData(host: TEXT): TEXT
  RAISES {ConnectionFailed, QueryError} =
VAR
  db: Database.T;
  result: TEXT;
BEGIN
  TRY
    db := Database.Connect(host, 5432);
    TRY
      result := Database.Query(db, "SELECT 1");
      RETURN result;
    FINALLY
      Database.Close(db);  (* always executed, even on exception *)
    END;
  EXCEPT
    Database.Error(msg) => RAISE ConnectionFailed("Cannot connect: " & msg);
  END;
END FetchData;

BEGIN
  TRY
    IO.Put(FetchData("db.example.com") & "\n");
  EXCEPT
    ConnectionFailed(msg) => IO.Put("Failed: " & msg & "\n");
  | QueryError(msg) => IO.Put("Query error: " & msg & "\n");
  END;
END SafeDatabase.

TRY/EXCEPT/FINALLY with typed exceptions and checked exceptions (procedures declare what they raise) — this is Modula-3's 1988 exception system. Java adopted all three: typed exceptions, checked exceptions (the throws clause), and finally. The design was Cardelli's.

cm3 — The Open-Source Modula-3 Compiler

CM3 (Critical Mass Modula-3) is the primary open-source implementation of Modula-3. It compiles to native code via a C backend and supports Linux on x86 and amd64:

# Install from source on Ubuntu/Debian
apt-get install -y gcc make g++ libglib2.0-dev

# Build CM3 from source (available on GitHub: modula3/cm3)
git clone https://github.com/modula3/cm3.git
cd cm3/scripts
./do-cm3-core.sh

# Or use the pre-built binary releases
# tar.gz available for Linux/amd64

# Compile a Modula-3 program
cd my-project
cm3 -build

# Run
cm3 -run

CM3 includes the full standard library: Thread, Mutex, IO, Fmt, Text, Rd (readers), Wr (writers), OS, Pathname, and network programming interfaces. It compiles to native binaries with performance comparable to C for compute-bound workloads.

Deploying to Europe with sota.io

(* src/Server.m3 — minimal HTTP server in Modula-3 *)
MODULE Server;

IMPORT IO, Fmt, TCP, IP, Thread;

CONST PORT = 8080;

PROCEDURE HandleClient(arg: REFANY): REFANY =
VAR
  conn: TCP.T := arg;
  response: TEXT;
BEGIN
  response := "HTTP/1.0 200 OK\r\n" &
              "Content-Type: text/plain\r\n" &
              "\r\n" &
              "Modula-3 on sota.io — EU infrastructure, GDPR-compliant\r\n";
  (* write response to connection *)
  TCP.Close(conn);
  RETURN NIL;
END HandleClient;

BEGIN
  VAR server := TCP.Listen(IP.Endpoint{IP.Any, PORT});
  IO.Put("Modula-3 server on :" & Fmt.Int(PORT) & "\n");
  LOOP
    VAR conn := TCP.Accept(server);
    EVAL Thread.Fork(NEW(Thread.Closure, apply := HandleClient, arg := conn));
  END;
END Server.

FROM debian:bookworm AS build

RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc g++ make git \
    libglib2.0-dev \
    && rm -rf /var/lib/apt/lists/*

# Build CM3 from source
RUN git clone --depth 1 https://github.com/modula3/cm3.git /tmp/cm3
WORKDIR /tmp/cm3
RUN cd scripts && ./do-cm3-core.sh 2>&1 | tail -20

ENV PATH="/tmp/cm3/bin:$PATH"

WORKDIR /app
COPY src/ ./src/
COPY m3makefile ./

RUN cm3 -build

FROM debian:bookworm-slim
WORKDIR /app
COPY --from=build /app/server .
EXPOSE 8080
CMD ["./server"]

# Deploy to EU infrastructure
curl -fsSL https://cli.sota.io/install.sh | sh
sota login
sota deploy --region eu-central-1

sota.io runs on Hetzner infrastructure in Germany, ISO 27001 certified, GDPR-compliant by architecture. Your Modula-3 services stay in EU jurisdiction — no Schrems II exposure, no US CLOUD Act reach.

The Olivetti–Cambridge–Cardelli Lineage

Modula-3 occupies a precise node in the genealogy of modern type systems. Following the lineage reveals how thoroughly European programming language research shaped the tools that power the global software industry:

Modula-2 (Niklaus Wirth 🇨🇭, ETH Zürich, 1978)
    ↓
Modula-3 (Cardelli 🇮🇹 + Jordan 🇬🇧, Olivetti Research Cambridge, 1988)
    ├── Java (James Gosling, Sun, 1995)
    │       → cited Modula-3 GC + interfaces + threads
    │       → today runs 3 billion devices
    ├── C# (.NET, Microsoft, 2000)
    │       → built by Anders Hejlsberg 🇩🇰 on Java/Modula-3 concepts
    └── TypeScript (Anders Hejlsberg 🇩🇰, MSR Cambridge, 2012)
            → type theory by Cardelli 🇮🇹 at MSR Cambridge 🇬🇧
            → System F<: (Cardelli 1994) = foundation of TS generics

Anders Hejlsberg 🇩🇰, who designed both C# and TypeScript, worked at Microsoft Research Cambridge alongside Cardelli. The structural type system of TypeScript — where {name: string, age: number} is a subtype of {name: string} because it has all required fields — implements the subtype polymorphism theory from Cardelli's 1985 paper "On Understanding Types, Data Abstraction, and Polymorphism."

Every TypeScript developer writing interface User { name: string } is working with a type system whose foundations Luca Cardelli developed at Olivetti Research Cambridge in 1988.

EU Regulatory Relevance

GDPR Article 25 — Data Protection by Design: Modula-3's opaque type system enforces information hiding at compile time. A Database.T opaque type cannot expose internal fields to modules that don't have explicit REVEAL access. This compile-time enforcement of access boundaries is precisely what "data protection by design" means translated into language semantics: the compiler prevents access to private data, rather than relying on runtime checks or developer discipline.

EU AI Act Article 9 — Risk Management: Modula-3's checked exception system (RAISES clauses) requires procedures to declare every failure mode. A function that can raise ConnectionFailed or QueryError must declare both; callers that don't handle them fail to compile. For AI systems that must demonstrate exhaustive error handling (required by EU AI Act Art. 9 for high-risk systems), language-enforced checked exceptions provide a stronger guarantee than documentation or convention.

NIS2 Directive — Thread Safety for Critical Infrastructure: Modula-3's MUTEX and LOCK semantics are formally specified in the language standard. Unlike C's POSIX threads (library calls with undefined behaviour on misuse) or Python's GIL (a runtime workaround), Modula-3's thread model provides compiler-verifiable mutual exclusion. For NIS2-regulated operators of essential services who must demonstrate secure concurrent design, Modula-3's formal thread model is directly relevant.

Legacy and Influence

Modula-3's direct descendants include the most widely used languages in the world:

Java (1995): James Gosling cited Modula-3 for GC, interfaces, and the thread/mutex model. The Java garbage collector design at Sun drew directly on the SRC GC work Cardelli contributed to.
C# (2000): Anders Hejlsberg 🇩🇰 built C# on Java's foundation, which rests on Modula-3. The using statement (deterministic cleanup), checked exceptions, and interface design all trace to Modula-3.
TypeScript (2012): Cardelli's type theory (System F<:, subtype polymorphism, structural typing) from his MSR Cambridge years is the mathematical foundation of TypeScript's type system.
Rust (2015): Rust's ownership types have conceptual ancestors in Cardelli's work on uniqueness typing and linear types (developed in part during his Cambridge years).
Go (2009): Go's interface system — implicit structural satisfaction rather than explicit declaration — is a more radical version of the information hiding Modula-3 pioneered.

The Modula-3 system at DEC SRC also produced two influential papers: Cardelli's "A Semantics of Multiple Inheritance" (1984) and "On Understanding Types, Data Abstraction, and Polymorphism" (1985, with Peter Wegner) — papers that appear in the bibliography of virtually every PhD thesis in programming language theory written since.