sota.io
2026-04-02·9 min read·sota.io team

Deploy Sather to Europe — Stephan Murer 🇩🇪 + Clemens Szyperski 🇩🇪, the Eiffel Successor That Invented Iterators on EU Infrastructure in 2026

In 1985, Bertrand Meyer 🇫🇷 — working at ETH Zürich and later at INRIA in France — designed Eiffel: the language that introduced Design by Contract to the world. Pre-conditions, post-conditions, and class invariants were not assertions added after the fact; in Eiffel they were part of the type system, checked by the compiler, and expressible as formal specifications that every method had to respect. This was a European idea, from a European institution, and it changed how the field thought about software correctness.

Five years later, a team at the International Computer Science Institute (ICSI) in Berkeley, California built on Eiffel's foundation to design Sather — a language that kept what was best about Eiffel (strong typing, garbage collection, Design by Contract) while discarding what was most limiting (proprietary licensing, expensive tooling, no C interoperability). The two German researchers who became central to Sather's design and implementation — Stephan Murer 🇩🇪 and Clemens Szyperski 🇩🇪 — brought the European intellectual tradition of formal specification and type-theoretic rigor to a freely available, C-targeting language that could run on any machine.

Sather also invented something that every programmer now takes for granted: the iterator as a language primitive. Before Python generators, before JavaScript async/await, before Rust's Iterator trait, Sather had !-suffixed methods that yield values one at a time through a loop construct. This was not a library pattern — it was built into the language. Every modern language that supports lazy sequences of values stands somewhere in Sather's shadow.

ICSI Berkeley and the German Researchers Who Built Sather

The International Computer Science Institute is an independent research centre affiliated with UC Berkeley, founded in 1988. It attracted researchers from Europe and around the world to work on problems at the intersection of computer science theory and practical systems. In the early 1990s, ICSI became the birthplace of Sather.

Stephan Murer 🇩🇪 is a German computer scientist who joined ICSI from the European tradition of type-theoretic programming language research. His work on Sather focused on the design of the core type system — particularly the handling of multiple inheritance and the linearisation mechanism that resolved the diamond problem without sacrificing expressiveness. Murer understood that Eiffel's approach to multiple inheritance, while powerful, created complexity that was difficult for programmers to reason about; Sather's linearisation made inheritance order deterministic and transparent.

Clemens Szyperski 🇩🇪 studied at Universität Passau in Bavaria before joining ICSI. At ICSI he became one of the principal implementors of GNU Sather — the open-source version that made the language freely available under the GPL and established it as a viable alternative to Eiffel for universities and research institutions. Szyperski later wrote "Component Software: Beyond Object-Oriented Programming" (Addison-Wesley, 1997; second edition 2002), which became one of the most influential books in software architecture. His work on Sather informed his thinking about component composition and type systems that shaped the component software field.

Both Murer and Szyperski brought to Sather what European computer science had been building since the 1960s: the belief that programming languages should make correct programs easy to write and incorrect programs hard to write — not by adding runtime checks, but by encoding correctness conditions in the type system and the language semantics themselves.

The language itself — Sather 1.0, released in 1990, and GNU Sather, released freely through the 1990s — is named after Sather Tower on the UC Berkeley campus, itself named after Jane Krom Sather (a Norwegian-American benefactor whose estate funded the tower). The Scandinavian etymological connection is accidental but fitting: Sather shares intellectual lineage with Simula, BETA, and the Scandinavian OOP tradition through Eiffel, which was itself deeply influenced by Simula's class concept.

Design by Contract: Correctness as a Compiler Responsibility

The most important idea Sather inherited from Eiffel — and preserved more accessibly — is Design by Contract. Every class in Sather can declare three kinds of formal specification:

These are not comments. They are executable specifications, checked at runtime in debug mode and usable as documentation in production. A class invariant declared once applies to every method in the class: every method that receives a valid object must return a valid object. The compiler knows this and can verify it.

class BANK_ACCOUNT is
  attr balance: FLT;
  attr owner_id: STR;
  attr consent_logged: BOOL;
  
  -- Class invariant: enforced at all times
  invariant: balance >= 0.0
    and owner_id.length > 0
    and consent_logged;
  
  -- Method with pre- and post-conditions
  deposit(amount: FLT) is
    pre amount > 0.0           -- caller must provide positive amount
    post balance = old(balance) + amount  -- balance must increase by exactly amount
  do
    balance := balance + amount
  end;
  
  withdraw(amount: FLT) is
    pre amount > 0.0 and amount <= balance  -- cannot overdraft
    post balance = old(balance) - amount
  do
    balance := balance - amount
  end;
  
  -- Consent must be established before any operation
  create(id: STR, initial: FLT, has_consent: BOOL): SAME is
    pre id.length > 0 and initial >= 0.0 and has_consent
  do
    res ::= new;
    res.owner_id := id;
    res.balance := initial;
    res.consent_logged := has_consent;
    return res
  end
end;

The old(balance) expression in the post-condition refers to the value of balance at the moment the method was called. This is a Sather feature inherited from Eiffel: post-conditions can compare the state after the method with the state before it, making it possible to formally specify that a deposit increases the balance by exactly the deposited amount — and have the compiler verify this at runtime.

This is Design by Contract as Bertrand Meyer 🇫🇷 intended it: not a testing framework, not a runtime assertion library, but a formal specification mechanism built into the language itself.

Iterators: The Innovation That Changed Everything

Sather's most original contribution to programming language design is the iterator — a method suffix and control structure that predates Python generators (PEP 255, 2001), JavaScript generators (ES6, 2015), and Rust's Iterator trait (pre-1.0, 2014) by a decade or more.

In Sather, any method whose name ends with ! is an iterator. An iterator method can yield values, pausing between each yield and resuming when the next value is requested. The calling code uses a loop ... end construct that repeatedly invokes the iterator until it is exhausted:

class RANGE is
  -- Iterator: yields integers from start to end (inclusive)
  upto!(start, finish: INT): INT is
    i: INT := start;
    loop
      if i > finish then quit end;
      yield i;
      i := i + 1
    end
  end;
  
  -- Fibonacci iterator
  fib!: INT is
    a: INT := 0;
    b: INT := 1;
    loop
      yield a;
      tmp ::= a + b;
      a := b;
      b := tmp
    end
  end
end;

-- Using the iterator:
class MAIN is
  main is
    r ::= RANGE::new;
    
    -- Sum 1 to 100 using iterator
    sum: INT := 0;
    loop
      n ::= r.upto!(1, 100);
      sum := sum + n
    end;
    
    -- Print: 5050
    #OUT + sum + "\n"
  end
end;

The ! suffix makes iterators immediately recognisable in code. The quit statement terminates iteration. The yield statement produces a value and suspends the iterator until the next loop iteration requests the next value. This is lazy evaluation of sequences without requiring a separate lazy evaluation semantic for the whole language.

Python's generators — introduced in 2001 — use yield in exactly the same way. JavaScript's generators — standardised in ES6 — use function* and yield. Kotlin's sequence { yield(value) }. Rust's yield-based generators (unstable). All of these are variations on the pattern that Sather formalised in 1990.

The CLU language (Barbara Liskov 🇺🇸, MIT, 1975) introduced the iterator concept earlier than Sather. Sather acknowledged CLU as an influence and refined the iterator model into the form — !-suffix, yield, loop/end — that is closest to what modern languages implement.

Multiple Inheritance Linearisation

Eiffel's approach to multiple inheritance was powerful but complex: a class could inherit from multiple parents and had to explicitly rename conflicting features. This gave maximum flexibility but required the programmer to resolve every conflict manually.

Sather chose a different approach: linearisation. When a class inherits from multiple parents that define the same method, Sather resolves the conflict by determining a linear order of the parent classes and calling the first definition found in that order. The linearisation algorithm is deterministic and described in the language specification — the programmer can always predict which implementation will be called.

This is the same approach that Python adopted for its Method Resolution Order (MRO) in Python 2.3 (the C3 linearisation algorithm). Sather's linearisation was an earlier, simpler form of the same idea: make multiple inheritance predictable without requiring manual conflict resolution.

-- Multiple inheritance with no conflict:
class PRINTABLE is
  print is do #OUT + "printable" end
end;

class SERIALISABLE is
  serialise: STR is do return "serialised" end
end;

-- Inherits from both without conflict:
class DATA_OBJECT < PRINTABLE, SERIALISABLE is
  attr id: INT;
  attr payload: STR
end;

When conflicts do arise, Sather requires explicit disambiguation — but the language's default resolution rules mean that most multiple inheritance hierarchies work without any additional annotations.

The GNU Sather Implementation

GNU Sather — the open-source version developed primarily by Clemens Szyperski 🇩🇪 and the ICSI team — compiles Sather source to C code, which is then compiled by the system C compiler to a native binary. This architecture has several advantages:

  1. Portability: Any platform with a C compiler can run GNU Sather programs
  2. Performance: The generated C code can be compiled with aggressive optimisations
  3. Interoperability: Sather can call C libraries directly through foreign function interfaces
  4. Auditability: The intermediate C code is human-readable and inspectable
# Build GNU Sather from source on EU Linux server:
sudo apt-get install -y build-essential gcc make git

git clone https://github.com/gnu/sather.git /opt/sather
cd /opt/sather
./configure --prefix=/usr/local
make
sudo make install

# Hello World in Sather:
cat > hello.sa << 'EOF'
class MAIN is
  main is
    #OUT + "Hello from Sather 🇩🇪 — Murer + Szyperski (ICSI Berkeley) on EU infrastructure!\n"
  end
end;
EOF

sather hello.sa -o hello
./hello

The compiled binary is a standard ELF executable with no Sather runtime dependencies beyond the C standard library. Deployment to EU infrastructure requires no special runtime environment — the binary runs anywhere Linux runs.

EU Regulatory Angles

GDPR Art. 25 — Data Protection by Design and by Default: Design by Contract is the most direct expression of "privacy by design" that any programming language has ever offered. A class that processes personal data can declare its invariants — consent_valid, purpose_limitation_respected, retention_period_not_exceeded — as class invariants that the compiler enforces on every method. No method can leave the object in a state that violates these invariants. This is GDPR Art. 25 encoded at the language level, not in documentation or tests.

GDPR Art. 5(1)(d) — Data Accuracy: Post-conditions in Sather methods can formally specify that data transformations are correct — that a calculated field equals the expected formula, that a derived attribute is consistent with its source. This makes data accuracy requirements verifiable rather than merely intended.

EU AI Act Art. 9 — Risk Management Systems: AI components that must be auditable — under the EU AI Act's requirements for high-risk AI systems — benefit from Sather's contract-based specification. Pre- and post-conditions can document exactly what inputs an AI component accepts, what guarantees it provides about its outputs, and what invariants it maintains throughout its operation. These are formal specifications that auditors can inspect.

NIS2 — Secure Software Design: Class invariants in Sather enforce security properties throughout an object's lifetime. An authentication object can declare as an invariant that it never holds decrypted credentials in memory longer than necessary; a session object can declare that session tokens are always within their validity period. These are compiler-enforced guarantees, not runtime assertions that could be disabled.

Deutsche Wissenschaftstradition: Sather's design reflects the German engineering tradition of rigour, specification, and formal correctness. Stephan Murer 🇩🇪 and Clemens Szyperski 🇩🇪 brought to an American research institute the European conviction that programming languages should make correctness properties explicit and verifiable. Szyperski's later book on component software — written in Germany, published in the UK — became a reference text for software architecture across European universities and technology companies.

Deploy Sather on sota.io

sota.io supports any language that compiles to a Linux binary. A Sather application compiled with GNU Sather and packaged as shown below deploys with:

sota deploy --region eu-west

The platform detects the container, provisions EU infrastructure on Hetzner (Germany) or Scaleway (France), injects managed PostgreSQL credentials as environment variables, configures TLS termination, and assigns a .sota.io subdomain. All infrastructure runs within the European Economic Area.

FROM ubuntu:24.04 AS builder
RUN apt-get update && apt-get install -y \
    build-essential gcc make git curl

# Build GNU Sather from source
RUN git clone https://github.com/gnu/sather.git /opt/sather && \
    cd /opt/sather && \
    ./configure --prefix=/usr/local && \
    make && make install

WORKDIR /app
COPY *.sa ./
RUN sather main.sa -o server

FROM ubuntu:24.04
RUN apt-get update && apt-get install -y libpq5 ca-certificates
COPY --from=builder /app/server /app/server
EXPOSE 8080
CMD ["/app/server"]

For an HTTP server using Sather's foreign function interface to call C networking libraries:

-- server.sa: Minimal HTTP server via C FFI
class MAIN is
  -- Bind to PORT env var (injected by sota.io)
  main is
    port_str ::= #ENV["PORT"];
    port: INT := port_str.to_i;
    
    -- Start HTTP server on the configured port
    server ::= HTTP_SERVER::create(port);
    
    loop
      req ::= server.accept!;
      -- Handle request with Design by Contract:
      handle_request(req)
    end
  end;
  
  handle_request(req: HTTP_REQUEST) is
    pre req.method.length > 0
    post req.response_sent
  do
    req.respond(200, "Hello from Sather 🇩🇪 on EU infrastructure\n")
  end
end;

The contract on handle_request — pre req.method.length > 0 and post req.response_sent — ensures that every request the server receives has a valid HTTP method, and that every handled request sends a response. These are not assertions in the body of the method; they are part of the method's specification, checked by the runtime in debug mode and available as documentation for any developer who reads the code.

The language Stephan Murer 🇩🇪 designed at ICSI, that Clemens Szyperski 🇩🇪 implemented as GNU Sather and carried into his foundational work on component software — is still compilable, still deployable, and still the clearest statement that formal specification and language design belong together. Design by Contract is not a testing strategy. It is a specification language built into the type system. Sather proved that in 1990.

sota.io is the EU-native platform-as-a-service for developers who need European infrastructure, GDPR compliance by default, and managed PostgreSQL without the operational overhead. Deploy your Sather application to EU servers in minutes at sota.io.