On 21 Jan 2026, at 03:09, Liberty Lover <rix....@gmail.com> wrote:
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/7bde2d51-3bec-4292-8bc0-4de7d5c89e1cn%40googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/BAFD1734-A84A-4A0C-88F0-745296B62802%40gmail.com.
Like Ian I am a bit skeptical about the name as it seems to suggest (from what I see, unwittingly) that either the rest of Eiffel is complicated, or this is a simplified version of Eiffel. But that may be too late to change and is not the end of the world.
More importantly, and possibly off-track since I have not had the time to look at the actual contents, here is a suggestion. If really it is meant to be a better library, it should use model-based contracts, namely MML. That is not so hard to do, and in particular does not require a hard-core competency in formal methods. The idea is simply that you identify a mathematical model behind every Eiffel concept; the model is expressed in terms of simple concepts, typically a set, a sequence, a function, or a combination of two or three of these elements. Then you express the effect of every operation as an operation on these mathematical objects. For example if behind a graphical interface you have a collection of widgets, an operation that removes a widget has a postcondition stating that the associated set does not have that element any more.
On MML https://se.inf.ethz.ch/people/schoeller/mml.html, The first reference given there can serve a tutorial on the concepts, but the above comments give the basic idea.
A library equipped with contracts of that kind becomes more attractive in my opinion.
-- BM
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/BAFD1734-A84A-4A0C-88F0-745296B62802%40gmail.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/1f2b01dc8ac2%243f86a730%24be93f590%24%40inf.ethz.ch.
To: Eiffel Users Group
Subject: Progress Report: MML Integration and Contract Refinement
This and other recent threads have been incredibly productive. I would like to report on concrete progress following Bertrand's suggestions and Eric’s detailed critique regarding the use of the Mathematical Model Library (MML) and automated reasoning.
simple_mml LibraryFollowing Bertrand's recommendation, we extracted the MML classes from $ISE_EIFFEL/unstable/library/base2/mml/ to create a Void-safe and SCOOP-compatible simple_mml library. This library provides:
MML_MODEL: Base class with model equality operator |=|.
MML_SEQUENCE [G]: Ordered collections (stacks, queues, lists).
MML_SET [G]: Unique unordered elements.
MML_BAG [G]: Collections with counted duplicates.
MML_MAP [K, V]: Key-value pairs.
MML_RELATION [K, V]: Multi-valued keys.
MML_INTERVAL: Integer ranges.
The simple_mml library is now fully void-safe (void_safety="all") and SCOOP-compatible (concurrency="scoop"). All 26 tests pass.
The primary challenge was the model_equals feature in MML_MODEL:
frozen model_equals (v1, v2: detachable ANY): BOOLEAN
With unconstrained generics ([G]), the compiler raises VUAR(2) errors when passing generic type parameters to detachable ANY arguments.
Our initial attempt used [G -> ANY] constraints, but this was incorrect as it constrains G to attached types only. The correct solution is [G -> detachable ANY]:
class MML_SET [G -> detachable ANY]
class MML_SEQUENCE [G -> detachable ANY]
class MML_BAG [G -> detachable ANY]
class MML_MAP [K -> detachable ANY, V -> detachable ANY]
class MML_RELATION [G -> detachable ANY, H -> detachable ANY]
This declared constraint allows the generic parameter to be either attached or detachable, ensuring compatibility with model_equals. Lesson learned (soon to be forgotten by Claude): When working with void-safe generics, the constraint must match the detachability of the target parameter type, not just the base type.
We have updated our AI workflow prompts (steps 01–07) to incorporate MML from the earliest specification phases:
Step 02 (Define Structure): Inclusion of model query signatures.
Step 04 (Write Postconditions): Preference for model-based postconditions (e.g., model |=| old model & x).
Step 05 (Write Invariants): Establishing model consistency.
Step 07 (Xtreme Maintenance): Implementing "Contract Assaults" to stress-test specifications.
simple_sorterWe addressed Eric’s specific criticisms of the previous implementation:
| Issue | Resolution |
| Missing sorted postcondition | Added result_sorted: is_sorted (a_array, a_key, a_descending). |
| Missing contracts in descendants | Added full pre/postconditions to heap_sort, merge_sort, etc. |
| Naming inconsistencies | Renamed to create_array_from_list (query) and copy_array_to_list (command). |
Arbitrary is_empty pre-condition | Removed; empty containers are now treated as trivially sorted. |
| Multi-key sorting | Added sort_by_then_by and sort_by_comparator with agent support. |
Redundant /= Void checks | Removed; unnecessary in a void-safe system. |
I am going to assume that Eric is correct regarding the performance trade-offs of complex assertions. We encountered this directly with an $O(n^2)$ is_permutation postcondition that hung during a 100K-element adversarial test:
ensure
count_unchanged: a_array.count = old a_array.count
result_sorted: is_sorted (a_array, a_key, a_descending)
-- result_permutation: is_permutation (a_array, old a_array.twin)
-- Note: Disabled for runtime performance; requires static verification.
With AutoProof, these expensive postconditions could be verified statically once, then safely disabled for production. This validates the MML + AutoProof synergy Bertrand and Eric described.
This discussion highlights the unique rigor of the Eiffel ecosystem. In mainstream stacks—Java, Python, Rust, or Go—developers often lack both the vocabulary and tools for this conversation. They cannot write ensure result_sorted as a native language feature; they rely on "testing by example" rather than "specification by contract."
While Claude’s initial simple_sorter was flawed within our Eiffel context and group expertise, its output still included void-safe types and feature categorization—foundations other languages cannot replicate. Our ability to fix AI-generated code through systematic methodology is a testament to Eiffel’s 40-year investment in software engineering.
Apply simple_mml to simple_container as the next proof-of-concept.
Investigate AutoProof tooling for static verification of expensive postconditions.
Document MML patterns for broader ecosystem adoption.
Thank you for the constructive feedback. This is exactly how we push the state of the art forward.
Best regards,
Larry
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/05ac68bc-c733-44f5-86f8-bacf2e2cc59d%40gobosoft.com.
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/b7dd9442-d393-47a0-94a2-e2de7055c757%40gobosoft.com.
Summary of Results
| Library | Constraint | Compilation | Tests |
| simple_mml |
[G -> detachable separate ANY] |
| Success | 26/26 pass |
| simple_container |
[G -> detachable separate ANY] |
| Success | 51/51 pass |
Both libraries compile successfully, and all 77 tests pass with the explicit separate keyword.
Eric,
Thank you for the clarification on generic constraints. We tested your observation that [G] is equivalent to [G -> detachable separate ANY] and that using [G -> detachable ANY] actually removes the implicit separate.
Based on your feedback, we updated both simple_mml and simple_container to use the explicit [G -> detachable separate ANY] constraint.
Updated MML_MODEL: Modified model_equals to:
frozen model_equals (v1, v2: detachable separate ANY): BOOLEAN
Updated simple_mml: Applied [G -> detachable separate ANY] to all generic classes (MML_SET, MML_SEQUENCE, MML_BAG, MML_MAP, MML_RELATION).
Updated simple_container: Applied the same constraint across all 11 generic classes.
simple_mml: Compiles, 26 tests pass.
simple_container: Compiles, 51 tests pass.
The explicit separate constraint works correctly and maintains SCOOP compatibility while still allowing the generic parameters to be passed to model_equals for void-safe model equality comparisons.
Already stated, but once more could you point me to official documentation that confirms [G] = [G -> detachable separate ANY]? I searched eiffel.org and the ECMA-367 standard but only found references stating [G] = [G -> ANY], without mention of detachable or separate.
Is this an ISE EiffelStudio-specific behavior since separate is not part of the core ECMA standard?
Thanks,
Larry
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/b7dd9442-d393-47a0-94a2-e2de7055c757%40gobosoft.com.
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/ffa172d0-bb6e-4697-b601-cae04110e164%40gobosoft.com.
simple_mml Ecosystem Integration Report
Over the past few hours, I have instructed Claude to apply the simple_mml (Mathematical Modeling Library) to 25 libraries in the simple_* Eiffel ecosystem. We utilized a systematic methodology termed "X03 Contract Assault" to strengthen specifications and verify consistency.
| Metric | Value |
| Libraries integrated | 25 |
| Source files modified | 49 |
| Total tests passing | 750+ |
| Bugs discovered | 2 |
| Redundant preconditions removed | 110+ |
| MML Type | Libraries Using | Primary Use Case |
| MML_SEQUENCE | 19 | Ordered collections, lists, arrays |
| MML_MAP | 13 | Key-value stores, indexes, registries |
| MML_SET | 11 | Unique collections, domains, keys |
| MML_BAG | 1 | Multisets (sorting permutation proofs) |
| MML_RELATION | 1 | Graph edges |
| MML_INTERVAL | 1 | Date/time ranges |
Integrated Libraries: simple_cache, simple_config, simple_container, simple_csv, simple_datetime, simple_diff, simple_encoding, simple_factory, simple_file, simple_graph, simple_hash, simple_http, simple_json, simple_logger, simple_math, simple_mock, simple_persist, simple_process, simple_regex, simple_scheduler, simple_sorter, simple_sql, simple_testing, simple_validation, simple_xml.
Using model queries allows us to prove properties that were previously difficult to express. For example, in simple_sorter, we can now mathematically prove a sort is a permutation:
sort (a_array: ARRAY [G]; a_key: FUNCTION [G, COMPARABLE]; a_descending: BOOLEAN)
ensure
model_sorted: is_sequence_sorted (array_to_sequence (a_array), a_key, a_descending)
model_permutation: array_to_bag (a_array) |=| old array_to_bag (a_array.twin)
Following Eric Bezault's clarification, all MML classes now utilize the most permissive constraint to ensure full SCOOP and Void Safety compatibility:
class MML_SET [G -> detachable separate ANY]
class MML_MAP [K -> detachable separate ANY, V -> detachable separate ANY]
The transition to attached types by default allowed us to strip a significant amount of "defensive" code that is no longer reachable:
simple_regex: 55+ redundant preconditions removed.
simple_hash: 23 redundant preconditions removed.
simple_xml: 19 redundant preconditions removed.
The rigor of model-based postconditions exposed two latent bugs:
simple_cache: LRU eviction failed for duplicate keys because it used prune_all (object equality) instead of same_string for STRING keys.
simple_mock: A VAPE error was caught where HTTP status constants used in preconditions were incorrectly exported to {NONE}.
The shift from implementation-based contracts to mathematical modeling significantly elevates the reliability of the code:
Before MML (Implementation-coupled):
ensure count_updated: entries.count = old entries.count + 1
After MML (Abstract Property):
ensure key_in_model: model_entries.domain [a_key]
ensure key_is_most_recent: model_keys.last.same_string (a_key)
simple_mml demonstrates that lightweight mathematical modeling is practical for real-world Eiffel development. The six core MML classes successfully covered the modeling needs of 25 diverse libraries. This integration validates Design by Contract at scale: 750+ tests pass with strengthened specifications, and two subtle bugs were identified and fixed.
Best regards,
Larry
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/1f2b01dc8ac2%243f86a730%24be93f590%24%40inf.ethz.ch.
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/8d598068-e8e9-4bb1-a829-0b0332b9294a%40gobosoft.com.
Eric,
The recent errors were not compile-time, but contract violations caught by the new MML-based postconditions. Here is the breakdown of what we encountered:
simple_regex (2 failures)Failed Tests: test_match_all_basic, test_match_all_as_strings
The Postcondition:
ensure
result_model: Result.matches_model |=| old Result.matches_model.extended (...)
The Cause: The MML |=| operator performs a deep equality check calling is_equal on elements. Because SIMPLE_REGEX_MATCH had not overridden is_equal, it defaulted to reference equality. When the old expression created a deep_twin copy of the model, the copied match objects had different references than the new result objects.
Resolution: Overriding is_equal in SIMPLE_REGEX_MATCH to compare values rather than references resolved the failure.
simple_process (7 failures)Failed Tests: test_output_of_command, test_output_of_command_echo, test_output_of_command_dir, etc.
The Postcondition:
ensure
execution_recorded: execution_count = old execution_count + 1
The Cause: This was a genuine logic omission exposed by the contract. The output_of_command feature calls execute, which delegates to execute_in_directory. However, execute_in_directory was failing to increment the internal execution_count_impl.
Resolution: Added the missing increment to the implementation, ensuring the abstract count correctly mirrors the internal execution state.
--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/c50ad6a6-002d-4f70-987b-998af7431e0b%40gobosoft.com.


--
You received this message because you are subscribed to the Google Groups "Eiffel Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to eiffel-users...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/eiffel-users/e2e84b1c-fece-408b-a9cb-f5d719bb134d%40gobosoft.com.
