First, feature redefinition, as seen above, is explicit. Second, because the language is typed, a compiler can check statically whether a feature application a.f is correct. Such errors will not happen during the execution of a type-checked Eiffel system. In other words, the language reconciles dynamic binding with static typing . Static typing means that the compiler makes sure there is at least one such version.
Assertions provide a further mechanism for controlling the power of redefinition.
Preconditions and postconditions provide the answer by limiting the amount of freedom granted to eventual redefiners.