![](bg2.png)
transition systems enabling the classification of sys-
tems into correct and incorrect ones with respect to
a property. It is only recently, however, that the dis-
tinction between properties and contracts has started
being explored. Yet, in much of the literature, con-
tract comparison is still defined in terms of how the
contracts regulate systems e.g. saying that a contract
is stricter than another if any system which violates
the latter will also violate the former. This means that
to reason about contracts one has to bring to play the
systems which they regulate.
Orthogonal to this issue is that of the notion of
time in contracts. From work in linear temporal log-
ics, one can (broadly) categorize such logics into a
number of categories: (i) ones which permit reason-
ing about sequentiality of events; (ii) ones which can
also reason about time using a notion of a discrete
global clock; and (iii) ones which allow reasoning
about timers which can take continuous time values
and which can interact with such timers e.g. trigger-
ing on timeouts, or resetting the timers. The notion
of continuous time clocks, i.e. (iii), introduces ad-
ditional complexity including aspects which may be
undecidable as can be seen, for instance, in the exten-
sive work on verification of timed automata and hy-
brid systems in general (Asarin et al., 2012). Multi-
party session types, which share much with contracts
have been extended to deal with timed aspects (Boc-
chi et al., 2014). Our approach to time shares much
with theirs, although our handling of notions such as
permission allows for an implicit notion of deontic
modalities
Furthermore, if events are timed, one has to intro-
duce a notion of time in the deontic logic — whether
in a point-wise manner (e.g. an obligation to perform
a particular action at a particular time) or over time
intervals (e.g. an obligation to perform a particular
action before a deadline). There is much work about
the combination of discrete time temporal and deon-
tic logics, but less so with dense-time logics. Our ap-
proach is an interval logic one, taking the approach
adopted by real time logics such as duration calculus
(Chaochen et al., 1991), which only allows statements
about signal values over non-point intervals.
In earlier work, we have developed a calculus to
reason about contracts independently of the systems
(Cambronero et al., 2017) in which, only temporal
sequentiality of events was handled. In this paper,
we present a time extension, give an operational view
of contracts, and use simulation techniques to reason
about contracts at an operational level.
The paper is organised as follows. First, we
present a running example (section 2) used through-
out the paper to clarify concepts. Then, the notation
we will use to formalize our notions is presented in
Section 3. We then present our timed contract calcu-
lus Themulus in Section 4 and formalize the notion of
refinement of contracts in section 5. We finally con-
clude in Section 6 with some conclusions and possible
lines of future work.
2 RUNNING EXAMPLE
In the rest of the paper, we will illustrate our logic and
results based on a contract commonly used in the lit-
erature, that of a plane boarding system, based on e.g.
(Azzopardi et al., 2014). In this section we present
this use case — an agreement between the passenger
and airline company, regulating the plane boarding
process, from check-in till the flight, including time
constraints. The use case is a simplified version based
on the Madrid Barajas airport regulations.
1. The passenger is permitted to use the check-in desk
within two hours before the plane takes off (t
0
).
2. At the check-in desk, the passenger is obliged to present
her boarding pass whitin 5 minutes.
3. After presenting the boarding pass, the passenger must
show her passport, she has 5 minutes for this purpose.
4. Henceforth, the passenger is (i) prohibited from carry-
ing liquids in her hand-luggage until boarding; and (ii)
prohibited from carrying weapons during the whole trip
until the plane lands. If she has liquids in her hand-
luggage, she is obliged to dispose of them within 10
minutes.
5. After presenting her passport, the passenger is permit-
ted to board within 90 minutes and to present the hand-
luggage to the staff within 10 minutes. Therefore, the
airline company is obliged to allow the passenger to
board within 90 minutes. If the passenger is stopped
from carrying luggage, the airline company is obliged
to put the passenger’s hand luggage in the hold within
20 minutes.
3 BACKGROUND AND
NOTATION
Contracts regulate the behaviour of agents or par-
ties that are acting concurrently. In this Section, we
present notation used to describe these agents and
their behaviour in order to be able to formalize con-
tracts in the following sections.
Structurally, the underlying system consists of
several indexed agents running in parallel, using vari-
ables A, A
1
to represent the individual agents. The sys-
tem as a whole will consist of the parallel composition
of all agents indexed by a finite set I i.e. the system
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
194