Themulus: A Timed Contract-calculus
∗
Alberto Aranda Garc
´
ıa
1
, Mar
´
ıa-Emilia Cambronero
2
, Christian Colombo
1
, Luis Llana
3
and Gordon J. Pace
1
1
Department of Computer Science, University of Malta, Malta
2
Department of Computer Science, University of Castilla-La Mancha, Albacete, Spain
3
Department of Computer Science and the Knowledge Technology Institute, University Complutense of Madrid, Spain
gordon.pace@um.edu.mt
Keywords:
Deontic Logic, Formal Methods, Operational Semantics, Simulation Semantics, Themulus.
Abstract:
Over these past years, formal reasoning about contracts between parties has been increasingly explored in the
literature. There has been a shift of view from that viewing contracts simply as properties to be satisfied by the
parties to contracts as first class syntactic objects which can be reasoned about independently of the parties’
behaviour. In this paper, we present a real-time deontic contract calculus, Themulus, to reason about contracts,
abstracting the parties’ behaviour through the use of a simulation relation. In doing so, we can compare
real-time deontic contracts in terms of their strictness over permissions, prohibitions and obligations.
1 INTRODUCTION
The need for formal techniques for reasoning about
contracts is becoming increasingly important as soft-
ware systems interact more frequently with other sys-
tems and with our everyday life. Although for many
applications a property-based approach suffices —
specifying pre-/post-conditions, invariants, temporal
properties, etc. — other applications require a first
class notion of contracts which property-based ap-
proaches do not address sufficiently well. Deontic
logics (Georg Henrik Von Wright, 1951) have been
developed precisely to deal with such a need to talk
about ideal behaviour of a system, possibly also in-
cluding exceptional situations when the system devi-
ates from such behaviour. For instance, consider a
contract which specifies that a party is to perform a
particular action, but if they fail to do so, they will
incur an additional charge (which they are obliged to
pay) and prohibited from taking certain actions until
they do so. Such contracts, typically using a deontic
logic, have been referred to as total contracts and have
been argued to be more informative (with the right
abstractions) than simple properties (Fenech et al.,
∗This work has been supported by the Spanish
MINECO-FEDER (grant numbers DArDOS, TIN2015-
65845-C3-1-R and FAME, RTI2018-093608-B-C31) and
the Region of Madrid (grant number FORTE-CM,
S2018/TCS-4314)
2009). The opportunity to move from seeing speci-
fications simply as expressions in a logic which must
hold to the higher level view of them being a form
of contract goes back to Khosla (Khosla, 1988). By
looking at contracts as first-class entities which can
be reasoned about, manipulated, etc., one can perform
contract analysis independent of the systems the con-
tract will regulate, e.g., one can analyze contracts for
potential conflicts, or to evaluate which is the stricter
one.
Different approaches to contract analysis have
been reported in the literature, with most approaches
focusing on the violation semantics of contracts, thus
enabling the characterization of agreements between
parties or agents regulating their behaviour. In sys-
tems with interacting parties, contracts play an even
more important role since an agent’s behaviour (or
non-behaviour) directly impacts other agents. Sur-
prisingly, many contract logics reason about deon-
tic modalities such as obligations and permissions
without specifying agents, and the literature address-
ing reasoning about directed deontic modalities is
relatively sparse (e.g. Modal Action Logic (Jere-
maes et al., 1986), deontic STIT logic (Belnap and
Perloff, 1993; Horty, 2001), Business Contract Lan-
guage (Governatori and Milosevic, 2005), contract
automata (Pace and Schapachnik, 2012)).
Interaction has long been studied in computer sci-
ence using calculi to reason about communicating
García, A., Cambronero, M., Colombo, C., Llana, L. and Pace, G.
Themulus: A Timed Contract-calculus.
DOI: 10.5220/0008878001930204
In Proceedings of the 8th International Conference on Model-Driven Engineering and Software Development (MODELSWARD 2020), pages 193-204
ISBN: 978-989-758-400-8; ISSN: 2184-4348
Copyright
c
2022 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved
193
transition systems enabling the classification of sys-
tems into correct and incorrect ones with respect to
a property. It is only recently, however, that the dis-
tinction between properties and contracts has started
being explored. Yet, in much of the literature, con-
tract comparison is still defined in terms of how the
contracts regulate systems e.g. saying that a contract
is stricter than another if any system which violates
the latter will also violate the former. This means that
to reason about contracts one has to bring to play the
systems which they regulate.
Orthogonal to this issue is that of the notion of
time in contracts. From work in linear temporal log-
ics, one can (broadly) categorize such logics into a
number of categories: (i) ones which permit reason-
ing about sequentiality of events; (ii) ones which can
also reason about time using a notion of a discrete
global clock; and (iii) ones which allow reasoning
about timers which can take continuous time values
and which can interact with such timers e.g. trigger-
ing on timeouts, or resetting the timers. The notion
of continuous time clocks, i.e. (iii), introduces ad-
ditional complexity including aspects which may be
undecidable as can be seen, for instance, in the exten-
sive work on verification of timed automata and hy-
brid systems in general (Asarin et al., 2012). Multi-
party session types, which share much with contracts
have been extended to deal with timed aspects (Boc-
chi et al., 2014). Our approach to time shares much
with theirs, although our handling of notions such as
permission allows for an implicit notion of deontic
modalities
Furthermore, if events are timed, one has to intro-
duce a notion of time in the deontic logic — whether
in a point-wise manner (e.g. an obligation to perform
a particular action at a particular time) or over time
intervals (e.g. an obligation to perform a particular
action before a deadline). There is much work about
the combination of discrete time temporal and deon-
tic logics, but less so with dense-time logics. Our ap-
proach is an interval logic one, taking the approach
adopted by real time logics such as duration calculus
(Chaochen et al., 1991), which only allows statements
about signal values over non-point intervals.
In earlier work, we have developed a calculus to
reason about contracts independently of the systems
(Cambronero et al., 2017) in which, only temporal
sequentiality of events was handled. In this paper,
we present a time extension, give an operational view
of contracts, and use simulation techniques to reason
about contracts at an operational level.
The paper is organised as follows. First, we
present a running example (section 2) used through-
out the paper to clarify concepts. Then, the notation
we will use to formalize our notions is presented in
Section 3. We then present our timed contract calcu-
lus Themulus in Section 4 and formalize the notion of
refinement of contracts in section 5. We finally con-
clude in Section 6 with some conclusions and possible
lines of future work.
2 RUNNING EXAMPLE
In the rest of the paper, we will illustrate our logic and
results based on a contract commonly used in the lit-
erature, that of a plane boarding system, based on e.g.
(Azzopardi et al., 2014). In this section we present
this use case — an agreement between the passenger
and airline company, regulating the plane boarding
process, from check-in till the flight, including time
constraints. The use case is a simplified version based
on the Madrid Barajas airport regulations.
1. The passenger is permitted to use the check-in desk
within two hours before the plane takes off (t
0
).
2. At the check-in desk, the passenger is obliged to present
her boarding pass whitin 5 minutes.
3. After presenting the boarding pass, the passenger must
show her passport, she has 5 minutes for this purpose.
4. Henceforth, the passenger is (i) prohibited from carry-
ing liquids in her hand-luggage until boarding; and (ii)
prohibited from carrying weapons during the whole trip
until the plane lands. If she has liquids in her hand-
luggage, she is obliged to dispose of them within 10
minutes.
5. After presenting her passport, the passenger is permit-
ted to board within 90 minutes and to present the hand-
luggage to the staff within 10 minutes. Therefore, the
airline company is obliged to allow the passenger to
board within 90 minutes. If the passenger is stopped
from carrying luggage, the airline company is obliged
to put the passenger’s hand luggage in the hold within
20 minutes.
3 BACKGROUND AND
NOTATION
Contracts regulate the behaviour of agents or par-
ties that are acting concurrently. In this Section, we
present notation used to describe these agents and
their behaviour in order to be able to formalize con-
tracts in the following sections.
Structurally, the underlying system consists of
several indexed agents running in parallel, using vari-
ables A, A
1
to represent the individual agents. The sys-
tem as a whole will consist of the parallel composition
of all agents indexed by a finite set I i.e. the system
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
194
will be of the form ||
iPI
A
i
. We will use variables A,
A
1
to denote the state of the system as a whole.
Notation: The visible behaviour of the system and
agents will be assumed to consist of actions over Act,
and the agents’ behaviour will be assumed to con-
sist of (i) a relation indicating how their state changes
whenever such action occurs; and (ii) a relation indi-
cating how they change over time. Time will be taken
to range over the non-negative reals: T = R
+
. Agents
semantics are thus represented as timed labelled tran-
sition systems:
• A
a
−−Ñ A
1
, for a P Act, indicates that agent A
changes to A
1
upon performing action a. As it is
usual in process algebrae (Yi, 1991), the execu-
tion of actions does not consume time. The tran-
sition A
a
−−Û indicates that agent A cannot perform
a: A
a
−−Û
df
= DA
1
¨ A
a
−−Ñ A
1
.
• A
d
::; A
1
, for d ą 0 P T, indicates that agent A
evolves to A
1
after d time units pass.
Assumptions: We will assume that agents are non-
blocking: for any agent A, there is an agent state A
1
such that either (i) A
a
−−Ñ A
1
(for some a P Act); or (ii)
A
d
::; A
1
(for some d ą 0 P T). We also assume the
following common properties of the time transition
relation: time determinism, time additivity, and time
continuity.
We can now define how a system as a whole
(a composition of agents) evolves. There are two
kinds of transitions: (i) action transitions of the form
A
a,S
−−Ñ A
1
will indicate that system A can perform ac-
tion a P Act with agents indexed by S P 2
I
participat-
ing, to become system A
1
; and (ii) timed transitions
A
d
::; A
1
indicate the evolution of the system as a
whole over time.
Definition 1. We define the following transition rela-
tions over systems:
• A
a,S
−−Ñ A
1
, with S P 2
I
indicating that agents in
S (and no others) synchronise on action a. For-
mally, A
a,S
−−Ñ A
1
, where A = A
1
}A
2
}¨¨¨}A
n
, and
A
1
= A
1
1
} A
1
2
¨¨¨ } A
1
n
1
is defined as follows: (i) the
number of agents does not change: n = n
1
; (ii)
agents other than those whose index appears in S
do not participate in action a: @i P I ¨i R S ñ A
i
=
A
1
i
; and (iii) agents indexed in S evolve over action
a: @i P I ¨ i P S ñ A
i
a
−−Ñ A
1
i
.
• A
d
::; A
1
indicates that system A evolves to A
1
after d ą 0 P T time units pass. Formally we define
A
d
::; A
1
to mean that all agents evolve with a
time transition of length d: A
i
d
::; A
1
i
for all
i P I, where A = A
1
} ¨ ¨ ¨ } A
l
} ¨ ¨ ¨ } A
n
, and A
1
=
A
1
1
} ¨¨¨ } A
1
l
} ¨¨¨ } A
1
n
.
We will also write A
a,S
−−Ñ to mean that system A
can perform action a involving the agents in set S:
A
a,S
−−Ñ
df
= DA
1
¨ A
a,S
−−Ñ A
1
. The lack of such a transi-
tion is written as: A
a,S
−−−−Û.
In order to formalize violation of contracts, we
will use predicates over agent behaviour.
Definition 2. A predicate is defined in terms of the
following grammar:
P ::= tt | ff | xa, ky | xa, ky | P _ Q | P ^ Q
In the grammar above, k P I ranges over agent
indices, a P Act over actions, and P, Q P P over pred-
icates.
Predicates tt and ff denote true and false respec-
tively. Predicate xa, ky means that agent k may per-
form action a. However, since some actions may re-
quire involvement by several agents, we use the pred-
icate xa, ky to indicate that agent k wants to perform
action a, but this action is not offered by any other
agent for synchronisation. For instance, an agent c
may want to purchase a ticket (action: ticket) to go
to a theatre. Predicate xticket, cy indicates the success
of such an action with c participating. However, if
the action requires the participation of the ticket of-
fice, we can write the predicate xticket, cy to indicate
that c wanted to perform the action, but neither the
ticket office (nor any other agent) was willing to per-
form the handshake required. Predicate disjunction
and conjunction are indicated by P _ Q and P ^ Q re-
spectively.
Definition 3.The semantics of a predicate P under a
system A, written A ( P, is defined as follows:
A ( tt
df
= true
A ( ff
df
= false
A ( xa, ky
df
= DS P 2
I
, A
1
¨ A
a,S
−−Ñ A
1
^ k P S
A ( xa, ky
df
= A
a,tku
−−−−Ñ and @l ¨l ‰ k ñ A
l
a
−−Û
A ( P _ Q
df
= A ( P or A ( Q
A ( P ^ Q
df
= A ( P and A ( Q
We can now define the notion of stronger-than and
that of equivalence between predicates.
Definition 4. Given predicates P, Q P P , we say that
P is stronger than Q, written P ( Q, iff for any state
of any system A for which A ( P holds, A ( Q also
holds. We say that P is equivalent to Q, written P )(
Q, iff P ( Q and Q ( P.
Themulus: A Timed Contract-calculus
195
We will now present a proposition which indicates
how equivalence combines with disjunction and ac-
tion success.
Proposition 1. Let P, Q P P , k be an agent index and
a P Act, then
1. If P
)(tt, then xa, ky _ P
)( tt and xa, ky _
P
)( tt.
2. If P _ Q )( tt then P )( tt or Q )( tt.
4 A TIMED CONTRACT
CALCULUS
We can now define our contract calculus Themulus.
We start by defining its syntax and an equivalence re-
lation over the syntactic forms. We then define the
notion of contract violation conditions based on the
operational semantics of the calculus. As we men-
tioned before, we will assume a time domain T rang-
ing over the non-negative reals. In order to deal with
the recursion operator, we assume a set of variables
fvars over which recursion will be defined.
4.1 Contract Syntax
Definition 5. The set of contract formulae denoted by
C (with variable ϕ P C to range over the contracts) is
syntactically defined as follows:
ϕ ::= J | K | P
k
paqrds | O
k
paqrds | F
k
paqrds
| waitpdq | cond
k
paqrdspϕ
1
, ϕ
2
q | ϕ
1
;ϕ
2
| ϕ
1
^ ϕ
2
| ϕ
1
_ ϕ
2
| ϕ
1
§ ϕ
2
| rec x.ϕ | x
where a P Act, x P fvars, k P I and d P T Y t8u.
The basic formulae J and K indicate, respectively,
the contracts that are trivially satisfied and violated.
The key modalities we use from deontic logic to spec-
ify contracts are permissions, obligations, and prohi-
bitions. The formula P
k
paqrds indicates the permis-
sion of agent k to perform action a within d time units,
while O
k
paqrds is an obligation on agent k to perform
action a within d time units, and F
k
paqrds is the pro-
hibition on agent k to perform action a within d time
units. The formula waitpdq represents a delay of d
time units.
Contract disjunction is written as ϕ
1
_ ϕ
2
, and
contract conjunction as ϕ
1
^ ϕ
2
. The formula ϕ
1
;ϕ
2
indicates the sequential composition of two contracts
— in order to satisfy the whole contract, the first con-
tract ϕ
1
must be satisfied and then the second one ϕ
2
.
For instance, we can model the obligation of agent k
of doing action a in 3 time units after a delay of 2 time
units: waitp2q;O
k
paqr3s.
The reparation operator, written ϕ
1
§ ϕ
2
, is the
contract which starts off as ϕ
1
, but when violated trig-
gers contract ϕ
2
, e.g., O
1
paqr2s § P
2
pbqr5s is the con-
tract which obliges agent 1 to perform action a in 2
time units, but if she does not, permits agent 2 to per-
form action b in 5 time units.
The formula cond
k
paqrdspϕ
1
, ϕ
2
q is a conditional
contract where (i) if party k performs action a within d
time units it proceeds to behave like ϕ
1
; otherwise (ii)
if d time units elapse without a being performed by k,
it then proceeds to behave like ϕ
2
. Note that we can
generalize to more general conditions on the system,
but we limit it to the ability of a party to perform an
action for the scope of this paper.
Finally, rec x.ϕ and x handles recursive contracts,
e.g., rec x.O
p
paqrds; x is the contract which obliges
agent p to repeatedly perform action a within d time
units of each other. In contrast, rec x.O
r
pprqr10s ^
waitp30q;x, is the contract in which agent r is repeat-
edly obliged to pay rent (action pr) during the first 10
days of the month.
Using these basic contract combinators, we can
define more complex ones, for example, a prohibi-
tion which persists until a particular action is per-
formed — a prohibition on agent k from perform-
ing action a until party l performs action b, written
F pra, ksU rb, lsq, and defined as follows:
F pra, ksU rb, lsq
df
= rec x.
`
cond
k
paqr8spK, Jq^
cond
l
pbqr8spJ, xq
˘
Example 1. The contract of the plane boarding sys-
tem from Section 2, can be formalised using our con-
tract calculus as follows:
ϕ
0
::= P
p
pcheckinqrt
0
− 120s
ϕ
1
::= O
p
pPBPqr5s
ϕ
2
::= O
p
pShPqr5s
ϕ
3
::= pF prweapon, ps U rlanding, csqq^
ppF prlq, psU rboarding, psqq § O
p
pdlqqr10sq
ϕ
4
::= pP
p
pbrdqr90s;P
p
phlqr10sq§
pO
c
pbrdqr90s; O
c
phlhldqr20sq
PBS ::= ϕ
0
;ϕ
1
;ϕ
2
;pϕ
3
^ ϕ
4
q
Where t
0
is departure estimated time. Note that
the clauses ϕ
0
to ϕ
4
are used to express different parts
of the contract, and combined together in the top-level
contract expression PBS.
[\
The syntax of our logic allows for formulae
whose meaning is unclear. For instance, the formula
F
k
paqrds_x is not well-formed since it contains a free
instance of variable x. Another problem arises with
formulae such as rec x.F
k
paqrds _ x, which use recur-
sion not guarded by a prefix formula since the latter
ensures certain desirable properties of our operational
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
196
semantics. In order to simplify our semantics, we re-
strict the set of well-formed formulae to ones which
are (i) closed; and (ii) strongly prefixed. As usual,
the closed formulae are those that do not contain free
recursion variables (a recursion variable x is free if it
not bound to a rec x above it). A strongly prefixed for-
mula is one where all the occurrences of the formula
variables are prefixed by an obligation, prohibition,
permission or wait operation.
4.2 Syntactical Congruence
As in other such approaches (Milner, 1999), we start
by defining a syntactical congruence, denoted by ”,
between contracts. This congruence is to be applied
on a well-formed formula and its subformulae before
the rules of the operational semantics.
Definition 6. We define the relation ” Ď C ˆC as the
least congruence relation that includes:
1. ϕ ^ J ” ϕ 2. J ^ ϕ ” ϕ
3. K ^ ϕ ” K 4. ϕ ^ K ” K
5. ϕ _ J ” J 6. J _ ϕ ” J
7. ϕ _ K ” ϕ 8. K _ ϕ ” ϕ
9. J; ϕ ” ϕ 10. K; ϕ ” K
11. J § ϕ ” J 12. K § ϕ ” ϕ
13. O
k
paqr0s ” K 14. F
k
paqr0s ” J
15. P
k
paqr0s ” J 16. waitp0q ” J
17. cond
k
paqr0spϕ, ψq ” ψ
In order to compute the ” relation, we transform
it into a rewriting calculus: we can see the rules above
as rewriting rules going from left to right. For in-
stance, the equivalence rule 13 (O
k
paqr0s ” K) allows
us to rewrite O
k
paqr0s;P
l
pbqr5s to K; P
l
pbqr5s, which
in turn can be rewritten to K using rule 10 (K;ϕ ” K).
Definition 7. We write ϕ ãÑ ϕ
1
(where ϕ, ϕ
1
P C ), if ϕ
1
is the result of applying one of the equivalence rules
from left to right on a subexpression of ϕ.
Example 2. Returning to the plane boarding system
agreement, consider the obligation on passengers to
present the boarding pass (action PBP) within 5 time
units: O
p
pPBPqr5s. In this case, equivalence rule 13
can be applied after 5 time units: O
p
pPBPqr5s
5
::;
O
p
pPBPqr0s ãÑ K.
[\
In order to justify the simplification of contract
formulae by applying these rules repeatedly, we will
need to prove that the rewriting process is terminat-
ing and confluent. To prove confluence of ãÑ, we
will first prove local confluence, from which conflu-
ence follows using a standard result from computer
science.
Proposition 2. The ãÑ P C Ø C relation is: (i) ter-
minating: there is no infinite sequence ϕ
1
, ϕ
2
. . . ,
such that @i ¨ ϕ
i
ãÑ ϕ
i+1
; and (ii) locally confluent:
if ϕ ãÑ ϕ
1
and ϕ ãÑ ϕ
2
, then there exists a contract ϕ
1
such that ϕ
1
ãÑ
∗
ϕ
1
and ϕ
2
ãÑ
∗
ϕ
1
.
Proof. Since the right term is always syntactically
smaller than the one on the left, the relation ãÑ is a
well-founded relation, and thus, termination is easily
proved. Local confluence is proved by structural in-
duction on ϕ. The base cases are trivial. To prove the
inductive cases, we perform case by case analysis on
the different rules, which are applied to the subformu-
lae to show that the confluence result holds. [\
Based on these results, confluence of ãÑ follows using
Newman’s Lemma (Newman, 1942).
Corollary 1. The syntactic equivalence relation ap-
plied from left to right is confluent: if ϕ ãÑ
∗
ϕ
1
and
ϕ ãÑ
∗
ϕ
2
, then there is a contract ϕ
1
such that ϕ
1
ãÑ
∗
ϕ
1
and ϕ
2
ãÑ
∗
ϕ
1
.
Confluence and termination mean that any given
formula can be deterministically reduced to an irre-
ducible formula in a finite number of steps.
Definition 8. A contract formula ϕ P C is said to be
irreducible, if the equivalence relation cannot be ap-
plied to any of its subexpressions: Dϕ
1
P C ¨ ϕ ãÑ ϕ
1
.
Given contract formulae ϕ,ϕ
1
P C , we write ϕ ÞÝÑ
ϕ
1
iff (i) ϕ can be syntactically reduced to ϕ
1
in a num-
ber of steps: ϕ ãÑ
∗
ϕ
1
; and (ii) ϕ
1
is irreducible.
Confluence and termination guarantee that for a
given ϕ, there exists a unique ϕ
1
such that ϕ ÞÝÑ ϕ
1
.
4.3 Operational Semantics
We can now define an operational semantics for our
contract calculus. The rules of the operational seman-
tics appear in Figure 1. The semantics take one of
three forms: (i) ϕ
a,k
−−Ñ ϕ
1
to denote that contract ϕ
can evolve (in one step) to ϕ
1
when action a is per-
formed, which involves party k (and possibly other
parties); or (ii) ϕ
pa,kq
−−−−Ñ ϕ
1
indicating that the contract
ϕ can evolve to ϕ
1
when the action a is not offered by
any party other than k; or (iii) ϕ
d
::; ϕ
1
to represent
that contract ϕ can evolve to contract ϕ
1
when d time
units pass. We will use variable α to stand for a label
of either form: pa, kq or pa, kq. The rules of the op-
erational semantics are always applied to irreducible
terms.
The core of any contract reasoning formalism is
the rules defining the semantics of the deontic modal-
ities.
Rules (O1), (O2), (O3), (O4), and (O5) define the
behaviour of obligations O
k
paqrds, i.e., the obligation
on agent k to perform action a within d time units.
Themulus: A Timed Contract-calculus
197
(O1) O
k
paqrds
a,k
−−Ñ J
(O2) O
k
paqrds
pa,kq
−−−−Ñ J
(O3) O
k
paqrds
b,l
−−Ñ O
k
paqrds , pa, kq ‰ pb, lq
(O4) O
k
paqrds
pb,lq
−−−−Ñ O
k
paqrds , pa, kq ‰ pb, lq
(O5) O
k
paqrds
d
1
::; O
k
paqrd − d
1
s, 0 < d
1
ď d
(F1) F
k
paqrds
a,k
−−Ñ K
(F2) F
k
paqrds
pa,kq
−−−−Ñ K
(F3) F
k
paqrds
b,l
−−Ñ F
k
paqrds , pb, lq ‰ pa, kq
(F4) F
k
paqrds
pb,lq
−−−−Ñ F
k
paqrds , pb, lq ‰ pa, kq
(F5) F
k
paqrds
d
1
::; F
k
paqrd − d
1
s, 0 < d
1
ď d
(P1) P
k
paqrds
a,k
−−Ñ J
(P2) P
k
paqrds
b,l
−−Ñ P
k
paqrds, pa, kq ‰ pb, lq
(P3) P
k
paqrds
pa,kq
−−−−Ñ K
(P4) P
k
paqrds
pb,lq
−−−−Ñ P
k
paqrds, pa, kq ‰ pb, lq
(P5) P
k
paqrds
d
1
::; P
k
paqrd − d
1
s, 0 < d
1
ď d
(C1) cond
k
paqrdspϕ, ψq
a,k
−−Ñ ϕ
(C2) cond
k
paqrdspϕ, ψq
pa,kq
−−−−Ñ ϕ
(C3) cond
k
paqrdspϕ, ψq
b,l
−−Ñ ψ, pb, lq ‰ pa, kq
(C4) cond
k
paqrdspϕ, ψq
pb,lq
−−−−Ñ ψ, pb, lq ‰ pa, kq
(C5) cond
k
paqrdspϕ, ψq
d
1
::;
cond
k
paqrd − d
1
spϕ, ψq , 0 < d
1
ď d
(AO1)
ϕ
α
−−Ñ ϕ
1
, ψ
α
−−Ñ ψ
1
ϕ op ψ
α
−−Ñ ϕ
1
op ψ
1
(AO2)
ϕ
d
::; ϕ
1
, ψ
d
::; ψ
1
ϕ op ψ
d
::; ϕ
1
op ψ
1
(AO3)
ϕ
d
::; J, ψ
d
1
::; ψ
1
ϕ ^ ψ
d
1
::; ψ
1
, d
1
ě d
(AO4)
ϕ
d
::; ϕ
1
, ψ
d
1
::; J
ϕ ^ ψ
d
::; ϕ
1
, d ě d
1
(AO5)
ϕ
d
::; K, ψ
d
1
::; ψ
1
ϕ _ ψ
d
1
::; ψ
1
, d
1
ě d
(AO6)
ϕ
d
::; ϕ
1
, ψ
d
1
::; K
ϕ _ ψ
d
::; ϕ
1
, d ě d
1
(V1)
ϕ
α
−−Ñ ϕ
1
ϕ § ψ
α
−−Ñ ϕ
1
§ ψ
(V2)
ϕ
d
::; ϕ
1
ϕ § ψ
d
::; ϕ
1
§ ψ
(V3)
ϕ
d
::; K, ψ
d
1
::; ψ
1
ϕ § ψ
d+d
1
::::; ψ
1
(S1)
ϕ
α
−−Ñ ϕ
1
ϕ;ψ
α
−−Ñ ϕ
1
;ψ
(S2)
ϕ
d
::; ϕ
1
ϕ;ψ
d
::; ϕ
1
;ψ
(S3)
ϕ
d
::; J, ψ
d
1
::; ψ
1
ϕ;ψ
d+d
1
::::; ψ
1
(wait1) waitpdq
d
1
::; waitpd − d
1
q , 0 < d
1
ď d
(wait2) waitpdq
α
−−Ñ waitpdq
(REC1)
ϕ
α
−−Ñ ϕ
1
rec x.ϕ
α
−−Ñ ϕ
1
rx{rec x.ϕs
(REC2)
ϕ
d
::; ϕ
1
rec x.ϕ
d
::; ϕ
1
rx{rec x.ϕs
Figure 1: Operational Semantics transition rules.
Rules (O1) and (O2) handle the case of the obliga-
tion clause being satisfied when agent k does action a
within d time units, in this case, the contract reduces
to the trivially satisfied one (J). Rules (O3) and (O4)
consider the case when another agent l performs an
action (l ‰ k) or the action b is not the compulsory
one b ‰ a; in both cases the obligation remaining in-
tact. Let us recall that actions are instantaneous, so
the time constraints do not change. Finally, (O5) han-
dles the case when d
1
time units pass with d
1
ď d,
then the obligation remains, but the obligation time
decreases in d
1
time units. Recall that O
k
paqr0s is han-
dled through syntactic equivalence (” K).
Example 3. Let us consider the obligation on the pas-
senger (agent: p) to present the boarding pass (action
PBP) within 5 time units: O
p
pPBPqr5s. The possible
outcomes are: (i) rule (O1) applies if the passenger
presents the boarding pass within 5 time units, with
the contract evolving to J: O
p
pPBPqr5s
PBP,p
−−−−Ñ J; (ii)
rule (O2) can be applied if the passenger is not al-
lowed to perform the action: O
p
pPBPqr5s
pPBP,pq
−−−−−Ñ J;
(iii) if an action other than PBP is performed or PBP
is performed by another party, the obligation remains
intact by rule (O3): O
p
pPBPqr5s
b,l
−−Ñ O
p
pPBPqr5s
(where b ‰ PBP or l ‰ p); (iv) similarly if other
parties or actions are not allowed, the obligation re-
mains unchanged by rule (O4): O
p
pPBPqr5s
pb,lq
−−−−Ñ
O
p
pPBPqr5s (where b ‰ PBP or l ‰ p ); and finally
(v) rule (O5) handles when an amount of time less
than 5 time units elapses, in which case the obliga-
tion remains in force, but the deadline is moved ac-
cordingly: O
p
pPBPqr5s
δ
::; O
p
pPBPqr5 − δs (where
δ ď 5). Note that in this final case, when the deadline
of the obligation decreases to 0, the syntactic equiva-
lence O
p
pPBPqr0s ” K is directly applied and reduced
accordingly.
[\
Rules (F1), (F2), (F3), (F4), and (F5) define the cases
for prohibition similar to obligation.
Permission of agent k to perform action a within
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
198
d time units (P
k
paqrds) is defined through Rules (P1),
(P2), (P3), (P4) and (P5). Rule (P1) considers the
case when agent k consumes her permission to per-
form action a by actually performing it, in this case,
the contract reduces to the trivially satisfied one (J).
Rule (P2) handles the case when an agent other than
k performs an action or the action involving b is
not the permitted one a, leaving k’s permission in-
tact. Rule (P3) handles the case when the permis-
sion is violated because agent k intended to perform
action a, but it was not offered a synchronizing ac-
tion. Rule (P4) considers the case when another agent
than k intends to perform an action b (different to
a), but it was not offered a synchronizing action. Fi-
nally, Rule (P5) considers the case when d
1
time units
elapse, with d
1
ď d, then the permission remains, but
the permission time decreases by d
1
time units.
The rules for conditional contracts handle the
cases when the condition holds ((C1) and (C2)), and
when it does not ((C3) and (C4)), resolving the con-
tract to the appropriate branch. The rule (C5) consid-
ers the case when d
1
time units pass (with d
1
ď d), in
which case the conditional deadline decreases accord-
ingly.
The rules for conjunction and disjunction are
structurally identical, since both take the two con-
tracts to evolve concurrently. The difference between
the two operators is only exhibited when one of the
two operands reduces to J or K, which is then han-
dled by the equivalence rules. The first rule (AO1)
states that the conjunction or disjunction of two for-
mulae evolves along with both operands concurrently.
The second rule (AO2) considers the case in
which d time units pass for both contracts. Rule
(AO3) shows the case in which: (i) d time units pass
for the first contract, ϕ, then it evolves to J and (ii)
d
1
for the second one, ψ, evolving to ψ
1
, with d
1
ě d.
Thus, the contracts’ conjunction evolves as the sec-
ond one. (AO4) handles the case in which d time
units pass for the first contract, ϕ, then it evolves to
ϕ
1
and d
1
time units for the second one, ψ, then it
evolves to J, with d ě d
1
, thus the contracts conjunc-
tion evolves as the first one. Rules (AO5) and (AO6)
consider the cases in which the first or second contract
has been already violated and how the disjunction of
both contracts evolve, in an analogous manner as the
conjunction.
The rules for reparation and sequential composi-
tion are similar. The rules (V1) and (V2) allow mov-
ing along the primary contract when some actions are
done or the time passes. There is no need for rules
dealing with the recovering from a violation since this
is handled by the syntactic equivalence rules. The se-
quential composition rules (S1) and (S2) behave in
an analogous manner, allowing evolution along with
the first contract, with no need for additional rules
thanks to the syntactic equivalence rules. It is worth
noting that, similar to reparation which fires the sec-
ond operand on the first (shortest trace) violation, se-
quential composition fires the second operand on the
shortest match of the first operand. Rules (V3) and
(S3) are necessary for time additivity with reparation
and sequential composition, respectively.
Example 4. In our running example, we can consider
clause ϕ
4
, that is:
ϕ
4
::= pP
p
pbrdqr90s;P
p
phlqr10sq §
pO
c
pbrdqr90s; O
c
phlhldqr20sq
where the passenger is permitted to board within 90
minutes (P
p
pbrdqr90s) and, then to present the hand-
luggage to the staff within 10 minutes (P
p
phlqr10s).
Therefore, the reparation part of this clause indi-
cates that if the passenger is stopped from board-
ing or carrying luggage, the airline company is
obliged to allow the passenger to board within 90
minutes (O
c
pbrdqr90s) and then, to put the passen-
ger’s hand luggage in the hold within 20 minutes
(O
c
phlhldqr20s). If 90-time units pass, ϕ
4
evolves
in the following way:
P
p
pbrdqr90s;P
p
phlqr10s § O
c
pbrdqr90s; O
c
phlhldqr20s
90
::;
P
p
pbrdqr0s;P
p
phlqr10s § pO
c
pbrdqr90s; O
c
phlhldqr20s
” J;P
p
phlqr10s § pO
c
pbrdqr90s; O
c
phlhldqr20sq
The latter equivalence applies by rule 15, since
P
p
pbrdqr0s ” J. In turn, rule 9 can be applied to
the first part (J; P
p
phlqr10s ” P
p
phlqr10s), then
ϕ
4
::= P
p
phlqr10s § pO
c
pbrdqr90s; O
c
phlhldqr20sq.
Thereafter, if 10 time units pass, rule 15 can be
applied again (P
p
phlqr10s
10
::; P
p
pbrdqr0s ” J),
then ϕ
4
::= J § pO
c
pbrdqr90s; O
c
phlhldqr20sq.
And finally, applying rule 11: ϕ
4
::=
J § pO
c
pbrdqr90s; O
c
phlhldqr20sq ” J, then in
this case, it is possible to conclude that the contract is
satisfied by only applying the congruence relations.
[\
The wait rules define two possible cases: when
d
1
time units pass, with d
1
ď d, then the time delay
decreases by d
1
time units (Rule (wait1)), and when
an action is performed (Rule (wait2)) the time delay
remains intact since (let us recall) actions are instan-
taneous.
The final rules deal with recursion in a standard
manner — by replacing free instances of the recur-
sion variable by the whole recursion formula. Note
that since we assume formulae to be closed and recur-
sion guarded, we require no rules for expressions con-
sisting of just a free variable, or to handle unguarded
recursion such as rec x. x.
Themulus: A Timed Contract-calculus
199
The following proposition shows that the seman-
tics ensure that any non-trivial contract (i.e. any ir-
reducible contract other than J and K) can evolve to
any observed action. Furthermore, they evolve in a
deterministic manner.
Proposition 3. Given a contract ϕ P C :
1. One of the following holds: (i) ϕ ” J; (ii) ϕ ”
K; or (iii) for any a P Act and k P I , ϕ
a,k
−−Ñ and
ϕ
pa,kq
−−−−Ñ.
2. If ϕ
a,k
−−Ñ ϕ
1
and ϕ
a,k
−−Ñ ϕ
2
, then ϕ
1
” ϕ
2
.
Proof. The first property follows immediately from
the operational semantics. The second follows by
structural induction on ϕ. [\
The following proposition shows that the con-
tracts behave coherently with respect to time.
Proposition 4. Let ϕ, ϕ
1
, ϕ
2
P C be contracts and
d
1
, d
2
P T be time values. Then, the following proper-
ties hold:
1. If ϕ
d
1
::; ϕ
1
and ϕ
d
1
::; ϕ
2
then ϕ
1
” ϕ
2
.
2. If ϕ
d
1
::; ϕ
1
d
2
::; ϕ
2
, then ϕ
d
1
+d
2
::::; ϕ
2
.
3. If ϕ
d
1
+d
2
::::; ϕ
2
then there is ϕ
1
P C such that
ϕ
d
1
::; ϕ
1
d
2
::; ϕ
2
Proof. These properties are proved by structural
induction. The base cases are trivial, one only
needs to take into account that the contracts O
k
paqrds,
F
k
paqrds, P
k
paqrds do not transition beyond time d
because the contracts are violated (in the case of obli-
gation) or satisfied (in the case for prohibition and
permission). [\
4.4 Contract Violation
We can now formally define contract violation. First,
we define the predicate viopϕq. This predicate will
be used to verify if a contract is currently violated,
which enables us to determine how a system can be
monitored with respect to a contract.
Definition 9. We say that an irreducible contract ϕ
is in a violated state, written viopϕq if and only if the
contract has already been violated:
viopJq
df
= ff viopKq
df
= tt
viopP
k
paqrdsq
df
= pa, kq viopO
k
paqrdsq
df
= ff
viopF
k
paqrdsq
df
= pa, kq viopwaitpdqq
df
= ff
viopϕ;ϕ
1
q
df
= viopϕq vioprec x.ϕq
df
= viopϕq
viopcond
k
paqrdspϕ, ϕ
1
qq
df
= ff
viopϕ ^ ϕ
1
q
df
= viopϕq _ viopϕ
1
q
viopϕ _ ϕ
1
q
df
= viopϕq ^ viopϕ
1
q
viopϕ § ϕ
1
q
df
= viopϕq ^ viopϕ
1
q
Since syntactical equivalences would remove any
zero time windows (i.e. d = 0), the above definition
covers only when d ą 0.
The two first cases for the trivially satisfied and
violated contracts are straightforward. In the case of
permission being currently in force, we flag a viola-
tion if the party holding the permission wants to per-
form the action but is not offered a synchronizing ac-
tion. In case of an obligation, a violation can only
occur after the time has expired (d = 0), but this case
is already defined because of the syntactical equiva-
lence O
k
paqr0s ” K. Let us note that an obligation
to perform an action within a (non-zero) time frame
is never in violation at this instant since there is still
time to perform the action and fulfil the obligation.
In the case of a reparation viopϕ § ϕ
1
q, a viola-
tion can only occur, if both ϕ and ϕ
1
are violated. In
the case of viopcond
k
paqrdspϕ, ϕ
1
qq, whether the ac-
tion a or any other action is observed the violation is
always false since the conditional contract only de-
fines how the contract will behave (as ϕ or ϕ
1
). In the
case of sequential composition viopϕ; ϕ
1
q, an imme-
diate violation must occur on the first operand (since
J;ϕ would have been reduced to ϕ), and it is thus de-
fined as viopϕq. In the case of waitpdq, the violation
is always false, since it depicts a time delay, then an
immediate violation is false. Finally, the definition
vioprec x.ϕq = viopϕq is well-formed since recursion
is always assumed to be guarded.
Lemma 1. For any contract ϕ P C , viopϕq )( tt if
and only if ϕ ” K.
Proof. The proof uses structural induction on ϕ.
The only non-trivial case being when ϕ = ϕ
1
^ ϕ
2
,
in which case we use Proposition 1. [\
4.5 Contracts Acting on Systems
We can now define how contracts evolve alongside a
system, and what it means for a system to satisfy a
contract.
Definition 10. Given a contract ϕ P C with a set of
actions Act
1
and a system A, we define the semantics
of ϕ}A — the combination of the system with the con-
tract — with alphabet Act with Act
1
Ď Act through
the following rules:
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
200
(M1)
ϕ
a,k
−−Ñ ϕ
1
, A
a,s
−−Ñ A
1
ϕ } A =ñ ϕ
1
} A
1
k P s
(M2)
ϕ
pa,kq
−−−−Ñ ϕ
1
, A ( xa, ky
ϕ } A =ñ ϕ
1
} A
(M3)
A
a,s
−−Ñ A
1
ϕ } A =ñ ϕ } A
1
a R Act
1
(M4)
A
d
::; A
1
, ϕ
d
::; ϕ
1
,
@d
1
< d ¨ if A
d
1
::; A
2
and
ϕ
d
1
::; ϕ
2
then A
2
( viopϕ
2
q
ϕ } A =ñ ϕ
1
} A
1
Rule (M1) and (M2) handles synchronization be-
tween the contract and the system. If an action a per-
formed by the system is of interest to the contract, the
contract evolves alongside the system ((M1)), if the
contract allows an agent to perform an action but only
agent k (and no other agent) is willing to engage in the
action, then only the contract evolves ((M2)). Rule
(M3) handles actions on the system in which the con-
tract is not interested in. Finally, rule (M4) ensures
that time cannot skip over a violation.
Definition 11. Let A be a system and ϕ P C be a con-
tract.
• System A can breach ϕ, written breachpA, ϕq, if
there exists a computation that leads to a violation
of the contract: for some n ě 0 and contracts ϕ
0
till ϕ
n
such that:
ϕ } A = ϕ
0
} A
0
=ñ . . . ϕ
n−1
} A
n−1
=ñ ϕ
n
} A
n
,
and A
n
( viopϕ
n
q.
• System A may fulfil ϕ, written fulfillpA, ϕq, if there
exists a computation of the system that fulfils the
contract: for some n ě 0 and contracts ϕ
0
till ϕ
n
:
ϕ } A = ϕ
0
} A
0
=ñ . . . ϕ
n−1
} A
n−1
=ñ ϕ
n
} A
n
,
and A ( viopϕ
k
q for 0 ď k < n, and ϕ
n
” J.
Note that there are contracts that may never be
fulfilled. An example of such a contract is ϕ =
rec x.ra, k, 8spK, 8q, which may never be fulfilled
since there are no transitions from this contract lead-
ing to J. Nevertheless, if agent k never performs ac-
tion a, then neither is the contract broken.
5 REFINEMENT
We now define two notions of contract refinement
(ď
K
and ď
J
). Intuitively ď
K
relates two contracts
ϕ, ψ P C (i.e. ϕ ď
K
ψ) if any system which can breach
contract ϕ, can also breach contract ψ. The meaning
of ď
J
is its dual: if ϕď
J
ψ then any system which can
fulfil ϕ can also fulfil ψ. Both notions are based on
simulation techniques, defined in a co-inductive fash-
ion.
Definition 12. Let ϕ, ψ P C and R Ď C ˆ C , we say
that R is a K-simulation relation iff whenever pϕ, ψq P
R the following conditions hold:
(i) viopϕq ( viopψq.
(ii) If ϕ
d
::; ϕ
1
then
a. there is d
1
ď d such that ψ
d
1
::; K, or
b. there is ψ
1
P C and ψ
d
::; ψ
1
and pϕ
1
, ψ
1
q P
R.
(iii) If ϕ
α
−−Ñ ϕ
1
then there exists ψ
1
P C and ψ
α
−−Ñ
ψ
1
and pϕ
1
, ψ
1
q P R.
We say ϕ ď
K
ψ if there is a K-simulation relation R
such that pϕ, ψq P R.
Definition 13. Let ϕ, ψ P C and R Ď C ˆ C , we say
that R is a J-simulation relation iff whenever pϕ, ψq P
R, the following conditions hold:
(i) If ϕ ” J then ψ ” J.
(ii) If viopψq ( viopϕq.
(iii) If ϕ
d
::; ϕ
1
then
a. there is d
1
ď d such that ψ
d
1
::; J, or
b. there is ψ
1
P C and that ψ
d
::; ψ
1
and
pϕ
1
, ψ
1
q P R.
(iv) If ϕ
α
−−Ñ ϕ
1
then there is ψ
1
P C such that ψ
α
−−Ñ
ψ
1
and pϕ
1
, ψ
1
q P R.
We say ϕ ď
K
ψ if there is a K-simulation relation R
such that pϕ, ψq P R.
Lemma 2. The relation id = tpϕ, ϕq | ϕ P C u is both
a K-simulation relation and a J-simulation relation.
Proof. It is immediate from the definitions. [\
Lemma 3. Let R
1
and R
2
be K-simulation relations
(respectively J-simulation). Then, their composition
R
1
˝ R
2
is also a K-simulation relation (respectively
J-simulation).
Proof. The proof is simple from the definitions. [\
Proposition 5. The relations ď
K
and ď
J
are reflex-
ive and transitive.
Proof. This proposition is immediate from Lemmas 2
and 3. [\
Consider the following example illustrating the
use of these definitions.
Example 5.
waitp3q ď
K
P
k
paqr5s
waitp3q;K ę
K
P
k
paqr5s;K
P
k
paqr3s ď
J
waitp3q
P
k
paqr3s § O
l
pbqr2s ę
J
waitp3q § O
l
pbqr2s
waitp5q ď
K
O
k
paqr6s
waitp5q ^ waitp7qď
K
O
k
paqr6s ^ waitp7q
Themulus: A Timed Contract-calculus
201
It is not difficult to formally verify the correctness of
these orderings. For instance, consider waitp3q and
P
k
paqr5s — the former cannot be violated, whilst the
latter can be violated by any system that does not al-
low agent k to perform action a within 5 units of time,
which ensures that the simulation holds. Now con-
sider waitp3q ď
K
P
k
paqr5s, we can put both contracts
in the context of the continuation operator to follow
up with K. While waitp3q;K cannot be fulfilled after
3 units of time whatever the system does, in the case
of P
k
paqr5s;K, if the system allows agent k to perform
a after 3 units of time but agent k does not perform the
action, the contract is not broken yet. Regarding the
ď
J
relation, dual reasoning can be applied, whilst the
other relations can be similarly reasoned about.
[\
Since the relations are preorders, for each of them
we have an equivalence relation. However, we can
prove that these relations are, in fact, equivalent.
Proposition 6. The two equivalence relations v
J
=
ď
J
Xď
J
−1
and v
K
= ď
K
Xď
K
−1
, are equal to each
other: v
J
= v
K
.
Proof. In order to prove v
K
Ď v
J
we have to prove
v
K
Ď ď
K
and v
K
Ď ď
K
−1
. Both proofs are symmet-
rical, so let us prove the first. It is sufficient to prove
that v
K
is a J-simulation relation. Consider ϕ, ψ P C
such that ϕ v
K
ψ — we must prove the conditions
of Definition 13, with the only non-trivial one being
condition i. Assume ϕ ” J. Since ϕv
K
ψ, we deduce
viopψq = ff . If ψ ı J, then by Proposition 3, for any
possible α there must exist ψ
1
such that ψ
α
−−Ñ ψ
1
.
Again, since ϕ v
K
ψ we obtain that for any α, there
must exist ϕ
1
such that J = ϕ
α
−−Ñ ϕ
1
, which is im-
possible. We can thus conclude that ψ ” J. [\
Given their equivalence, we can define the sim-
ulation equivalence of contracts as either of the two
equivalence relations.
Definition 14. We define the simulation equivalence
relation as v
df
= ď
J
X ď
J
−1
Consider the K simulation: if two contracts are
related ϕď
K
ψ, then the violations identified by ϕ are
also identified by ψ.
Theorem 1. Let A be a system and ϕ, ψ P C be con-
tracts, such that ϕ ď
K
ψ. Then, if A violates ϕ, it also
violates ψ: breachpA, ϕq ñ breachpA, ψq.
Proof. Since ϕ ď
K
ψ, then there exists a simula-
tion contract relation R, such that pϕ, ψq P R. On the
other hand, since breachpA, ϕq holds, there exists a
sequence of transitions
ϕ } A = ϕ
0
} A
0
=ñ . . . ϕ
n
} A
n
= ϕ
1
} A
1
where n ě 0, such that breachpA
1
, ϕ
1
q. By simulat-
ing ϕ, we can build a computation beginning with the
contract ψ
0
= ψ:
ψ } A = ψ
0
} A
0
=ñ . . . ψ
m
} A
m
= ψ
1
} A
1
such that m ď n, pϕ
k
, ψ
k
q P R for 0 ď k < m, and
breachpA
1
, ψ
m
q. Let us proceed by induction. If n = 0
the proof is immediate, so let us consider the induc-
tive case n ą 0. Let us consider the first transition.
There are four cases according to the rules of the sys-
tem transitions (Definition 1):
Rules M1 and M2. ϕ
0
α
−−Ñ ϕ
1
. Since pϕ
0
, ψ
0
q P R,
then there is a contract ψ
1
such that ψ
0
α
−−Ñ ψ
1
and
pϕ
1
, ψ
1
q P R. Therefore, we obtain that we have the
computation ψ
0
} A
0
=ñ ψ
1
} A
1
. Then we obtain the
result by induction.
Rule M3. This is trivial because the contract is not
involved.
Rule M4. ϕ
0
d
::; ϕ
1
then either:
1. There exists d
1
< d such that ψ
0
d
::; K. In this
case we obtain ψ } A =ñ K} A
1
.
2. There exists ψ
1
such that ψ
0
d
::; ψ
1
and
pϕ
1
, ψ
1
q P R. If there were 0 < d
1
< d such
that ψ
d
1
::; ψ
1
, A
d
1
::; A
1
, and A
1
( viopψ
1
q,
then we obtain the result immediately. Otherwise
ψ } A =ñ ψ
1
} A
1
and we obtain the result by in-
duction.
Finally, if m < n we have found the computation ψ }
A =ñ
∗
K } A
1
. Otherwise pϕ
n
, ψ
n
q P R, then viopϕ
n
q (
viopψ
n
q, and by definition A
n
( viopψ
n
q. [\
Now let us prove the corresponding property of J
simulated contract. If two contracts are related ϕ ď
J
ϕ
1
, and if ϕ can be fulfilled by a system, then ϕ
1
is also
fulfilled by the same system.
Theorem 2. Let A be a system and ϕ, ψ P C be con-
tracts such that ϕď
J
ψ. Then, if A can fulfil ϕ, it can
also fulfil ψ: fulfillpA, ϕq ñ fulfillpA, ψq.
Proof. The proof of this theorem is very similar to
the previous one. The inductive cases for rules M1,
M2 and M3 are similar: We only have to verify A
k
(
viopψ
k
q, which is immediate since viopψ
k
q ( viopϕ
k
q.
The case M4 is slightly different; so let us assume
ϕ
0
d
−−Ñ ϕ
1
. First let us suppose that there exists d
1
< d
such that ψ
0
d
1
−−Ñ ψ
1
, A
d
1
::; A
1
and A
1
( viopψ
1
q.
Due to Proposition 4 and the definition of J simula-
tion contract, there exists ϕ
1
such that ϕ
0
d
1
−−Ñ ϕ
1
with
pϕ
1
, ψ
1
q P R. Therefore viopψ
1
q ( viopϕ
1
q and then the
transition ϕ } A =ñ ϕ
1
} A is not possible. Now, since
pϕ
0
, ψ
0
q P R there are two cases:
1. There exists d
1
< d such that ψ
d
1
::; J, so in this
case we have found the computation ψ
0
}A
d
1
::;
J } A.
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
202
2. There exists ψ
1
such that ψ
0
d
::; ψ
1
and
pϕ
1
, ψ
1
q P R. If ϕ
1
” J then ψ
1
” J and we
have found the required computation. Otherwise,
viopψ
1
q ( viopϕ
1
q and then A
1
( viopψ
1
q, so we
obtain the result by induction.
[\
Finally, in this section we are going to show im-
portant properties of the relations ď
J
and ď
K
. First,
let us show that J and K are the best contracts in their
respective relations ď
J
and ď
K
. Then, as ϕ ^ J ” ϕ
and ϕ _ K ” ϕ, it is important to show ϕ ^ ϕ
1
ď
J
ϕ
and ϕ _ ϕ
1
ď
K
ϕ.
Proposition 7. For any ϕ, ϕ
1
P C , the following hold:
1. ϕ ď
J
J
2. ϕ ď
K
K
3. ϕ _ ϕ
1
ď
K
ϕ
4. ϕ ^ ϕ
1
ď
J
ϕ
5. ϕ v ϕ _ ϕ
6. ϕ v ϕ ^ ϕ
Proof.. Statements 1 and 2 follow from the def-
initions and Lemma 1. For 3 we have to check
that R
K
= tpϕ _ ϕ
1
, ϕq | ϕ, ϕ
1
P C u is a K simula-
tion contract. While for 4 we have to check that
R
J
= tpϕ ^ ϕ
1
, ϕq | ϕ, ϕ
1
P C u is a J simulation con-
tract. For 5 and 6 it is easy to check that the relations
R
_
= tpϕ, ϕ _ ϕq | ϕ P C }, R
1
_
= tpϕ _ϕ, ϕq | ϕ P C },
R
^
= tpϕ, ϕ ^ ϕq | ϕ P C }, and R
1
^
= tpϕ ^ ϕ, ϕq | ϕ P
C } are respectively both, J simulation contracts and
K simulation contracts. [\
Let us show cases in which the relations act as
congruences.
Proposition 8. For any ϕ, ϕ
1
, ψ, ψ
1
P C , the following
hold:
If ϕ
1
ď
K
ϕ and ψ
1
ď
K
ψ:
K.1 ϕ
1
§ ψ
1
ď
K
ϕ § ψ
K.2 ϕ
1
^ ψ
1
ď
K
ϕ ^ ψ
K.3 ϕ
1
_ ψ
1
ď
K
ϕ _ ψ
K.4 cond
k
paqrdspϕ
1
, ψ
1
q
ď
K
cond
k
paqrdspϕ, ψq
If ϕ
1
ď
J
ϕ and ψ
1
ď
J
ψ:
J.1 ϕ
1
;ψ
1
ď
J
ϕ;ψ
J.2 ϕ
1
^ ψ
1
ď
J
ϕ ^ ψ
J.3 ϕ
1
_ ψ
1
ď
J
ϕ _ ψ
J.4 cond
k
paqrdspϕ
1
, ψ
1
q
ď
J
cond
k
paqrdspϕ, ψq
Proof. For all the cases consider the relations:
R
pop,relq
= ď
rel
Ytpϕ op ψ, ϕ
1
op ψ
1
q |
ϕ, ϕ
1
, ψ, ψ
1
P C , ϕ ď
rel
ϕ
1
, ψ ď
rel
ψ
1
u
where op P t;, §, ^, _, cond
l
paqrdsp¨, ¨qu and rel P
tJ, Ku. In all cases we have to prove that R
pop,relq
is a
rel simulation. Also in all cases we are going to con-
sider pχ, χ
1
q P R
pop,relq
and to prove that pχ, χ
1
q Pď
rel
. If pχ, χ
1
q Pď
rel
there is nothing to prove, so we con-
sider that χ = ϕ op ψ, χ
1
= ϕ
1
op ψ
1
, ϕ ď
rel
ϕ
1
and
ψ ď
rel
ψ
1
. In all cases we have to check the condi-
tions on the corresponding relation in Definitions 12
and 13. [\
Theorem 3. v is a congruence.
Proof. This follows from the previous proposition
and Proposition 6. [\
6 CONCLUSIONS
The calculus Themulus allows us to reason about con-
tracts with time constraints independent of the sys-
tems on which they are applied to. In order to achieve
this, we have introduced a notion of similarity be-
tween contracts, which takes into account predicates
over system states, and shows how these semantics
can be used for runtime verification of contracts.
There are various research directions we intend
to explore. From a practical perspective, we will be
looking into automated runtime verification of con-
tracts, and looking at how this scales up with more
complex contracts. From a theoretical perspective,
there are various questions we have yet to explore —
from identifying conflicts in our contract language, to
looking at automated synthesis of the strongest con-
tract satisfied by a given system (analogous to the
weakest-precondition) and synthesis of the weakest
system satisfying a given contract.
One application arising from runtime monitoring
was that of runtime enforcement, where starting from
a specification, algorithmic machinery is synthesized
to ensure that the system under scrutiny does not vi-
olate the specification e.g. by delaying or injecting
events. In particular, there is a body of work on run-
time enforcement of timed properties e.g. (Falcone
et al., 2016) which could offer insight on how our
work can be extended to build contract enforcement
engines, a notion that has not been widely explored in
the deontic logic world.
REFERENCES
Asarin, E., Mysore, V., Pnueli, A., and Schneider, G.
(2012). Low dimensional hybrid systems - decidable,
undecidable, don’t know. Inf. Comput., 211:138–159.
Azzopardi, S., Pace, G. J., and Schapachnik, F. (2014).
Contract automata with reparations. In Legal Knowl-
edge and Information Systems - JURIX: The Twenty-
Seventh Annual Conference, Jagiellonian University,
Krakow, Poland, 10-12 December, pages 49–54.
Belnap, N. and Perloff, M. (1993). In the realm of agents.
Ann. Math. Artif. Intell., 9(1-2):25–48.
Bocchi, L., Yang, W., and Yoshida, N. (2014). Timed mul-
tiparty session types. In CONCUR 2014 - Concur-
rency Theory - 25th International Conference, CON-
CUR 2014, Rome, Italy, September 2-5, 2014. Pro-
ceedings, pages 419–434.
Cambronero, M., Llana, L., and Pace, G. J. (2017). A cal-
culus supporting contract reasoning and monitoring.
IEEE Access, 5:6735–6745.
Chaochen, Z., Hoare, C. A. R., and Ravn, A. P. (1991). A
calculus of durations. Inf. Process. Lett., 40(5):269–
276.
Themulus: A Timed Contract-calculus
203
Falcone, Y., J
´
eron, T., Marchand, H., and Pinisetty, S.
(2016). Runtime enforcement of regular timed proper-
ties by suppressing and delaying events. Sci. Comput.
Program., 123:2–41.
Fenech, S., Pace, G. J., Okika, J. C., Ravn, A. P., and
Schneider, G. (2009). On the specification of full con-
tracts. Electr. Notes Theor. Comput. Sci., 253(1):39–
55.
Georg Henrik Von Wright (1951). Deontic Logic. Mind,
60(237):1–15.
Governatori, G. and Milosevic, Z. (2005). Dealing with
contract violations: formalism and domain specific
language. In EDOC Enterprise Computing Confer-
ence, Ninth IEEE International, pages 46–57. IEEE
Computer Society.
Horty, J. F. (2001). Agency and Deontic Logic. Oxford
University Press.
Jeremaes, P., Khosla, S., and Maibaum, T. (1986). A modal
(action) logic for requirements specification. Software
Engineering, 86:278–294.
Khosla, S. (1988). System Specification: A Deontic Ap-
proach. PhD thesis, Imperial College of Science and
Technology, University of London.
Milner, R. (1999). Communicating and Mobile Systems:
the π-Calculus. Cambridge University Press.
Newman, M. H. A. (1942). On theories with a combinato-
rial definition of” equivalence”. Annals of mathemat-
ics, pages 223–243.
Pace, G. J. and Schapachnik, F. (2012). Contracts for Inter-
acting Two-Party Systems. In FLACOS’12, volume 94
of ENTCS, pages 21–30.
Yi, W. (1991). CCS + time = an interleaving model for
real time systems. In Automata, Languages and Pro-
gramming, 18th International Colloquium, ICALP91,
Madrid, Spain, July 8-12, 1991, Proceedings, pages
217–228.
MODELSWARD 2020 - 8th International Conference on Model-Driven Engineering and Software Development
204
