28 Contract GateSaftey is Assume: - At startup no train is already in XR - Gate changes its position only in response to controller commands - Trains obey semaphore commands Promise: - Gate closed as long as a train is in XR..
{}