Towards the formalisation of soft systems models using Petri net theory

J.S. Sagoo J.T. Boardman

Abstract: The analytical capability of conceptual models that are used in a soft systems methodology to capture the processes within a business organisation is examined and extended. Specifically, the models known as systcmigrams, which form part of the Boardman soft systems methodology, are considcred. The informal nature of systemigranis allows a nonspecialist to easily create models of processes, but it docs not permit analysis of the resulting model. Hence, problems can occur in verifying the correctness of these models. This problem is addressed by presenting a translation algorithm that converts systemigram descriptions into Petri net models. This translation allows the behaviour. reprcsentcd by thc systemigram, to be analysed via Petri net theory, and it has the potcntial of performing ‘what if analysis. Application or this algorithm is shown via a case study that translates and analyses a systemigram of a realistic industrial process that forms the Order Intake phasc of a product’s life cycle.

1 introduction

Checkland‘s soft systcnis methodology (SSM) [ 1 I emerged due to the inadequacies of traditional systems engineering in addressing the problems arising in thc management of systems. Typically, such problems; tended to be unstructured 01- vaguely defined, and thcq involved the modelling of human activity within a sys- tem [2]. Thus SSM was most suitcd to examining the nature of businesses and organisations [3, 41. In parlic- ular, it has bcen used to identify the problem arcas within an organisation, or to promote learning and awareness of a company’s practices and procedures [5] .

The framework of SSM centres 011: eliciting peoples’ views of a process; capturing these views in conceptual models; using these modcls in a debate to clarify thc problem situation [4]. In the application of SSM it is

0 IEC. 1998 IEI? fioicrrli~gs online no. 10982234 Papei- rcceivcd 6th March 1998 .I.S. Sagoo is with DERA Malvcim. LI 15, SI. Andrews Road, Malvern. Wot-cs. WL14 3PS. U K J.T. Boardman is with the Systcins Engincering Group, Science and En@ nccring Research Centre, De Montfort University, Hawthorn Building, The Gateway, Lcicestct- LEI 9Bf-I, U t i

necessary to capture several vicws of a process, because the problem itself is ill-’defined arid no single view is necessarily correct or completely citptures the problem. Once a conceptual model is constructed, it is verified to be corrcct in accordance with its respective view. The debate is conducted in the presence of a target audience in which each model is validated with respect to the ‘real world’ system. Tlie outcome of a debate usually involves some changes which can range from a change in peoples’ thinking to a change in a company’s prac- tices and procedures. This paper focuses on the issue of verifying the correctness of a conceptual model with respect to a particular view.

The verification and analysis of SSM models is a dif- ficult task because, essentially, thcy are informal dia- grams that are augmented with a linguistic component. Some researchers [6, 71 have examined the formal nature of SSM models and concluded that the logical basis of these models is ;somewhat ambiguous. Hence, these models must eitliei- be formalised or combined with a formal techniqu’e to facilitate analysis. For instance, Gregory [6, 81 Nextends the notation of SSM with modal logic to allow a theorem prover to be used to query the modelled system [8]. Also Minkowitz [9] combines the formal method of VDM with process modelling techniques to analyse the requirements of business processes. The above works strengthen the logical base of SSM models, but tlieir application to the modelling of industrial processes is unclear.

Other derivatives of SSM, such as; the Boardman soft systems methodology (BS’SM) [lo], have been success- fully used to model industrial processes. In particular, the notation of its SSM model, known as a systemi- gram, has been shown to be simple and easy to use, and systemigram models are easily understood by a nonspecialist [l 11. However, like SSM models, systemi- grams cannot be formally analysed, and can only be verified by inspection. This form of verification may be acceptable for ‘small’ systemigrains, but, as the size and complexity of the systeniigram increases, so does the possibility of human error.

This paper addresses the problem of extending sys- temigrams with an analytical capability, by combining them with Petri net theory [12-14]. Specifically, a trans- lation algorithm is prescnled which converts a systemi- gram into a Petri net model and uses Petri net theory to verify that the behaviobur captured by the net does indeed correspond to its respcctive :;ystcmigram. Previ- ously, Petri net theory has been used to verify system models [15, 161. Specifically, verification is performed using a combination of !static analysis (i.e. invariant analysis [13. 141) and dpiimic analysis (i.e. using state

463

reachability graphs [12, 141). In these works, there is a clear requirement to develop designs for a system, such as an information system, and so it is important to per- form detailed analysis. However, in the context of SSM, since the problem itself needs investigation, it may be more appropriate to check the occurrences of certain sequences of activities. Hence, this paper uses reachability analysis as the basis for verifying the behaviour of a Petri net model. However, this work does not preclude the use of detailed analysis which can be performed on the net. The application of the above translation algorithm is illustrated by a case study which analyses a systemigram of an industrial process that captures the Order Intake phase of a prod- uct's life cycle.

2 Petri nets: an overview

Petri nets have been widely used to model and analyse concurrent systems. This technique is particularly use- ful for explicitly representing the information flow, the control flow, or the synchronisation within a system [la]. Since Petri nets have a graphical and mathemati- cal form, these models can be formally analysed. This Section introduces several basic definitions of Petri net theory that are used in this paper; a more detailed exposition can be found in [13, 141. Definition 1: A marked Petri net N is defined as a 5- tuple: N = { P , T, I, 0, M O } where

(9 P = {PI, p2, ..., A) , n > 0. (ii) T = { t , , tZ, ..., t,T}, s > 0, with P U T # M and P f' T = M. (iii) I : P x T - (0, I} . (iv) 0: T x P - ( 0 , 1) . (v) MO: P - (0, 1, 2, ...}. In this definition, p l (1 5 i 5 n) is called a place and t , (1 5 i 5 s) a transition; I is an input function defining the set of directed arcs from P to T; 0 is an output func- tion defining the set of directed arcs from T to P; MO is an initial marking which represents the initial state of the net. The marking of a net is denoted by the distri- bution of tokens in the places of the net. The graphical form of a Petri net is shown in Fig. 1, in which a circle denotes a place, a bar denotes a transition, a black dot denotes a token, a single pointed arrow denotes an arc, and a double pointed arrow denotes a self-loop.

& 1' "ao y t m

Customer Take Decision Advice

Fig. 1

464

Petri net stvucture,for behaviour of Customev in Fig. 2

The marking of N changes when a transition becomes enabled and then fires, the conditions neces- sary for this to occur are delined as follows: Definition 2: The firing rules of N are: (i) A transition ti E T is enabled if Vpi E P (M(pi) 2 #bt, I(t,))) where M(pI) denotes the number of tokens in pi under M , and #@,, I(t,)) denotes the number of occurrences of pi in the input function I(t j) . (ii) An enabled transition t j E T may fire at M by instantaneously moving tokens from its input places to its output places to produce a new marking M ' :

where #(pi, O(t,)) is the number of occurrences of p l in the output function O(t,). The marking M' is said to be immediately reachable from M .

Given N and MO, the reachability set is the set of all markings immediately reachable from MO through fir- ing various sequences of transitions; this set is denoted by R(N, MO). To study the behaviour generated by N , a reachability graph of the net is constructed using the rules detailed in definition 2. A reachability graph is a directed graph, in which the nodes are markings of R(N, MO) and the arcs are labelled by T.

3 Systemigrams

A systeniigram (systemic diagram) is a graphical tech- nique that uses a linguistic component to describe a system under observation (Suo). This technique describes a system as a set of sentences. Specifically, sentences make references to the key entities in a sys- tem, such as the agents involved in a process, the activ- ities they perform and the artefacts that they create. An example of the graphical form of a systemigram is shown in Fig. 2. In this notation, agents and artefacts are denoted by noun phrases and drawn as elliptical nodes, such as Customer and Contracts Dept., RFQ (Request For Quotation) Data Pack and Customer Advice. The activities are denoted by verb phrases and shown as labels on the arrows that interconnect nodes. An agent node may be further divided into other nodes such as the Customer node in Fig. 2, which is labelled as Customer (Chelmsford BU) and Customer (Other BU). This type of node is known as a containment node, and is used to refine the detail contained in a node.

returned

9- who makes a

addressed

issues RFQ and

Fig. 2 Fig. 2 Sitnple systemigram

A systemigram is 'read', or interpreted, by following the arrows from node to node and forming sentences. In Fig. 2 the following sentences can be created starting from the Customer node:

I E E Proc.-Control Theory Appl., Vol. 145, No. 5, September 1998

(i) The Customer issues a RFQDP (RFQ and Data Pack). (ii) The RFQDP is addressed to the Contracts Dept.. ( i i i ) The Contracts Dept. makes a decision and recorcls it on a Customer Advice. (iv) The Customer Advice is returned to the Customer, i.e. to the Customer that issued the RFQDP.

In essence, a systemigrain is a graphical illustration of prose that provides a sumniary of the processes within a SUO. This description forms the basis for debating the functionality and behaviour of the system.

4 Petri nets

Ascribing systemigrams with semantics of

An inspection of sentences (i)-(iv), in Section 3, shows that they essentially describe a sequence of events, or a behaviour, of the SUO. However, due to the informal nature of systemigrams, the behaviours that they repre- sent cannot be analysed. The absence of this analytical feature becomes most prevalent when it is necessary to show that the systemigram captures the SUO. In this paper, systemigrams are analysed by translating them into Petri nct structures; the following shows a possible approach for translating a typical systemigram.

4. I Cyclic structure in a systemigram An examination of sentences (i)-(iv) of Fig. 2 reveals the following behavioural sequence: the Customer issues an RFQDP; the Customer sends the RFQDP to the Contracts Dept.; the Contracts Dept. makes a decy,- sion and generates a Customer Advice; the Contracts Dept. sends the Customer Advice to the Customer. The above sequence can be further refined by the fact that the Customer, in Fig. 2, is denoted by a containment node. Specifically, the arrow labclled as ‘issues’ is drawn leaving the outer elliptical node of Customer, this is interpreted as either the Customer (Chelmsford BU) or the Customer (Other BU) being able to per- form the relevant activity. Hence, an exclusive or rela- tionship exists between these Customers when issuing a RFQDP.

A Petri net structure for the above behaviour can be generated by identifying the agents and artefacts as places of a net, and the activities as transitions of a net.. Several Petri net models may be synthesised for the above behaviour. However, in this paper, the Petri net model of Fig. 1 was synthesised to represent the sys- temigram of Fig. 2. In this net, p I , p 2 and p4 denote agents, p,7 and pi9 denote artefacts, t8 and tq denote the issuing of an RFQDP, t lo denotes the sending of ai1 RFQDP, t l I denotes recording a decision, and t l 2 denotes the sending of a Customer Advice. The exclu- sive or relationship that exists between the Customers was quite implicit in the systemigram of Fig. 2. How- ever, this relationship was considered to be important, and it is explicitly shown by p,

The behaviours produced by Fig. 1 can be ascer- tained by examining its reachability graph. The partial reachability graph of Fig. 3 was generated using defini- tion 2; in this diagram, the numbers shown in boxes denote the places as per Fig. 1. An inspection of thl: static states in Fig. 3 shows that they are all consistent with the particular view expressed in the systemigram of Fig. 2. Similarly, the state sequences also correspond to those identified in sentences (i)-(iv) in Section 3. The reachability graph of Fig. 3 also shows that once ;z

Prorc-Control Theory Appl., Voi. 145, N o 5 , s(~pl~wl7/J?r 1998

RFQIIP is generated in state M , (denoted by tlic f n m ~ g of Ih 01 ts) , the Customer can gcnxate othei RFQnPs (denoted by the Sirability of tX and f , In subwqucnt statec) ‘ Ih ic behaviour coriesponds to that which 1s expected or the systein, but for the ~ U I ~ Q S C Y of dnaly- SIS, this p q e i shall nssuine thnt orly one order I S prod- es\ed

M i

++*- ti 2

1 Fig.3 Rcuchuhility Er@ o/ f+ t r i net rnodel in Fig. 3 inhere j > OJ

5 Casestudy

This Section examines one of a set of systemigrams that were produced using the BSS’M as part of a col- laborative research project with GrEC Marconi Radar Defence Systems specifically at one of their factories in Leicester, which shall be referred to as SRL (Scuda- more Road, Leicester). The aim of this collaboration was to use SSM as a tool for learning about the manu- Sacturing processes within SRL, with a view to reduc- ing the product cycle times and introducing concurrent engineering within the workplace. This paper focuses on the verification of a specific systemigram that was generated for the Order Intake phase, and which is shown in Fig. 4. This phase describes all the agents, the activities they perform arid the artefacts that are gener- ated when a Customer issues an order.

The level of detail necessary to describe a process can often complicate the resulting systemigram. Hence, to manage this complexity, a systemigram can be shown in stages or scenes. A slcene s h o w a ‘snapshot’ of a process at a certain instant, and a set of scenes can describe a ‘story’ of the ~xogression of a process. Cur- rently, within the BSSM, the task of decomposing a systemigram into scenes is an intuitive process that is performed by the user of the methodology. However, the scenes may be derive’d from a systemigram using a causal or temporal ordering of activities. The Order Intake phase is described in four scenes, as shown in Figs. 5-8, and a causal ordering between these scenes is implied.

The analysis of the Order Intake systemigrain is per- formed by translating it into a Petri net model. Specifi- cally, the translation approach of Section 4 is incorporated in the following algorithm: Translation algorithm: Syrtemiyrams into Petri net mod- el,s

Consjder each scene of a systemigram and apply the following steps: (i) Interpret the information contained in a scene by creating a set of sentences. Each sentence is formed by using the arrows to traverse from rode to node.

465

Order Intake

who makes a

\ Requisition, I - - --:-- -- -_ - -_____ _ , _ _

required ,

directly initiate? - - - - - - , Planning Phase , - - - _ _ _ - e

'--------_-_______ -- - - - -______________- - - - - - - - - - - - - - - - Fig. 8

(ii) For each sentence generated in (i), identify the agents, activities and artefacts. (iii) Using the agent-activity-artefact information in (ii), create a Petri net structure in which the places are labelled by the agents or artefacts, and the transitions by activities.

technique to that introduced in [17], compose each Petri net structure in (iii) into a Petri net model of a scene. (v) Generate a reachability graph for the model created in (iv), and inspect its state space for desired or abnor- mal behaviour of the Suo. (vi) Combine the Petri net models for each scene (by merging places with identical labels) into a 'global' Petri net that represents the whole process. (vii) Use Petri net theory to analyse the behaviour of the 'global' Petri net.

5. I Petri net model of the Order Intake phase Due to space limitations, the above algorithm will oiily

lowing sentences can be read: (i) Customer may issue ITP received by Contracts Dept. thut of;ficiully pre-empts the Prime Purchase Order and Data Pack (PPODP) that initiates the Set-Up and Plan-

Sj'steinigr~ini for SC~W 4

easily identified. The chain of agent-activity-artefact can be inferred as follows. For sentence (i): (a ) Customer issues an ITP. (b) Customer sends TTP to the Contracts Dept.. (c) Contracts Dept. receives the ITP, and the PPODP is pre-empted (which initiates the SUPP). This sentence

the supp is initiated, Similarly, for sentence (ii): (a) Customer (Chelmsford BU) issues a Works Requisi- tion. (0) Customer (Chelmsford BU) sends Works Requisi- tion to the PM(RC, SC)). (c ) PM(RC, SC)) receives the Works Requisition and the SUPP is initiated.

tiV> By merging places with identica1 labels, a similar implies tliat when the Contracts Dept. receives the ITP,

Customer

bc illustrated for scene 1 of Fig. 5, from which the fol-

ning Phase (SUPP).' (ii) Customer (Chelmsford BU) issues Works Requisi- tion received by Programme Manager (Repair Cell, Spares Cell) (PM(RC, SC)) directly initiates SUPP.

words in italics, and the agents and artefacts can be In sentences (i)-(iii), the activities are shown by the SUPP

Fig.9 Petri net modeiel/or .scene 1

468 IEE Proc.-Conrrol Tlzrorv A p p / , Vol. 145, N o 5, S i ~ p i m b r ~ - 1'198

Fig.

By trciiirlnling cdeh chain of ngent-nctn ity-Lii lefr-ict in thc above aentences into a Petri net ctructuic c0111p115-

ing ~9lace(s)-tr~insitiorl-pliice(s). a Petri nct model for. s cme 1 can be synthesised. This nct is shown Iii fig^ 9 The bchaviour produced by this net is shown by the rcachability graph of‘ Fig. 10. This siatc-space was gen- eraled on the assumption that a single order is raised by the Customer; thc possibility of raising Further orders is shown by the firability o f L,, t4 aird t-; in sub- sequent states. An inspection of thc static statcs shows that they correspond to those expected kom sccnr 1. Moreovcr, the state sequences are meaningfirl kti-id con- sistcnt with respect to sentcnces ( i ) and (ii).

If the Petri net inodei for each iccne is gencrated (as illustrated abovc) and the resulting ricts arc; combined, the Pctri net model for the cornpleie Order Intal<e phase can be synthesised. The Petri net for the Order Intake phase is shown i n Fig. 1 I .

PlO - _ I - -

I I I I I I I I

b 6

CO

t27

SC)

Estimate Request

pTl3

T6 Out Sources

Items

5.2 Analysis of the Order Intake phase The analysis of the Order lntake phase model of I'ig, 11 comi.nences with the generation 0 1 its reacha- bi!it,y giaph. 111 order 10 constri.1ct a state-space for a

it is tarost efficient to use a Petri net analysis tool such as Design CPN 1,151. Although Design CPN was developed for use with coloured Petri ners, it accommodates nets such as that shown in Fig. 11 as a special case and thus analysis can be easily performed. Since a reachability graph can be readily generated, and also due to space limitations, the state- space for Fig. I 1 is not shown. A state analysis of Fig. 11 shows that all reachable states (if one order is processed by this phase) do conforin to the behaviour of this phase.

A state sequence analysis of Fig. 1 1 shows thc exist- ence of the following behaviours: Serial behaviour these behaviours are denoted by the successive execution of a set of activities such as: ol = <tl , t 2 , t3>.

Sequence q can be interpreted as: the Customer (Chelmsford BU) issues a Works Req.; the Works Req. is sent to the PM(RC, SC); the PM(RC, SC) initiates the SUPP. Other such sequences include:

02 = (t.l,t5,tti) U 3 = ( t 7 , t 5 , t t i )

@4 = ( t l l , t l 2 ) o5 = ( t l 3 , t 2 6 , t 2 7 )

@8 = ((tR V t R ) , t l O ) 0 6 (t13,t14,t15)

09 = (tlG;t17,t18:t19)

07 ( t 2 0 , t 2 l - t 2 2 , t 2 3 , ( t 2 4 v t25)) where v denotes the logical OR operator Mutually exclusive behaviours: these behaviours are characterised by the fact that only one of a set of behaviours can occur. For instance, consider the fol- lowing firing sequence:

Pl = ( ( t 4 ) ) v ( ( t 7 ) )

In PI only one of two transitions t4 or t7 may fire; this relates to the issue of an ITP by either the Customer (Chelmsford BU) or the Customer (Other BU). Other such sequences include:

P2 = ( ( t 8 ) ) v ( ( t 9 ) ) P 3 = 01 v 02 v 0-3 v 010

where 0 1 0 = <(t8 or t9)> l10, ...> t16> t17, t18,

Concurrent (or independent) behaviours: in these behav- iours several paths may execute at the same time, such as:

71 = a4 1105 / l a 6 1107

where the symbol 1 1 denotes a concurrent operation. Seyuenlial (or depeizdent) behaviours: in these behav- iours the progression of one behaviour is dependent upon the completion of another behaviour. For instance, consider the following sequential combination of sequences:

dl = (P2;06;o7;o9) 62 = ( , 0 2 ; o 7 ; 0 6 ; o 9 )

The Petri net of Order lntake phase and its reachability graph can be used to investigate the operations of a particular agent. Specifically, a prioritised list of the activities performed by an agent can be enumerated. This information can be used to probe the scheduling of activities within a department as well as verifying its behaviour. For example, the agent activity set for the Contracts Dept. is detailed as follows:

470

( 1 ) I'he Contracts Dept. either: ( i ) teccives a n iTP and generales the SUPP (firing 01' t5 aud l6 in succession). or (ii) receives a RFQDP (Gring of tI0) and then per- lorrns the following tasks in any order:

(a) Take decision and generate Customer Advice (fire t I l and then tlz). (b) Raise an Order Intake and send it to the Finance (NP) Dept. (fire tlo).

(2) Following the activities of (l)(ii)(u) and (b) , the Contracts Dept. receives the Overhead Rates from the Finance (NP) Dept. and generates the CSP (fire t I 5 ) . (3) Following activity ( 2 ) , thc Contracts Dept. receives a Customer Quotation from the PM(PBD) and gener- ates the reviewed Customer Quotation (fire t17). The above state sequences and the agent activity sets (for the Contracts Dept. and other Depts) were com- pared with the systemigram of Fig. 4, and this analysis was shown to the person whose view was used to gen- erate the systemigram. It was found that some sequences of activities needed further discussion and explanation, which led to minor changes to the arrows on the systemigram. However, in general, this analysis verified the information contained on the systemigram.

6 Conclusions

The graphical formalism of systemigrams has been suc- cessfully used, within the framework of the BSSM, to model industrial processes. However, since it lacks a formal base, a systemigram cannot be formally ana- lysed or verified other than by inspection. This paper has addressed the issue by combining systemigrams with Petri net theory.

The formalisation and verification of systemigrams in Petri net theory was facilitated by a translation algo- rithm. Application of this algorithm to part of an industrial case study showed that there are benefits to be gained by using this approach, which are akin to adopting a formal approach. For example: (i) The process formalising systemigrams into Petri nets allowed the information contained in the former to be carefully examined. Specifically, any doubts concerning the activities of the agents or the verb phrases used were discussed and clarified with the author of the sys- temigram. (ii) Petri net theory revealed the dynamic behaviour which is latent in a systemigram via reachability analy- sis. This analysis allowed the verification of the correct- ness of a systemigram. While performing the above case study, it was noted that the translation algorithm can be partially auto- mated. The task of reading a systemigram, however, needs human intervention, because: (i) Complex agent-activity relationships can be cap- tured by relatively simple systemigrams (see the system- igram of Fig. 2 and its corresponding Petri net model of Fig. 1). (ii) The linguistic component of systemigrains may lead to interpretation, producing several Petri net models for a systemigram. The above difficulties may be resolved by limiting the vocabulary used to label activities to a set of reserved words, which are precise and event oriented.

IEE Pro? -Conrvul Thmrj Appl , Vol 145, No. 5 , Seprenzbcr 1998

a svffxisrrt means f ~ r verifying ehe correctness of n s y i - temigr-xn

Although t h h papcr dC3C‘i not consrden- I\SUC”I or Vd!i- &lmg d \ys:cl:Rlgr‘lnl uath ;?specl to RllC vrcal world’ \)/st“ I t l i , ahorrght that the nbovc nlldlySl’? colsld l-e L1SCd l i l tills process SpeclGc;rlly, the clctlvliy \et5 fc r ,1gcnts dnd \ldk cequence can be coanpl1ec-l I n l o ;I llsl yucatioiinaire, and submitted in <i cklsdtc for ihc SCI LL- tiny of a target audience.

This paper views the formalisation of systemigrams with Petri nets as advantageous to soft systems model- ling, because it allows a close examination of the view expressed by the systemigrain and this model can be verified and analysed. Future work will continue to cxplore the theme of using Petri nets with systemi- grams, specifically the possibility of using high-level Petri nets [ 151 with systemigrams, and automating the translation of systemigrams into Petri iiet inodels.

I

7 Acknowledgments

The authors of this paper would like to acknowledge GEC Marconi for allowing their industrial processes to bc used iii this case study. Moreover, De Montfort University is acknowledged for providing the research environinent and resources that enabled this work to bc: pcrforined.

8

I

I

4

i

h

7

x 9

10

11

12

13 14

15

16

17

dpplicatiw or soft sys ims method-logy’, .1. Ope?. R ~ . F , SOL.., 1993. 36, pp. 1(21--831

modcls‘. ,/. Opc,r. Re.s. J’O~. , 1993, 44; (4). pp. 333-344 CiRE6;C)RV. b‘.Ii.: ‘C’Cttisi;, cFltct, ell‘ciency a n d &oft sys!elns

I-”IIOBEI<T, S.K. : ‘Logic iiiid conccptuai modclling in sort sys- ot the confercnce oil 7’/zeorv, ii.w oilo/ogie.s. 1993, (British Coinpu- Methodologies Spccial liltcrest

Group). p 1 2 . 233-246 GREGORY, F.H.: ‘Soft systems modcl:, [or kiiowledgc elicitatioii

Oper. R m Soc., 1995, 46, (5), pp. 562 -578 ormal process modelling’. In6 Sofiw T e d -

nol., 1993. 35, (11 -12), pp. 659-667 BOARDMAN, J.T., and COLE, AJ . : ‘Integrated process improvement in dcsign and manuficture using a systems approach’, IEE Proi‘. D , Conlr’ol Theory Appl., 1996. 143, (2), pp. 171-185 CLEGG, B.T.. and BOARDMAN, J.T. ‘Process integration and improvement using systcinic diagrams and a human-centred approach‘, Coniwi. Eng., Rcs. A p L , 1996, 4, (2), pp. 119-136 PETERSON, J.L.: ‘Petri net theory and the modelling 01‘ systems’ (Prenticc-Hall, 1981) REISIG, W.: ‘Petri nels: a n introduction’ (Springer-Vcrlag, 1985) MURATA, T.: ‘Petri nets: properties, analysis and applications’.

JENSEN, IC: ‘Coloured Petri nets: basic concepts, analysis mcth- ods and practical usc, Vol. I ’ (Springer-Verlag, Berlin/Heidelberg, 1992) SAKTHIVEL, S.. and MOILY, J.P.: ‘Analytical verification of information-system requirernents using Petri net properties’, Inf.’ S‘o/tiv, Toc/z/zol., 1993, 35, (2). pp. 89-100 KROGH, H.H., and BECK. C.L.: ‘Synthcsis of placdtransition nets for simulation and control or manirfacturing systems’. Pro- ceedings of’ the IFIP sympwiium oil Larqe .scu/e sj.c/erns, Zurich. Switerzland, August 1986

P ~ ~ ) ~ . IEEE, 19n9,11, pp 5111-577

47 I