This can be a very serious situation because, as a
consequence, the library may lose income needed to
acquire enough resources and eventually go bank-
rupt, closing down the business. Dysfunctions will
have a cause which may be expected or unexpected.
If the cause is expected, certain resilience strategies
may already exist that can be activated to eliminate
or circumvent dysfunctions (Holland, 1996). From
several approaches to support Organizational Engi-
neering being proposed, DEMO seems to be one of
the most coherent, comprehensive, consistent and
concise (Dietz, 2006). It has shown to be useful in a
number of applications, from small to large scale
organizations – see, for example, (Op' t Land, 2008)
(p. 39). Nevertheless, DEMO models have been
mostly used to devise blueprints to serve as instru-
ments for discussion of broader scale organizational
change or development/change of IT systems (Op' t
Land, 2008) (p. 58) and does not, yet, provide mod-
eling constructs and a method for the continuous
control (resilience) that we need to exert on organi-
zations to guarantee viability. Contributions of our
research – part of which is presented in the next sec-
tion – extend DEMO, with the devising of concepts
and a method that systematically address the referred
shortcoming. The reader which is unfamiliar with
DEMO is advised to consult (Dietz, 2006) or publi-
cations in: www.demo.nl.
2 CONTROL ORGANIZATION
One of the contributions of our research is to apply
DEMO to model what we propose to call the Control
Organization. The Control Organization's ontologi-
cal model (COM) is the specification of a generic
organization considered to exist included in every
organization and responsible for controlling its vi-
ability. It clearly and precisely specifies (1) accepted
outcomes of organizational behavior so that viability
is guaranteed, as well as (2) resilience strategies that
can be activated or deactivated, as to eliminate dys-
functions caused by expected exceptions. For audit-
ing reasons and to aid organizational change, we
should keep structured information of the state and
dynamics of control acts which may be very useful
to trace a new previously unexpected exception
causing a need for change. We next present one of
the main aspect models of the COM, namely the
CO's State Model (CO's SM) which is expressed, in
World Ontology Specification Languate (WOSL)
(Dietz, 2005) in Figure 1, consisting in the CO's
State Space Diagram (CO's SSD). WOSL is highly
based in the ORM fact oriented modeling language
(Halpin, 1998), extending it with the ability of mod-
eling events (result kinds) affecting facts. In prac-
tice, the CO's SSD is a default subset of the SSD of
every organization. For separation of concerns rea-
sons we model the CO as a “separate” organization,
although, in practice, it is included in the controlled
organization itself. A similar reasoning applies to the
other aspect models of the CO: the CO's CM and the
CO's AM, which, for space reasons, are left out of
this paper. As a central piece in the CO's SM, we
specify object class DYSFUNCTION, of which in-
stances will aggregate all kinds of useful information
regarding a certain dysfunction. Special and also
fundamental pieces of the CO's SM are object
classes MEASURE and VIABILITY NORM.
2.1 Measures and Viability Norms
Norms specify values for properties of the organiza-
tion system that need to be respected so that viability
is maintained. We propose to call such properties as
measures and norms as viability norms, as they spec-
ify allowed states for certain measures of an organi-
zation which guarantee its viability. We find in
(Dietz, 2006) the Object Property List, part of the
SM, as a convenient way of specifying fact types
that are proper (mathematical) functions, and of
which the range is a set of values. The fact types in
an OPL are called properties (of object classes). We
observe, from the OPL of the library (Dietz, 2006),
that certain properties specify restrictions on another
property. E.g, we have property max_copies_in_loan
which specifies the maximum (restriction) number
of book copies a certain member of the library is
allowed to have in loan (property). This (restriction)
property is checked in the action rule that decides on
an acceptance or a decline in transaction loan start. It
logically follows that, in the SM of a certain organi-
zation, certain properties will have to be declared
that specify restrictions on certain measures related
to its information banks (i.e., to its production and
coordination information). Taking the case of the
library, one of its production banks is PB01, also
named by alias membership fee payments. To make
sure one is able to cover all expenses of the library,
we will need to measure a relevant property of
PB01, namely, total income per month. As a viabil-
ity norm, we need to declare a certain necessary
minimum income per month. We do this with prop-
erty min total income per month. To detect possible
problems in loans, we will also need to measure a
relevant property of coordination bank CB04,
namely, loan declines per week. As a viability norm
we need to declare a certain maximum of declines
per week. We do this with property max total loan
declines per week. Object class MEASURE, of the
CO's SM, represents the aggregation of all properties
ICEIS 2010 - 12th International Conference on Enterprise Information Systems
490