A Straightforward Introduction to Formal Methods Using

Coloured Petri Nets

Franciny Medeiros Barreto, Joslaine Cristina Jeske de Freitas,

Michel S. Soares and St´ephane Julia

Universidade Federal de Uberlˆandia - Faculdade de Computac¸ ˜ao, Uberlˆandia, Minas Gerais, Brazil

Keywords:

Formal Methods, Coloured Petri Nets, Modelling.

Abstract:

Coloured Petri Nets (CPN) arose from the need to model very large and complex systems, which are found

in real industrial applications. The idea behind CPN is to unite the ability to represent synchronization and

competition for resources of Petri nets with the expressive power of programming languages, data types and

diverse abstraction levels. Through this union, systems which study was previously impractical have become

amenable to study. The objective of this paper is to present a formal modeling of the Health Watcher System

applying the concepts of CPN using CPN Tools. Using a graphical language such as CPN often proves to be a

helpful didactic method for introducing formal methods. This paper presents a brief introduction to Coloured

Petri Nets, and illustrates how the construction, simulation, and veriﬁcation are supported through the use of

CPN Tools.

1 INTRODUCTION

With the explosive involvement of technology in the

lives of humans, it is extremely important to design

software systems which are free from errors and are

able to satisfy their users in terms of performance, ef-

ﬁciency, correctness, and easy of use. If due to certain

reasons, these systems are designed and implemented

incorrectly the cost of correcting these errors becomes

enormous. Thus, it is very important to have a mech-

anism where design errors can be discovered and cor-

rected early (OMG, 2011).

Many modelling languages were proposed in past

years to design software systems. Currently UML is

one of the most used languages for software and sys-

tems modelling. UML (Uniﬁed Modelling Language)

(Booch et al., 2005) is a graphical language for vi-

sualizing, specifying, constructing, and documenting

information about software-intensive systems. The

language gives us a standard way to write a system’s

view, covering conceptual aspects such as business

processes and system functions, as well as elements

such as classes to be implemented in a speciﬁc pro-

gramming language, database schemas, and reusable

software components.

UML is a semi-formal modelling language, mak-

ing it difﬁcult to analyze semantics and to verify

correctness of a system. Therefore, it is necessary

that a formal approach is applied. Various authors

have argued the advantages of such formal modelling

languages: they reduce the vagueness and ambigu-

ity of informal descriptions, they allow for valida-

tion of completeness and consistency through formal

proofs, and they bridge the gap between the infor-

mal model and the design of a system (Sommerville,

2010), (Thayer et al., 2002). However, other au-

thors believe that formal languages suffer from prob-

lems which severely limit their practical usefulness:

they are often not expressive enough to deal with real

world applications, formal models are complex and

hard to read, and constructing a formal model is a dif-

ﬁcult, error prone and expensive process (Hall, 1990).

A Petri net is a formal language that allows the

modelling of systems, using as a foundation a strong

mathematical background. The language has the par-

ticularity to enable modelling parallel, concurrent,

asynchronous and non-deterministiccharacteristics of

systems (Murata, 1989). Like other industry stan-

dards such as UML Activity Diagrams or BPMN,

Petri nets offer a graphical notation for stepwise pro-

cesses that include choice, iteration, and concurrent

execution. Unlike these standards, Petri nets have an

exact mathematical deﬁnition of their execution se-

mantics, with a well-developed mathematical theory

for process analysis using different methods. How-

ever, when ordinary Petri nets are used for the mod-

145

Medeiros Barreto F., Cristina Jeske de Freitas J., S. Soares M. and Julia S..

A Straightforward Introduction to Formal Methods Using Coloured Petri Nets.

DOI: 10.5220/0004861901450152

In Proceedings of the 16th International Conference on Enterprise Information Systems (ICEIS-2014), pages 145-152

ISBN: 978-989-758-028-4

 2014 SCITEPRESS (Science and Technology Publications, Lda.)

eling process, the size of very large and complex sys-

tems became an issue of major complication. Then,

the concept of CPN arose from the need to represent

these complex systems, which are found in real indus-

trial applications.

The idea of CPN is to unite the ability to rep-

resent synchronization and competition of Petri nets

with the expressive power of programming languages

with their data types. Through this union, systems

which study was previously impractical have become

amenable to study (Jensen and Kristensen, 2009).

CPN is a language for the modelling and validation of

systems in which concurrency, communication, and

synchronization play a major role (Aalst et al., 2013).

CPN is a discrete-event modelling language combin-

ing Petri nets with the functional programming lan-

guage Standard ML (Milner et al., 1997).

Recent examples of applications using CPN can

be found in (Noguera et al., 2010), in which the au-

thors provide a mapping between UML and Web On-

tology Language (OWL), through a set of mapping

rules. This mapping, which results in a formalization

of collaborative processes, also sets a basis for sub-

sequent construction of executable models using the

CPN formalism. For this purpose, the authors also

provide appropriate mappings from OWL-based on-

tological elements into CPN elements. In (Kolr and

Kvetonov, 2012), the paper presents how the whole

public transport system can be described by a Petri

net model, in particular by CPN Tools. In (Weidlich

et al., 2013), the authors takeup the challenge of mod-

elling event processing networks using CPN. They

outline how this type of system is modelled and illus-

trate the formalization with the widely used showcase

of the Fast Flower Delivery Application (FFDA). Fi-

nally, they show how the net of the FFDA is employed

for analysis with CPN Tools.

The importance of validating software require-

ments has been widely discussed (Boehm, 1984),

(Queralt and Teniente, 2012), (Michael et al., 2011).

The advantages of providing formal validation for

software has been extensively explored (Berard et al.,

2010), (Goknil et al., 2010). In recent research, the

authors show how to validate UML models using

CPN Model. For example, in (Laxman, 2013), the

author defends the thesis that it is possible to validate

UML models for interactive systems with CPN and

the SPIN model checker. In (Ribeiro and Fernandes,

2009), the validation of scenario-based business re-

quirements with CPN is presented.

It is possible to realize that CPN is a general pur-

pose modelling language, i.e., it is not focused on

modelling a speciﬁc class of systems, but aimed to-

wards a very broad class of systems that can be char-

acterized as concurrent systems. The objective of this

paper is to present a formal modelling of the Health

Watcher System (Soares et al., 2002) applying the

concepts of CPN using the CPN Tools. Using a graph-

ical language such as CPN often provesto be a helpful

didactic method for introducing formal methods.

The requirements document for the Health

Watcher (HW) System was speciﬁed in 2002 (Soares

et al., 2002). Since then, the requirements, design

and implementation for HW have been used in sev-

eral studies, but none of them using a formal method.

For example, in (Cavalcante et al., 2012) the system

was the case study with focus on cloud computing.

Another example is presented in (Dyer et al., 2012),

in which the authors show an empirical study using

quantitative metrics to evaluate the Health Watcher

System. Additional examples of the use of Health

Watcher System can be found in (d’Amorim and

Borba, 2010), (Preece, 2010), (Dai, 2009) and (Siy

et al., 2007).

This paper presents a brief introduction to CPN,

and illustrates how the construction, simulation, and

state space analysis are supported by the use of CPN

Tools. The main contribution of this paper is to

show that it is possible to use CPN Tools for mod-

elling and validation of information systems without

initially modelling using UML and then validate the

model in CPN. Therefore, CPN are used not only for

the veriﬁcation and validation activities, but also for

the modeling activities of a software system.

The reminder of this paper is as follows. Sec-

tion 2 introduces the concepts of CPN. Section 3 il-

lustrates the steps to create a model of CPN from

the requirements of the Health Watcher System pre-

sented in (Soares et al., 2002) using CPN Tools.

Section 4 shows how the simulation of the Health

Watcher model is supported. Section 5 shows results

obtained from the monitoring. Section 6 presents the

formal veriﬁcation of the model. Finally, section 7

concludes the paper and provides references for addi-

tional works concerning the modelling language for

CPN, practical examples, and use of tools for Petri

nets.

2 CONCEPTS OF CPN

CPN is a graphical modelling language (Jensen and

Kristensen, 2009), which combines the strengths of

Petri nets (Wolfang Reisig, 2013) and of functional

programming languages (Milner et al., 1997). The

formalism of Petri nets is well suited for describing

concurrent and synchronizing actions in distributed

systems. Programming languages can be used to de-

ICEIS2014-16thInternationalConferenceonEnterpriseInformationSystems

146

ﬁne data types and manipulation of data. An intro-

duction to the practical use of CPN can be found at

(Kristensen et al., 2004).

The CPN are designed to reduce the size of the

model, allowing individualization of tokens, using

colours assigned to them, so different processes or

resources can be represented in the same network.

Colours do not mean just colours or patterns. They

can represent complex data types (Jensen and Kris-

tensen, 2009).

CPN models are formal, in the sense that the CPN

modelling language has a mathematical deﬁnition of

its syntax and semantics. This means that they can

be used to verify system properties, i.e., prove that

certain desired properties are fulﬁlled or that certain

undesired properties are guaranteed to be absent.

Large and complex models can be built using hi-

erarchical CPN in which modules, which are called

pages in the CPN terminology, are related to each

other in a well-deﬁned way. Without the hierarchi-

cal structuring mechanism, it would be difﬁcult to

create understandable CPN models of real-world sys-

tems (Jensen and Kristensen, 2009).

2.1 Formal Deﬁnition of Coloured Petri

Net

The formal deﬁnition of a CPN is as follows (Jensen

and Kristensen, 2009):

A Coloured Petri Net is a tuple CPN =

(

∑

, P, T, A, N, C, G, E, I) satisfying the following

requirements

(i.)

∑

is a ﬁnite set of non-empty types, called

colour sets.

(ii.) P is a ﬁnite set of places.

(iii.) T T is a ﬁnite set of transitions.

(iv.) A is a ﬁnite set of arcs such that:

• P∩ T = P∩ A = T ∩ A =

(v.) N is a node function. It is deﬁned from A into

PXT ∪ TXP.

(vi.) C is a colour function. It is deﬁned from P into

∑

(vii.) G is a guard function. It is deﬁned from T into

expressions such that:

• ∀t ∈ T: [Type(G(t)) = Bool ∧

Type(Var(G(t))) ⊆

∑

]

(viii.) E is an arc expression function. It is deﬁned

from A into expressions such that:

• ∀a ∈ A: [Type(E(a)) = C(p(a))

∧

Type(Var(E(a))) ⊆

∑

]

where p(a) is a place of N(a).

(ix.) I is an initialization function. It is derived from

P into closed expressions such that:

• ∀p ∈ P : [Type(I(p)) = C(p)

2.2 Hierarchical CPN

One of the problems presented in Petri nets is associ-

ated with the fact that, as the size of the system grows,

it becomes increasingly difﬁcult to maintain the clar-

ity of the model.

CPN models can be structured into a number of

related modules. This is particularly important when

dealing with CPN models of large systems. The mod-

ule concept of CPN is based on a hierarchical structur-

ing mechanism, which supports bottom-up as well as

top-down working style. New modules can be created

from existing modules, and modules can be reused

in several parts of the CPN model. By means of the

structuring mechanism it is possible to capture differ-

ent abstraction levels of the modeled system in the

same CPN model.

2.3 CPN Tools

The practical application of CPN modelling and anal-

ysis heavily relies on the existence of computer tools

supporting the creation and manipulation of mod-

els. CPN Tools is a tool suite for editing, simu-

lating, providing state space analysis, and provid-

ing performance analysis of CPN models. It is cur-

rently licensed to more than 4000 users in more than

100 different countries and is available both for MS-

Windows and Linux platforms. The user of CPN

Tools works directly on the graphical representation

of the CPN model. The graphical user interface (GUI)

of CPN Tools has no conventional menu bars or pull-

down menus, but is based on interaction techniques,

such as tool palettes and marking menus. A license

for CPN Tools can be obtained free of charge via the

CPN Tools web pages http://www.cpntools.org.

3 CPN MODEL FOR HEALTH

WATCHER

The purpose of the system is to collect and then man-

age public health related complaints and notiﬁcations.

The system is also used to notify people about impor-

tant information regarding the Health System.

System users are employees of the Department of

Health and any citizen who wants to interact with the

system. A citizen can access the system through the

AStraightforwardIntroductiontoFormalMethodsUsingColouredPetriNets

147

Internet and make their complaint or request informa-

tion about the different health service sectors avail-

able. In the event of a complaint being made, it will

be registered on the system and addressed to a spe-

ciﬁc department. This department will be able to han-

dle the complaint in an appropriate manner and give a

suitable response to the client once the complaint has

been dealt with. This response will be registered on

the system and available to be queried. The system

should provide access to 20 users simultaneously.

Figure 1: The most abstract level of modelling for Health

Watcher.

The modelling approach is hierarchical, where

each transition can be replaced by a module with de-

tails of the activities associated with the transition.

The most abstract level of the modelling of the Health

Watcher system is depicted in ﬁgure 1.

Figure 2: Module: Access System, Process Access and Re-

turning Access.

As depicted in ﬁgure 1, the colset ACCESS is a

set of colours that contains only 20 tokens of the ac-

cess type as the system should only allow 20 concur-

rent accesses. The colset UserType is a set of colours

that contains tokens of types citizen and employee.

The transition Access System will be ready for bind-

ing when there is at least one free access and one user

to use the system.

Figure 2 depicts, in details, three modules Access

System, Process Access and Returning Access.

The transition Access System is enabled when

there is a token type access and another token type

UserType. When the transition is binding, then the

two tokens are consumed and then they generate a

new token with function NextTypeUser in place User,

and other token in place System Released.

When there is a token in place System Released,

the transition Process Access is enabled. When the

transition Process Access is binding, the token is con-

sumed and a token is produced in place Separate Ac-

cess. In this case, the transition to be enabled depends

on the type of token produced. The guard condition

tu = citizen or tu = employee enables the correct tran-

sition. Besides, when the task ends - place Completed

- the token is returned to the place Free Access.

There are several scenarios deﬁned by the spec-

iﬁcation of the requirements of the Health Watcher

System and we can not show them all due to space

limitations. Therefore, the authors chose the scenario

in which the citizen accesses the system to make a

complaint.

3.1 Complaint Speciﬁcation

According to the work presented in (Soares et al.,

2002), the main ﬂow of events for the complaint spec-

iﬁcation is:

1. The citizen logs into the system; (ﬁgure 3)

2. The citizen chooses the option Specify Complaint;

(ﬁgure 4)

3. The citizen informs the system of the type of com-

plaint being made and reports data; (ﬁgure 5)

4. The system records the complaint; (ﬁgure 6)

5. Access is released. (ﬁgure 7)

The sequence of ﬁgures 3, 4, 5, 6, 7, show the

modelling of the scenario when the citizen decides to

make a complaint.

4 SIMULATION

A CPN model of a system describes the states of the

system and the events (transitions) that can cause the

ICEIS2014-16thInternationalConferenceonEnterpriseInformationSystems

148

Figure 3: The citizen logs into the system.

Figure 4: The citizen chooses the option Specify Complaint.

system to change state. By making simulations of

the CPN model, it is possible to investigate differ-

ent scenarios and to explore the behaviors of the sys-

tem. Very often, the goal of simulation is to debug

and to investigate the system design. CPN nets can

be simulated interactively or automatically. An inter-

active simulation is similar to single step debugging.

It provides a way to “walk through” a CPN model,

investigating different scenarios in detail and check-

ing whether the model works as expected. During an

interactive simulation, the modeler is in charge and

determines the next step by selecting between the en-

abled events in the current state.

Before and after an automatic simulation, the cur-

Figure 5: The citizen informs the system of the type of com-

plaint being made and reports data.

Figure 6: The system records the complaint.

rent marking and the enabled transitions are displayed

as described for the interactive mode. However, the

token game is not displayed during automatic simu-

lations. Of course, this typically constitutes less in-

formation than desired. A straightforward possibil-

ity to obtain information about “what happened” is to

use the simulation report, which is a textual ﬁle con-

taining detailed information about all the bindings of

transitions that occurred. Figure 8 shows a simulation

report of the ﬁrst 8 steps from an automatic simulation

of the Health Watcher System.

AStraightforwardIntroductiontoFormalMethodsUsingColouredPetriNets

149

Figure 7: Access is released.

Figure 8: Partial sample simulation report.

5 MONITORING

In CPN Tools, monitors can be used to examine the

binding elements that occur and the markings that are

reached during a simulation. Different kinds of mon-

itors can be used for different purposes, and break-

point monitors can be used to stop simulations when

speciﬁc conditions are fulﬁlled. A transition enabled

monitor is a standard breakpoint monitor that can be

associated with a transition, and the monitor will stop

a simulation when the transition is enabled (or dis-

abled, as determined by an option for the monitor).

Figure 9: Monitoring Report.

The monitoring results are obtained during the

running of the simulation. After 10000 simulation

steps, a result of the monitoring is obtained and can

be seen in ﬁgure 9.

The result shows that the system was accessed

1046 times during the simulation, which was made up

of 508 employees and 535 citizens. However, moni-

toring shows that access allows employees to perform

several different tasks. For example, there were 497

activities related to the Register table, 485 activities

opinion of complaints, totaling 982 tasks associated

to the employee, and only 535 citizen - 116 activities

related to consult health guide, 147 activities related

to consult different information and 272 activities re-

lated to specify the complaint.

6 STATE SPACE ANALYSIS

CPN models are formal, in the sense that the CPN

modelling language has a mathematical deﬁnition to

its syntax and semantics. This means that they can be

used to verify system properties, i.e., prove that cer-

tain desired properties are fulﬁlled or that certain un-

desired properties are guaranteed to be absent. Ver-

iﬁcation of system properties is supported by a set

of state space methods. The basic underlying idea

of state spaces is to compute all reachable states and

state changes of the CPN model and represent these as

a directed graph where nodes represent states and arcs

represent occurring events. State spaces can be con-

structed entirely automatic. From a constructed state

space it is possible to answer a large set of veriﬁcation

questions concerning the behavior of the system such

as absence of deadlocks, the possibility of always be-

ing able to reach a given state, and the guaranteed de-

livery of a given service.

Figure 10: State space report: statistics.

For the CPN model in Figure 1, the state space re-

port is the same as that shown in Figures 10 - 13. First

we have some state space statistics (see Fig.10) telling

how large the state space is. For the Health Watcher

System we have 17089 nodes and 58108 arcs. Statis-

tics about the SCC-graph are also received. It has

13131 nodes and 44343 arcs.

The next parts of the state space report contain

information about the boundedness properties. The

boundedness properties give information as to how

many (and which) tokens a place may hold, when all

reachable markings are considered.

Figure 11 speciﬁes the best upper and lower inte-

ger bounds. The best upper integer bound of a place

speciﬁes the maximal number of tokens that can re-

ICEIS2014-16thInternationalConferenceonEnterpriseInformationSystems

150

Figure 11: State space report: integer bounds.

side on a place in any reachable marking. The best up-

per integer bound of place Top’User is 1 which means

that there is at most one token in place Top’User, and

there exists reachable markings where there is one to-

ken in Top’User.

The best lower integer bounds for a place speciﬁes

the minimal number of tokens that can reside in the

place on any reachable marking. The place Top’User

has a best lower integer bound of 1 which means that

there is always at least one token in this place. When

the best upper and lower integer bound are equal it im-

plies that the place always contains the same number

of tokens.

Figure 12: State space report: home properties.

Figure 12 shows the part of the state space report

that speciﬁes the home properties. The home prop-

erties tell us that there does not exist a single home

marking.

Figure 13: State space report: liveness properties.

The liveness properties in Figure 13 specify that

there is not a single dead marking. A dead marking is

a marking in which no binding elements are enabled.

Figure 13 speciﬁes that there are no live transi-

tions. A transition is live if from any reachable mark-

ing we can always ﬁnd an occurrence sequence con-

taining the transition. In other words, we cannot do

things which will make it impossible for the transi-

tion to occur afterwards.

Figure 13 also speciﬁes that there are no dead tran-

sitions. A transition is dead if there are no reachable

markings in which it has been enabled. There are

no dead transitions means that each transition in the

Health Watcher System has the possibility to occur at

least once. If a model has dead transitions then they

correspond to parts of the model that can never be ac-

tivated. Hence, we can remove dead transitions from

the model without changing its behavior.

7 CONCLUSION

Coloured Petri nets are a formal method in which

models depicting the exact functionality of the sys-

tem are designed, simulated and analyzed. This is a

technique with a lot of research done to prove the cor-

rectness of a vast variety of systems.

The focus of this paper was the modelling and

simulation of Coloured Petri Networks using the

CPN Tools. Normally, critical systems are mod-

elled through the use of formal methods. However,

the modelling of an information system, such as the

Health Watcher System, provides a different perspec-

tive to formal modelling. The CPN Tools unite all the

properties of a CPN, which makes its use extremely

practical and powerful, leaving the user with only the

job of how to create the semantic model. Another

factor which favors the use of the tool is the ease

by which it can be obtained. The CPN Tools is dis-

tributed free of charge, unlike other simulation soft-

ware.

As an important approach to modelling, UML has

been successfully applied in many ﬁelds of software

engineering. However, because of the semantic gap,

UML is hard to be checked, which can cause disas-

trous consequences for the system. CPN has a pre-

cise mathematical semantics and automatic veriﬁca-

tion tools. Using CPN Tools, it is possible to in-

vestigate the behaviour of the modelled system us-

ing simulation, to verify properties by means of state

space methods and model checking, and to conduct

simulation-based performance analysis. Therefore,

CPN is an interesting modelling approach because it

is capable of describing the software detects errors

and obtaining greater conﬁdence of the correctness of

the model.

AStraightforwardIntroductiontoFormalMethodsUsingColouredPetriNets

151

REFERENCES

Aalst, W. M., Stahl, C., and Westergaard, M. (2013). Strate-

gies for modeling complex processes using colored

petri nets. Transactions on Petri Nets and Other Mod-

els of Concurrency, 7:6–55.

Berard, B., Bidoit, M., Finkel, A., Laroussinie, F., Petit, A.,

Petrucci, L., and Schnoebelen, P. (2010). Systems and

Software Veriﬁcation: Model-Checking Techniques

and Tools. Springer Publishing Company, Incorpo-

rated, 1st edition.

Boehm, B. W. (1984). Verifying and validating software

requirements and design speciﬁcations. IEEE Softw.,

1(1):75–88.

Booch, G., Rumbaugh, J., and Jacobson, I. (2005). Uniﬁed

Modeling Language User Guide, The (2nd Edition)

(Addison-Wesley Object Technology Series). Addison-

Wesley Professional.

Cavalcante, E., Almeida, A., Batista, T., Cacho, N., Lopes,

F., Delicato, F. C., Sena, T., and Pires, P. F. (2012). Ex-

ploiting software product lines to develop cloud com-

puting applications. In Proceedings of the 16th Inter-

national Software Product Line Conference - Volume

2, SPLC ’12, pages 179–187, New York, NY, USA.

ACM.

Dai, L. (2009). Security variability design and analysis in an

aspect oriented software architecture. In Proceedings

of the 2009 Third IEEE International Conference on

Secure Software Integration and Reliability Improve-

ment, SSIRI ’09, pages 275–280, Washington, DC,

USA. IEEE Computer Society.

d’Amorim, F. and Borba, P. (2010). Modularity analy-

sis of use case implementations. In Proceedings of

the 2010 Fourth Brazilian Symposium on Software

Components, Architectures and Reuse, SBCARS ’10,

pages 11–20, Washington, DC, USA. IEEE Computer

Society.

Dyer, R., Rajan, H., and Cai, Y. (2012). An exploratory

study of the design impact of language features for

aspect-oriented interfaces. In Proceedings of the 11th

annual international conference on Aspect-oriented

Software Development, AOSD ’12, pages 143–154,

New York, NY, USA. ACM.

Goknil, A., Kurtev, I., and van den Berg, K. (2010). Tool

support for generation and validation of traces be-

tween requirements and architecture. In Proceedings

of the 6th ECMFA Traceability Workshop, ECMFA-

TW ’10, pages 39–46, New York, NY, USA. ACM.

Hall, A. (1990). Seven myths of formal methods. IEEE

Softw., 7(5):11–19.

Jensen, K. and Kristensen, L. (2009). Coloured Petri Nets.

Springer.

Kolr, D. and Kvetonov, S. (2012). People transfer in city

transport modeled via cpn. In Proceedings of the 13th

international conference on Computer Aided Systems

Theory - Volume Part I, EUROCAST’11, pages 192–

199, Berlin, Heidelberg. Springer-Verlag.

Kristensen, L. M., Jrgensen, J. B., and Jensen, K. (2004).

Application of coloured petri nets in system develop-

ment. In In Lecture on Concurrency and Petri Nets,

Jorg Desel, Wolfgang Reisig and Grezegorz Rozen-

berg (Eds.), Springer, LNCS 3089, pages 626–685.

Springer-Verlag.

Laxman, P. B. (2013). Validation of UML Models for In-

teractive Systems with CPN and SPIN. PhD thesis,

Department of Computer Science and Engineering -

National Institute of Technology Rourkela.

Michael, J. B., Drusinsky, D., Otani, T. W., and Shing, M.-

T. (2011). Veriﬁcation and validation for trustworthy

software systems. IEEE Softw., 28(6):86–92.

Milner, R., Tofte, M., and Macqueen, D. (1997). The Def-

inition of Standard ML. MIT Press, Cambridge, MA,

USA.

Murata, T. (1989). Petri nets: Properties, analysis and ap-

plications. Proceedings of the IEEE, 77(4):541–580.

Noguera, M., Hurtado, M. V., Rodr´ıguez, M. L., Chung, L.,

and Garrido, J. L. (2010). Ontology-driven analysis

of uml-based collaborative processes using owl-dl and

cpn. Sci. Comput. Program., 75(8):726–760.

OMG (2011). OMG Uniﬁed Modeling Language (OMG

UML), Superstructure, Version 2.4.1. Object Manage-

ment Group.

Preece, J. J. (2010). I persuade, they persuade, it persuades!

In Proceedings of the 5th international conference on

Persuasive Technology, PERSUASIVE’10, pages 2–

3, Berlin, Heidelberg. Springer-Verlag.

Queralt, A. and Teniente, E. (2012). Veriﬁcation and valida-

tion of uml conceptual schemas with ocl constraints.

ACM Trans. Softw. Eng. Methodol., 21(2):13:1–13:41.

Ribeiro, s. R. and Fernandes, J. M. (2009). Validation of

scenario-based business requirements with coloured

petri nets. In Boness, K., Fernandes, J. M., Hall, J. G.,

Machado, R. J., and Oberhauser, R., editors, ICSEA,

pages 250–255. IEEE Computer Society.

Siy, H., Aryal, P., Winter, V., and Zand, M. (2007). As-

pectual support for specifying requirements in soft-

ware product lines. In Proceedings of the Early

Aspects at ICSE: Workshops in Aspect-Oriented Re-

quirements Engineering and Architecture Design,

EARLYASPECTS ’07, pages 2–, Washington, DC,

USA. IEEE Computer Society.

Soares, S., Laureano, E., and Borba, P. (2002). Implement-

ing distribution and persistence aspects with aspectj.

SIGPLAN Not., 37(11):174–190.

Sommerville, I. (2010). Software Engineering. Addison-

Wesley, Harlow, England, 9 edition.

Thayer, R., Dorfman, M., and Hunter, R. (2002). Software

Engineering Member Package (4 Volume Set). Practi-

tioners. Wiley.

Weidlich, M., Mendling, J., and Gal, A. (2013). Net-based

analysis of event processing networks: the fast ﬂower

delivery case. In Proceedings of the 34th international

conference on Application and Theory of Petri Nets

and Concurrency, PETRI NETS’13, pages 270–290,

Berlin, Heidelberg. Springer-Verlag.

Wolfang Reisig (2013). Understanding Petri Nets: Mod-

eling Techniques, Analysis Methods, Case Studies.

Springer. 230 pages; ISBN 978-3-642-33277-7.

ICEIS2014-16thInternationalConferenceonEnterpriseInformationSystems

152