Petri nets for modelling fault tolerant distibuted systems in a modular and incremental way

In his paper 'Beyond Programming Languages' T. Winograd [1] claims that for modelling complex systems sometimes one needs a temporary suppression of details. In particular, he focuses his attention on the need of a clear distinction between the "normal" behaviour of a system, and its more complex behaviour for handling exceptions and possible faults. That is, the relative simplicity of the specification of the first one should not be overloaded with all the details necessary for handling erroneus situations. We also have realized recently the usefulness of such guidelines when we have undertaken the specification and modelling of some case studies in the framework of the ESPRIT BRA #3148 DEMON (DEsign Methods based On Nets). The considered systems [2] are composed of distributed components which synchronize their behaviour to do the job: examples are a Telephon Switching System, a Flexible Manifacturing System, the Lift and the Distributed Termination Problem. Once more we have found that the problem descriptions in general mix the specification of the routine (or normal or standard) cases with the specification of some exceptions and with the requirement of handling possible faults of some system components. This mix makes the