Fuzzy Concepts and Formal Methods: Some Illustrative ... - CiteSeerX

Fuzzy Concepts and Formal Methods: Some Illustrative Examples Chris Matthews Division of Information Technology School of Management, Technology and Environment La Trobe University, Bendigo Bendigo, Victoria, Australia Phone: +61 3 54447350 Fax: +61 3 54447998 email: [email protected] Paul A. Swatman School of Management Information Sciences Deakin University Burwood, Victoria, Australia Phone: +61 3 9244 6268 Fax: +61 3 9244 6928 November 8, 2000

Abstract

It has been recognised that formal methods are useful as a modelling tool in requirements engineering. Speci cation languages such as Z permit the precise and unambiguous modelling of system properties and behaviour. However some system problems, particularly those drawn from the IS problem domain, may be dicult to model in crisp or precise terms. It may also be desirable that formal modelling should commence as early as possible, even when our understanding of parts of the problem domain is only approximate. This working paper identi es the problem types of interest and argues that they are characterised by uncertainty and imprecision. It suggests fuzzy set theory as a useful formalism for modelling aspects of this imprecision. The paper illustrates how an extended notation for Z, incorporating fuzzy concepts, can be used across a variety of problem domains. Several examples are presented and these underpin the discussion. In particular the following issues are addressed:     

The representation of fuzzy concepts as invariant and/or multi-dimensional fuzzy sets. The limitation of a crisp approach when modelling such concepts. Operations that add or remove elements from fuzzy sets. Fuzzy relations. System requirements as a series of linguistically quanti ed propositions.

1

Modelling con ict and agreement. The possibility of a `soft' pre-condition.  The speci cation of a fuzzy expert system for decision support This paper is an updated version of an earlier form of the illustrative examples working paper(1999). It contains extra material on the speci cation of a fuzzy expert system  

Keywords: Formal Methods, Z, Fuzzy set theory, Requirements engineering

1 Introduction Requirements engineering or analysis is normally seen as the process by which software requirements are identi ed and speci ed and has been described as a `process of discovery, re nement, modelling and speci cation' (Pressman 1997, page 270). Both the client and the requirements engineer take an active role in this process. Requirements analysis is critical to the success of a software implementation and it has long been accepted that many system faults can be traced back to inaccurate or ambiguous speci cations1. The client may only bring a vague or unclear notion of the system needs and the challenge is take the imprecise and incomplete ideas of the clients and re ne them through a process of debate and elicitation into a precise and formal speci cation. To do this we must rstly to attempt to gather and understand the client's requirements, and then be able to communicate our understanding to both the client and the system builder. System modelling is a useful tool in this process. We can create models to express our understanding of a current system problem, to identify areas for change or to describe the nal product to be built. These may be developed from diering perspectives and can express both functional and behavioural aspects of a system. They permit partitioning of complex system problems into smaller and more manageable units. They also can be used as a basis for communication and validation with the client. Many of these modelling techniques use semi-formal diagramming techniques such as data ow diagrams, state transition diagrams and entity relationship diagrams, and may be supported by explanatory text. However these approaches lack the well de ned and formal syntax that permits precise analysis, and models expressed in these terms are open to possible ambiguity and misunderstanding. At some point we need to express the model more formally and to subject it to precise and rigorous analysis. The use of a formal speci cation language as a modelling tool provides a possible way to achieve this.

2 Formal Approaches Formal methods are a set of mathematical based techniques that allow the development of a complete, precise and correct speci cation for system behaviour and properties. They have been For example, the results of Boehm's IBM and TRW studies (Boehm 1976) which indicate that around 60% of system faults can be traced to speci cation errors, ambiguities and omissions, appear to be widely accepted within the academic and professional computing community. It appears that the situation has not improved. More recent studies on IT failure suggest that a signi cant number of systems are being delivered late, are over-budget and fail to fully meet their requirements (Orton & Sacerdoti 1992, OASIG 1996, Jackson 1997). 1

2

described as `methods that use formulas' (Jacky 1997, page 3). A formula can be text (or even a diagram) that is formed by applying a set of explicit rules to a series of pre-de ned symbols. The symbols and syntactic rules form a speci cation language which can be checked for syntactic correctness by a computer. In this context any programming language can be seen as being a formal speci cation language. However unlike the more abstract speci cation languages, a programming language is executable and is designed with only limited attention being paid to the communication of the meaning of a speci cation to a human being. It is only through the execution of the program on a computer that the meaning becomes evident. If we use a programming language as the only formal speci cation tool in system development then any errors or omissions in the speci cation may only become apparent at run-time. Furthermore programming languages focus attention on how a set of requirements are to be implemented, rather than what is required. The use of more abstract languages, however, allows us to model and predict system behaviour, and to identify errors and omissions prior to implementation | `The whole point of formal methods is to be able to predict what a program will do without running any code | in fact, without writing any' (Jacky 1997, page 4). Although formal approaches have been most commonly used in the speci cation of safety critical software, it has been argued that they can and should be applied to all stages of the systems development lifecycle, including requirements determination (Wing 1990). It has also been further argued that a formal approach should be introduced as early as possible during requirements determination (Swatman & Swatman 1992, Swatman 1996). Formally expressed models can provide an unambiguous and precise expression of a client's requirements. They allow the requirements engineer and the client to share a common understanding of the problem and enable issues of ambiguity and uncertainty to be identi ed and resolved as early as possible. One commonly used speci cation language is Z (Spivey 1992) and it, together with it's object-oriented successor, Object-Z (Duke, King, Rose & Smith 1991, Duke, Rose & Smith 1995), has been used as a basis for communication and requirements validation in the FOOM (Formal Object-Oriented Methodology) systems development methodology (Swatman & Swatman 1992, Swatman 1996). Z is based on typed set theory and rst order predicate calculus. System properties are modelled using set-theoretic concepts and the necessary pre- and post-conditions for each system operation, or change of state, are explicitly stated. The speci cation describes what the system has to do rather than how it is to be done. The basic building block in any Z speci cation is the schema. This is a named grouping of components to which reference can be made throughout the speci cation. Schemas provide structure for a speci cation and describe system operations and permissable system states. The schema calculus allows more complex components of a speci cation to be built from a set of previously de ned and simpler schemas. Z is a powerful analytical tool that facilitates system understanding through the development of a series of unambiguous, veri able mathemetical models (Potter, Sinclair & Till 1996, Jacky 1997). Various levels of abstraction are possible. These may vary from a statement of requirements (to be used as a basis for communication and validation) to a more concrete software design document. Unlike some of the more informal graphical methods such as data ow diagrams, Z is not open to diering interpretations, but instead allows the designer to prove through rigorous mathematical reasoning, the properties of a speci cation (Saiedian 1997). 3

3 Problem Types Some problem domains may not naturally be understood in precise or `crisp' terms. For example soft or socio-organisational systems, whose major focus is the interaction of people with organisations, are social rather than technical in nature. A substantial body of research (including Checkland (1981), Wilson (1990) and Checkland & Scholes (1990)) suggests that a subjectivist approach to understanding these `human activity systems' is important. This school of thought underpins the Soft Systems Methodology. It denies that in a complex socio-organisational context, there is any one problem de nition simply waiting to be uncovered. Instead it suggests that the problem is `socially constructed' rather than being in any sense objective, and admits the possible existence of several perspectives on the problem domain. Although these may be imprecise, vague and uncertain; and be both internally and externally inconsistent, potentially they can result in several valid models relevant to the problem situation. The Soft Systems Methodology attempts to focus attention and debate around the problem context and the differing perspectives of that problem. In essence it sees requirements engineering as a learning rather than a detection and identi cation process. L. A. Zadeh's concept of a humanistic system presents an alternative view. He de nes a humanistic system as one `whose behaviour is strongly in uenced by human judgement, perceptions or emotions' (Zadeh 1975). Economic, political, legal and educational systems are all examples of such systems and Zadeh suggests that a `single individual and his thought processes may also be viewed as a humanistic system'. One characteristic of systems of this type is that human decision making and judgement may take place in a climate of uncertainty. In the development of systems that attempt to model human decision making it has been recognised that it is necessary to deal with uncertain or ill-de ned knowledge (Buchanan & Shortlie 1985, Castillo & Alvarez 1991, Jackson 1999). We use terms such as vagueness, ambiguity, contradiction and imprecision when describing such systems. Our diculty in precisely representing these `softer' system problems is due in part to the uncertainty inherent in the problem domain. Uncertainty may arise in several ways. For example we may have diculty classifying objects or concepts into one or more classes based on a series of attributes. The uncertainty as to which class an object belongs could be simply due to a lack of information. In other words if we have enough information or if we are considering sucient attributes, then we should be able to make a precise categorisation. Klir & Harmanec (1997) refers to this type of uncertainty as being due to non-speci city and/or con ict, and they describe it as arising from `information de ciency'. However, as will be seen shortly, uncertainty can also arise from some natural imprecision in the problem domain itself. The classi cation into precise classes may not be possible | not because we do not have enough information | but instead, because the classes themselves are not naturally discrete. Klir & Harmanec (1997) suggest that uncertainty of this type is a property of natural language and that it arises from `linguistic imprecision'. It is the problem domains 4

which exhibit this second type of uncertainty that are of interest to us here2 . The need to deal with multiple perspectives within a complex problem domain and to be able to manage the inconsistencies that may exist between them is well recognised in requirements engineering (for example, see Finkelstein, Gabby, Hunter, Kramer & Nuseibeh (1994) and Darke & Shanks (1995)). Rather than dealing with this issue, our current research focuses on the possible use of formal methods as a modelling tool for these `softer' system problems. In particular we are interested in those containing uncertainty which arises from some natural imprecision or vagueness in the problem domain. This work is allied to a range of approaches, such as FOOM, which attempt to use a formal speci cation language as a bridge between socio-organisational analysis on the one hand and controlled development following the production of a formal speci cation on the other. As Object-Z is an object-oriented extension of Z and retains much of the original Z syntax, our initial work uses Z as the speci cation language. An advantage of using Z is the availability of a range of automated tools such as type checking software which allows speci cations to be checked for type consistency. Currently this level of automated support is unavailable for Object-Z. Problem domains which are not naturally understood in precise terms may be dicult to model using boolean set theory. Concepts or objects, whether they be individuals, organisational units, opinions etc may not be easily or naturally characterised into precise groupings. Instead we may be more interested in the extent to which something resembles a type or in the relative ranking of something within a class or type rather than a precise description. For example it might be more realistic to think of the degree of experience of a particular employee rather than attempting to distinguish between an experienced and an inexperienced employee. Rather than classifying a person as one of a group holding a particular set of opinions, it might be more useful to consider to what extent the person resembles people holding those views. We might be interested in the level of customer service provided by an organisation, rather than simply classifying it as good or bad. Additionally many of these concepts may only be partially understood and dicult to de ne or precisely measure. In this environment system requirements themselves may be dicult to express or model precisely. For example, the requirement that the performance of a new network be as ecient as possible may be sucient as an approximate statement of network performance, without having to precisely understand or de ne the performance benchmarks necessary to measure it, or to work out what is precisely meant by as ecient as possible. In fact it may be dicult or unrealistic to assign a precise meaning to statements of this type. Concepts like pro ts are high, system performance is poor, share prices are low etc may be sucient to express an approximate understanding shared by a group of people. There is some support for this in the literature. Prototype theory3 suggests that when clasIt should be pointed out that the classi cation of uncertainty types varies somewhat in the literature. Some authors (for example, see Dubois & Prade (1988), Lee & Kuo (1998)) adopt a narrower view of uncertainty and reserve the term to describe situations where we are uncertain due to insucient information. In this context Klir & Harmanec (1997)'s uncertainty arising from `linguistic imprecision' is referred to as imprecision or vagueness. 3 The term is being used a little loosely here. It refers to a range of theories (including exemplar theory) that attempt to explain concept categorization in terms of the resemblance of an example to what is considered to be 2

5

sifying objects we do so by comparing an instance or example against what we consider to be prototypical or an exemplar of that class. Thus we may see an overlap, rather than a crisp boundary between categories. Zhang (1998) de nes categorical membership of this type as fuzziness and argues that it is not resolvable even when more information is available or a context is provided. In other words the overlap is natural and cannot be expressed any more precisely. Fuzziness is also an inherent property of natural language and may arise when we deal with statements like someone who is clever can solve that problem or a tall person makes a good basketballer and so on (Zadeh 1975, Zadeh 1988, Klir & Harmanec 1997). The boundary between clever people and not so clever people, between good and poor basketballers is not clear cut. Instead it is probably gradual and no amount of extra information can fully resolve this and allow a complete categorisation. In the measurement of a person's attitudes or preferences, it has been argued that respondents should be allowed to indicate their extent of agreement rather than simply responding yes or no (Viswanathan, Bergen, Dutta & Childers 1996). More generally it has been suggested that they should be also permitted to indicate the uncertainty or fuzziness in their response (Hesketh, Prior, Gleitzman & Hesketh 1988, Hesketh, Pryor & Gleitzman 1989). Some recent comparative experimental results supports this approach (Costa, Maranon & Cabrera 1994), again suggesting that precise categorisation may be inappropriate when dealing with a person's preferences, attitudes or requirements. Lee & Yen (1994) have recognised the qualitative and imprecise nature of some system requirements themselves. These may be requirements that are only stated approximately or are heuristically expressed. They introduce the concept of a soft functional requirement | one where the degree to which the requirement pre-condition holds in uences the degree to which that requirement is met. In this way they attempt to introduce an elasticity into the system model, which may more naturally re ect the competing requirements within a problem domain. The use of a formal speci cation language such as Z, requires that we are able to categorise objects and concepts into precise types as the speci cation is developed. This may present a problem if imprecision or fuzziness is inherent to the problem domain itself. As suggested above, this may be the case in problem domains that are predominantly social rather than technical in nature. There is a danger that we will lose part of what we are attempting to represent. Languages like Z also require that permissable system states and operations are precisely expressed. Schema pre-conditions and post-conditions either hold or they don't, a system operation either succeeds or fails | the idea that a requirement need only be partially met or that a given system state may only approximately hold is dicult to imagine. As suggested earlier, there are advantages in introducing a formal approach as early as possible during requirements determination. It may be useful if we are able to express those parts of the problem domain that are only partially understood in the formal model. Then we could re ne the model as these issues are clari ed. One could imagine both our precise and approximate understanding of the problem domain being expressed in the same formal model. This would be particularly useful typical of a particular concept or class. There are alternative views as to how the prototypes or exemplars might be structured but the underlying principle remains the same i.e. that the boundaries between classes may be fuzzy or unclear and that instances of a concept can be ordered according to how typical they are of that concept. See Medin & Ross (1992, Chapter 12), Kess (1992, pages 218-21) and Eysenck & Keane (1995, Chapter 10) for an outline of the theory and a description of some supporting experimental results.

6

if we attempt to develop formal models early in requirements determination, while elicitation is still occurring. In order to facilitate this sort of approach to requirements engineering the speci cation language should allow us to both syntactically and semantically capture and represent imprecision and/or approximation. Fuzzy set theory (and fuzzy logic) oers such a possibility, particularly when dealing with naturally occuring or linguistic imprecision.

4 Fuzzy Sets Fuzzy set theory and fuzzy logic provides a mathematical basis for representing and reasoning with knowledge in uncertain and imprecise problem domains (Cox 1994, Cox 1995, Bojadziev & Bojadziev 1995). Unlike boolean set theory where set membership is crisp (i.e. an element is either a member of the set or it isn't), the underlying principle in fuzzy set theory is that partial set membership is permitted. Fuzzy set theory allows us to represent the imprecise concepts (e.g. motivated employees, high pro ts, productive workers) which may be important in a problem within an organisational context. For example, the values of a linguistic variable such as pro ts can be represented as fuzzy sets4 . Thus phrases such as high pro ts, low pro ts etc can then be interpretated as approximate rather than precise statements about the pro t levels of an organisation. Fuzzy set theory can be seen as a generalisation of boolean set theory. The common set operators such as negation, union and intersection all have their fuzzy equivalents and measures for fuzzy subsetness and degrees of fuzziness have also been proposed (Kosko 1990, Kosko 1992). Fuzzy logic deals with degrees of truth and provides a conceptual framework for approximate rather than exact reasoning. The truth of propositions such as a few employees are motivated or productive workers lead to high pro ts can be estimated and, more importantly, reasoned with in an intuitive manner (Zadeh 1988, Zadeh 1992). Fuzzy set theory and fuzzy logic have been successfully applied to industrial control problems, delivering performance levels similar to those obtained by expert human operators (Berenji 1992, Viot 1993). Fuzzy methods have also been used as a technique for uncertainty management in some commercial expert systems (Graham 1991). Fuzzy set theory, and related theories such as possibility theory (Dubois & Prade 1988), have been suggested as an alternative analytical tool in the social sciences. Smithson (1988) argues that existing statistical techniques are too restrictive when applied to the modelling of human behaviour. In his view, there is a mismatch between the probabilistic and deterministic basis of these approaches and that of some of the psychological theories that have been proposed to explain human behaviour. He and others (for example, see Zhang, Brody & Wright (1994) and Treadwell (1995) as well as Smithson (1987)) see the elasticity inherent in fuzzy set (and possibility) theory as providing a more exible tool for quantitative analysis in the social sciences, particularly in the areas of human choice and decision making. The idea that over-precision in the instruments used in psychological measurement may present problems has motivated research into areas such as the use of a fuzzy graphic A linguistic variable is one whose values are expressed in words rather than numerically. The variable pro ts can be considered to be a linguistic variable when we assign values such as high, average, low, very high etc to it. See Zadeh (1975) for the application of these ideas to approximate reasoning and to fuzzy sets 4

7

rating scale for the measurement of occupational preference (Hesketh et al. 1989), a fuzzy set approach to personnel selection (Allinger, Feinzig & Janak 1993) and a fuzzy linguistic model to predict the risk of carpal tunnel syndrome in the workplace (Bell 1997). In each case fuzzy methods have been used as the basis for data analysis delivering results that are at least as good, if not better, than those obtained using a non-fuzzy approach. Fuzzy set theory and fuzzy logic have also been used to model group decision making, particularly in environments containing imprecise information (Kacprzyk, Fedrizzi & Nurmi 1992). Individuals may express the degree to which they prefer each of a series of options, given the available evidence. Linguistic quanti ers such as most or almost all can then be used to express the degree of support or consensus across the entire group for each of the possible courses of action. Fuzzy logic, and more particularly the calculus of linguistically quanti ed statements, provides the underlying basis for this work. The recognition that fuzziness may be an inherent property of natural language suggests that fuzzy set theory may be useful in natural language processing. Fuzzy sets have attracted interest as a modelling tool for natural language semantics (Novak 1992). Schmucker (1984) argues that the intuitiveness and imprecision of risk analysis makes a precise numerical rating approach impractical. Instead he uses fuzzy sets, described using linguistic variables as a basis for a natural language scheme to build a more natural risk analysis system. It is clear that fuzzy methods are useful as both an analytical and a descriptive tool in problem domains that are predominantly social rather than technical. In particular fuzzy set theory can be used to formalise the uncertainty or imprecision due to the impossibility of making a precise distinction between any two concepts or categories (Klir & Harmanec 1997). Uncertainty of this type is sometimes referred to as fuzziness and appears to occur naturally in some problem domains (Wang 1996, Zhang 1998). Our current research focusses on the possible use of formal approaches, such as the speci cation language Z, as a modelling tool in problem domains of this type. Our motivation can be summarised as follows:

 Given that there are some system problems, particularly those drawn from a socio - organ-

isational context, that are not naturally modelled or understood in precise or crisp terms and given that we wish to retain the bene ts of a speci cation language such as Z as a method for communication and validation, is it possible to build into the existing syntax the necessary semantics to capture the uncertainty, imprecision or vagueness characteristic of such systems?  Fuzzy set theory is an established technique for representing uncertainty and imprecision and can be seen as a generalisation of boolean or crisp set theory. Given that Z is a set based speci cation language then it should be possible to provide a notation that incorporates fuzzy set ideas within the language itself while at the same time retaining the precision of any Z model. We have developed a possible fuzzy set notation within the existing Z syntax (Matthews & Swatman 1999, Matthews & Swatman 2000). The existing schema calculus and logical structures of Z are retained, but we extend the set notation to explicitly show the degree of set membership of each element. In this extended notation fuzzy sets are modelled as a total 8

function from some generic type to the real number interval [0,1]. For boolean or crisp sets set membership is constrained to 0 or 1. Set union, intersection and dierence are de ned as operations on functions of this type. We provide generic de nitions for fuzzy relations and properties such as range, domain, range and domain restrictions and anti-restriction, relational composition and relational image. We have developed a series of proofs which show that the extended notation is isomorphic with conventional Z when set membership is constrained to 0 or 1. The purpose of this working paper is to show via several examples how the notation might be applied and interpreted. The examples are typical of many systems drawn from a social rather than technical problem domain. We are interested in human characteristics that are dicult to de ne or are only partially understood. We have attempted to represent these using the fuzzy set notation introduced previously. The intention is not to present a complete model, but instead to use parts of each example to illustrate the usefulness of the representation scheme and where applicable to highlight the limitations of a `crisp' approach when applied to the systems of this type.

5 The Illustrative Examples It is assumed that the reader is familar with the Z extended notation language de nition. If not, he/she is directed to the language working paper (Matthews & Swatman 1999) for the de nitions of the generic symbols, fuzzy set operators, fuzzy set measures and fuzzy set modi ers that appear in the following examples. The proofs for all laws can also be found here.

5.1 Invariant fuzzy sets

As indicated earlier there are times when we are unable to precisely categorise concepts into distinct classes or types. Instead there appears to be an overlap or gradual transistion from one class to another. These classes can be described linguistically and represented using fuzzy sets. The extended notation allows us to model such concepts in a Z speci cation. As a simple illustration consider the example of pro t levels within an organisation. Although pro ts are measured in monetary terms they can also be described using terms such as high pro ts, low pro ts etc. In this case the variable, pro ts is a linguistic variable whose values (i.e high, low, average etc) can be described using fuzzy sets. In terms of a Z speci cation and using the extended notation we might model this concept as follows: pro ts : P R+ highPro ts : F pro ts averagePro ts : F pro ts lowPro ts : F pro ts

The de nitions for the fuzzy sets whose parameters will remain unchanged (or are invariant) throughout the speci cation (in this case highPro ts, averagePro ts and lowPro ts) appear as 9

axiomatic de nitions at the beginning of the speci cation. They represent the degree to which pro t levels are seen to be high, average and so on. A particular pro t level may be considered to be more or less high, but it also could be seen in some small way, to be average. In other words there is an overlap rather than a crisp boundary between them. This is a typical and well established interpretation of partial set membership (Zadeh 1975, Zadeh 1988, Ross 1995). For the purposes of this example we assume that it possible to acquire meaningful parameters for each set and that they represent the collective understanding by people within the organisation of these concepts. The mapping functions would then be de ned as constraints in the axiomatic de nitions. For example: averagePro ts : F pro ts averagePro ts = around(100000)

where around is a fuzzy number, as de ned in the language de nition (Matthews & Swatman 1999) Similar constraints could be developed for lowPro ts and highPro ts resulting in the mapping functions shown below. 6

1

m'ship

0

lowPro ts

averagePro ts

highPro ts


A

AA
A
A
A
A A
A
A
A

A A

A
A
A
A
A
A A

A AA


A

75,000

100,000

125,000

-

pro ts($)

An advantage of this approach is that we are able to include the fuzzy sets in the model without necessarily having a complete understanding of the set parameters. This may come later as our knowledge of the problem domain deepens. There are many other examples of linguistic variables that could be de ned as invariant fuzzy sets at the beginning of a speci cation. These include concepts such as customer demand in a retail system, student enrolments in an educational system, treatment costs in a health system and so on. In each case the reference set is numeric and at some stage the mapping functions that deliver set membership will need to be determined. 10

5.2 Multidimensional fuzzy sets

We will now extend this example a little further and consider the employees within the organisation. As well as being interested in whether a person is employed by the organisation, we are also interested in the motivation, productivity and experience of the workforce. If we assume the basic type, person in our model then we could write a state schema which de nes fuzzy sets that represent these concepts. [person ] stang employed : F person motivated : F person experienced : F person productive : F person

The reference set for each of the fuzzy sets is the basic type person. Set membership could be interpreted in a variety of ways. Membership in employed may represent a combination of factors | including employment conditions, mode of employment, salary package etc. At this stage we may not completely understand the diering employment modes and conditions but instead only provide an approximate indication of the degree of employment. All we are able to say is that zero membership in employed means that a person is not employed by the organisation and that full membership in employed could be interpreted as full-time permanent employment at the highest salary level. On the other hand the degree of membership in employed could simply indicate the degree of full time employment of that person. These issues can remain unresolved at this early stage. Later, as our understanding of this concept deepens, employed might be resolved into a series of disjoint crisp sets, each re ecting a particular employment mode. Alternatively it might remain fuzzy where degree of membership is simply an indication of the proportion of full- time employment. Experience, motivation and productivity could be seen as `graded' concepts. People will show degrees of motivation, experience and productivity represented by the degree of membership in the fuzzy sets motivated, experience and productive. In each of the above cases the fuzzy sets are multidimensional in the sense that it is assumed that set membership is due to more than one property of the reference set (Haack 1996). Unlike the invariant fuzzy sets described above there is no mapping function to deliver set membership, but instead the reference set elements will be fully, or partially, `added' and `removed' as a result of system operations. As will be seen shortly these fuzzy sets will be empty in the initial system state and consequently nite.

5.3 A `crisp' approach?

The example could be modelled less satisfactorily in boolean rather than fuzzy terms. Using a boolean approach the boundaries between concepts such as high and average pro ts would 11

be crisp rather than gradual and the linguistic variable pro t could be de ned as a series of threshold values. For example: highPro ts == 125000 averagePro ts == 100000 etc For a particular pro t level, p ? we could determine whether pro ts are high by evaluating p ?  highPro ts , whether pro ts are average by evaluating averagePro ts  p ? < highPro ts and so on. There is no equivocation here, the concepts are mutually exclusive. A pro t level of $125,000 is high whereas a pro t of $124,999 is only average. This seems unrealisitic and places an unnatural degree of precision on what seems to be, at the boundaries at least, a blurry or fuzzy concept.

In a similar fashion the sets de ned on the basic type, person might also be modelled crisply. They could be de ned as power sets of type, person i.e employed : P person , motivated : P person and so on, or if the extended notation is being used, as employed : C person , motivated : C person etc. In either case we could only distinguish between a motivated person and a non-motivated person, a productive person and a non-productive person, a fully employed person and an unemployed person and so on. The model doesn't allow for degrees of motivation, degrees of productivity etc. There are no shades of gray, things can only be black and white. The crisp approach is more restrictive. At best we are forced to resolve much of the uncertainty or approximation prior to model development or at worst, build an unnatural degree of precision into model itself. There is the danger that important parts of the problem domain cannot be modelled and will be lost.

5.4 Fuzzy set operators and modi ers

A series of fuzzy set operators and modi ers are de ned in the extended notation. They are useful as they allow us to model properties which could be interpreted as approximate statements or heuristics describing aspects of the problem domain. For example

 highly motivated employees can be modelled as the set, very(motivated and employed )  inexperienced employees can be modelled as the set, not (experienced ) and employed  experienced and motivated people are the most productive can be modelled as productive =

experienced and motivated Some of these could be built into the speci cation. For example we could incorporate the heuristic that the most productive people are those that are motivated and experienced, into the

12


schema as follows.
stang stang stang 0 productive 0 = productive  (motivated 0 and experienced 0 ) We assume that in the initial state there are no employees and that the sets representing motivation, productivity and experience are all empty. In other words the degree of membership of all reference set elements in these sets is zero. A schema describing the initial state can be written as: INIT stang employed = empty motivated = empty experienced = empty productive = empty

Adding or removing elements from sets of this type involves altering the degree of membership of the particular element or elements. As a fuzzy set is modelled as a total function, then this can be achieved through a function override. For example, an operation that adjusts the degree of membership of an employee (p ?) in the set motivated to a value m ? could be written as: newMotivation
stang p ? : person m? : M employed (p ?) > 0 motivated 0 = motivated  fp ? 7! m ?g employed 0 = employed experienced 0 = experienced

Or more generally, for more than one employee:

13

newMotivation 2
stang employeeGroup : person ! 77 M 8 p : dom employeeGroup  employed (p ) > 0 motivated 0 = motivated  employeeGroup employed 0 = employed experienced 0 = experienced

It can be shown that empty is a nite fuzzy set. Thus in the initial system state employed, motivated, experience and productive are all nite fuzzy sets. Provided the overriding function is nite then the sets motivated, employed, experience and productive will remain nite fuzzy sets throughout subsequent system states. This is important because it means that they are countable and properties such as the degree of fuzziness, set similarity and degree of subsetness can be evaluated. As will be seen shortly such properties give us the ability to ask `softer' questions about a speci cation and to estimate the degree to which a set of requirements might be met.

5.5 Fuzzy and crisp relations

To illustrate the use of fuzzy and crisp relations, and to show why we might wish to ask `softer' questions of a speci cation, we will introduce a second and more detailed example. This example models part of a health care network. There are a series of institutions that deliver a variety of medical services to the general public. The model that follows relates to service delivery only. There are ve basic types of interest. [institution ; client ; medicalServiceType ; date ] institution | all institutions involved in the delivery of medical services e.g hospitals, clinics, hostels etc. client | all of those people who will possibly use the medical sevices oered by the institutions. medicalServiceType | all of the medical service types oered by the health system e.g. in-patient care, radiography, physiotheraphy, aged care etc. date | all possible dates. medicalService == medicalServiceType  date

A medicalService is the use of a medicalServiceType on a particular date. 14

A simple state schema describing the service delivery of the system: ClientService C institution oeredBy : medicalService $ F institution highQuality : medicalService $ C (medicalService $ C institution ) usedBy : client $ F (medicalService $ C institution ) satisfaction : client $ F

highQuality  oeredBy F satisfaction  usedBy

The fact that a medical service is oered by an institution has been modelled as a crisp relation. There is no fuzziness here | either a medical service is oered or it is not. It should be noted that by a medical service we mean that a particular medical service type has been oered on a given date. If instead we were modelling whether a medical service type was oered by an institution then perhaps some fuzziness would be permitted. This might allow us to represent the idea of an institution oering a particular type of medical service most of the time, or some of the time and so on. We are also interested in the quality of medical services oered by the various institutions throughout the network. Degrees of service quality are possible and consequently it has been modelled as a fuzzy relation. For simplicity we have only included a single relation, namely highQuality, but if concepts such averageQuality and lowQuality were important then they could be modelled as well. A similar approach has been taken when dealing with the use of medical services oered throughout the system and client satisfaction with those service oerings. The schema constraints state that the degree of membership of a medicalService oered by a particular institution in the relation highQuality has to be less than or equal to that in the oeredBy. In other words we are only interested in the quality of those services oered by institutions in the health care network. Similarly we are only interested in the satisfaction of clients that use the medical services oered by the institutions in the network. F

The state schema constraints could be re-written, using the de nition of , as:

8 c : client ; ms : medicalService ; i : institution  satisfaction (c 7! (ms 7! i ))  usedBy (c 7! (ms 7! i )) ^ highQuality (ms 7! i )  oeredBy (ms 7! i ) In the initial state all sets are empty. In other words there are no services oered by any of the institutions in the system and there are no services used by any clients of the system. A schema describing the initial state can be written as follows: 15

INIT ClientService oeredBy = empty highQuality = empty usedBy = empty satisfaction = empty

It can be shown that the initial state is a permissible state i.e F

F

F

empty  empty ) highQuality  oeredBy ^ satisfaction  usedBy

Now we will de ne some system operations. A schema describing a particular institution oering a particular medical service. oerService
ClientService ms ? : medicalService i ? : institution (ms ? 7! i ?) notin oeredBy oeredBy 0 = oeredBy  f((ms ? 7! i ?) 7! 1)g highQuality 0 = highQuality usedBy 0 = usedBy satisfaction 0 = satisfaction

It can shown that this operation will succeed from the initial state and any subsequent state as long as there remains an institution that has not oered all possible medical services. This is an example of the `addition' of an element to a boolean set written using the extended notation. It has exactly the same meaning as the following (written in conventional Z). (ms ? 7! i ?) 62 oeredBy oeredBy 0 = oeredBy [ fms ? 7! i ?g where oeredBy is of type medicalService $ institution A schema describing the quality of a medical service oered by an institution within the system. addserviceQuality =b serviceQuality _ ClientService

where: 16

serviceQuality
ClientService ms ? : medicalService i ? : institution m? : M highQuality 0 = highQuality  f((ms ? 7! i ?) 7! m ?)g oeredBy 0 = oeredBy usedBy 0 = usedBy satisfaction 0 = satisfaction

 In the initial state, for any m ? > 0, addserviceQuality =b ClientService . This is because F the state constraint highQuality 0  oeredBy 0 is violated. When m ? = 0 the operation has no eect. The system remains in the initial state.

 The function override can only succeed in any subsequent state when oeredBy (ms ? 7! F i ?) = 1 5 . This ensures that highQuality 0  oeredBy 0 holds. In other words we can't

deal with the quality of a medical service until it is oered within the system. It doesn't necessarily have to be used by a client, but only oered by an institution.

An advantage in modelling concepts such as service quality and client satisfaction in fuzzy terms is that we are able to ask `softer' questions of the speci cation. By a `soft' question we mean one to which there is no de nitive answer i.e where it is dicult to simply answer yes or no. Instead the answer could be expressed in approximate or more general terms. For example, rather than asking whether the medical services oered throughout the network are of high quality, we could ask to what degree are all medical services oered by the institutions of a high quality? More generally we could ask to what degree are most medical services of a high quality and so on. In the next section we will show how questions of this type can be answered and how they could be re-stated as a series of quanti ed propositions that express part of the system requirements.

5.6 Linguistically quanti ed propositions

When highQuality = oeredBy all oered services are of the highest quality i.e.

8 ms : medicalService ; i : institution  oeredBy (ms 7! i ) = 1 , highQuality (ms 7! i ) = 1 ^ oeredBy (ms 7! i ) = 0 , highQuality (ms 7! i ) = 0 5

oeredBy is a crisp relation.

17

The degree to which all oered services are of a high quality could be given by the degree to which the two sets are equal i.e. highQuality  oeredBy

A schema that determines the quality of all oered services across the system qualityOfOerings 1 ClientService m! : M oeredBy 6= empty m ! = (highQuality  oeredBy )

A schema that determines the quality of most oered services across the system qualityOfOerings 2 ClientService m! : M oeredBy = 6 empty m ! = most(highQuality  oeredBy )

The fuzzy quanti er most, and the degree of equality(similarity) measure , are de ned in Matthews & Swatman (1999). The de nition always ensures that the degree to which most oered services are of a high quality is always greater or equal to that of all oered services. The schema pre-condition ensures that at least one service has to be oered somewhere in the system before the question(s) can be answered. Using appropriate fuzzy quanti ers and linguistic hedges a series of similar questions could be framed. For example: 1. To what degree are most clients satis ed with the medical services they have used within the system? i.e. most(satisfaction  usedBy ) 2. To what degree are the services oered across the system of very high quality? i.e. (very highQuality )  oeredBy 18

3. To what degree are most clients somewhat satis ed with the medical services they have used within the system? i.e. most((somewhat satisfaction )  usedBy ) etc. These questions could be re-stated as series of linguistically quanti ed propositions6 i.e. Most clients are satis ed All services are of a very high quality Most clients are somewhat satis ed Most services are of a high quality and so on. All of these are fuzzy in the sense that a degree of truth for each proposition can be evaluated. They could be interpreted as a statement of requirements for the system and provide a way of determining to what extent the system meets these requirements at any given time.

5.7 Modelling con ict and agreement

In a recent paper, Pawlak (1998, p. 66) observed that: It seems that fuzzy and rough sets are perfect candidates for modelling con ict situations in the presence of uncertainty, but to my knowledge not very much has been done in this area so far, particularly when fuzzy sets are concerned. Pawlak presents a framework for con ict analysis based on rough set theory7 . However concepts such as support, agreement and con ict which form part of his analysis could also be treated in fuzzy terms. Given that some of the system problems of interest could include con ict and contradiction it may be possible to build such aspects of this into a formal model. To illustrate how this might be achieved we introduce a third example. In this case the example is somewhat abstract. Imagine a set of agents (consisting perhaps of people, institutions, organisational units, stakeholders etc) and a set of issues that are important to these agents. We could de ne the following fuzzy relations: A linguistically quanti ed proposition is one that can be written in general terms as: Q Y's are F, where Q is a quanti er (e.g. all, most, a few etc), Y is a set of objects and F is some property of those objects (Kacprzyk et al. 1992) 7 A rough set is a crisp set that is not precisely de ned. There is no concept of partial set membership but instead the idea that an element may surely or possibly belong to the set. Roughness arises from a lack of information rather than any natural imprecision in the problem domain. 6

19

F issues support : agents $ F issues inAgreement : (agents  agents ) $

The relation, support , indicates the degree of support that an agent expresses for a particular issue. The relation, inAgreement indicates the extent to which any two agents are in agreement over a particular issue. Obviously any agent has to be in total agreement with themselves on all issues. F

F

For any agent a, the fuzzy relational image support (j Pfa g j) is a fuzzy set of type F issues indicating the degree of support of that particular agent a for each issue8. We will now de ne inAgreement in terms of support . We assume that the degree to which any two agents are in agreement on a particular issue is related to the `closeness' of their individual support for that issue. A simple closeness measure for any m1 ; m2 : M could be the absolute value of the dierence between m1 and m2 i.e. abs (m1 ? m2 ). The relation, inAgreement can be de ned as follows:

8 a1 ; a2 : agents ; i : issues  inAgreement ((a1 ; a2 ) 7! i ) = 1 ? abs (support (a1 7! i ) ? support (a2 7! i )) The de nition has the following properties. 1. inAgreement ((a1 ; a1 ) 7! i ) = 1 2. inAgreement ((a1 ; a2 ) 7! i ) = inAgreement ((a2 ; a1 ) 7! i ) 3. inAgreement ((a1 ; a2 ) 7! i ) = 1 ^ inAgreement ((a2 ; a3 7! i ) = 1 ) inAgreement ((a1 ; a3 ) 7! i ) = 1 A further relation, inCon ict can be de ned in terms of inAgreement i.e. F issues inCon ict : (agents  agents ) $ where inCon ict = not inAgreement

Note that we could have de ned the concepts of agreement and con ict the other way around i.e. inCon ict ((a1 ; a2 ) 7! i ) = abs (support (a1 7! i ) ? support (a2 7! i )) and inAgreement = not inCon ict . The modelling of these as fuzzy concepts permits the possibility of overlap. In other words there may be some degree of agreement and con ict on certain issues at the same 8

F F

Standard de nitions exist in the extended notation for (j j) and P

20

time. The following describes the system state which formalises these ideas. [agents ; issues ] con ictModel F issues support : agents $ F issues inAgreement : (agents  agents ) $ F issues inCon ict : (agents  agents ) $ 8 a1 ; a2 : agents ; i : issues  inAgreement ((a1 ; a2 ) 7! i ) = 1 ? abs (support (a1 7! i ) ? support (a2 7! i )) inCon ict = not inAgreement

If the sets of agents and issues were non-empty and nite (i.e. they were known before the speci cation was developed) then they could be declared as free types i.e. agents ::= a1 j a2 j :::an ?1 j an issues ::= i1 j i2 j :::im ?1 j im

We might choose to de ne the initial state for the system in several ways, depending on how we view the problem. For example we might consider that initially there is no support by any of the agents for the issues of interest. In this case the schema describing the initial state would be as follows. INIT con ictModel support = empty

where inAgreement = U and inCon ict = empty Alternatively we might consider that there is full support for all issues. The INIT schema would then be written as: INIT con ictModel support = U

21

where inAgreement = empty and inCon ict = U The speci cation would provide an operation to allow an agent to express some degree of support for a particular issue. This will be a function override on the fuzzy relation, support i.e. expressSupport
con ictModel a ? : agents i ? : issues supportLevel : M support 0 = support  f(a ? 7! i ?) 7! supportLevel g

We could ask for the degree of broad agreement amongst any two agents across all issues of interest. broadAgreement con ictModel agent 1?; agent 2? : agents m! : M F

F

dom support (agent 1?) > 0 ^ dom support (agent 2?) > 0 F F F F m ! = support (j Pfagent 1g j)  support (j Pfagent 2g j) This might be interpreted as follows. The degree to which any two agents are in broad agreement across a range of issues of interest is equal to the degree of equality (or similarity) between the two fuzzy sets, of type issues, that indicate the degree of support each agent shows for all issues of interest. The pre-condition ensures that each agent shows some support for at least one issue. This enquiry can only be made if in the initial state, support = empty . This ensures that support is nite and that the fuzzy relational images are nite and therefore countable. In the case where the basic types issues and agents are nite (i.e de ned as free types), then the degree of equality measure could be replaced by a closeness measure. This could be based on an average hamming distance measure9 between membership values in the relational image sets i.e closeness (A; B ) = 1 ? (counter (A distance B )=# [ A ]0 )

Where A and B are fuzzy sets de ned on some nite reference set T and the cardinality of the zero cut of A gives the number of elements in the nite reference set. The distance measure 9 The hamming distance measure is a standard measure for estimating the distance between any two multidimensional vectors. For two vectors, X = (x1 ; x2 ; :::) and Y = (y1 ; y2 ; :::) the hamming distance measure, H(X,Y) is given by abs (x ? y )

P

i

i

i

22

between A and B can be de ned as follows. [T ]

distance : (T !7 M)  (T !7 M) ! (T !7 M) 8 t : T ; fun 1; fun 2 : (T !7 M)  (t 2 dom fun 1 ^ t 2 dom fun 2) ) (fun 1 distance fun 2)(t ) = abs (fun 1(t ) ? fun 2(t ))

The degree of fuzziness of the relation support (i.e fuzzyEntropy(support )) could be interpreted as indicating the lack of certainty that the agents have in expressing their support (or non-support) for the issues of interest. As the degree of fuzziness approaches zero then we might say that there is a more clear cut indication of support or non-support. The degree of fuzziness measure, fuzzyEntropy is de ned in the extended notation. Finally it should be noted that there are many other problem domains where the approaches discussed in this section might be useful. For example a similar approach could be used to model the extent to which a set of system requirements are met by a series of competing vendors or the extent to which a set of criteria are met by a series of tendering organisations and so on. The application of a fuzzy approach to problems involving group and multi-criteria decision making is well established (Kacprzyk et al. 1992, Yager 1996, Kacprzyk, Fedrizzi & Nurmi 1997).

5.8 A `soft' pre-condition?

A pre-condition is a constraint placed on an operation. The operation can only succeed if the pre-condition holds. In the rst example we introduced the concepts of employment and pro t levels. We could write a schema which `adds' a person to the set of employed people only when pro t levels are high. employ
stang p ? : person pro tLevel ? : pro ts pro tLevel ?  highPro ts p ? notin employed employed 0 = employed  fp ? 7! 1g motivated 0 = motivated experienced 0 = experienced

In this case the extended notation is being used and pro t levels and employment are modelled in crisp terms. The operation only succeeds when pro tLevel is greater or equal to the threshold 23

value for high pro ts and if the membership of p? in the set employed is zero. However we suggested earlier that a concept such as pro t levels could be considered to be a linguistic variable whose values low, average, high can be described using fuzzy sets. Instead of simply evaluating whether pro t levels are high or not, it is possible to determine the degree to which pro t levels are high. Consequently the pre-condition that we only employ sta when our pro t levels are high may only partially hold. In other words it could be considered to be a `soft' pre-condition. How might we model this? There are several ways to approach this. We could consider that the degree to which we employ a person is related to the degree to which pro ts are high. The schema below takes this approach. employ
stang p ? : person pro tLevel ? : pro ts p ? notin employed employed 0 = employed  fp ? 7! highPro ts (pro tLevel ?)g motivated 0 = motivated experienced 0 = experienced

The pre-condition that the person is not already employed is retained. The sets employed and highPro ts are now fuzzy. The interpretation of partial set membership in employed is somewhat unclear here. It could indicate the possibility of employment rather than the degree of full-time employment. The idea that the degree to which pro ts are high directly determines the proportion of full time employment oered seems somewhat simplistic. However there might be some problem domains where this approach may be appropriate. A second approach is to suggest that the degree to which the pre-condition holds determines the degree to which the operation succeeds. To illustrate this consider the following. Imagine a group of people whose employement status is aected by the degree to which the pro t levels are high. This group may include people already employed and/or people seeking employment. The schema below attempts to model an adjustment of the employment mix of the people concerned as a result of the pro t levels within an organisation. The eect on the employment status of a particular individual is not speci ed, just the overall eect on the group.

24

employ
stang P ? : person ! 77 M pro tLevel ? : pro ts dom P ? ? C employed 0 = dom P ? ?C employed total (dom P ?Cemployed 0 )  total ((dom P ? C employed )  P ?) = highPro ts (pro tLevel ?) motivated 0 = motivated experienced 0 = experienced

Where total forms a fuzzy set of type T ! M from one of type T !7 M. It is de ned in Matthews & Swatman (1999). Discussion: 1. P ? : person ! 7 7 M contains those people who will be aected by the operation and their desired employment status if the operation completely succeeds. There are a nite number of such people. 2. dom P ? ? C employed 0 = dom P ? ?C employed ensures that the membership of those people in the fuzzy set employed, unaected by the operation, is unchanged. 3. The degree of equality(similarity) measure can be used as the domain restrictions are of type nite F employed and are therefore countable i.e. P ? : person ! 7 7 M is nite ) dom P ? is nite ) (dom P ? C employed ) is nite ) ((dom P ? C employed )  P ?) is nite ) total ((dom P ? C employed )  P ?) is of type, nite F employed 4. It can be shown (from the laws for  in Matthews & Swatman (1999)) that: (a) highPro ts (pro tLevel ?) = 1 ) total (dom P ? C employed 0 ) = total ((dom P ? C employed )  P ?) i.e. the employment adjustment completely succeeds (b) highPro ts (pro tLevel ?) = 0 ) total (dom P ? C employed 0 ) and total ((dom P ? C employed )  P ?) = empty i.e. all aected people are no longer employed (8 p : person  employed 0 (p ) = 0) 5. What happens when the nite partial function P ? contains only one person? 25

When P ? = fp 7! mn g then dom P ? = fp g ) dom P ? C employee = fp 7! mi g

(mi is the m'ship of p in employee prior to the operation)

) (dom P ? C employee )  P ? = fp 7! mn g

(mn is the desired (i.e. the overriding) m'ship for p in employee ) We will assume that highPro ts (pro tLevel ?) = mp and dom P ? C employee 0 = fp 7! mj g (mj is the m'ship of p in employee after the operation) Can we determine mj in terms of mn and mp ? In other words what eect does the precondition have the m'ship of p after the operation? For simplicity we also assume E 0 = total (dom P ? C employee 0 ) and E 00 = total ((dom P ? C employee )  P ?). We can say, from the de nition of : count (E 0 and E 00 )=count (E 0 or E 00 ) = mp

(E 0 and E 00 )(p ) = min fmj ; mn g and (E 0 or E 00 )(p ) = max fmj ; mn g (for all other p : person ; (E 0 and E 00 )(p ) = 0 ^ (E 0 or E 00 )(p ) = 0 | by defn of total ) count (E 0 and E 00 ) = min fmj ; mn g = mj count (E 0 or E 00 ) = max fmj ; mn g = mn

(assuming that nal m'ship cannot exceed the overriding m'ship) thus mj =mn = mp ) mj = mn  m p This result is consistent with that described in (4) above. When mp = 1 then the m'ship of p in employee after the operation (mj ) is equal to the overriding m'ship (mn ). When mp = 0 then employee 0 (p ) = 0. The result is also consistent with the rst approach described above. When mn = 1 (i.e. the intention is to fully employ p ), the degree of m'ship of p in employee 0 is equal to the degree to which the pre-condition holds i.e. mn = 1 ) m j = m p . 6. What happens when the partial function P ? contains more than one person? Assume that P ? = fp1 7! mn 1 ; p2 7! mn 2 ; :::; pn 7! mnn g and that highPro ts (pro tLevel ?) = mp dom P ? = fp1 ; p2 ; :::; pn g ) (dom P ? C employee )  P ? = fp1 7! mn 1 ; p2 7! mn 2 ; :::; pn 7! mnn g 26

We will also assume that dom P ? C employee 0 = fp1 7! mj 1 ; p2 7! mj 2 ; :::; pn 7! mjn g and that E 0 and E 00 are de ned as in (5) above. We can say, from the de nition of  count (E 0 and E 00 )=count (E 0 or E 00 ) = mp

8 p 2 dom P ?;

(E 0 and E 00 )(p ) = min fmji ; mni g and (E 0 or E 00 )(p ) = max fmji ; mni g, i = 1:::n (8 p 62 dom P ?; (E 0 and E 00 )(p ) = 0 ^ (E 0 or E 00 )(p ) = 0 | by defn of total ) If we assume that for any pi 2 dom P ? the nal m'ship value in employee (i.e mji ) cannot exceed the overriding m'ship(mni ) then: count (E 0 and E 00 ) = mj 1 + mj 2 + ::: + mjn count (E 0 or E 00 ) = mn 1 + mn 2 + ::: + mnn

thus (mj 1 + mj 2 + ::: + mjn )=(mn 1 + mn 2 + ::: + mnn ) = mp

) (mj 1 + mj 2 + ::: + mjn ) = mp (mn 1 + mn 2 + ::: + mnn )

This result is a generalisation of that described in (4) and (5) above. When the precondition completely holds (i.e. mp = 1) then (mj 1 + mj 2 + ::: + mjn ) = (mn 1 + mn 2 + ::: + mnn ). Given that mji  mni , for all i = 1:::n , then the summation can only be equal if mji = mni , for all i = 1:::n . Thus the function override succeeds completely. Similarly when the pre-condition does not hold to any degree (i.e. mp = 0) then (mj 1 + mj 2 + ::: + mjn ) = 0. In other words 8 p : dom P ?; employee 0 (p ) = 0. What is of more interest is the case where the pre-condition only partially holds (i.e 0 < mp < 1). In (5) above the m'ship of p after the override (i.e. employee 0 (p )) is simply proportional to the desired m'ship value (i.e employee 0 (p ) = mn  mp ). In the more general case where there is more than one element in the domain of the overriding function all we can say is the sum of m'ships after the override (i.e (mj 1 + mj 2 + ::: + mjn )) is proportional to the sum of the desired m'ships (i.e (mn 1 + mn 2 + ::: + mnn )). Thus the mix of employment levels of those people aected by the operation can vary. The only constraint is that the nal employment level of a person cannot exceed that de ned in the overriding function. We cannot predict an actual nal m'ship value for any given person, but only talk about the summation of the m'ship values of all people aected. In other words we can only talk about an overall eect, and not about the precise eect on a given individual.

27

5.9 Modelling a fuzzy expert system for decision support

There is a body of literature suggesting that systems attempting to model human decision making may need to deal with ill-de ned and uncertain knowledge (for example, see Zadeh (1975), Buchanan & Shortlie (1985), Castillo & Alvarez (1991) and Jackson (1999)). Included amongst these are fuzzy expert systems which model expert decision making in an eort to provide decision support. Systems of this type are of interest as they may involve decision making in a climate of uncertainty or approximation. The example presented in this section illustrates how the toolkit can be of use in the speci cation of such a system. Section 5.9.1 provides some general background on fuzzy expert systems and introduces the example. A partial speci cation is then presented and discussed in section 5.9.2.

5.9.1 Background

F

The toolkit contains generic de nitions for a fuzzy cartesian operator (), fuzzy set truncation cp (cm )) and fuzzy set scaling () ). As indicated earlier the fuzzy cartesian product permits the formation of a fuzzy relation between any two fuzzy sets, rather than declaring one directly. The formation of a fuzzy relation in this way may be useful in situations where it is more natural to express relational membership in terms of fuzzy set membership rather than determining it directly. One such example is the speci cation of a rule base for a fuzzy expert system. The following illustrates this and shows the application of fuzzy set truncation and scaling in fuzzy reasoning. Fuzzy expert systems are rule based systems that attempt to model approximate or `common sense' reasoning. They incorporate fuzzy set theory and fuzzy logic in both reasoning and knowledge representation (Graham 1991, Kandel 1992, Cox 1994, Ross 1995). Fuzzy expert systems consist of three major conceptual components | a fuzzy rule base, a description of the fuzzy set parameters and a method for fuzzy inferencing (or reasoning). They use linguistic variables modelled as fuzzy sets, in both the premise and consequent of the fuzzy rules that make up the fuzzy rule base. Fuzzy rules are conditional statements and in general can be represented as IF x is Xi and y is Yi and ::: THEN o is Oi where x and y are linguistic (input) variables. Xi and Yi are possible linguistic values for x and y respectively. They are modelled as fuzzy sets based on reference sets containing x and y. Similarily the output or decision variable, o is a linguistic variable with a possible value, Oi modelled as a fuzzy set. The clauses x is Xi and y is Yi can be interpreted as fuzzy propositions delivering partial set membership or partial truth. Consequently the partial truth of the rule premise can be evaluated, modifying the fuzzy set parameters of the output fuzzy sets. The basic assumption is that the truth of a rule consequent cannot exceed that of the rule premise and consequently the output fuzzy sets are modi ed either by scaling or truncating the set at a point corresponding to the partial truth of the rule premise. A combined output set is formed from the union of each of these modi ed output sets. If a single scalar output value is required, then a representative value is determined from the output fuzzy set. This is known as defuzzi 28

cation and a variety of techniques have been proposed in the literature. The reader is directed to the bibliography (in particular Cox (1994), Ross (1995) and Jang, Sun & Mizutani (1997)) for a review of possible defuzzi cation methods and for further detail on fuzzy systems in general.

The following illustrates the use of the fuzzy cartesian product, fuzzy set truncation and fuzzy set scaling in a fuzzy system speci cation. The example is a stock market advisory system and is a typical example of a simple two input, single output fuzzy model. It is based on one from Viot (1993). In this case the two input variables are share price and trading volume and they in uence the decision to buy, sell or hold stock. These decisions could be expressed as a series of heuristics. For example We hold shares when the share price is stable and the trading volume is heavy We sell shares when the share price is decreasing and the trading volume is moderate

etc ...

Each of these can be represented as a fuzzy rule, where share price and trading volume are linguistic variables with values such as stable, decreasing, heavy and moderate. IF share price is stable and trading volume is heavy THEN decision is hold IF share price is decreasing and trading volume is moderate THEN decision is sell etc ... Figure 1 uses these two rules and illustrates how an output fuzzy set is constructed as a result of fuzzy reasoning. In this case the output sets in each rule consequent are being truncated at a point corresponding to the partial truth value of the rule premise. Any number of extra rules can be added to the rule base and depending on the input variable values, they may contribute to the nal output set. Figure 2 illustrates the same example but uses fuzzy set scaling to modify the output fuzzy sets. The decision between scaling or truncation is a design issue and in many cases is made on a pragmatic rather than theoretical basis ( for example see Cox (1994) and Jang et al. (1997) for a discussion of these issues). Although continuous tarpezoid and triangular membership functions are being used to de ne the fuzzy sets, there is no reason why they could not be discrete. However it should be noted that when using a defuzzi cation technique that estimates an average or representative value from the output set it is necessary that the support set of the output set has at least an upper and lower bound. This will always be the case if the output fuzzy sets are de ned on a fully bounded reference set.

5.9.2 The speci cation

The following is a partial speci cation for a fuzzy expert system based on the stock market advisory system described above. The example is extended to a rule base containing nine fuzzy rules. [sharePrice ; tradingVolume ] 29

heavyVolume

stablePrice

1

0

6

{

C  C  C  C  C  C  C  C  C  C

0

6

and

-

+

0

decreasingPrice

1

0

6

{

C C C C C

0

6

 

) -

+

{

moderateVolume 6

C C C C C

 

     

hold

and

-

+

0

C  C  C  C  C  C  C  C  C  C

share price

C  C  C  C  C  C  C  C  C  C

0

-

+

sell 6

) -

+

{

C C C C C

C C C C C

-

0

+

+

trading volume 6

Output set: (hold or sell ) The scalar output decision is an `average' or is repesentative of the output fuzzy set

{

   C  C ?0

C C C

decision

C

-

+

Figure 1: Fuzzy reasoning for part of the stock market advisory system, illustrating fuzzy set truncation

30

stablePrice

1

0

6

{

C  C  C  C  C  C  C C   C  C

0

heavyVolume 6

and

-

+

0

decreasingPrice

1

0

6

{

C C C C C

0

6

 

)

-

+

{

moderateVolume 6

C C C C C

 

     

hold

and

-

+

0

C  C  C  C  C  C  C  C  C  C

share price

C  C  C  C  C 
A C 
A C AC 

AC 
AC

0

-

+

sell 6

) -

+

{

C C C @ C @@C

0

-

+

+

trading volume 6

The scalar output decision is an `average' or is repesentative of the output fuzzy set

C C C C C

{

Output set: (hold or sell )
A
A
A @
@ A
@ A + ? 0

decision

Figure 2: Fuzzy reasoning for part of the stock market advisory system, illustrating fuzzy set scaling

31

6

sell

1

hold

buy




AA

A

A
A
A
A

A A

A
A
A
A
A
A A

A AA


A A A A A

m'ship

-300

-100

0

+100

-

+300 decision

Figure 3: Fuzzy set parameters for the output sets in the stock market advisory There are two basic types, sharePrice and tradingVolume. Fuzzy sets will be de ned on each and a system operation will be provided to allow the sets to be constructed. This provides exibility as it permits the setting of fuzzy set parameters during system operation. An alternative approach would have been to de ne these sets axiomatically on a numeric reference set at the beginning of the speci cation. decision : P Z

The set, decision represents the reference set for three output fuzzy sets hold, buy and sell. It is de ned as a subset of the set of integers, rather than as one of the set of reals, because it is intended that the scalar output from the system will be the number of shares that should be traded. The output sets can be de ned axiomatically as buy : F decision hold : F decision sell : F decision

The parameters for these sets could be de ned as part of the axiomatic de nition. Figure 3 shows some standard trapezoid and triangular that may be applicable. It should be noted that the sets will be discrete due to the discrete nature of the reference set, decision and that for a de-fuzzi cation technique to be applied the nal output set should be a convex fuzzy set10 . The schema ruleBase de nes the fuzzy rule base for the system. In this example there are nine F (9) fuzzy rules, each formed using the fuzzy cartesian product operator (). A convex fuzzy set is one where every cut , [ this case on Z (Bae, Chung & Kwon 2000) 10

] for 0 <   1, is a closed interval on the reference set, in 32

ruleBase increasingPrice : F sharePrice stablePrice : F sharePrice decreasingPrice : F sharePrice lightVolume : F tradingVolume moderateVolume : F tradingVolume heavyVolume : F tradingVolume F tradingVolume buyShares : sharePrice $ F tradingVolume sellShares : sharePrice $ F tradingVolume holdShares : sharePrice $ F

buyShares = (stablePrice  lightVolume ) F or (increasingPrice  moderateVolume ) F or (increasingPrice  heavyVolume ) F holdShares = (stablePrice  heavyVolume ) F or (stablePrice  moderateVolume ) F or (increasingPrice  lightVolume ) F or (decreasingPrice  lightVolume ) F sellShares = (decreasingPrice  moderateVolume ) F or (decreasingPrice  heavyVolume )

Three of the rules lead to a decision to buy shares, four to a decision to hold shares and two lead to a decision to sell shares. It should be emphasised that the knowledge contained in the rule base together with the parameters that de ne the fuzzy sets used by these rules could be acquired from a domain expert or perhaps be learnt from a set of previous decisions or examples. The rule base given here is intended only as an example only. The focus is on the use of the toolkit in the speci cation of systems of this type rather than on issues concerned with knowledge acquisition and elicitation for fuzzy expert systems 11 . The rule base should be read as follows. IF share price is stable and trading volume is light THEN decision is buy IF share price is increasing and trading volume is moderate THEN decision is buy IF share price is increasing and trading volume is heavy THEN decision is buy IF share price is stable and trading volume is heavy THEN decision is hold IF share price is stable and trading volume is moderate THEN decision is hold IF share price is increasing and trading volume is light THEN decision is hold IF share price is decreasing and trading volume is light THEN decision is hold IF share price is decreasing and trading volume is moderate THEN decision is sell There is a considerable body of literature concerned with knowledge acquisition for knowledge based systems in general. For example see Kidd (1987), Hart (1992) and Sestito & Dillon (1994). 11

33

IF share price is decreasing and trading volume is heavy THEN decision is sell The
and  schemas are now de ned. There are no system constraints other than the formation of the three fuzzy relations referred to above.
ruleBase ruleBase ruleBase 0 ruleBase ruleBase ruleBase 0 increasingPrice = increasingPrice 0 stablePrice = stablePrice 0 decreasingPrice = decreasingPrice 0 lightVolume = lightVolume 0 moderateVolume = moderateVolume 0 heavyVolume = heavyVolume 0 In the initial state all fuzzy sets and relations are empty. The initial system state is INIT ruleBase increasingPrice = empty stablePrice = empty decreasingPrice = empty lightVolume = empty moderateVolume = empty heavyVolume = empty

It can be shown that in the initial state the following holds. buyShares = empty holdShares = empty sellShares = empty

The operational schemas, buildShareprice and buildTradingVolume allow the construction of the fuzzy sets for the share price and for the trading volume. 34

buildSharePrice
ruleBase sp ? : sharePrice msp ?; mip ?; mdp ? : M stablePrice 0 = stablePrice  f(sp ? 7! msp ?)g increasingPrice 0 = increasingPrice  f(sp ? 7! mip ?)g decreasingPrice 0 = decreasingPrice  f(sp ? 7! mdp ?)g lightVolume 0 = lightVolume moderateVolume 0 = moderateVolume heavyVolume 0 = heavyVolume buildTradingVolume
ruleBase tv ? : tradingVolume mmv ?; mlv ?; mhv ? : M stablePrice 0 = stablePrice increasingPrice 0 = increasingPrice decreasingPrice 0 = decreasingPrice lightVolume 0 = lightVolume  f(tv ? 7! mlv ?)g moderateVolume 0 = moderateVolume  f(tv ? 7! mmv ?)g heavyVolume 0 = heavyVolume  f(tv ? 7! mhv ?)g

The operational schema, advise takes a share price and a trading volume as an input, builds the output fuzzy set and provides the number of shares to be traded as an output. advise ruleBase sp ? : sharePrice tv ? : tradingVolume ans ! : decision decisionSet : F decision decisionSet = (buyShares (sp ? 7! tv ?) cm ) buy ) or (sellShares (sp ? 7! tv ?) cm )cmsell ) or (holdShares (sp ? 7! tv ?) ) hold ) ans ! = (centroid (decisionSet )) div 1 In this example the schema uses the fuzzy set modi cation operator, (cm )), to truncate each of the output fuzzy sets and forms the decision set by evaluating the fuzzy set union of each of the truncated sets. The schema output is given by applying a defuzzi cation function, centroid to the decision set. The function div is used to return the integer part of centroid (decisionSet )12 . It is assumed here that the function div is de ned for real arguments and returns the integer part of a division, see Valentine (1995). 12

35

As indicated earlier there is a choice of possible fuzzy set modi cation operators and defuzzi cation techniques, and again those provided here are only intended as examples. Currently the toolkit does not contain any de nitions for a defuzzi cation function. In general defuzzi cation involves the determination of some reference set value that is representative or is an `average' of a fuzzy set, taking into account the degree of membership of each reference set element. It really only has practical meaning for fuzzy sets de ned on a closed interval nite numeric reference set and probably is best introduced in a particular speci cation rather than generically in the toolkit. To complete the above speci cation it would therefore be necessary to provide the necessary axiomatic de nitions for the centroid defuzzi cation function in the preamble, i.e. before introducing the state and operational schemas. To ensure that the function will be applied to a nite fuzzy set, the decision set reference set, decision should be constrained to a closed interval (e.g. decision == fz : Z j ?300  z  300g. The centroid defuzzi cation technique determines the weighted mean of the fuzzy set (Cox 1994) and can be speci ed using the following axiomatic de nitions. It is assumed that set of real numbers, R is known and that the set of integers, Z has been de ned as a subset of R. The functions wcounter and wcount are similar to counter and count (Matthews & Swatman 1999). They sum the product of each reference set element and membership value pair. They are only de ned for nite fuzzy sets on the reference set R. The function, centroid evaluates the weighted mean. For an empty fuzzy set, the weighted mean should be zero. wcounter : (R ! 7 7 M) ! R 8 fset : (R !7 7 M)  (8 r : dom fset  wcounter (fset) = (fset(r)  r) + wcounter (frg ? C fset)) ^ wcounter ? = 0 wcount : nite FR ! R 8 fset : nite FR  wcount (fset) = wcounter (ES (fset))

centroid : ( nite FR) ! R 8 fset : nite FR  (fset = empty ) ) (centroid (fset ) = 0) ^ (fset 6= empty ) ) (centroid (fset ) = wcount (fset)=count (fset))

36

6 Conclusion We have argued that some system problems are not naturally understood in precise or exact terms. They mainly arise in a socio-organisational context and are characterised by inherent uncertainty and imprecision. Many involve human decision making and judgement. We have also argued that there are advantages to be gained by using formal methods as early as possible in systems development. However the usefulness of existing formal method languages such as Z is limited when applied to these softer problem types. We have suggested fuzzy set theory as a possible formalism for modelling some of the uncertainty and imprecision typical of these systems. We have developed an extension to Z which permits the possibility of partial set membership and have shown that this extended notation is isomorphic with conventional Z when expressing crisp concepts (Matthews & Swatman 1997, Matthews & Swatman 1999, Matthews & Swatman 2000). In this paper we have presented as series of examples that illustrate how the notation might be applied to the sort of system problems identi ed above. The emphasis has been on those aspects of the problem domain where it is more natural to think in terms of the degree or the extent to which something occurs, or where it is more natural to describe concepts approximately and linguistically rather than in a precise or numeric way. We have attempted to focus on the `grayness' in the problem domain. The resultant models are more continuous than discrete re ecting the underlying fuzziness characteristic of these problem types.

References Allinger, G., Feinzig, S. & Janak, E. (1993). Fuzzy Sets and Personnel Selection: Discussion and an Application, Journal of Occupational and Organizational Psychology 66: 162{169. Bae, H. S., Chung, I. S. & Kwon, Y. R. (2000). Specifying and Verifying real-time systems with timing uncertainty, The Journal of Systems and Software 50: 85{96. Bell, P. M. (1997). A fuzzy linguistic model for the prediction of carpal tunnel syndrome risks in an occupational environment, Ergonomics 40(8): 790{799. Berenji, H. R. (1992). Fuzzy Logic Controllers, in R. Yager & L. Zadeh (eds), An Introduction to Fuzzy Logic Applications in Intelligent Systems, Kluwer Academic, pp. 69{96. Boehm, B. W. (1976). Software Engineering, IEEE Transactions on Computers C-25(12): 1226{ 1241. Bojadziev, G. & Bojadziev, M. (1995). Fuzzy Sets, Fuzzy Logic, Applications, World Scienti c, Singapore. Buchanan, B. G. & Shortlie, E. H. (eds) (1985). Rule-Based Expert Systems: The MYCIN Experiments of the Stanford Heuristic Programming Project, Addison-Wesley Publishing Company, Reading, Massachusetts. Castillo, E. & Alvarez, E. (1991). Expert Systems: Uncertainty and Learning, Elsevier Science Publishers Ltd, Barking, Essex. 37

Checkland, P. (1981). Systems Thinking, Systems Practice, John Wiley and Sons, Chichester. Checkland, P. & Scholes, J. (1990). Soft Systems Methodology in Action, John Wiley and Sons, Chichester. Costa, C. S. L., Maranon, P. P. & Cabrera, J. A. H. (1994). Application of diuse measurement to the evaluation of psychological structures, Quality & Quantity 28: 305{313. Cox, E. (1994). The Fuzzy Systems Handbook, AP Professional - Harcourt Brace & Company, Boston. Cox, E. (1995). Fuzzy Logic for Business and Industry, Charles River Media Inc., Rockland, Mass. Darke, P. & Shanks, G. (1995). Understanding stakeholder viewpoints in requirements de nitions: A framework for viewpoint development, Technical Report 37/95, Department of Information Systems, Monash University. Dubois, D. & Prade, H. (1988). Possibility Theory - An Approach to Computerised Processing of Uncertainty, Plenum Press, New York. Duke, R., King, P., Rose, G. & Smith, G. (1991). The Object-Z Speci cation Language: Version 1, Technical Report 91-1, Dept of Computer Science, University of Queensland. Duke, R., Rose, G. & Smith, G. (1995). Object-Z: A Speci cation Language Advocated for the Description of Standards, Computer Standards and Interfaces 17: 511{533. Eysenck, M. W. & Keane, M. T. (1995). Cognitive Psychology, Lawrence Erlbaum Associates, Hove. Finkelstein, A. C. W., Gabby, D., Hunter, A., Kramer, J. & Nuseibeh, B. (1994). Inconsistency handling in multiperspective speci cations, IEEE Transactions on Software Engineering 20(8): 569{578. Graham, I. (1991). Fuzzy Logic in Commercial Expert Systems - Results and Prospects, Fuzzy Sets and Systems 40: 451{472. Haack, S. (1996). Deviant Logic, Fuzzy Logic | Beyond Formalism, second edn, University of Chicago Press, Chicago. Hart, A. (ed.) (1992). Knowledge Acquisition for Expert Systems, McGraw-Hill, New York. Hesketh, B., Prior, R., Gleitzman, M. & Hesketh, T. (1988). Practical Applications and Psychometric Evaluation of a Computerised Fuzzy Graphic Rating Scale, in T. Zetenyi (ed.), Fuzzy Sets in Psychology, Elsevier Science Publishers B.V, North-Holland, pp. 425{454. Hesketh, B., Pryor, R. & Gleitzman, M. (1989). Fuzzy Logic: Toward Measuring Gottfredson's Concept of Occupational Social Space, Journal of Counselling Psychology 36(1): 103{109. 38

Jackson, M. C. (1997). Critical Systems Thinking and Information Systems Development, Proceedings of the 8th Australasian Conference on Information Systems, Adelaide. Jackson, P. (1999). Introduction to Expert Systems, third edn, Addison Wesley Longman, Harlow, England. Jacky, J. (1997). The Way of Z: Practical Programming with Formal Methods, Cambridge University Press, Cambridge. Jang, J.-S. R., Sun, C.-T. & Mizutani, E. (1997). Neuro-Fuzzy and Soft Computing - A Computational Approach to Learning and Machine Intelligence, Prentice-Hall, Inc., New Jersey. Kacprzyk, J., Fedrizzi, M. & Nurmi, H. (1992). Fuzzy Logic with Linguistic Quanti ers in Group Decision Making, in R. Yager & L. Zadeh (eds), An Introduction to Fuzzy Logic Applications in Intelligent Systems, Kluwer Academic, pp. 263{280. Kacprzyk, J., Fedrizzi, M. & Nurmi, H. (1997). Soft Degrees of Consensus under Fuzzy Preferences and Fuzzy Majorities, in J. Kacprzyk, H. Nurmi & M. Fedrizzi (eds), Consensus under Fuzziness, Kluwer Academic, pp. 56{81. Kandel, A. (ed.) (1992). Fuzzy Expert Systems, CRC Press, Boca Raton, Florida. Kess, J. F. (1992). Psycholinguistics - Psychology, Linguistics and the study of natural language, John Benjamin, Amsterdam/Philadelphia. Kidd, A. L. (ed.) (1987). Knowledge Acquisition for Expert Systems: A Practical Handbook, Plenum Press, New York. Klir, G. J. & Harmanec, D. (1997). Types and Measures of Uncertainty, in J. Kacprzyk, H. Nurmi & M. Fedrizzi (eds), Consensus under Fuzziness, Kluwer Academic, pp. 29{51. Kosko, B. (1990). Fuzziness vs. Probability, Int. J. General Systems 17: 211{240. Kosko, B. (1992). Neural Networks and Fuzzy Systems, Prentice-Hall, New Jersey. Lee, J. & Kuo, J.-Y. (1998). New Approach to Requirements Trade-o Analysis for Complex Systems, IEEE Transactions on Knowledge and Data Engineering 10(4): 551{562. Lee, J. & Yen, J. (1994). Specifying Soft Requirements of Knowledge-Based Systems, in R. Yager & L. Zadeh (eds), Fuzzy Sets, Neural Networks, and Soft Computing, Van Nostrand Reinhold, New York, pp. 285{295. Matthews, C. & Swatman, P. A. (1997). Fuzzy Z?, The Second Australian Workshop on Requirements Engineering (AWRE'97), Macquarie University, Sydney, pp. 99{114. Matthews, C. & Swatman, P. A. (1999). Fuzzy Z - The Extended Notation (Version 0), Technical Report 1999:38, Rev 1, School of Management Information Systems, Deakin University.

39

Matthews, C. & Swatman, P. A. (2000). Fuzzy Concepts and Formal Methods : A Fuzzy Logic Toolkit for Z, ZB2000: Formal Speci cation and Development in Z and B, First International Conference of B and Z Users York, UK, 29 Aug. to 2 Sept. 2000, Lecture Notes in Computer Science, Springer-Verlag. Medin, D. L. & Ross, B. H. (1992). Cognitive Psychology, Harcourt Brace Jovanovich, Inc., Orlando. Novak, V. (1992). Fuzzy Sets in Natural Language Processing, in R. Yager & L. Zadeh (eds), An Introduction to Fuzzy Logic Applications in Intelligent Systems, Kluwer Academic, pp. 185{ 200. OASIG (1996). The OASIG study: Why do IT Projects so often Fail, The OR Newsletter 309: 12{16. Orton, T. & Sacerdoti, M. (1992). Can Anything Be Done With IT? A Lament With Relief, The Australian Computer Society Bulletin April: 8{10. Pawlak, Z. (1998). An inquiry into anatomy of con icts, Journal of Information Sciences 109: 65 { 78. Potter, B., Sinclair, J. & Till, D. (1996). An Introduction to Formal Speci cation and Z, second edn, Prentice Hall International Series in Computer Science, Hemel Hempstead. Pressman, R. S. (1997). Software Engineering A Practioner's Approach, fourth edn, McGrawHill, International Edition. Ross, T. J. (1995). Fuzzy Logic with Engineering Applications, McGraw-Hill, Inc, New York. Saiedian, H. (1997). Formal Methods in Information Systems Engineering, in R. H. Thayer & M. Dorfman (eds), Software Requirements Engineering, second edn, IEEE Computer Society Press, pp. 336{349. Schmucker, K. (1984). Fuzzy Sets, Natural Language Computations, and Risk Analysis, Computer Science Press, Rockville. Sestito, S. & Dillon, T. S. (eds) (1994). Automated Knowledge Acquisition, Prentice Hall, Sydney. Smithson, M. (1987). Fuzzy Set Analysis for Behavioral and Social Sciences, Springer-Verlag, New York. Smithson, M. (1988). Possibility Theory, Fuzzy Logic, and Psychological Explanation, in T. Zetenyi (ed.), Fuzzy Sets in Psychology, Elsevier Science Publishers B.V, North-Holland, pp. 1{50. Spivey, J. (1992). The Z Notation: A Reference Manual, second edn, Prentice Hall International Series in Computer Science, Hemel Hempstead. 40

Swatman, P. A. (1996). Formal Object-Oriented Method - FOOM, in H. Kilov & W. Harvey (eds), Speci cation of Behavioural Semantics in Object-Oriented Information Systems, Kluwer Academic, pp. 297{310. Swatman, P. A. & Swatman, P. M. C. (1992). Formal Speci cation: An Analytical Tool for (Management) Information Systems, Journal of Information Systems 2(2): 121{160. Treadwell, W. (1995). Fuzzy Set Theory Movement in the Social Science, Public Administration Review 55(1): 91{98. Valentine, S. H. (1995). An Algebraic Introduction of Real Numbers into Z, Proceedings 7th International Conference on Putting into Practice Methods and Tools for Information Systems Design: Z twenty years on | What is its Future?, IUT de Nantes. Viot, G. (1993). Fuzzy Logic: Concepts to Constructs, AI Expert 8(11): 26{33. Viswanathan, M., Bergen, M., Dutta, S. & Childers, T. (1996). Does a Single Response Category in a Scale Completely Capture a Response?, Psychology and Marketing 13(5): 457{479. Wang, P. (1996). The Interpretation of Fuzziness, IEEE Transactions on Systems, Man, and Cybernetics - Part B: Cybernetics 26(2): 312{326. Wilson, B. (1990). Systems: Concepts, Methodologies and Applications, second edn, John Wiley and Sons, Chichester. Wing, J. M. (1990). A Speci er's Introduction to Formal Methods, IEEE Computer 23(9): 8{24. Yager, R. R. (1996). Fuzzy logic in the formulation of decision functions from linguistic speci cations, Kybernetes 25(4): 119{130. Zadeh, L. A. (1975). The Concept of a Linguistic Variable and its Application to Approximate Reasoning I, Information Sciences 8(4): 199{249. Zadeh, L. A. (1988). Fuzzy Logic, IEEE Computer 21(4): 83{92. Zadeh, L. A. (1992). Knowledge Representation in Fuzzy Logic, in R. Yager & L. Zadeh (eds), An Introduction to Fuzzy Logic Applications in Intelligent Systems, Kluwer Academic, pp. 1{25. Zhang, J., Brody, C. J. & Wright, J. D. (1994). Sociological Applications of Fuzzy Classi cation Analysis, Applied Behavioral Science Review 2(2): 171{186. Zhang, Q. (1998). Fuzziness { vagueness { generality { ambiguity, Journal of Pragmatics 29: 13{ 31.

41