ization state. Such a state is a pending state where the response of more than one operation is awaited. Do not confuse operational synchronism with message synchronism? Message synchronism means that a protocol element is not allowed to send the next message before the reception of the previous message has been acknowl- edged. Message synchronism is a mechanism on integration level 2 (protocol network). Operational synchronism means that a user is not allowed to request a new oper- ation before the previous one has been responded to. Operational synchronism is a mechanism on integration level 1 (abstract network). 7 Concepts and Notations for Process Control Systems Modelling op1 is synchronous: op1 and op2 are asynchronous: op1Req op Req op1 Pending Pending op1Cnf op1Cnf op2Req op1Pending op1 done op1 done op2Pending op1Cnf op2Cnf op2Req op2Req op2Pending p2Pending op1Pending op1 done op1 done op2 done op2Cnf op2Cnf op1 done op1 done op2 done op2 done Fig. 7.33 The SYNCH property: how synchronous and asynchronous operations affect state dia- grams The type of synchronism that is chosen on levels 1 and 2 are independent. This means that synchronous operations can be implemented on top of an asynchronous message handler, or asynchronous operations can be implemented on top of a syn- chronous message handler. The ATOMIC property defines what happens with the service state if an activity fails. If an operation is atomic, the provider must leave the object in the same serv- ice state as before the operation was requested. That might require that some type of recovery mechanism must be implemented on the provider side. If the operation is nonAtomic, the service state is, in principle, unknown when an activity has failed. In that case the user might have to initiate some type of recovery action. Figure 7.34 shows how the ATOMIC property affects state diagrams for a user port. In the atomic case, the user knows that the state is still A if the operation fails. In the nonAtomic case, the state is unknown if the operatio