Chemins critiques dans le dépliage partiellement ordonné d'un réseau de Petri stochastique

Résumé : Dans les processus concurrents à temps-réel, la vitesse des composants individuels a un double impact : d'une part, le délai de bout-en-bout d'un processus est affecté par les délais de ses composants. Mais si la politique d'ordonnancement est la race policy, le résultat final lui-même dépendra des délais des composants. En utilisant les réseaux de Petri stochastiques, nous calculons la probabilité que l'occurrence d'une transition soit critique, c'est-à-dire qu'une légère variation de sa durée de tir modifie la durée totale du processus global. Dans un premier temps, nous nous intéressons aus réseaux d'occurrence qui, dépliés, nous permettent d'obtenir ordre partiel sur les événements et ainsi de déterminer les événements critiques. Ensuite, nous nous plaçons au niveau des workflow nets pour trouver les transitions critiques dans ce modèle.

Mots

Introduction

This paper studies the impact of component performances -measured by transition delays -on the global performance of a composite workflow. This impact analysis is complicated by the presence of concurrency and of conflict, both of which may either hide individual delays or accentuate their impact. To capture these effects, we consider continuous time processes within the framework of partial order unfolding semantics [START_REF] Engelfriet | Branching Processes of Petri Nets[END_REF][START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF][START_REF] Mcmillan | Using Unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF] of Petri nets.

To motivate the ideas, consider a machine servicing workflow, represented as a Petri net in Figure 1. A token in the initial place represents a client requesting that his machine be serviced. A client can revoke his request (by firing transition N ), but this has to be done before the servicing process has been started (by the firing of S). The machine has two components C X and C Y , the operations servicing them are denoted by the transitions X and Y respectively. The component C Y degrades when it is idle and has to be shipped to the client (denoted by transition D) as soon as possible after its servicing. If the machine can not be delivered (either because component C X 's servicing has not yet finished or because the shipping process has not yet begun), after a certain time the component C Y has to be sent for servicing again (denoted by the firing of C). Now, the latency of individual events has a double impact on the configurations. Firstly, the overall latency of a configuration is affected by the latency of its individual events: the latency of a configuration is a max-plus combination of the latencies of its individual events. A second impact of the latencies of the individual events is the choice of configuration itself, since an event with a shorter latency can pre-empt the occurrence of a conflicting event whose delay is larger. The authors of [START_REF] Ruys | First Passage Time Analysis of Stochastic Process Algebra Using Partial Orders[END_REF] have analyzed first-passage time in event structures for a fixed configuration; here, we also take into account the second impact of real-time durations, namely, on choice. A concurrent system generally has several qualitatively possible evolutions (or configurations) that could occur. By 'qualitatively' we mean the difference between runs that have different sets of events (rather than just different durations for the same set of events, which would be a merely quantitative distinction). Which one among the possible configurations actually occurs, depends in general on non-predetermined choices. In [START_REF] Abbes | True-concurrency probabilistic models: Markov nets and a law of large numbers[END_REF][START_REF] Abbes | Probabilistic models for true-concurrency: branching cells and distributed probabilities for event structures[END_REF][START_REF] Benveniste | Markov Nets: Probabilistic Models for distributed and concurrent systems[END_REF][START_REF] Varacca | Probabilistic event structures and domains[END_REF], this is treated as a logical choice, or conflict; no timing issues are considered. Our approach combines the two orthogonal viewpoints, and considers timing and choice jointly rather than separately: the very shape and outcome of the process will depend on the latency of component processes.

We capture the random and asynchronous character of such behaviours, and the dependencies encountered, e.g., in orchestrated processes, in Petri nets with stochastic delays on transitions. Although the work in this paper was initially motivated by Web-Services orchestrations, the scope of application encompasses all concurrent real-time processes.

This paper is organized as follows. In Section 2, we recall the definitions for Petri Nets and their unfoldings. In Section 3, we introduce stochastic delays in those structures, which are then used to compute the occurrence probability of an event; this is lifted in Section 4 to computing the probability for an event to be critical in an unfolding. Section 5 then lifts the analysis to the level of workflows and finishes the discussion of the running example; finally, Section 6 concludes.

Petri Nets

Let denote by N = {0, 1, . . .} the set of natural numbers. We now formally define the models we use in the rest of this paper. Definition 1. A net is a tuple N = (P , T , F ) where

P = ∅ is a set of places, T = ∅ is a set of transitions such that P ∩ T = ∅, F ⊆ (P × T ) ∪ (T × P ) is a set of flow arcs.
A marking is a multiset m of places, i.e. a map from P to N. A Petri net is a tuple N = (P , T , F , m), where (P , T , F ) is a finite net, and m : P → N is an initial marking.

Elements of P ∪ T are called the nodes of N . For a transition t ∈ T , we call The nodes of E are called events, those of B conditions. In the model below, durations are associated only to events, not to conditions; the starting instant of an event is thus determined by its predecessor events alone. We therefore define for convenience, for every e in E, • e by • e = •• e and e • by e • = e •• . As for each place b, | • b| ≤ 1, the firing of event e requires that all events in • e have fired previously. We also suppose that E contains an an initial event ⊥ such that

• t = {p | (p, t) ∈ F } the preset of t, t • = {p | (t, p) ∈ F } the postset of t. A transition t is enabled in marking m if ∀p ∈ • t, m(p) > 0.
t 1 ∩ • t 2 = ∅; the conflict relation # ⊆ (T ∪ P ) 2 is given by a # b ⇔ ∃t a , t b ∈ T : t a # im t b ∧ t a a ∧ t b b. (1)
• e = {⊥} iff e is ≺-minimal in E \ ({⊥} ∪ • ⊥).
A prefix of ON is any subnet spanned by a downward closed subset π ⊆ B ∪ E , i.e. such that for every x ∈ π, [x] ⊆ π. Prefix κ is a configuration if and only if it is conflict-free, i.e. x ∈ κ and x#y imply y ∈ κ. Denote as C(ON ) the set of ON 's configurations. Call any ⊆-maximal element of C(ON ) a run of ON . Denote the set of ON 's runs as Θ(ON ), or Θ if no confusion can arise. A pair (x, y) ∈ (B ∪ E ) 2 of nodes is concurrent, written x co y, if and only if neither x y nor y

x nor x#y hold. Further, any set of conditions W ⊆ B such that all conditions in W are pairwise concurrent, is called a co-set. A ⊆ -maximal co-set is a cut.

Occurrence nets are the mathematical form of the partial order unfolding semantics for Petri nets [START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF]; although more general applications are possible, we will focus here on unfoldings of safe Petri nets only.

If N 1 = (P 1 , T 1 , F 1 ) and N 2 = (P 2 , T 2 , F 2 ) are nets, a homomorphism is a mapping h : P 1 ∪ T 1 → P 2 ∪ T 2 such that h(P 1 ) ⊆ P 2 and for every t 1 ∈ T 1 , the restriction of h to • t 1 is a bijection between the set • t 1 in N 1 and the set • h(t 1 ) in N 2 , and similarly for t 1

• and (h(t 1 )) A branching process of safe Petri net N = (N , m 0 ) is a pair β = (ON , π), where ON = (B , E , G) is an occurrence net, and π is a homomorphism from ON to N such that:

• . i C Y Y C t t D D i i i t X S N Y
1. The restriction of π to C 0 is a bijection from C 0 to m 0 , and 2. for every e 1 , e 2 ∈ E , if • e 1 = • e 2 and h(e 1 ) = h(e 2 ) then e 1 = e 2 .

Branching processes β 1 = (ON 1 , π 1 ) and β 2 = (ON 2 , π 2 ) for N are isomorphic iff there exists a bijective homomorphism h :

ON 1 → ON 2 such that π 1 = π 2 • h. The unique (up to isomorphism) maximal branching process β = (U N , π) of N is called the unfolding of N .
Following [START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF], the unfolding of N can be computed using the canonical algorithm given below (we omit any cut-off criteria here since they are not essential for our purposes). Let β = (ON β , π β ) be a branching process of N = (P , T , F , m 0 ), where ON β = (B β , E β , G β ). Denote as PE(β) ⊆ T × P(B β ) the set of possible extensions of β, i.e. of the pairs (t, W ) such that

W is a co-set of ON β , • t = π β (W ), E β contains no event e such that π β (e) = t and • e = W .
The unfolding procedure adapted from [START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF] for safe Petri net N = (N , m 0 ) is then:

Let C 0 m 0 ×{∅} and initialize β = (C 0 , ∅, ∅, π β ) with π β sending all conditions in C 0 to the corresponding place in m 0 . For given β = (ON β , π β ) with ON β = (B β , E β , G β ), compute PE(β) and replace -E β by E β ∪ PE(β), -B β by B β ∪ V , where V {(p, e) | e ∈ PE(β), p ∈ π β (e)
• }, and

-G β by G β ∪ U , where U {(b, (t, W )) | (t, W ) ∈ PE(β), b ∈ W } ∪ (e, (p, e)) | e ∈ PE(β), p ∈ π β (e) • ;
finally, extend π β to the new nodes in the natural way, i.e. (t, W ) → t and (p, e) → p.

Figure 2 shows a prefix of the unfolding for the net of Figure 1. Note the multiple occurrences of the looping transition t (shaded in the figure). In this figure, every occurrence of t corresponds to a distinct way in which the net of Figure 1 reaches the output transition o. Every occurrence of t is followed by the place i, which denotes that the net of Figure 1 has come back to its initial marking.

Adding Time and Probability

Until now, we have defined structures that model the concurrency between events. The applications and properties we are interested in (mainly Web-services) are strongly related to the timed behavior of those structures (cf. [START_REF] Haas | Stochastic Petri Nets. Modelling, Stability, Simulation[END_REF]).

Definitions and Assumptions

We will consider safe Petri nets N = (P , T , F , m 0 ) such that each transition t ∈ T is equipped with a probability law P t whose support is contained in [0, ∞). P t gives the law of the delay δ t for firing t after t is enabled. If t becomes enabled at time τ , a new realization δ t (ω) of δ t is drawn from P t , independently of other transitions and of previous realizations of δ t . If t is continuously enabled during the interval [τ, τ + δ t (ω)], then t fires at time τ + δ t (ω), otherwise it has been preempted. Upon unfolding N , the events of U N inherit the delay law from the corresponding transitions of N : we obtain a family (δ e ) e∈E such that δ e ∼ δ π(e) .

Note that our approach is not to be confounded with Timed Event Structures, see [START_REF] Katoen | Metric semantics for true concurrent real time[END_REF],where delays merely indicate when an event may occur (but is not forced to). Let ON = (B, E, G) be the unfolding of N . Each value ω = (δ(e)) e∈E in the space Ω E [0, ∞) E will be seen to yield a unique configuration θ of ON .

We make the following assumptions:

Assumption 1. The measures (P e ) e∈E are pairwise independent.

Assumption 2.

No P e has atoms:

∀ e ∈ E : ∀x ∈ [0, ∞) : P e ({x}) = 0.
Heights. The height of an event e is defined (see, e.g., [START_REF] Mairesse | Modeling and Analysis of Timed Petri Nets using Heaps of Pieces[END_REF]) recursively by

H(e, ω) max e ′ ∈ • e {H(e ′ , ω)} + δ(e) and H(⊥, ω) = 0; (2)
a configuration κ has height

H(κ, ω) max e∈κ {H(e, ω)} . (3)
Note that only the causality relation and the delays are relevant in the computation of H(e, ω), conflicting events have no influence. In other words, for every event e of E, H(e, ω) is defined, regardless of whether or not e actually occurs. We may thus apply different firing policies without modifying H(•, •); on the other hand, the occurrence of e will depend on ω through the firing policy. Here, all decisions will be made according to race policy: the first event whose delay expires first preempts its competitors. We use Ω instead of Ω E .

For τ ∈ [0, ∞), denote as

E τ (ω) {e | H(e, ω) τ } (4)
the random set of those events whose height is bounded by τ .

Theorem 1. Under assumptions 1 and 2, the following properties hold.

1. H(e, ω) < ∞ for all e ∈ E and almost all ω ∈ Ω.

2. H(e, ω) = H(e ′ , ω) almost surely for any e, e ′ ∈ E such that e = e ′ .

3. For all τ ∈ [0, ∞), the set E τ (ω) is finite for almost all ω.

Proof:

1. Obvious.
2. The claim is obvious for e ≺ e ′ or e ′ ≺ e, so assume neither holds. Let H(e) be the random variable given by (H(e, ω)) ω∈Ω , and define analogously H(κ) for any configuration κ. Let x be the configuration

x [x]\{x}.
Then A H(e) -H(ě) and A ′ H(e ′ ) -H( ě′ ) are independent of one another and of H(ě) and H( ě′ ). In particular, A and A ′ are independent of B H(ě ′ ) -H(ě), and thus A is independent of A ′ + B. Now, for any ω,

H(e, ω) = H(e ′ , ω) ⇔ A(ω) = A ′ (ω) + B(ω).
Now, if X and Y are two atomless independent real random variables, then X -Y is also atomless (see [START_REF] Tucker | An Introduction to probability and mathematical statistics[END_REF]Chapter 5] for example). Then P(X = Y ) = P(X -Y = 0) = 0. Setting X A and Y A ′ + B, one can conclude.

3. Assume there exist ε > 0 and τ ∈ [0, ∞) such that

P {ω : |E τ (ω)| = ∞} ε, (5)
and let

τ ε inf{τ ∈ [0, ∞) | (5) holds}. If P {ω : |E τε (ω)| = ∞} ε, (6)
then, by construction of τ ε , there is a positive probability that an infinite number of firings must occur simultaneously at time τ ε . However, N is safe and finite, therefore only a finite number of transition firings can be simultaneously enabled; from this contradiction, we conclude that

u P {ω : |E τε (ω)| = ∞} < ε.
Thus, for every ǫ > 0,

P{|E τε+ǫ (ω)| = ∞ | |E τε (ω)| < ∞} ε -u 1 -u > 0.
Since N is finite, this implies that there exists some transition t such that

P{t fires ∞ly often in [τ ε , τ ε + ǫ] | |E τε (ω)| < ∞} > 0.
But since N is safe, no two occurrences of the same transition are enabled simultaneously. Hence, since the δ t (n k , ω) are i.i.d., this implies the existence of a series n 1 < n 2 < . . . of indexes such that

P ∞ k=1 δ t (n k , ω) < α t (2 -k ) > 0, (7)
where α t (x) is the x-quantile of the distribution of δ t . Note that by assumption 2, one has that P(δ t (n k , ω) = 0) = 0, and therefore α t (x) > 0 for all x > 0. By construction,

∞ k=1 P{δ t (n k , ω) < α t (2 -k )} ∞ k=1 2 -k = 1; (8)
but then the Borel-Cantelli lemma1 contradicts (7), and we are done. 2. Define the set of events enabled in a configuration κ 1 as

enab(κ 1 ) {e ∈ E \ κ 1 | κ 1 ∪ {e} ∈ C(ON )} (12)
The probability to go from state κ 1 to state κ 2 = κ 1 ∪ {e} is

P κ1,κ2 = λ e e ′ ∈enab(κ1) λ e ′ . ( 13
)
3. Transitions between any other states have zero probability.

The initial state of the Markov chain is the minimal configuration {⊥} and the maximal states are the maximal configurations of ON . Let prec(κ) denote the set of immediate predecessor states of κ in the graph. We obtain p(κ) recursively as:

p(κ) = κ ′ ∈prec(κ) p(κ ′ ).P κ ′ ,κ , (14)
taking p({⊥}) = 1.

In general, Equation ( 11) can be computed only when B(e) is finite.

Critical Chains in Occurrence Nets

4.1 When is a critical for b?

We now turn to the central problem of criticality. As a simple example consider the occurrence net in Figure 3 and the only maximal configuration u = {a, b, c}. Any change in the delay δ c of event c will affect the delay δ u of configuration u. Event c is thus critical for the configuration u for all possible delay values of a, b and c. The same cannot be said for events a and b: if δ a > δ b , a increase or decrease in δ b by an amount ǫ such that δ a > δ b + ǫ does not affect δ u . Similarly, a is non-critical when δ b > δ a . Events a and b are thus critical for configuration u only in certain situations, depending on the delays of both a and b.

We will study first criticality of events for a configuration, and then move on to asking whether a transition is critical. The latter will become meaningful in the context of workflow nets and their unfoldings.

To formalize our question, let u e be the tuple from [0, ∞) E whose e-component is 1 and all of whose other components are 0. We are interested in situations in which the delay of e is critical for the delay of configuration κ, in the following sense:

crit(e, κ, ω) ⇐⇒ ∀ ε > 0 : H(κ, ω) < H(κ, ω + ε • u e ).
In the example of Figures 1 and2, let us ask whether the first occurrence of X (called X 0 ) is critical for the first occurrence D 0 of D, assuming both occur. This is the case iff the delay required by X 0 is longer than that of Y 0 . Here and in the remainder of the paper, let all exponential transition delay parameters be denoted by λ with the name of the transition as subscript, i.e., λ X for the delay parameter at transition X, etc. We obtain, by independence of the delays,

P(crit(X 0 , [D 0 ], ω)) = λ Y λ X + λ Y .
An event e is in Crit(e, ω) if it is critical for the configuration that occurs with respect to ω. That is, for all positive but "small enough" increases of e ′ s delay, that increase is also "felt" by R:

Crit(e, ω) := {e | ∃η s. th. ∀ ε ∈]0, η[: H(R(ω), ω) < H(R(ω + ε • u e ), ω + ε • u e )} . (15)
Indeed, due to Assumption 1), no pair of events can have the same height. Then, for sufficiently small increases of latencies the events that occur do not change and R(ω) = R(ω + ε • u e ). If ε is to large, there could be a change in the run that occurs and the total height of the occurring run could become smaller.

The definitions given for defining critical events are valid only for finite configurations, i.e. we consider all heights to be finite. The notion of critical event cannot be well-defined for an infinite configuration. For example, take a configuration κ = e 0 , f 1 , e 1 , f 1 , . . ., where ∀i, j ∈ N, e i < e i+1 and f j < f j+1 and ¬(e i #f j ). If event e i occurs at time t, then, at that time, events e 0 , . . . , e i are critical, and not event f j . Conversely, if event f j occurs at time t, events f 0 , . . . , f j are critical and not events e i . Making t grow to infinity, should we consider that the critical events are all the events, or none? Whatever our choice, it will not articulate any meaningful information about our system.

Problem CRIT Given a finite configuration κ What is the probability P({ω | crit(e, κ, ω)}) for the delay of e ∈ κ to be critical?

For notational convenience, write x ≪ ω y to say that the delay of x is critical for the height of [y] in ω. More formally, we have the following definition. Definition 5. For all ω, let ≪ ω be the smallest reflexive relation on E that satisfies:

1. For any u ∈ E and x ∈ • u, x ≪ ω u if and only if ∀ e ∈ • u \ {x} : H(e, ω) < H(x, ω). 2. For all ω, relation ≪ ω is transitive: x ≪ ω y ≪ ω z ⇒ x ≪ ω z.
A critical chain of ON for ω is a maximal set cc ⊆ {e | Crit(e, ω)} such that for all x, y ∈ cc, either x ≪ ω y or y ≪ ω x.

Note that if there exists ω such that x ≪ ω y, then x < y. In principle, there can be more than one critical chain for a given ω; however, under Assumption 1, the set of those ω has measure 0 under P, i.e. ≪ ω is uniquely defined for almost all ω.

The following lemma ensures that every critical chain contains a minimal event and is the finite sequence of events x 0 , . . . , x n where x 0 ∈ min(E) and ∀i ∈ {1, . . . , n}, x i-1 ∈ • x i . The following lemma is a direct consequence of Definition 5.

Lemma 2. For every event y such that Crit(y, ω) and y = ⊥, ∃x ∈ E such that x ≪ ω y and x ∈ • y.

In the remainder of this section, we first give an algorithm to compute the critical events for a given configuration and given timings on the events, then we describe a method to solve Problem CRIT.

Critical events for a given configuration and given timings

For a given finite configuration κ and a given ω, one can find a critical chain of critical events using Algorithm 1. Indeed, from the definition, an event of κ that has the maximum height is critical. Then, one can find a critical chain that ends with that event. Then, from Lemma 2 and Definition 5, it is easy to see that at each step of the loop, one computes a critical event that is a predecessor of the last computed critical event. This gives a maximal critical chain (the condition [e ′ ] \ {e ′ } = ∅ is equivalent to e ′ ∈ min(E)).

Computation of the Criticality Probability

We now give a method to compute the probability of an event to be critical. Note that as the critical character of an event depends on the future of that event, we need the configurations to be finite and in finite number.

As stated in the previous section, the behavior of the net can be modeled by a Markov chain whose states are the configurations and we will use the notations already defined. Since a Markov chain can be seen as a directed graph labeled by the transition probabilities or by the events on the arcs, we will use graph theoretic terminology. Each maximal path of the chain (from the empty configuration to a run κ) defines an order of occurrence of the event in the configuration κ. From this order, one can define the critical chain on the path; if the events that occur of that path are in their occurrence order e 1 , . . . , e n , we have: 1. e n is critical;

2. if e k is critical and if {i | i < k, e i < e k } is non-empty, define i 0 max{i | i < k, e i < e k }.
Event i 0 is then the last event to occur before e k . This event does not exist (the considered set is empty) if e k is a minimal event. Then e i0 ≪ ω e k and ∄j ∈ {i 0 + 1, . . . , k -1} such that e i0 ≪ ω e j ≪ ω e k : e i0 is critical and there is no critical event between e i0 and e k .

Under Assumption 1, the critical chain constructed in this way is unique with probability 1. The occurrence of an event e depends only on the "past" of event e, whereas the critical character of an event depends only on the "future" of e (that is, the events that occur after it), thanks to the memoryless properties of the exponential distribution. Thanks to that property, the past and the future of e can be separated in the computations. We now develop an algorithm to compute that probability.

We will use the following notations:

For two states κ 1 , κ 2 of the chain P(κ 1 , κ 2 ) is the probability to reach κ 2 from κ 1 .

We denote by P crit (κ, e) the probability of e to be critical if starting from configuration κ, e is a minimal event (that is, if κ ∪ {e} is a configuration). P crit (κ, e) = 0 otherwise. For a maximal event e of a longest run κ, one has P crit (κ -{e}, e) = P κ-{e},κ .

Let e be a maximal event -recall that the maximal events are those that may occur at the latest time in κ -of a run κ. From the above, configuration κ occurs and e is critical if and only if configuration κ occurs and e is the last event to occur. The probability for that event is P(∅, κ -{e}) • P κ-{e},κ . Now, let us compute P crit for the other arcs. Let (κ 1 , κ 2 ) be an arc such that every arc successor of it has its P crit computed. It is always possible to find such an arc because the graph is acyclic. Using a topological sort, one can find an order on the configurations such that this condition is always satisfied. Denote by e the unique event in κ 2κ 1 .

From the choice of configuration κ 1 , for a run κ that contains κ 1 ∪ {e}, if e is the first event to occur, e is critical iff

∃f ∈ e • ∩ κ such that • f ∩ (κ -κ 1 ) = {e} and f is critical . (16)
Indeed, from Definition 5.1, e can be critical only if there is a critical event f in e • . Moreover, if there is a event u ∈ • f ∩ (κκ 1 ), then H(u) > H(e) and u is critical, not e.

Equation ( 16) leads to a method to recursively compute P crit . Let F be the set of events f satisfying Equation ( 16) for a run κ and A F = {(κ i , κ ′i ), i ∈ {1, . . . , m}} be the set of arcs labeled by an event in F reachable from κ 2 (we denote the label of (κ i , κ ′i ) by f i ). We have

P crit (κ 1 , e) = n i=1 P(κ 1 , κ 2 )P(κ 2 , κ i )P(κ i , κ ′i )P crit (κ i , f i ).
This formula can be explained in the following way: event e can be critical from κ 1 if e is the first event to occur in the remaining of a run (by definition of P crit ). Then, consider the next event f to occur in e • . From Equation ( 16), e can be critical only if f can be critical. Then, f is a label of an arc in A F . Let (κ i , κ ′i ) be this arc. The probability to effectively reach that arc is P(κ 2 , κ i ) and the path that has been followed between configurations κ 2 and κ i does not matter: the events occurring are concurrent to f (f ∈ e • and ∀e ′ ∈ κ iκ 2 , e ′ / ∈ • f ) and they are the same for every path, so their order does not matter. For the rest of the formula, one has to remark that f being critical from κ i is independent of what happens before conditionally to the occurrence of the state κ i .

Then, the probability for an event e to be critical is

P crit (e) =
κ⊆κ∪{e}∈C(ON ) P(κ)P crit (κ, e).

Criticality of a component in a Workflow

The above discussion covers the criticality of events in an occurrence net. However, it is of much greater relevance in practice to ask whether a given system component is critical for the performance of a compound system, in particular for systems and services that are to be frequently used. The knowledge of criticality in a complex system allows e.g. to allocate resources -maintenance, renewal, replacement by newer but costly equipment, etc -where they yield best global results: if only a limited budget for such interventions is available, one should strive to use it as much as possible on improvement of the performance in bottlenecks of the system. Clearly, the above discussions on criticality in occurrence nets can serve as preparations for the system analysis here, in the sense that one wishes to lift statements on an occurrence of t being critical for an occurrence of t ′ in the unfolding U N , to the net N itself and to saying that t is critical for t ′ . However, this is not very meaningful for general nets since the occurrences of t and t ′ may be only loosely coupled. We can, however, give a precise meaning to transition criticality in a particular class of Petri nets, called workflow nets.

The following definitions are based on [START_REF] Van Der Aalst | The application of Petri Nets to Workflow Management[END_REF]. It is known that WF-net W is sound iff N is live and bounded [START_REF] Van Der Aalst | Verification of Workflow nets[END_REF]. Let us call any Petri net N = (W , m 0 ) for which W is a looped and sound WF-net a WF Petri net, or WFPN.

Consider the net in Figure 1. We see intuitively that, between two consecutive occurrences of the loop transition, transition N will be critical for the entire workflow every time it actually occurs, and transition X, Y and C can each be critical if N does not occur. More precisely, in that case both X and Y will occur, X exactly once, Y possibly several times; in fact, Y occurs exactly one more time than C does, before leaving the loop.

We will make this more precise now. To start, note that the successive occurrences of the loop transition provide a natural regeneration point for the stochastic behaviour of the net. The loop transition also marks the end of one execution of the workflow and the passage to the next execution. We will thus consider the criticality problem with a focus on the loop transition: at each new occurrence of it, look back to the period since the last occurrence, and ask which of the other transitions have, this time around, been critical for the total time spent.

The dynamics of WFPNs features a sequence of rounds separated by the successive occurrences e 1 , e 2 , . . . of t. Formally, for any event e in the unfolding (ON , π) of N , define the round number of e by round (e) |π -1 ({t}) ∩ [e]|. Call t n (ω) the nth occurrence of t under ω; that is, one has round (e) < n for all e ≺ t and round (e ′ ) ≥ n for all t e ′ . We will consider the following problem:

(P) Given a sound WFPN N and a transition x = t of N , what is the probability P crit (x, n) that the occurrence (if any) in round n of x is critical for t n ?

Observe that the loop transition t synchronises the flow at the end of each round, hence it is critical in every round. Due to this synchronisation, if x n , the n th occurrence of a transition x is critical for a round, then x n remains critical for all successive rounds of the looped WF-Net.

As mentioned above, the synchronization at the end of a workflow round and in the firing of t induces a renewal of the underlying Markov processes. In particular, P crit (x, n) = P crit (x, 1) for any round n. We will therefore discard the round index n and represent the previous terms by P crit (x), which denotes the probability that a transition x of N is critical for a round. The problem (P) can thus be restated as: Given a sound WFPN N and a transition x = t of N , what is the probability P crit (x) that the occurrence (if any) of x is critical in an execution round of N ? Solving this problem for the example of Figure 1 and its unfolding in Figure 2, we obtain the following results:

Transition N is critical in a round iff δ N < δ S , hence P crit (N ) = λN λN +λS .
If δ N > δ S , both S and D are critical in that round, hence P crit (S) = P crit (D) = λS λN +λS . For criticality of X, Y and C, the number of firings of C in a round is central. Denote by Num C , this number of firings of C in a given round. We note that (i) Y fires Num C + 1 times in this round, and (ii) X is critical in this round iff it fires after the last firing of Y , otherwise Y is critical in this round. For convenience, for transitions P and Q, let P P/Q = λP λP +λQ , the probability of the delay of P being lesser than that of Q. We then have for the probability of X being critical in a round:

P crit (X) = P crit (S) • ∞ i=0 P Y /X • P C/X i • P Y /X • P X/C • P D/C = P crit (S) • P Y /X • P X/C • P D/C • 1 1 -P Y /X • P C/X
Since Y is critical in a round whenever X is not critical, we have P crit (Y ) = P crit (S) -P crit (X).

Finally, C is critical in a round whenever Y is critical, except for the case when Num C = 0, when C does not occur. We thus have, In practice, it will be acceptable for X to be critical but not for transitions that may have to be iterated a large number of times, such as Y and C. Therefore, one will strive to increase P Y /X to keep P crit (X) large.

Conclusion and Outlook

We have established several properties of distributed Markovian systems allowing to exhibit which are the critical events of a non-deterministic process, and studied how to lift this analysis to workflow nets. Note that we have used a timed Markovian model in computations, whose execution traces are linearly ordered sequences. One might therefore think that we could have dropped the use of partial orders entirely and have simply used interleaved semantics throughout. However, only the causal semantics provided by unfoldings allows to retrieve the dependencies which are crucial in finding critical events : the fact that event e occurs before event e ′ in itself does not imply that e is critical for e ′ , since the ordering of the two events may result merely from the contingent delay values. In that case, both events evolve independently of one another, and modifications in the component corresponding to e would have no impact on e ′ . Criticality implies causal ordering, hence in order to analyze criticality, the investigation of partial order unfoldings cannot be avoided. Identification and prediction of likely bottlenecks in composite processes allows to anticipate possible performance deterioration. Conversely, once the bottlenecks of an intended composite application are known, resource allocation can be optimized so that attention is focused on latency-critical components by reducing the critical local latencies. More delicate analyses, such as concerning monotonicity (see [START_REF] Bouillar | Monotonicity in Service Orchestrations[END_REF]) and robustness of global performance with respect to local performances, are under way or part of future work.

Figure 1 :

 1 Figure 1: A workflow net.

Figure 2 :

 2 Figure 2: The (partial) unfolding of the workflow net of Figure 1.

2 3. 2 Definition 3 .Figure 3 :

 2233 Figure 3: An occurrence net.

Algorithm 1

 1 Critical chain Take e ∈ κ such that H(e, ω) = H(κ, ω); cc ← [e]; κ ← [e] \ {e}; while κ = ∅ do Take e ′ ∈ κ such that H(e ′ , ω) = H(κ, ω); cc ← e ′ :: cc; κ ← [e ′ ] \ {e ′ }; end while return cc.

P

  crit (C) = P crit (Y ) -P crit (S) • P X/Y • P D/C .

  This enabled transition can fire, resulting in a new marking m ′ = m-• t+t • ; this firing relation is denoted by m[t m ′ . A marking m is reachable if there exists a sequence of transitions t 0 , t 1 . . . t n such that m 0 [t 0 m 1 [t 1 . . . [t n m. A net is safe if for all reachable markings m, m(p) ⊆ {0, 1} for all p ∈ P . From now on, we will consider only safe nets, and consider markings simply as place sets, i.e. we use the symbol m for the set {p ∈ P | m(p) = 1}. Let ≺ the transitive closure of F and the reflexive closure of ≺. The set of causes or prime configuration of x ∈ P ∪ T is [x] {y | y x}. Further, write t 1 # im t 2 for transitions t 1 and t 2 if and only if t 1 = t 2 and •

  Definition 6 (WF-Net). A net W * = (P * , T * , F * ) is a WF-net 2 if and only if:1. W has two special places, source place i and sink place o, such that• i = o • = ∅.2. If we add a transition t to T * that connects place o with i, i.e. • t = {o} and t • = {i}, then the resulting net W = (P , T , F ) -the looped version of W * -is strongly connected.

	W is then called a looped WF-net, and t is called the loop transition of W . WF-net W is sound iff
	1. m 0 = {i};
	2. m 0 is a home marking, i.e. from every reachable marking of N , m 0 is reachable;
	3. N has no dead transitions, i.e. for every t ∈ T there is a reachable marking m such that m[t .

RR n 7003

see e.g. Lemma 8.1 in P. Brémaud. Markov Chains. Gibbs Fields, Monte Carlo Simulation, and Queues. Texts in Applied Mathematics 31, Springer 1999. RR n 7003

WorkFlow net INRIA

Further, for all e ∈ E , define Occ(e) {ω | occ(e, ω)}. In other words, occ(e) holds iff event e eventually occurs, under ω and the race policy. Letting R(ω) {e ∈ E | occ(e, ω)} the set of events that occur under ω, we have:

Proof. R(ω) is a configuration by construction. For maximality, suppose there exists e ∈ R(ω) such that R(ω) ∪ {e} ∈ C(ON ). By Theorem 1, e has finite height, and check(e, ω) is almost surely finite. By choice of e, 1. • e ⊆ R(ω), and 2. there is no e ∈ R(ω) such that e#e.

But this implies that check(e, ω) contains no e ′ with occ(e ′ , ω), which implies occ(e, ω), contradicting our assumption.

Probability of occurrence

The occurrence of an event e under any ω is determined by [e] and the set of events {e ′ | e#e ′ } (see definition of occ(e, ω)). In fact, the latter set can be further restricted to events e ′ that are in minimal conflict with e.

Minimal Conflict: If e#e ′ , but there exist events e 1 e, e ′

1 ≺ e ′ such that e 1 #e ′ 1 , then e#e ′ can be seen as a conflict derived from e 1 and e ′ 1 . The height of e ′ in any run ω, H(e ′ , ω), can not affect the occurrence of e which is decided by the race between the mutually conflicting events e 1 and e ′ 1 . This inspires the following definition for minimal conflict [START_REF] Abbes | True-concurrency probabilistic models: Markov nets and a law of large numbers[END_REF][START_REF] Abbes | Probabilistic models for true-concurrency: branching cells and distributed probabilities for event structures[END_REF]:

Thus the set of events which completely determine the occurrence of an event e is a prefix containing e which is closed under minimal conflict. This set B(e) is formally defined as:

1. e ∈ B(e);

We thus need to compute all possible ways in which a maximal configuration κ C could occur in B(e). This can be done for any occurrence net ON using a Markov chain, which is a graph of configurations κ of ON with probabilistic transitions. This graph is constructed as below:

1. The states of the graph are the configurations κ of ON .


1 « Perhaps the infatuation which makes one neglect intermediate causes comes from a certain anthropomorphism: one lends to God the ambition of a man who, in things worthy of praise, prefers to accomplish everything alone, lest the person whom he would have act in his stead or associate with, by magnanimity, should conceal from the eyes of the crowd his own merit; his solution is undoubtedly mediocre, but it appears to be sure, and at its height » 2 Pope Francis, Fratelli Tutti, §6. The quotes of the magisterium texts are from the website of the Holy see : www.vatican.va 3 Ibid., §11. 4 "In some countries, a concept of popular and national unity influenced by various ideologies is creating new forms of selfishness and a loss of the social sense under the guise of defending national interests." (Ibid., §11). It refers to the theme of the "culture of walls" (Ibid., §27) and to the xenophobic mentality (Ibid., §39). 5 Ibid., §99: "This is a far cry from the false universalism of those who constantly travel abroad because they cannot tolerate or love their own people".

Universal and particular: Fratelli tutti in the light of St Thomas conception of universality

Bernard Guéry IPC-Paris « Peut-être l'infatuation qui fait négliger les causes intermédiaires vient-elle d'un certain anthropomorphisme : on prête ieu l'ambition d'un homme qui, dans les choses dignes de louange, aime mieux tout accomplir seul, crainte que la personne que par magnanimité il ferait agir sa lace ou s'associerait, ne masque aux yeux de la foule son mérite lui ; sa solution est sans doute médiocre mais elle apparaît sûre et sa toise 1 . » De Koninck, C. (1959). Le scandale de la médiation (II). Laval théologique et philosophique, 15(1), 80-81.

Universal love sounds beautiful under the pen of Pope Francis. But genuine generosity towards other peoples seems quite utopic, heroic, or restricted to some holy men and women. At the same time the pope dedicates his encyclical to all people of good will 2 . How can we understand the o e's aspiration? In this text, I aim to show how Thomas Aquinas' thought is useful to understand properly the o e's conce tion of the relationshi between universal love and articular friendshi . While doing this, I will work as a philosopher. As the philosopher seeks for reasons, I will look for the reason why the pope says that universal love is fostered by particular love. Actually, there are many ways to articulate the universal and particular, and many levels of universality and particularity. In the text, it is clear that Francis cautions against two mistakes in a lying the distinction when com aring love of mankind and love of one's nation or local political community: the first would consist in reinforcing the particular against the universal; the second to promote the universal at the expense of the particular. Of course, in politics, those two contradictory positions can lead to the following ideologies: first, "aggressive nationalism 3 ", which assumes that fostering universal fraternity pulls down the identities of nations 4 . What Francis calls the "false universalism 5 " constitutes the o osite ideology, which argues that the existence of nations is an obstacle to universal fraternity, and this position endeavors to weaken the local political communities, which are said to obstruct the way towards universalism. The pope's intention is to promotes both poles. He tries to show a way towards "building fraternity, be it local or universal6 ". He says more precisely: "We need to pay attention to the global so as to avoid narrowness and banality. Yet we also need to look to the local, which keeps our feet on the ground. Together, the two prevent us from falling into one of two extremes 7 ." But he not only promotes them simultaneously. According to the pope, the particular is a path to the universal. Indeed, in this text, which promotes universal love, he complains against a phenomenon that "fosters low national self-esteem8 " and recalls that "there is no worse form of alienation than to feel uprooted, belonging to no one 9 ." His advocacy for universal love does not lead him to despise local connections. Such remarks leave no doubt, when we carefully read the encyclical, that Francis is convinced that promoting the local groups is a way to foster universal fraternity. How can we understand this claim? It is not easy to interpret this double love. One could say that all the love I give to the members of my family can't be given to strangers. And all the love I give to strangers is not given to my family. We think we have to choose where to place the balance between the two poles, because our life and our love are not infinite. Although this claim of the pope deserves an explanation, one is not given in the text itself; but such an explanation is given in the philosophical tradition shared by St. Thomas Aquinas. It is useful to mobilize St. Thomas's thought to enlighten this paradoxal assertion, because St. Thomas elaborated the notion of the common good, which is the heart of the question. Indeed, the pope just mentions, without arguing for it, that: "The common good likewise requires that we protect and love our native land 10 ." But which conce tion of the common good allows one to assert that ?

Relationship between universal fraternity and social friendship

We can start our reflection with the interpretation of the title of the encyclical. It gives a good idea of the link between local and universal in Francis's thought. Why "fraternity and social friendshi " in the subtitle of the encyclical11 ? Why not only "fraternity" ? The answer is that it would be a mistake to turn our back on local friendship in order to build global fraternity. We need both: "Universal fraternity and social friendshi are thus two inse arable and equally vital poles in every society 12 ." But further, they need each other: "A love ca able of transcending borders is the basis of what in every city and country can be called 'social friendship'. Genuine social friendship within a society makes true universal openness possible 13 ." Social friendship, in the sense of a more or less extended society, is the condition necessary for an openness to a more extended fraternity. The true universalism is grounded on particular loves in particular places: "The solution is not an openness that spurns its own richness. Just as there can be no dialogue with 'others' without a sense of our own identity, so there can be no o enness between eo les exce t on the basis of love for one's own land, one's own eo le, one's own cultural roots. I cannot truly encounter another unless I stand on firm foundations, for it is on the basis of these that I can accept the gift the other brings and in turn offer an authentic gift of my own14 ." This is why "Families are the first place where the values of love and fraternity, togetherness and sharing, concern and care for others are lived15 ". The sign of this articulation between the two poles is that the pope does not blame nationalism in itself, but only "violent nationalism16 " or "narrow forms of nationalism17 ". He does not condemn grou s or cou les, but only "closed grou s18 " and "self-absorbed couples19 ". But how is this articulation possible ? St. Thomas's thought enables us to understand the possibility of promoting universal love without condemning particular loves.

St. Thomas's conception of universal and particular

In the commentary of Aristotle's Physics, St. Thomas asserts that there are two ways to understand universal causes20 . After lectio 5, where he presents the four species of causes, he dedicates the next lectio to the modes of causality, two of which are prior or universal or common on the one hand, and posterior and proper cause on the other. Following Aristotle, St. Thomas gives the example of the doctor who treats a patient. Assuming that medicine is an art, we can say that the artisan is a prior or universal cause of health, the doctor is the posterior or proper cause. Those modes of causality can be found in each species 21 . The example of the man and the doctor is taken from the line of efficient causes, because here the man who cures is the efficient cause of health. Thomas gives an example of formal universal cause, saying that the "dia ason" (or musical interval called now called the "octave") is the effect of a formal cause, which is " ro ortio du la" (or the double ratio of the chord lengths). But " ro ortio du la" is a articular cause com ared to " ro ortio numeralis" (numerical relation), a more universal formal cause. Thomas does not give further examples, and asserts that it is the same in each species. Consequently, in final causes, we will find universal causes as well. Considering that for St. Thomas, universal and common are synonymous here 22 , and that the final cause is the good to which tends each being, 23 we can say that the common good is another name for the universal final cause 24 . Because to love, in St. Thomas's thought, signifies to be attracted to a final cause, we can say that universal love is an effect provoked by the final universal cause, by the common good. Of course, while using this key interpretation, we leave open for the moment the question of whether this universal common good is a political one. Now, we are able to ask the question raised about Francis's text in a more accurate way. To experience universal love without despising particular love means now to love the more universal common good without despising a less universal common good. But the main difficulty remains: how can the same effect be performed by two causes, one universal, and one particular ?

Two kinds of universality

Here we have to distinguish between two interpretations of "universality," because the answer will not be the same in the two cases. In the text commented on above25 , Thomas distinguishes two kinds of universality: "it must be noted, however, that the universal cause and the particular cause, and the prior cause and the posterior cause, can be taken either according to a commonness in predication, as in the example given about the doctor and the artisan, or according to a commonness in causality, as if we say the sun is a universal cause of heating, whereas fire is a proper cause 26 ." Notice that the universal in praedicando is the result of an abstraction, as in the example of the artisan and the doctor, who are numerically the same in reality, whereas a universal cause in causando is numerically different from the particular one. For example the hand, which is able to produce many kinds of effects, is not the tool, which is a particular cause of only one type of effect. In the order of universality in praedicando, we do not deal with different causes, but with different formalities in the same cause. As Ronald McArthur says: "We do not infer, by the distinction of 'artist' and 'doctor,' that there are two causes, but that the same cause is known under two formalities [START_REF] Mcarthur | Universal in praedicando, universal in causando[END_REF] ". We can easily recognize, in this type of universal, the whole abstracted from its part, which is object of a confused knowledge. Because the genus, when compared to the specific difference and the species, says in a confused way the same thing, we can say with McArthur that "the more general is the universal in praedicando, the more superficially does it explain the objects of which it is said 28 ". Consequently, "superiority, then, in the case of the universal in praedicando, is synonymous with potentiality and confusion, because the universal is less intelligible than its inferiors 29 ." We can say that the more universal a cause, the less he has an action proper to the effect. The doctor merely insofar he is an artisan has a weaker impact on health than does the doctor as such. We could put forward the idea that in this conception of universality, the existence of lower causes weakens the power of the higher. To understand that, we have to keep in mind that universal is a relative concept. Something is universal versus something else. And in the same way that artisan is more universal than doctor, but particular compared to man, we can say that the common good of the village is a more universal final cause than the common good of the family, but less universal than that of the nation. With this in mind, we can say that the causal power of the superior formality decreases as its universality increases. If one must operate as a physician, the power of the physician as a man to determine the effect is weak. Now, if one has to operate as a physician surgeon, and a surgeon specialized in dermatology, the relative power of determination of the man will be even weaker. In other words, one finds all the less trace of the cause in the effect that the cause is universal in praedicando. Consequently, the more particular causes (here specific formalities under which the agent acts) are interposed between the cause and the effect, the more the cause will be relatively universal with respect to its effect, and the more its power of determination on the effect will decrease.

It works on the opposite way in the order of universality in causando. According to St. Thomas, "the higher the cause the greater its scope and efficacy: and the more efficacious the cause, the more deeply does it penetrate into its effect, and the more remote the potentiality from which it brings that effect into act 30 ". More universality means more diversity among the effects 31 , but more universality leads also to a deeper impact in the effect. As McArthur says: "The more universal cause, therefore, not only causes more effects by a single act, but, in virtue of its power it also attains those effects more intimately and determinately than does the inferior cause. The more universal is the cause, the more is it the cause of its effects in all their determinations 32 ." And this manifests the enormous difference between the ways to conceive of the universal. As McArthur says: "this order seems to be similar to the order within our universal predicates, but the difference is really immense, for the greater extension of causality, characteristic of the more universal cause, does not mean that it is more remote or potential. It is, in fact, because of its perfection and greater actuality able to attain its effects more perfectly and intimately than does the inferior cause. If the universal causes were potential and indeterminate, as is characteristic of the universal in praedicando, the higher causes would be more remote than the inferior causes, with the result that they would attain their effects less determinately 33 ". Consequently, in the field of universal of causality, the lower cause is not an impediment for the universal one, because it is "subject to the higher cause, and takes its very determination in causing from it, so that both work per modum unius towards the production of their effect in all its determination 34 ". And because a universal is relative to the particular, it is possible to say that in the line of the universal in causando, a universal cause is in some sens more powerful thanks to particular lower causes, which proportion the universal cause to the effect, as the hand is more powerful with a hammer than without it 35 . Applying this assertion to final causes, we have to say that a more universal common good, which is nothing else than a universal final cause, is in a sense more attractive to people thanks to the intermediate common goods that also attract them 36 . This answer assumes that the commonness of the good is understood as a universal in causando.

A parallel in the line of efficient causes 30 35 The hand is, practically speaking, more powerful with a hammer than without one, but the hammer itself is an artifact, something made by the hand, so the hammer's ower comes from the hand (and the mind). Certainly we don't want to say that God is, without qualification, more powerful because of his instruments ; but we do want to say his power is in some sense more determined or focused by his creation and use of those instruments, so in that sense he is more powerful 36 For the common good as universal in causando, see Gregory Froelich, « On the Common Goods », The Aquinas Review 15 (2008): 1-28. We can have an example of this relationship between universal and particular causes in the way God governs creatures. Of course, it is in the field of efficient causes, but it will be possible to draw an analogy with the field of final causes 37 . St. Thomas asks how the same effect is from God and from a natural agent 38 . And we will ask a similar question: how a universal love can be provoked simultaneously by a universal common good and a particular one? St. Thomas first says that "it seems difficult for some people to understand how natural effects are attributed to God and to a natural agent 39 ." We already raised the same difficulty for final causes when we asserted that it is difficult to understand how our love can be attracted by the national common good and the universal common good. St Thomas says, "For it does not seem ossible for one action to roceed from two agents 40 ". For our case, we can say that it does not seem possible that our love be oriented towards two objects simultaneously without there being a certain tension or competition between these loves. St Thomas adds: "Again, when a thing can be done adequately by one agent, it is superfluous for it to be done by many; in fact, we see that nature does not do with two instruments what it can do with one. So, since the divine power is sufficient to produce natural effects, it is superfluous to use natural powers, too, for the production of the same effects. Or, if the natural power adequately produces the proper effect, it is superfluous for the divine power to act for the same effect 41 ." Applied to the line of final causes, this signifies that when a local common good is powerful enough to attract our love, it would not be necessary to assume attraction to a more universal common good. And when the universal common good is attractive, it is counterproductive for an attraction to a particular common good to intervene between individuals and this universal cause. Here is the way Thomas answers those difficulties: "In every agent, in fact, there are two things to consider: namely, the thing itself that acts, and the power by which it acts. Fire, for instance, heats by means of heat. But the power of a lower agent depends on the power of the superior agent, according as the superior agent gives this power to the lower agent whereby it may act; or preserves it; or even applies it to the action, as the artisan applies an instrument to its proper effect 42 ." If we make the analogy from the efficient causes to final causes, we find the following duality in the lower group of particular final causes: the lower final causes themselves, which cause the love of the participants, and the power by which they attract love. We can now understand better how the intermediate causes facilitate the causality of the highest cause. In the case of final causes, we can say that the local common good has a causal power, because it owes it to the more universal cause. The universal common good communicates its causal power to the particular. Another text of Thomas goes deeper into the explanation of the subordinate causes, and will give us the reason why the particular cause depends on the universal one: "Nor can the second cause by its own ower have any influence on the effect of the first cause, although it is the instrument of the first cause in regard to that effect: because an instrument is in a manner the cause of the rinci al cause's effect, not by its own form or ower, but in so far as it participates somewhat in the power of the principal cause through 37 As Thomas writes : "sicut est ordo in causis agentibus, ita etiam in causis finalibus. Ut scilicet secundarius finis a rinci ali de endeat, sicut secundarius agens a rinci ali de endet" Contra Gentiles, lib. 3 cap. 109. 38 Contra Gentiles, lib. 3 cap. 70. 39 Ibid., n. 1. 40 Ibid., n. 2. 41 Ibid., n. 3. 42 Ibid., n. 5. being moved thereby: thus the axe is the cause of the craftsman's handiwork not by its own form or power, but by the power of the craftsman who moves it so that it participates in his power 43 ."

The reason why the instrumental cause has a power on the effect, is its participation in the power of the higher cause. For our perspective, a particular common good has a causal attractive power for men in sofar as it participates in the more universal common good. Moreover, in the synthesis of his respondeo, Thomas gives the reason why the higher cause has a greater impact on the effect through the lower cause: "If, then, we consider the subsistent agent, every articular agent is immediate to its effect: but if we consider the power whereby the action is done, then the power of the higher cause is more immediate to the effect than the power of the lower cause; since the power of the lower cause is not coupled with its effect save by the power of the higher cause: wherefore it is said in De Causis (prop. i) that the power of the first cause takes the first place in the production of the effect and enters more deeply therein 44 ."

The power of the lower cause is so dependent on the power of the higher cause that we can say that when the lower cause acts, it is still the higher cause which acts through the lower. The effect remains the effect of the universal cause 45 . From this analogy with universal efficient causes in causando we can conclude that to be attracted by a local common good means to be attracted by the more universal common good by means of the local one. There is no rivalry between the particular and the universal common goods, because they are two essentially subordinated causes that, as we said, "both work per modum unius". It would be inappropriate to think that the causal action of the tool hinders or is a rival with the causal action of the craftsman. To love humanity as a whole is heroic. But to love one's neighbor, who gives a concrete appearance to humanity, is easier. The love of humanity as universal common good is easier because of less universal common goods that proportion the causality of the universal final cause to the effect. Because we are made in such a way that our knowledge always begins with the senses, we need intermediate common goods, perceptible to our faculties, in order to proportion the causal power of the more universal common good to our capacities for knowledge and love. That is why it is easier to love humanity as a whole because there is first in front of me a particular man to love. It is easier to love my country, because I have a son and a daughter who are the visible 43

De potentia, III, 7 resp.: "Nec causa secunda potest in effectum causae primae per virtutem propriam, quamvis sit instrumentum causae primae respectu illius effectus. Instrumentum enim est causa quodammodo effectus principalis causae, non per formam vel virtutem propriam, sed in quantum participat aliquid de virtute principalis causae per motum eius, sicut dolabra non est causa rei artificiatae per formam vel virtutem propriam, sed per virtutem artificis a quo movetur et eam quoquomodo participat."

It is important to prevent the reader against the reduction of all less universal cause to an instrumental cause. The universal/particular distinction is in every kind of cause (In Physic., lib. 2 l. 6 n. 2), whereas the instrumental cause is only one kind of the efficient cause ("causa adjuvans", In Physic., lib. 2 l. 5 n. 5). See Charles De Koninck. « e scandale de la m diation » (II). a al th olo i ue et philosophi ue, 15(1), 1959, p. 79. But the instrumental cause is more known for us, and makes a good pedagogical analogy to understand the relations between first and second cause. 44 De potentia, III, 7 resp. 45 The very reason of this doctrine has to be taken from the communicatio of God's goodness. Talking about the osition of those who "dicebant quod ignis non calefacit, sed Deus creat calorem in re calefacta", Thomas says: "Repugnat etiam divinae bonitati, quae sui communicativa est" (De potentia, q. 3 a. 7 co.). In this light, the false universalism of which Pope Francis speaks can be understood as a political version of occasionalism. face of my nation. It is the sense of the o e's claim: "No one can experience the true beauty of life without relating to others, without having real faces to love 46 ."

The common good in praedicando

At this step of our reasoning, we can rise a question: why do our contemporary culture have so much difficulty understanding that the love for a particular common good is not an obstacle for the love of the universal common good ? Why do we so easily make the mistake of thinking that nationalism is an obstacle to universal fraternity ? Here we have to question our conception of common good. It is necessary to remember that the harmonic articulation between the universal and particular cause is such as long as we stay in the field of universal in causando. If we understand this articulation in the field of universal in praedicando, it will not be the same. The universal cause in praedicando is as remote to the effect as there are, as it were, many intermediate causal agents. The universal cause is less powerful if there are many intermediate particular causes. In this case, the intermediate mitigates the impact of the universal cause. This is the case when we think of the common good on the pattern of a whole that would be like a mathematical sum. A sum is somewhat like an abstraction. It is a total constituted from his parts, and it abstracts from the specificity of the parts that constitute it. The common good, in this conception, is constituted a posteriori from the particular goods. It is in the field of the universal in praedicando. The common good considered to be a consequence of a mathematical addition is far from the common good as a cause of particular goods, just as a number is not a cause of its units. If it is difficult for us to understand how the particular cause can facilitate the role of the universal, it is because our conception of common good is affected by an inappropriate idea of commonness. Indeed, Charles De Koninck remarks judiciously that if this kind of mathematically common good can be called "common," it loses the characteristic of a good insofar as it is distant from its effect. About an "abstracted and quantitative conce tion of the common good", he writes: "One could believe, indeed, that the good of the highest number is also the most perfect and the most secured. Let us suppose that it is the most common, the most general: does it follows that it has more the nature of a good ? Because, provided that we talk of the common good of a political society, it has to be a good "o erable" by ourselves, a good to be realized by our own activity. […]. As soon as we are talking of a human good, it has to have the needed appeal, known practically, in order that it inclines us to action in an efficient manner 47 ".

The most universal, the less powerful to attract love: this is the characteristic of a good that would be in the line of universal in praedicando.

Political consequences

46 Fratelli tutti, §87. 47 La confédération rempart contre le grand Etat, in OEu res de Charles De Koninck, Tome II, vol. 3, Presses Universitaires de Laval, 2015, p. 85. The translation is ours: « n pourrait croire en effet ue le ien du plus rand nom re est aussi le ien commun le plus parfait et le mieu assur . Mettons u'il soit le plus commun plus général: s'ensuit-il u'il ait da anta e la nature de bien ? Car du moment que nous parlons du bien commun de la société politique, il doit être un bien « opérable » par nous-mêmes un ien réaliser grâce notre propre activité. […] Dès lors u'on parle d'un ien humain il lui faut a oir l'attrait nécessaire, connu d'une manière prati ue afin u'il nous incline l'action de façon efficace. » Now we can see the political consequences of the fact that one's love for particular causes facilitates one's love for the universal cause. An adjusted nationalism is the first consequence of the relationship between the universal and particular [START_REF]About the roots of Francis' conce tion of the nation and eo le, see Juan Carlos Scannone, « Pope Francis and the Theology of the People[END_REF] . As we have already said, the pope does not blame nationalism, but only "violent nationalism". What is a good nationalism ? It is the love of one's nation that is open to a more universal good [START_REF]This assertion follows the traditional positions of the Church. See for example Pope John Paul II, Memory and Identity : Con ersations at the Dawn of a Millennium[END_REF] . In this light we can see the nation as a particular expression of humanity [START_REF] Pierre | Metamorphoses of the city: On the western dynamic, trans[END_REF] .

Here is a question about what we call the universal common good. The validity of St Thomas' doctrine of the universal and particular does not excuse us from being aware of the specificity of the reality to which we apply this doctrine. We could assume, without examining it, that there is a continuity of nested communities from family to the global population. But the natures of those human groups are not the same. They differ not only according to their size, but according to their very "s ecies". Families and nations are actual communities, insofar as they are linked by a common culture, a common history, and a common goal. In this respect, it is difficult to be certain that the global population is an actual community, because there is no common culture, nor living together. As Aristotle says for interpersonal relations : "distance does not break off the friendshi absolutely, but only the activity of it. But if the absence is lasting, it seems actually to make men forget their friendship; hence the saying 'out of sight, out of mind'. [START_REF]Multae amicitiae dissolvuntur per hoc, quod unus alium non appellat, id est non colloquitur et convivit alteri[END_REF] " . There is no community without friendship, and no friendship without living together. Consequently, there is no global community. Pope Francis speaks in accordance with this idea when he reserves the term friendship for local interactions, and uses the word fraternity for love that transcends borders. It remains true that sound nationalism is characterised by its openness to the more universal good. But does that imply that this universal good is the common good of a community ? It would be possible to speak of community, but in an analogous way. Indeed, the brotherhood that derives from a similarity of kind (in the initial sense of family deriving from the same father) is a certain community, even if the brothers have no other relations between them than their common birth without knowing each other. In this case, the unity is made according to the anterior causes, which cannot take the place of final cause. To expect the antecedent causes to play the role of a common good is the error that we reproach to racist nationalism, and that we can reproach just as much to those who promote world citizenship in the name of an initial brotherhood of the sons of Adam. As Charles De Koninck says about nationalism: "the life of man does not consist in a return to the initial principles of his being, but in tending towards an end which is the good of his reasonable nature, and which one should not look for as rigorously preestablished in natural origins [START_REF] Koninck | La confédération, rempart contre le grand État[END_REF] ." The reason why the unity of origin cannot guarantee the existence of a harmonious political community is proposed by Charles De Koninck: "nature does not have of itself that unity which reason can achieve. As we see so clearly in animals, equilibrium in nature depends on the play of opposites. If fish could not swallow each other, and the beasts of the jungle devour each other, this animal life would soon be exterminated. A similar contrariety exists everywhere in nature. It is therefore not by turning back to nature alone that we can achieve harmony between nations [START_REF] Koninck | This argument presupposes the Aristotelian theme, recurrent in the Quebec philosopher, of reason[END_REF] ". Here we have to be reminded that the common good is a broad notion, and is certainly applicable to political realities, but not only to such. The common good of humanity is not necessarily the common good of a political community. 2. The second is the relationshi between "universal destination of created goods 54 " and private property. In Fratelli Tutti, as in the continuity of the magisterium on the social doctrine of the Church, the pope recalls "the social purpose of all forms of private property 55 " according to the principle of the universal destination of goods 56 , formulated in Gaudium et Spes [START_REF]God intended the earth with everything contained in it for the use of all human beings and peoples[END_REF] in accordance with the Thomistic conception of private property [START_REF] Thomas | [END_REF] . The doctrine of the relationship between the universal and the particular as set out above sheds a fruitful light on the relationship between private property and the universal destination of goods, because if the particular good would be an obstacle towards universal, it would be inappropriate to promote private property. In the light of St. Thomas's doctrine, we can assert that the universal destination of goods will not be hindered by the promotion of private property. Indeed, to possess something in particular does not signify that this material thing is only for me. We can say that "to be mine" is not the same as "to be for me". On the contrary, I make it mine in order that it can be for all. The way the o e justifies the love of one's country from the theme of the universal destination of goods is original in the magisterium: "Everyone loves and cares for his or her native land and village, just as they love and care for their home and are personally responsible for its upkeep. The common good likewise requires that we protect and love our native land. Otherwise, the consequences of a disaster in one country will end up affecting the entire planet. All this brings out the positive meaning of the right to property: I care for and cultivate something that I possess, in such a way that it can contribute to the good of all 59 ." The universal common good requires that everyone takes care of a particular place. The love of a particular place is the concrete means to the love of all. 3. The doctrine of the universal and particular explains also how the work towards universal fraternity should not eliminate the differences between local cultures and identities. For the pope, unity is not uniformity 60 . Indeed, we could easily think that local identities are hindrances to a universal fraternity. But in the light of the proper relationship between the universal and particular, it is possible to understand how a diversity of cultures is a precondition for an expanded fraternity. The universal common good needs particular cultures to proportion its power of attraction to each people. In the commentary of the Politics of Aristotle, St. Thomas explains Aristotle's criticism of Plato's theory about the unity of the city. First, he presents Socrates's reasoning: "Socrates supposed as a principle, as it were, that it was best that the political community should be as unified as possible. And so he wanted all things, even sons and wives, to be common, so that citizens were united with one another to the greatest extent 61 ." For St. Thomas commenting on Aristotle, there are two ways of understanding unity. It can be either unicity or similarity. In both cases, Aristotle gives objections, but those directed against a city's unity as similarity will interest us. St. Thomas reports the three reasons Aristotle gives, the third is as follows: "the things out of which it is necessary to make a erfect thing differ in kind. And so we find that every perfect whole in things of nature is composed of parts different in kind (e.g., human beings of flesh, bones, and nerves). But every whole composed of parts of the same kind (e.g., air, water, and other purely material substances) is imperfect in the way of nature. And so it is clear that a political community, since it is a perfect whole, needs to consist of parts dissimilar in species [START_REF]Ea ex quibus oportet unum aliquid perfectum fieri, differunt specie unde omne totum perfectum in rebus naturalibus invenitur esse constitutum ex partibus diversis secundum speciem; ut homo ex carnibus, ossibus et nervis. Totum vero quod componitur ex partibus eiusdem speciei est imperfectum in genere naturae, sicut aer et aqua et alia inanimata corpora. Unde manifestum est quod, cum civitas sit quoddam totum perfectum, oportet quod consistat ex partibus dissimilibus secundum speciem[END_REF] ". The perfection of a whole consists in the diversity of its parts. Likewise, then, the perfection of the human world consists in the diversity of cultures [START_REF]In efence of St Thomas, A re ly to Father Eschmann's Attack on The rimacy of the common good[END_REF] . If we consider that the perfection of the whole is the universal common good, we can say that its causal attractive power can be fostered better through the diversity of particular common goods. The variety of effects of the common good is a sign of its universality. The perfection of a common good is measured less by the quantity of effects produced than by their specific diversity. This conce tual context enlightens the Po e's blame against "One model of globalization" which "in fact 'consciously aims at a one-dimensional uniformity and seeks to eliminate all differences and traditions in a su erficial quest for unity… If a certain kind of globalization claims to make everyone uniform, to level everyone out, that globalization destroys the rich gifts and uniqueness of each person and each people'. This false universalism ends up depriving the world of its various colours, its beauty and, ultimately, its humanity 64 ." The heterogeneity of local cultures is not the sign of an imperfection of the universal common good; on the contrary, it results from its perfection.

Conclusion

In some sentences the style of Pope Francis can sound disruptive and far from the Magisterium's traditional manner of expression. But we have shown that on the main subject 65 of Fratelli Tutti, the o e's thought a ears rooted in the Thomistic tradition. Sound nationalism, the universal destination of goods, and cultural diversities depends on a fair conception of the relationship between universal and particular causes in Thomas' writings.

Those political conceptions lean against an adequate theory of intermediate causes that provide a structure to the natural order, and such theory is specific to the genuine Catholic natural philosophy. The text of the pope, despite the sometimes confusing wording, remains rooted in this tradition. It endorses the principles of this natural philosophy and uses it to apply the traditional principles to the Res novae of the twenty-first century.

  "Quanto enim aliqua causa est altior, tanto est communior et efficacior, et quanto est efficacior, tanto profundius ingreditur in effectum, et de remotiori potentia ipsum reducit in actum."

	(St.	Thomas,
	Quaestiones disputatae de potentia, q. 3, a. 7, corpus.)
	31 See also S. Thomae Aquinatis, In duodecim libros Metaphysicorum Aristotelis exposition, Ed. M. R. Cathala,
	R. M. Spiazzi, 2ª ed.: Marietti, Taurini-Romae, 1971, lib. 6 l. 3 n. 15.
	32 McArthur, op. cit., p. 73-74.
	33 Ibid., p. 73.
	34 Ibid., 73-74.

Ibid., §50.

Ibid., §142.

Ibid., §51.

Ibid., §53.

Ibid., §143.

"Sulla fraternit e l'amicizia sociale".

Ibid., §142.

Ibid., §99. Cf. §154: "The development of a global community of fraternity based on the practice of social friendshi on the art of eo les and nations calls for a better kind of olitics".

Ibid., §143.

Ibid., §114.

Ibid., §86.

Ibid., §141.

Ibid., §89.

Ibid.

St. Thomas, Commentaria in octo libros Physicorum Aristotelis, lib. 2 l. 6 n. 3. All references of the quotes from St. Thomas are from https://www.corpusthomisticum.org/.

Ibid. Lect. 6 n. 2.

For example, in the case of the artisan and the doctor, artisan is "communior et prior". Ibid., n. 2.

See Ibid., lib. 2 l. 5 n. 11. And "id autem ad quod tendit actio agentis, dicitur causa finalis." (Ibid., lib. 2 l. 10 n. 15); "bonum est quod omnia appetunt." (St. Thomas, Quaestiones disputatae de veritate, q. 1 a. 1 co.)

Here it is necessary to understand the common good in a broad sense, which transcends the merely political application of the concept. For recent insights on the common good as final cause, see Aquinas Guilbeau, Charles De Koninck's Defense of the Primacy of the Common Good, Doctoral thesis, University of Fribourg (Switzerland), 2016, p. 140.

In Physic., lib. 2 l. 5.

"Advertendum est autem quod causa universalis et propria, vel prior et posterior, potest accipi aut secundum communitatem praedicationis, secundum exempla hic posita de medico et artifice; vel secundum communitatem causalitatis, ut si dicamus solem esse causam universalem calefactionis, ignem vero causam propria". Ibid., lib.