Normann Bu

Estíbaliz Decker

Aina Fraca

He Frau

Lue Huang

Jakub Huang

Yusuke Kallas

Polyvios Kawamoto

Feifei Kosmatos

Jiagui Liang

Sergey Liu

Sosuke Lozenko

David Mizusaki

Elie Montoya

Martín Rached

Zhongwei Rais

Mario Tang

Yao Vega

Tibor Wang

I Zavadil

CROUS for providing food and housing

A B S T R A C T

Humans make mistakes, especially when faced to complex tasks, such as the construction of modern hardware or software. This thesis focuses on machine-assisted techniques to guarantee that computers behave correctly.

Modern computer systems are large and complex. Automated formal verification stands as an alternative to testing or simulation to ensuring their reliability. It essentially proposes to employ computers to exhaustively check the system behavior. Unfortunately, automated verification suffers from the state-space explosion problem: even relatively small systems can reach a huge number of states. Using the right representation for the system behavior seems to be a key step to tackle the inherent complexity of the problems that automated verification solves.

The verification of concurrent systems poses additional issues, as their analysis requires to evaluate, conceptually, all possible execution orders of their concurrent actions. Petri net unfoldings are a well-established verification technique for concurrent systems. They represent behavior by partial orders, which not only is natural but also efficient for automatic verification.

This dissertation focuses on the verification of concurrent systems, employing Petri nets to formalize them, and studies two prominent verification techniques: model checking and fault diagnosis.

We investigate the unfoldings of Petri nets extended with read arcs. The unfoldings of these so-called contextual nets seem to be a better representation for systems exhibiting concurrent read access to shared resources: they can be exponentially smaller than conventional unfoldings on these cases.

Theoretical and practical contributions are made. We first study the construction of contextual unfoldings, introducing algorithms and data structures that enable their efficient computation. We integrate contextual unfoldings with merged processes, another representation of concurrent behavior that alleviates the explosion caused by non-determinism. The resulting structure, called contextual merged processes, is often orders of magnitude smaller than unfoldings, as we experimentally demonstrate.

Next, we develop verification techniques based on unfoldings. We define SAT encodings for the reachability problem in contextual unfoldings, thus solving the problem of detecting cycles of asymmetric conflict. Also, an unfolding-based decision procedure for fault diagnosis under fairness constraints is presented, in this case only for conventional unfoldings.

Finally, we implement our verification algorithms, aiming at producing a competitive model checker intended to handle realistic benchmarks. We subsequently evaluate our methods over a standard set of benchmarks and compare them with existing unfolding-based techniques. The experiments demonstrate that reachability checking based on contextual unfoldings outperforms existing techniques on a wide number of cases.

This suggests that contextual unfoldings, and asymmetric event structures in general, have a rightful place in research on concurrency, also from an efficiency point of view.

iii R É S U M É L'être humain fait des erreurs, en particulier dans la réalisation de taches complexes comme la construction des systèmes informatiques modernes. Nous nous intéresserons dans cette thèse à la vérification assistée par ordinateur du bon fonctionnement des systèmes informatiques.

Les systèmes informatiques actuels sont de grande complexité. Afin de garantir leur fiabilité, la vérification automatique est une alternative au testing et à la simulation. Elle propose d'utiliser des ordinateurs pour explorer exhaustivement l'ensemble des états du système, ce qui est problématique: même des systèmes assez simples peuvent atteindre un grand nombre d'états. L'utilisation des bonnes représentations des espaces d'états est essentielle pour surmonter la complexité des problèmes posés en vérification automatique.

La vérification des systèmes concurrents amène des difficultés additionnelles, car l'analyse doit, en principe, examiner tous les ordres possibles d'exécution des actions concurrentes. Le dépliage des réseaux de Petri est une technique largement étudiée pour la vérification des systèmes concurrents. Il représentent l'espace d'états du système par un ordre partiel, ce qui se révèle aussi naturel qu'efficace pour la vérification automatique.

Nous nous intéressons à la vérification des systèmes concurrents modélisés par des réseaux de Petri, en étudiant deux techniques remarquables de vérification: le model checking et le diagnostic.

Nous étudions les dépliages des réseaux de Petri étendus avec des arcs de lecture. Ces dépliages, aussi appelés dépliages contextuels, semblent être une meilleure représentation des systèmes contenant des actions concurrentes qui lisent des ressources partagées : ils peuvent être exponentiellement plus compacts dans ces cas.

Ce travail contient des contributions théoriques et pratiques. Dans un premier temps, nous étudions la construction des dépliages contextuels, en proposant des algorithmes et des structures de données pour leur construction efficace. Nous combinons les dépliages contextuels avec les merged process, une autre représentation des systèmes concurrents qui contourne l'explosion d'états dérivée du non-déterminisme. Cette nouvelle structure, appelée contextual merged process, est souvent exponentiellement plus compacte, ce que nous montrons expérimentalement.

Ensuite, nous nous intéressons à la vérification à l'aide des dépliages contextuels. Nous traduisons vers SAT le problème d'atteignabilité des dépliages contextuels, en abordant les problèmes issus des cycles de conflit asymétrique. Nous introduisons également une méthode de diagnostic avec des hypothèses d'équité, cette fois pour des dépliages ordinaires.

Enfin, nous implémentons ces algorithmes dans le but de produire un outil de vérification compétitif et robuste. L'évaluation de nos méthodes sur un ensemble d'exemples standards, et leur comparaison avec des techniques issues des dépliages ordinaires, montrent que la vérification avec des dépliages contextuels est plus efficace que les techniques existantes dans de nombreux cas.

Ceci suggère que les dépliages contextuels, et les structures d'évènements asymétriques en général, méritent une place légitime dans la recherche en concurrence, également du point de vu de leur efficacité.

A C K N O W L E D G M E N T S

I am indebted with Stefan Schwoon, who kindly accepted to be my advisor during both my Ph.D and Master thesis. For his generous time and dedication, for the many insights about unfoldings I learnt from him, and for the patience, support, enthusiasm, freedom, and pedagogy he applied in his guidance, I express to him my deepest gratitude. I extend this acknowledgement to Stefan Haar, who either as the garant of this thesis or as a co-author, played an essential rôle in making this research possible, proposing interesting questions and offering help whenever it was necessary.

I sincerely thank the reviewers and jury members: Keijo Heljanko and Maciej Koutny for accepting reviewing this manuscript and for their comments on it; and Fabrice Kordon and Jiri Srba for the time they have kindly employed for me.

ENS de Cachan, Fundación Caja Madrid, and INRIA generously provided the necessary financial support, and they are gratefully acknowledged.

I am particularly thankful to Paolo Baldan and Victor Khomenko, who always found time for replying mail and collaborated in many ways with me. Working with you was a pleasure. Victor hosted me during a visit to Newcastle University in February 2013, this was a very profitable time and I heartedly thank him. I am also thankful to Thomas Chatain for many discussions about research or teaching, and Javier Esparza for some inspiring conversations.

My interest in formal methods originates from previous work in the Space Research Group (SRG) at University of Alcalá (Spain). There, I had the luck of collaborating in the actual development of embedded software for the satellite Nanosat 1B, now in orbit. I warmly thank my advisor at SRG, Óscar R. Polo, for the freedom and support he offered me to pursue my own goals. I also thank Paul Gastin for having wisely guided my first steps in formal verification; Ocan Sankur and Aiswarya Cyriac were also important persons those days.

Many people from LSV (and LSV groupies) contributed to making these last three years a wonderful experience. I want to thank Hernán Ponce de León for helping to cope with the rainy weather of Paris. . . and for many discussions about unfoldings. Mahsa Shirmohammadi, Vincent Cheval, and Sinem Kavak always managed to propose a gathering around some eastern delights, they will be much missed. Guillaume Scerri kindly revised fragments of this document. I also thank Benoît Barbot for the many good moments we shared while teaching the course on network programming; Benedikt Bollig and Erwing Fang for all those coffee talks; Christoph Haase for his good advices when applying for my post-doc; and the administrative and systems team for making my life so much easier.

Outside LSV, I was very lucky to count on many friends to make these years enriching and worth remembering. They know who they are, and I thank all of them. Here it goes an incomplete list: Etienne Boisseau, Tong

I N T R O D U C T I O N

Since the advent of affordable digital computers, three decades ago, the complexity of hardware and software devices has grown without pause, and there is no reason to think that this will naturally stop in a near future. As systems grow in complexity, so does the difficulty to construct them, and consequently the likelihood that subtle errors remain undetected in the final product. Our modern society is increasingly dependent on computers, and this tendency is likely to hold for long time. We need, in summary, adequate methods for constructing complex and reliable computer-based systems.

Reliability is paramount in safety-critical systems, customarily defined as those whose malfunction may result in risks for human life, environmental damage, or substantial economic loss [START_REF] Knight | Safety critical systems: challenges and directions[END_REF]. Well known examples are avionics, nuclear-power plants, oil refineries, traffic control systems, spacecrafts, and medical or military equipment.

Reliability is also important for non-critical systems. Any unreliable system often has negative economic consequences for the manufacturer. For instance, a faulty smartphone may substantially decrease the sales and turn the market attention to the competing vendor.

Testing and simulation are two methods to improve reliability. They are very effective at least on the early stages of the development. However, testing or simulation explore some of the possible behaviors. They can only show the existence of errors, not the absence thereof. It is often claimed that testing can in the best case achieve systems whose failure rate oscillates around 10 -4 or 10 -5 failures per hour of operation [START_REF] Bishop | Does Software Have to Be Ultra Reliable in Safety Critical Systems?[END_REF]. This is insufficient for certain applications. Failure rates for avionics, for instance, are often required to be under 10 -9 , a figure thousands of times more stringent than what testing seems to offer.

In the last decades, formal verification has been suggested as an effective means of improving reliability. Unlike testing, formal verification examines all behaviors of the system and compares them to a formal specification, which distinguishes the good behaviors from the faulty ones. If the system is declared correct, formal verification has established a mathematically rigorous proof that the system is free from all faults described by the specification. Otherwise, depending on the particular technique used, one obtains some level of evidence that the system contains an error.

Observe that formal verification cannot guarantee absolute correctness, it only ensures the system to be as correct as the specification is. It can, however, effectively reveal very subtle errors that may otherwise go undetected if only testing or simulation was used.

Formal verification encompasses a number of methods for proving correctness. Two well-established ones are theorem proving [START_REF] Bertot | Interactive Theorem Proving and Program Development -Coq'Art: The Calculus of Inductive Constructions[END_REF] and model checking [START_REF] Clarke | Model Checking[END_REF], both of which are machine-assisted. In theorem proving, a number of proof obligations are generated from the specification and the implementation. These are formal statements whose validity entails the correctness of the system. Assisted by the theorem prover, the user constructs the proof of each obligation, either interactively or in a highly automated way, depending on the capabilities of the method used. A shortcoming of theorem proving is that it often requires substantial interaction of the user.

In contrast, model checking is a fully automatic technique. Here, a computer exhaustively explores all possible execution paths that the system could follow, and checks compliance with the specification for each of them. If the search terminates without finding any error, model checking has established a formal argument proving the system correct with respect to the specification. If not, an execution path that falsifies the specification is shown to the user, which often is highly valuable to fix the problem.

Asserting validity of the specification thus requires reasoning about the potentially intractably many possible ways in which the system reacts. Even very small systems contain a huge number of execution paths. The statespace explosion (SSE) problem refers to the computational difficulty of performing this analysis automatically, and is one of the main obstacles hindering the adoption of model checking in practice.

For certain applications, even formal verification is unable to provide the required reliability. This is the case, e.g., in ultra-critical systems [START_REF] Pike | Runtime Verification for Ultra-Critical Systems[END_REF]. Recall that formal methods cannot guarantee absolute reliability. What if the formal specification was wrong? Also, formal verification often makes assumptions that may be hard to guarantee. Software verification, for instance, guarantee that a program is logically correct provided that the CPU or memory behave as expected, which in some harsh environments such as outer space one cannot really assume.

Complementary techniques have been proposed to mitigate the consequences of faults dynamically, while the system runs. Among them one finds runtime verification [START_REF] Leucker | A brief account of runtime verification[END_REF], fault tolerance [START_REF] Avižienis | Design of fault-tolerant computers[END_REF], or fault diagnosis [START_REF] Sampath | Diagnosability of discrete-event systems[END_REF]. The latter is specially useful when limited information of the system execution is available. For instance, the system could be a large telecommunication network with links and nodes that can fail at any moment, where only restricted or even outdated state information of them is known at every time. Fault diagnosis monitors a system in execution and infers which states the system could currently be in, and more specifically, whether a fault may have happened, or will inevitably happen.

Despite its clear benefits, formal verification is still far from being fully integrated into mainstream industrial practice, specially for the development of software. A number of causes have been identified [START_REF] Bowen | An Invitation to Formal Methods[END_REF][START_REF] Lorge | Really Rethinking 'Formal Methods[END_REF][START_REF] Wassyng | Who Are We, and What Are We Doing Here?[END_REF], among which we cite: Thus foundational work aiming at more efficient algorithms for the automated verification of systems and the development of robust tools supporting these methods address at least two of the causes above. This dissertation makes foundational and practical contributions to model checking and fault diagnosis. We present algorithms for reducing the internal representation of a system that model checkers or fault diagnosers need to construct during the analysis. Furthermore, we implement our model checking algorithms into the Cunf Toolset, a robust model checker intended to handle realistic examples.

We focus on the verification and diagnosis of concurrent systems.

automated verification of concurrent systems

Two actions are said to be concurrent when they are executed simultaneously.

A concurrent system is one which performs concurrent actions. Verification techniques for concurrent systems need to deal with the additional complexity introduced by concurrency. If two concurrent actions a and b are present, the analysis needs to explore, in principle, the execution paths where a happens before b, or b before a, or even when a and b happen at the same time. If n concurrent actions are present, the number of execution paths grows exponentially with n. Concurrency is a well known source of SSE for automated verification techniques, including model checking and fault diagnosis.

In model checking of concurrent systems, existing approaches to mitigate the SSE problem can mainly be classified as symbolic or partial-order methods. Ordinarily, model checking explicitly generates and explores each possible state that the system under analysis could enter. In contrast, symbolic model checking explores and manipulates sets of reachable states represented implicitly, or symbolically, e.g., as the solutions of a Boolean formula. Symbolic model checking was introduced by Ken McMillan [START_REF] Burch | Symbolic model checking: 10 20 states and beyond[END_REF][START_REF] Kenneth | Symbolic model checking[END_REF], who proposed to use binary decision diagrams (BDDs) [START_REF] Bryant | Graph-Based Algorithms for Boolean Function Manipulation[END_REF] as a symbolic, more abstract, representation for sets of states. BDDs seem to exploit very well the regularity of synchronous digital circuits, making symbolic model checking with BDDs a very successful technique for the verification of hardware.

Partial-order methods encompasses two families of techniques of similar nature that are often presented quite differently. On the one hand we have partial-order reduction techniques, such as stubborn sets, persistent sets, and ample sets, see [START_REF] Valmari | The State Explosion Problem[END_REF]. They work by classifying all execution paths of the system according to some equivalence relation such that all paths in each equivalence class either satisfy or falsify the property. Then, they explore at least one path on each equivalence class, thus potentially avoiding the exploration of many equivalent paths. In this sense, these techniques can also be described as model checking using representatives [START_REF] Peled | All from one, one for all: on model checking using representatives[END_REF].

On the other hand we have methods issued from partial-order semantics of the modelling language. Here, the system is transformed into a set of events partially ordered by a precedence relation. Concurrent actions are represented as unordered events, and execution paths correspond to precedenceclosed sets of events. Importantly, every such set symbolically represents many execution paths, a fact that the model checker uses to avoid individually generating each of them. This manuscript develops model checking methods based on partial-order semantics, we come back to them in the next section.

Similarly, fault diagnosis faces the SSE problem due to concurrency. A prominent approach based on partial-order semantics has been proposed by Benveniste et al. [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF]. As before, the technique constructs a partialorder representation of the system upon which the reasoning is performed. This thesis contributes with a generalization and extension of this method.

Both model checking and fault diagnosis assume that a model of the system is given as input to the verification procedure. Well-established general models for concurrent systems are process algebras [START_REF] Baeten | A brief history of process algebra[END_REF] and Petri nets [START_REF] Reisig | Understanding petri nets modeling techniques, analysis methods, case studies[END_REF]. Process algebras, or process calculi, are formal languages whose modelling primitives focus on expressing the interaction between the different agents, or processes, that compose the system. A process algebra provides algebraic laws making possible to analyze and transform system mod- els using equational reasoning. The three most well-known process algebras are CCS, CSP, and ACP; many variants of them appear in the literature, see [START_REF] Baeten | A brief history of process algebra[END_REF]. Petri nets are both a graphical and formal notation for modelling systems, and they will be the specification language for the methods developed in this thesis.

petri nets and non-sequential semantics

Petri nets [START_REF] Reisig | Understanding petri nets modeling techniques, analysis methods, case studies[END_REF] are a formal notation to represent, manipulate, and reason about concurrent systems. Because they are general models of concurrency, their study is the study of the principles underlying diverse classes of systems. While Petri nets were invented by Carl Adam Petri at the age of 13 [START_REF] Adam | Petri net[END_REF], the first semi-formal notations for them appeared on his thesis [START_REF] Adam | Communication with automata[END_REF].

Figure 1 shows the graphical representation of a Petri net. This net models a system with two components that operate in mutual exclusion, as it will be clear shortly. Petri nets are composed of three kinds of elements: places, depicted as circles, transitions, depicted as boxes, and arcs, which can only link places to transitions and vice versa, but never transitions to transitions or places to places. Certain places, idle 1 and idle 2 in our example, are depicted with a dot inside. Such dots are called tokens. The preset of a transition is the set of places from which there is an arc to the transition; the postset is the set of those reached by an arc originating at the transition.

Petri net can be given essentially two kinds of semantics, so called sequential and non-sequential. A third kind of semantics, so called step semantics can basically be derived from non-sequential semantics.

We recall now the sequential semantics of Petri nets. A state of the net, or marking, is an assignment of tokens to places. The initial marking is the one often depicted with the net: in Fig. 1, it is the marking that assigns one token to idle 1 , idle 2 , and mutex, and zero to the remaining places. From a marking, one may fire a transition and reach a new marking, provided that the transition is enabled by the first marking. A transition is enabled at a marking if the latter assigns at least one token to each place in the preset of the transition. For instance, the initial marking in Fig. 1 enables start 1 and start 2 , but not enter 1 , as there is no token in waiting 1 . Firing any enabled transition consumes one token in places of the preset and produces one token for the places in the postset. In the example, firing start 1 produces a new marking that assigns one token to waiting 1 , zero to idle 1 , and leaves remaining places as they were on the initial marking. In this new marking, both enter 1 , and start 2 are enabled and may be fired, again producing new markings. Any sequence of transitions that can be fired from the initial marking is called a firing sequence or run, and the last marking it produces is said to be reachable.

Finally, the reachability graph of the net is a directed, edge-labelled graph whose vertices are the reachable markings and such that there is an edge labelled by a transition t between a marking m and m ′ if and only if t is enabled at m and, after firing, produces m ′ . Clearly, the firing sequences of the net correspond to paths on the reachability graph starting from the initial marking. The reachability graph is often referred as the state space of the net.

It should now be clear that Fig. 1 represents a mutual exclusion algorithm for two parties, 1 and 2. Initially, any of the parties can execute start i , reaching a marking where at most one can execute enter i . This is because both enter 1 and enter 2 consume the token in mutex. So only after the party which manages to enter the critical section executes the corresponding exit transition, putting back the token in the mutex, will the other party be able to enter the critical section.

The literature of Petri nets contains many extensions to this basic formulation. Examples are time Petri nets, coloured nets, nets with inhibitor arcs, nets with read arcs, etc. The latter ones will be specially relevant in this work.

Sequential semantics, then, associate every net with a set of firing sequences, or alternatively, a directed graph that represent all reachable markings. A firing sequence imposes a total order on the transition occurrences and, as such, implicitly assumes the existence of a global time that marks the order of occurrence. Non-sequential semantics eliminate this assumption and order transition occurrences, also called events, not by their time of occurrence, but by their relative causal or precedence relations. For instance, any occurrence of the transition writing 1 is always preceded by another one of start 1 . In contrast, the two events corresponding to firing start 1 and start 2 after the initial marking are concurrent, causally unrelated, they can happen in any order without one affecting the other.

Replacing the total ordering of time by the relative precedences between transition occurrences induces a partial ordering of events. In it, concurrent events necessarily appear unordered.

Historically, the non-sequential semantics of Petri nets settled in two steps, see [START_REF] Esparza | A False History of True Concurrency: From Petri to Tools[END_REF]. Petri himself defined non-sequential processes [START_REF] Adam | Non-sequential Processes[END_REF], the notion corresponding to sequential runs in the realm of partial-order semantics. A process represents a partially-ordered run, where precedence-unrelated events may happen in any order. Any linear extension of the precedence order yields a sequential run.

Figure 2 (a), (b), (c), and (d) show four different processes of the net in Fig. 1. Processes are actually represented as acyclic Petri nets instead of partial orders of events, but this is only a technical matter. For instance, (b) corresponds to the sequential run start 1 , start 2 , enter 1 , but also to the same run if we invert the first two transitions. Conceptually, (b) represents a concurrent run where both parties intend to enter the critical section, but only the first enters, no matter in which order they interleave their actions.

The second step was to fuse the common parts of all processes of the net, into an object called unfolding. The unfolding is conceptually equivalent to the computation tree in sequential semantics, it binds together all processes and branches where executions diverge into different futures. This notion first appeared, with a different name, in [START_REF] Nielsen | Petri nets, event structures and domains, part I[END_REF].

Figure 2 (e) shows the unfolding of Fig. 1. Actually, the unfolding of Fig. 1 is infinite: since an infinite sequential execution is possible in the net, the unfolding contains an infinite branch. So (e) only shows a prefix of the unfolding. Observe that all processes shown in Fig. 2 prefix, and that they share, roughly speaking, the events that are common to multiple processes. Given a net, many natural questions can be posed, such as: (reachability) is a given marking reachable on the net? or, (deadlock-freeness) is it possible to reach a marking that enables no transition? Observe that the second question actually reduces to the first. Similarly, many verification questions reduced to the reachability problem. Answers to them can, theoretically, be found by looking into any of the two semantics presented here. But in practice, it will be more interesting to use non-sequential semantics, as we explain now.

unfoldings for verification

Model checking was invented independently by two groups in the beginning of the 80s [CE82; QS82], see [START_REF] Clarke | The Birth of Model Checking[END_REF]. It introduced a different regard for semantics. While semantics were, and still are, a mathematical object of interest in capturing the precise meaning of programs, model checking suggested to compute them as a means to explore the reachable states of the system. Model checking suffered from the SSE problem, one of the sources was concurrency, as explained above. The non-sequential semantics of Petri nets had been developed from the late 70s, providing not only an adequate representation of concurrency, but also a concise one, in the form of a partial order. The time was ripe and Ken McMillan made the key contribution [START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF][START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF]. He proposed an algorithm to construct and prune the infinite unfolding of a bounded1 net into a finite unfolding prefix that still represented complete reachability information about the system.

Figure 3 shows the finite and complete unfolding prefix constructed by McMillan's algorithm from the net shown in Fig. 1. The events crossed out are the pruning points that the algorithm chooses, called cutoffs in the literature. Cutoffs are chosen in a way such that they prune all potentially infinite branches, but late enough to preserve in the prefix all reachable states of the system. Observe that this prefix is actually a prefix of Fig. 2 (e).

While complete unfolding prefixes are in general larger than the original net, they are usually much smaller than the reachability graph, effectively palliating the SSE problem derived from concurrency. Consider again Fig. 1. Exploring the states reached by all interleavings of the transitions start 1 and start 2 requires visiting four states. With n participants in the mutual exclusion, we would have 2 n states. However, the unfolding would just include n concurrent events, as shown in Fig. 3 for n = 2. Although McMillan's algorithm usually builds very compact unfolding prefixes, it may also produce prefixes larger than the reachability graph. Subsequent work [START_REF] Esparza | An improvement of McMillan's unfolding algorithm[END_REF][START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF] addressed this, essentially improving the pruning algorithm so that the resulting prefix was never larger than the state space of the net.

From the perspective of complexity, unfoldings provide an interesting trade-off between space and time. While checking for deadlock-freeness or reachability on a bounded Petri net are PSPACE-complete problems on the net, they are only NP-complete when a complete unfolding prefix is on the input. Naturally, such prefix may be exponentially larger than the net, but never larger (and often much smaller) than the reachability graph, where these problems can be solved in linear time.

Unfortunately, concurrency is not the only source of SSE in automatic verification. An important source are sequences of choices. For example, the smallest complete prefix of the Petri net in Fig. 4 is exponential in its size (as big as the state space) since no event can be declared a cutoff -intuitively, each reachable marking remembers its past, and so different runs cannot lead to the same marking.

Recently, a technique addressing this source of SSE emerged. In [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF], a new condensed representation of Petri net behavior called merged processes (MPs) was proposed, which copes not only with concurrency, but also with sequences of choices. The main idea behind MPs is to fuse some nodes in the unfolding prefix, and use the result as the basis for verification. Moreover, MPs are sufficiently similar to unfoldings so that a large body of results developed for them can be re-used.

Another important source of SSE are concurrent read accesses, that is, multiple actions requiring non-exclusive access to a shared resource, as we explain in the next section.

contextual net unfoldings

Assume that we want to model a system that has two concurrent actions, a and b, which need to test that some resource r is available for them to proceed. The resource could represent, for instance, a logical condition that a third concurrent component may independently enable or disable.

A Petri net modelling this system could be that shown in Fig. 5 (a). The only possibility for modelling the reading, or testing operation is by means of the depicted consume-produce loops. However, this is not entirely satisfactory. Actions a and b are supposed to be truly concurrent but they are not: the loops serialize the access to r, rather modelling a system where a and b acquire and return the right to access r. The problem lies in the fact that the modelling primitives of Petri nets can only express consuming and producing.

A solution is to incorporate read arcs into Petri nets, which results in the net shown in Fig. 5 (b). Read arcs are the undirected (red) lines between r and a or b. Petri nets with read arcs are called contextual nets [START_REF] Montanari | Contextual nets[END_REF] and, like ordinary Petri nets, have been given sequential, step, and non-sequential semantics [JK93; JK95; MR95; BP96; VSY98; GM98; BCM01]. Under sequential semantics, the nets in Fig. 5 (a) and (b) are completely equivalent. However, their step semantics authorize firing {a, b} in (b) while such step can only be emulated by interleaving in (a).

While faithful modelling of concurrency is important, it is not the central subject of this dissertation.

Consider the unfolding semantics of Fig. 5 The PR-encoding duplicates n times a resource with n readers, and each reader obtains a private copy which is accessed with a consume-produce loop. Although smaller than (d), the resulting unfolding (f) is still exponential in n.

Thus the unfolding of a contextual net can be exponentially more compact than that of an equivalent ordinary Petri nets, when the system contains concurrent read-access actions. One goal of this thesis is proving that automated verification based on contextual unfoldings improves existing methods based on ordinary unfoldings.

Concurrent read access naturally arise in many practical applications, and would benefit from verification methods based on contextual unfoldings. Contextual nets have been used, e.g., to model concurrent database access [START_REF] Ristori | Modelling Systems with Shared Resources via Petri Nets[END_REF], concurrent constraint programs [START_REF] Montanari | Contextual occurrence nets and concurrent constraint programming[END_REF], priorities [START_REF] Janicki | Invariant Semantics of Nets with Inhibitor Arcs[END_REF], and asynchronous circuits [START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF]. We highlight the following applications:

• Distributed algorithms. For instance, mutual exclusion protocols, such as those by Dijkstra and Dekker, use a number of state variables per process, which the other concurrent processes read in order to synchronize adequately. Verification of mutual exclusion protocols, and other distributed algorithms that need to read state could be an important application of c-net unfoldings. We provide a case study in Ch. 7.

t 2 t 1 (c) t 1 t 2 (b) t 1 t 2 (a)
Figure 6: Three contextual nets where different step semantics found in the literature disagree on accepting the step {t 1 , t 2 }. While the properties and construction of ordinary Petri net unfoldings are well-understood, research on how to construct and exploit contextual unfoldings for automated verification has been lacking so far. The rest of this section reviews the literature on contextual nets upon which this work stands.

Contextual nets have been proposed by Montanari and Rossi in [START_REF] Montanari | Contextual nets[END_REF], although the notion of read arc had already been discussed before [AF73; Pet81; JK91; JK93; CH93], in many cases under a different name, such as test arc or activator arc.

The step semantics of contextual nets can be grouped in two different schools, essentially distinguished by the steps that they assign to the nets in Fig. 6, see [START_REF] Vogler | Partial order semantics and read arcs[END_REF]. While all considered semantics agree on allowing the step {t 1 , t 2 } for (a), they disagree on (b) and (c). If, for instance, transition occurrences are viewed as activities taking time, then {t 1 , t 2 } should be also a step of (b) and (c), as it can in fact be observed if t 1 and t 2 start at the same time. In [START_REF] Janicki | Semantics of Inhibitor Nets[END_REF], Janicki and Koutny develop step semantics under this notion of observation. In contrast, Montanari and Rossi [START_REF] Montanari | Contextual nets[END_REF] adopt a different view: only transitions that are independent from each other should be allowed in a step. Clearly, t 1 and t 2 are not independent because they cannot fire in any order: t 1 t 2 is a valid firing sequence but t 2 t 1 is not. Then {t 1 , t 2 } should not be a step of (b) and (c). These semantics can be understood as viewing transition occurrences as instantaneous events. The same semantics are adopted in [CH93; BP96], as well as in this dissertation.

Process semantics for contextual nets can be found in [JK91; MR95; BP96; JK95; Vog97; Win98; GM98]. However, in this dissertation the focus will be on the non-sequential unfolding semantics of contextual nets, independently introduced by Baldan, Corradini, and Montanari in [START_REF] Baldan | An Event Structure Semantics for P/T Contextual Nets: Asymmetric Event Structures[END_REF], and Vogler, Semenov, and Yakovlev in [START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF]. In both works, the same unfolding semantics are defined, employing the view of [START_REF] Montanari | Contextual nets[END_REF] about the simultaneous occurrence of transitions.

A first unfolding procedure for constructing finite and complete contextual prefixes is found in [START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF]. Their procedure is essentially a generalization of McMillan's algorithm, and works for only a restricted class of socalled read-persistent contextual nets. The authors find that interesting practical applications, such as hazard checking in asynchronous circuits, lie within this class. However, the class is quite restricted. It consist of all the contextual nets that have no reachable marking which enables two transitions such that one consumes a place read by the other. The c-nets in Fig. 6 (b) and (c), for instance, lie outside, despite their simple structure.

The problem with non read-persistent nets is that events have multiple causal histories. Roughly speaking, a history of an event e is a set of events that must precede e in a possible execution. This multiplicity negatively interacts with the cutoff criterion of McMillan's algorithm, preventing the latter from constructing complete prefixes.

A general procedure for the whole class of contextual nets was later proposed by Winkowsky [START_REF] Winkowski | Reachability in Contextual Nets[END_REF], who lifted McMillan's cutoff criterion from local configurations [START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF] to the aforementioned causal histories. The procedure always terminates with a complete unfolding prefix, but it is not constructive in general, as events may have infinitely many causal histories.

A constructive, general solution was finally given in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], at the price of making the underlying theory notably more complicated. In particular, computing a complete prefix required to annotate every event e with a subset of its histories.

However, it remained unclear whether the approach of [BCKS08] could be implemented with reasonable efficiency, and how. For safe nets, the interest of computing a complete contextual prefix was not evident from a practical point of view: while the prefix can be exponentially smaller than the complete prefix of the corresponding PR-encoding, the intermediate structure used to produce it has asymptotically the same size. More precisely, the number of histories that the approach of [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] needs to consider to construct the contextual prefix matches the number of events in the prefix of the PR-encoding (for general bounded nets, this is not the case).

Additionally, only an abstract procedure was given in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], mainly focusing on the technical difficulties of the cutoff criterion. It was left unresolved how to turn the procedure into a reasonably efficient algorithm, and no data structure for dealing with causal histories was proposed.

contributions and outline

This dissertation makes foundational and practical contributions to model checking and fault diagnosis. We present verification algorithms for Petri nets that exploit the aforementioned compactness of contextual unfoldings, and extend an unfolding-based diagnosis method with fairness assumptions. We implement our model checking algorithms aiming at producing an efficient and robust model checker intended to handle realistic benchmarks.

We demonstrate that contextual unfolding construction and analysis is practical and outperforms existing techniques on a wide number of cases.

Contextual nets and their unfoldings therefore have a rightful place in research on concurrency, also from an efficiency point of view.

More specifically, the outline and contributions of the manuscript are:

• Chapter 3. We render effective the abstract procedure of [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] with a view to efficiency. We develop a concurrency relation on a notion of unfolding conditions enriched with histories, use it to characterize the possible extensions of the prefix, and provide an inductive characterization of this relation that lies at the heart of the efficient computation of prefix extensions. We include adequate orders in the framework of contextual unfoldings and compare our method to the one independently proposed in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. This chapter is based on [RSB11b; BBC+12].

• Chapter 4. We encode into SAT the reachability and deadlock-freeness problems based on contextual unfoldings. Unlike conventional unfoldings, contextual unfoldings may contain cycles of so-called asymmetric conflict. We propose and optimize encodings for avoiding them. A number of additional optimizations are also studied. This chapter is based on [RS12b].

• Chapter 5. We integrate two methods for representing the state space of Petri nets: merged processes and contextual unfoldings. The resulting technique, called contextual merged processes (CMPs), combines the advantages of the original techniques and copes with several important sources of state space explosion: concurrency, sequences of choices, and concurrent read accesses to shared resources. A SAT encoding of the reachability problem based on CMPs is presented. This chapter is based on [RSK13].

• Chapter 6. We present an unfolding-based procedure for deciding the weak fault diagnosis problem. The diagnosis approaches proposed in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] and [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF], mostly focused on sequential observations. We generalize them to partially ordered observations, and extend the method adding fairness assumptions, which gives rise to weak diagnosis. Additionally, we present a decision procedure of the weak diagnosis problem using SAT. The results in this chapter hold for ordinary Petri nets, not contextual nets. This chapter is based on [HRS13]. Chapter 2 fixes general definitions and assumptions for the rest of the manuscript, and contains a number of small technical results that will be used later. We conclude in Ch. 8. The manual of the Cunf Toolset is contained in App. A.

publications

Most of the contributions in this manuscript have been already published in international conferences or journals. The following publications partially contain the results of this dissertation:

P R E L I M I N A R I E S

This first technical chapter recalls and formally defines general background that will be necessary for the rest of the manuscript. New, often technical, results are spread over the presentation. We have decided to place them here not only because they are preliminary results, necessary for subsequent developments, but mainly because they contribute to forge deeper intuitions about the basic notions presented here, before they are used to construct, over the next chapters, the main contributions of the thesis.

The outline is as follows. We recall basic notions about orders and multisets in § 2.1. Petri nets with read arcs and related notions are formally defined in § § 2.2 and 2.3, and two different ways to encode them into ordinary Petri nets are recalled. Their non-sequential unfolding semantics are presented in § 2.4.

orders and multisets

Let S be a set. A relation R ⊆ S × S is • reflexive if (s, s) ∈ R for all s ∈ S; • irreflexive if (s, s) / ∈ R for all s ∈ S; • transitive if {(s, t), (t, u)} ⊆ R implies (s, u) ∈ R for all s, t, u ∈ S; • asymmetric if (s, t) ∈ R implies (t, s) /
∈ R for all s, t ∈ S; and

• antisymmetric if {(s, t), (t, s)} ⊆ R implies s = t for all s, t ∈ S.
A (non-strict) partial order is any reflexive, transitive, and antisymmetric relation. A strict partial order is any irreflexive and transitive relation. Any strict partial order is asymmetric and antisymmetric, which can easily be derived from the definition. Finally recall that if R is asymmetric, it is also irreflexive.

The reflexive closure of any strict partial order is a partial order. Conversely, the reflexive reduction of any partial order is a strict partial order.

Any partial order R, strict or not, is total if any two elements of S are ordered, i.e., ether (s, t) ∈ R or (t, s) ∈ R holds for all s, t ∈ S with s = t. For any subset S ′ ⊆ S, we denote by R S ′ the relation R ∩ (S ′ × S ′ ), also called the restriction of R to S ′ .

A chain of R is any subset C ⊆ S that is totally ordered under R, i.e., R C is total. A linear extension of R, or topological ordering of S, is any total order R ′ on S such that R ⊆ R ′ . Observe that a linear extension of R always exists because R is a partial order. In many cases we will also call R ′ an interleaving of R -or S if R is clear.

We identify any relation R on S with the directed graph whose edge relation is precisely R. We say that R is acyclic iff its associated digraph is. In other words, R is acyclic if its transitive closure is irreflexive, i.e., a strict partial order. Similarly, we will speak about the Strongly Connected Components (SCCs) of R to mean SCCs of the directed graph identified by R.

A multiset over a set S is a function M : S → N. The support of M is the set M := {x ∈ S : M(x) > 0} of elements in S occurring at least once in M.

p 1 f 1 s 1 p 2 p 0 q 1 q 2 s 2 f 2 q 0 t 2 w 2 t 1 w 1
Figure 7: A c-net with four read arcs.

We write x ∈ M if x is in the support of M; we say that M is finite iff its support is. Given multisets M and N over S, their sum and difference are

(M + N)(x) := M(x) + N(x), (M -N)(x) := max(0, M(x) -N(x)).
We write M ≤ N iff M(x) ≤ N(x) for all x ∈ S. We let S (observe the bold typography) denote the set of multisets over S. For any function f : S → T we lift f to multisets as the partial function f : S → T (again observe the bold typography for f) that maps M ∈ S to f(M) = N where N(t) := ∑ s∈ f -1 (t) M(s). Observe that N is well-defined iff for every t ∈ T finitely many terms M(s) are non-zero, with s ∈ f -1 (t). This is always the case if, e.g., M has a finite support. Any set will be interpreted as a multiset in the natural way.

contextual nets

A contextual net (c-net) is a tuple N := P, T, F, C, m 0 , where For any node x ∈ P ∪ T we will sometimes write x ∈ N to mean that x is a node of N. Throughout this manuscript, whenever N denotes a c-net, we will assume that N := P, T, F, C, m 0 , unless otherwise stated. Subscripts, primes or other decorations of N will pass through to the components of the tuple.

Figure 7 shows a c-net. As usual, transitions are depicted as boxes and places as circles. Read arcs are depicted as undirected lines. 2 For instance, (s 1 , q 0 ) is a read arc. Places initially marked will be drawn with a token inside. In this case, the initial marking puts one token on places p 0 and q 0 . Within this work, Petri nets will be referred or qualified as ordinary nets, as opposed to contextual nets. 3 By extension, any notion related to them will also be qualified as ordinary. For instance, we will speak of ordinary occurrence nets, or ordinary unfoldings when discussing the corresponding notions in Petri net theory.

For any node x ∈ P ∪ T, the preset, postset, and context of x is defined as a function from x to, respectively, the set:

• x := {y ∈ P ∪ T : (y, x) ∈ F}, x • := {y ∈ P ∪ T : (x, y) ∈ F}, x := {y ∈ P ∪ T : (y, x) ∈ C ∪ C -1 }.
Such notions are naturally lifted to sets and multisets of nodes. In Fig. 7, we have

• s 1 = {p 1 }, s • 1 = {p 2 }, s 1 = {q 0 }, {p 1 , q 1 } = {w 1 , w 2 }. A marking of N is a multiset m : P → N over P. We say that m is k-bounded if m(p) ≤ k for all p ∈ P. A set A ⊆ T of transitions is enabled at marking m if for all p ∈ P, m(p) ≥ |p • ∩ A| + 1 if p ∩ A = ∅ 0 otherwise (1)
Such A can occur or be executed, leading to a new marking m ′ , where

m ′ (p) = m(p) -|p • ∩ A| + | • p ∩ A| for all p ∈ P. We call m, A, m ′ a step of N.
If A is a singleton with one transition t ∈ T, we also write m, t, m ′ . Although the enabling condition could be defined for multisets A instead of sets, for the purposes of this work, sets will suffice. Some examples follow. In Fig. 7, the initial marking enables the sets {t 1 } and {t 1 , t 2 }. In both cases, the marking covers the pre-places of all transitions; and the presets of t 1 , t 2 do not overlap. A marking m such that m(p 1 ) = 2 and m(q 0 ) = 2 would enable the set {s 1 , t 2 }. Here, s 1 overlaps • t 2 , but the only place in common, q 0 , contains two tokens. Coming back to the discussion about steps semantics in § 1.4, and considering Fig. 6 (b), the set {t 1 , t 2 } is not enabled at the initial marking. In this case, the only place in t 1 ∩ • t 2 contains only one token, but (1) demands at least two.

A finite sequence of transitions σ = t 1 . . . t n ∈ T * is a run or firing sequence iff there exist markings m 1 , . . . , m n such that m i-1 , t i , m i is an step for all for 1 ≤ i ≤ n, and m 0 is the initial marking of N. If such a run exists, m n is said to be reachable; we denote by reach(N) the set of reachable markings of N. For instance, in Fig. 7, t 1 s 1 t 2 f 1 is a run. An infinite sequence t 1 t 2 . . . ∈ T ∞ is a run if all its finite prefixes are. We call any run repetition-free if it fires every transition at most once.

A c-net N is said to be k-bounded if every reachable marking of N is kbounded; we say N is bounded if it is k-bounded for some k ∈ N and safe if it is 1-bounded. For safe nets, we treat markings as sets of places. A marking m is deadlocked if it does not enable any transition, and coverable if there is some other reachable marking

m ′ ∈ reach(N) such that m ≥ m ′ .
The reachability graph of N is the directed graph whose vertices are all reachable markings of N, i.e., reach(N), and whose edges are all pairs (m, m ′ ) such that m, t, m ′ is an step for some t ∈ T.

The immediate causality relation on N is the binary relation < i on P ∪ T defined as x < i y iff

(x, y) ∈ F, or (2)
x, y ∈ T and

x • ∩ y = ∅ (3)
The second condition, (3), is new for contextual nets w.r.t. ordinary nets. In Fig. 8, for instance, it establishes that t 1 < i t 2 . The causality relation < is the

t 2 t 1 t 3 t 4
Figure 8: Illustrating causality, symmetric, and asymmetric conflict.

transitive closure of < i , and we denote by ≤ the reflexive closure of <. For a node x, we define its set of causes as the set of transitions preceding it:

[x] := {t ∈ T : t ≤ x}. A set X ⊆ T is causally closed if [t] ⊆ X for all t ∈ X. The conflict relation # ⊆ (P ∪ T) 2 is the least symmetric relation satisfying • t # t ′ if t, t ′ ∈ T with t = t ′ and • t ∩ • t ′ = ∅; and • x # z if there is y ∈ P ∪ T such that x # y and y < z.
In Fig. 8, we have t 3 # t 4 . Two transitions t and t ′ are in asymmetric conflict, written t ր t ′ , iff either

t • ∩ ( • t ′ ∪ t ′ ) = ∅, or (4) t ∩ • t ′ = ∅, or (5) t # t ′ . ( 6
)
Again in Fig. 8, we have the following examples t 1 ր t 2 , by (4) t 1 ր t 3 , by (4) t 2 ր t 3 , by (5) t 3 ր t 4 , by (6) t 4 ր t 3 , by (6) As explained in § 2.1, for any set X ⊆ T of transitions, we will denote the relation ր ∩ (X × X) by ր X .

Although we define causality, symmetric, and asymmetric conflicts for general c-nets, the intuition behind them is only meaningful for occurrence nets, a subclass of c-nets defined in § 2.4. For this reason, it will be in § 2.4 where we explain more in detail these definitions. We will instantiate these notions for general c-nets on certain cases, so we need to define them for general c-nets rather than directly for occurrence nets.

Remark 1. For any c-net, (< i ∪ < i 2 ) ∩ (T × T) ⊆ ր.
Proof. If t < i t ′ for some t and t ′ in T, necessarily (3) holds, and then (4) also holds. If t < i 2 t ′ holds, there is some place p such that t < i p < i t ′ . Then (4) holds between t and t ′ .

Remark 2. For any

Petri net, ր = # ∪ (< i 2 ∩ (T × T))
general assumptions. Throughout this manuscript, we will often assume that a c-net N satisfies the following conditions:

1. ( • t ∪ t • ) ∩ t = ∅ for each transition t ∈ T; (7) 2. • t = ∅ for all t ∈ T; (8) 3. m 0 is safe; (9)
Observe that due to (7), relation < i is irreflexive. Assuming that the initial marking m 0 is safe is not restrictive 4 and will simplify the notation of some definitions, notably the branching processes of N, in § 2.4.2.

Let N ′ = P ′ , T ′ , F ′ , C ′ , m ′ 0 be a c-net. A homomorphism [VSY98] from N to N ′ is a function h : P ∪ T → P ′ ∪ T ′ satisfying: • h(P) ⊆ P ′ and h(T) ⊆ T ′ ; (10) • h(m 0 ) = m ′ 0 ; (11)
• for all t ∈ T, h(

• t) = • h(t), h(t • ) = h(t) • , and h(t) = h(t). ( 12
)
Such a homomorphism is a specialisation of Definition 4.20 in [START_REF] Baldan | Contextual Petri nets, asymmetric event structures, and processes[END_REF].

Notice that ( 11) is equivalent to asking that h restricted to m 0 is a bijection between m 0 and m ′ 0 . Similarly, (12) requests that for every transition t of N, h restricted to • t is a bijection to • h(t), and similarly for t • and t. An isomorphism between N and N ′ is a bijection f : P ∪ T → P ′ ∪ T ′ such that f and f -1 are homomorphisms.

We finish this section showing that asymmetric conflict, causality, and steps are, among other notions, preserved by homomorphisms. Remark that the following result is restricted to singleton steps, which are enough for our purposes.

Lemma 1. Let N and N ′ be c-nets, and h be a homomorphism from N to N ′ . If m, t, m is a step of N and h(m) is well-defined, then

h(m), h(t), h( m) is a step of N ′ .

Furthermore, for any nodes x, y and transitions t, u of N, x < y implies h(x) < h(y) and t ր u implies either h(t) ր h(u) or h(t) = h(u).

Proof. That c-net homomorphisms preserve steps, the first part of the lemma, is already stated by Proposition 4.1 in [START_REF] Baldan | Contextual Petri nets, asymmetric event structures, and processes[END_REF], since our definition of homomorphism is a specialisation of theirs -we enforce h to be total and h(p) is a place instead of a multiset of places. At any rate, the second part of our lemma is new, and what follows is a proof of both parts.

Let P, T and P ′ , T ′ be the places and transitions of, respectively, N and N ′ . Let m, t, m be step of N such that m ′ := h(m) is a well-defined marking of N ′ . Let t ′ := h(t).

We first show that t ′ is enabled at m

′ . Let p ′ ∈ • t ′ . Because h restricted to • t is a bijection between • t and • t ′ , there is a single p ∈ • t such that h(p) = p ′ . Since t is enabled at m, m(p) ≥ 1. Recall that m ′ (p ′ ) = ∑ p∈h -1 (p ′ ) m( p). Then m ′ (p ′ ) ≥ 1 because p ∈ h -1 (p ′ ). An analogous argument shows that m ′ (p ′ ) ≥ 1 if p ′ ∈ t ′ . So m ′ enables t ′ . Let m ′ , t ′ , m ′ be a step of N ′ . We show that h( m) = m ′ , i.e., that for any p ′ ∈ P ′ , we have h( m)(p ′ ) = m ′ (p ′ ).
We proceed as follows:

h( m)(p ′ ) = ∑ p∈h -1 (p ′ ) m(p) = ∑ p∈h -1 (p ′ ) (m(p) -|{p} ∩ • t| + |{p} ∩ t • |) = ∑ p∈h -1 (p ′ ) m(p) - ∑ p∈h -1 (p ′ ) |{p} ∩ • t| + ∑ p∈h -1 (p ′ ) |{p} ∩ t • | = ∑ p∈h -1 (p ′ ) m(p) -|h -1 (p ′ ) ∩ • t| + |h -1 (p ′ ) ∩ t • |
As for m ′ (p ′ ), we have:

m ′ (p ′ ) = h(m)(p ′ ) -|{p ′ } ∩ • t ′ | + |{p ′ } ∩ t ′• | = ∑ p∈h -1 (p ′ ) m(p) -|{p ′ } ∩ • t ′ | + |{p ′ } ∩ t ′• | Therefore, to show that h( m)(p ′ ) = m ′ (p ′ ) it suffices to show that |{p ′ } ∩ • t ′ | = |h -1 (p ′ ) ∩ • t| and that |{p ′ } ∩ t ′• | = |h -1 (p ′ ) ∩ t • |. Either p ′ ∈ • t ′ holds or not. If it holds, there is a single p ∈ • t such that h(p) = p ′ , since otherwise h restricted to • t would not be a bijection between • t and • t ′ . Then |h -1 (p ′ ) ∩ • t| = 1. If p ′ / ∈ • t ′ , then no p ∈ • t is such that h(p) = p ′ , again because h is a homomorphism. Then |h -1 (p ′ ) ∩ • t| = 0. This proves that |{p ′ } ∩ • t ′ | = |h -1 (p ′ ) ∩ • t|; an analogous argument shows that |{p ′ } ∩ t ′• | = |h -1 (p ′ ) ∩ t • |.
We now show why x < i y implies h(x) < i h(y), for x, y ∈ P ∪ T. That x < y implies h(x) < h(y) is basically a consequence of the previous fact. Three cases are possible:

• x ∈ P and x ∈ • y. Since y ∈ T, we know that h restricted to • y is a bijection to • h(y). So h(x) ∈ • h(y) and h(x) < i h(y). • x ∈ T and x ∈ • y. Analogous. • x, y ∈ T and x • ∩ y = ∅. Then let p ∈ x • be such that p ∈ y. Again, h(p) is in h(x)
• and in h(y), and so h(x) < i h(y).

We now show that t ր u implies either h(t) ր h(u) or h(t) = h(u). Assume the hypothesis and assume that h(t) = h(u), we show that h(t) ր h(u). Three cases are possible: As usual, homomorphisms preserve runs and reachable markings: if σ is a run of N that reaches m, then h(σ) is a run of N ′ that reaches h(m), because h(m 0 ) = m ′ 0 is a well-defined marking and due to Lemma 1.

• t • ∩ ( • u ∪ u) contains some place p.

encoding contextual nets into ordinary petri nets

A c-net N can be encoded into a Petri net whose reachable markings are in one-to-one correspondence with those of N. We discuss two such encodings, and illustrate them by the c-net N in Fig. 9 (a). Place p has two transitions t 2 , t 3 in its context, modelling a situation where, e.g., two processes are accessing in a read-only way a common resource represented by p. Note that the step {t 2 , t 3 } can occur in N after executing t 1 .

Plain Encoding

Given a c-net N, the plain encoding of N is the net N p obtained by replacing every read arc (p, Observe that in (b) the firings of t 2 and t 3 are sequentialized: after executing t 1 , the step {t 2 , t 3 }, which was possible in (a), can no longer occur.

Place-Replication Encoding

The Place-Replication (PR-) encoding [MR95; VSY98] of a c-net N is a Petri net N r in which we substitute every place p in the context of n ≥ The PR-encoding of the net N in Fig. 9 (a) is the net N ′′ shown in Fig. 9 (c). Reachable markings, runs, and steps of N ′′ are in bijective correspondence to those of N.

More formally, let N := P, T, F, C, m 0 be a c-net. Assume that P is partitioned in two sets P 0 and P 1 that contain, respectively, all places with zero (P 0 ) and one or more (P 1 ) incident read arcs. The PR-encoding of N is the ordinary net N r := P r , T r , F r , m 0,r , defined as follows.

• P r := P 0 ∪ { p, t : p ∈ P 1 , t ∈ T, (p, t) ∈ C} • T r := T • F ′ contains
all directed arcs (p, t) and (t, p) in F such that p ∈ P 0 , plus arcs ( p, t , t ′ ) for all p, t ∈ P r and all (p, t ′ ) ∈ F, -arcs (t ′ , p, t ) for all p, t ∈ P r and all (t ′ , p) ∈ F, -arcs (t, p, t ) and ( p, t , t) for all p, t ∈ P r .

• m 0,r marks all P 0 ∩ P r ⊆ m 0 and all p, t ∈ P r such that p ∈ m 0 .

Remark 3. A sequence t 1 t 2 . . . ∈ T * is a run of N iff it is a run of N r .
Proof. Steps of N are in bijective correspondence with the steps of N r .

unfoldings

In this section we define the notion of unfolding of a c-net and recall properties of it. We mainly follow [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF].

Occurrence Nets

In the context of this manuscript, an occurrence net is a c-net that represent the occurrences of transitions in one or several executions of the net. All five nets illustrated in Fig. 2 are occurrence nets.

Formally, an occurrence net (ON) is a c-net O = B, E, G, D, m0 that satisfies the following:

• | • c| ≤ 1 holds for any c ∈ B;
(13)

• [e] is finite for all e ∈ E; (14)

• ր [e] is acyclic for all e ∈ E; and (15)

• m0 = {c ∈ B : • c = ∅}. (16)
As before, when denoting an ON by O, unless otherwise stated, we will assume O := B, E, G, D, m0 . For the rest of this section, let O be an ON.

As per tradition, we call the elements of B conditions, and those of E events. The requirements (13), ( 14) and ( 16) are usual in this definition. The general assumptions of p. 18 also apply to ON; in particular, property (8) implies that all <-minimal nodes are conditions, and by ( 16) they are initially marked. Notice that m0 is safe. As for (15), we shall see later in this section that it asks for [e] to be, intuitively, a firable set of events.

Occurrence nets are defined above differently than in [BCKS08; BCM01; Win02]: we do not require O to be safe or < to be a (strict) partial order.5 These properties can rather be derived from the definition: Remark 4. For any occurrence net O:

1. < is irreflexive, i.e., it is a strict partial order. 2. Every run of O is repetition-free. 3. O is safe. Proof.
1. For some node x, assume that x < x. If x < i x then necessarily x ∈ E and by Rmk. 1 we have x ր x, a contradiction to (15). On the other hand, if < i is irreflexive, then the pair (x, x) has been added to < during the transitive closure and there are n ≥ 1 nodes x 1 , . . . , x n of O that form a cycle of < i which involves x, i.e., such that

x < i x 1 < i . . . < i x n < i x.
Since either x or x 1 is an event, w.l.o.g. we can assume x ∈ E. From this cycle in the relation < i we can extract a cycle in the relation < e := < i ∪ < i 2 which only involves events. That is, there are m ≥ 0 events

x i 1 , . . . , x i m such that

x < e x i 1 < e . . . < e x i m < e x, and i j ∈ {1, . . . , n} for 1 ≤ j ≤ m, and each i j is either i

j-1 + 1 or i j-1 + 2 for 2 ≤ j ≤ m. Notice that all x i j are in [x]. By Rmk. 1, such cycle of in relation < e is a cycle of ր [x]
, a contradiction to (15). 2. By induction on the length n of any run e 1 , . . . , e n of O. The claim is obviously true for n ≤ 1. If, for a proof by contradiction, e n = e i for some 1 ≤ i < n, any condition c ∈ • e i is marked twice. By (16), c / ∈ m0 ; by (13), the single event in • c ⊆ {e 1 , . . . , e i-1 } fires twice in the run e 1 , . . . , e n-1 , a contradiction. 3. Marking a condition c twice needs to fire • c twice. In the light of Rmk. 4, let us present some intuition behind the relations <, #, and ր in ONs. Any two nodes x, y of O satisfy x < y iff any run that fires or marks y first fires or marks x. Intuitively, this is a consequence of the fact that a condition is never marked again once it is consumed, which in turn follows after the second item in Rmk. 4 and (13).

If x, y are in symmetric conflict, then no run that fires or marks x, fires or marks y, for the same reasons as before. In ordinary ONs, the inverse statement is also true, i.e., if no run fires or marks x and y, then both are in symmetric conflict. This is however not valid in contextual ONs. Figure 10 (b) shows an ON where no run fires both events e 1 and e 2 but they are not in symmetric conflict. They actually form a cycle of asymmetric conflict, as we discuss now.

An asymmetric conflict can be thought of as a scheduling constraint: if two events e and e ′ both occur in a run σ of O and e ր e ′ , then e must occur first -firing e ′ prevents e from firing. The definition of ր, in p. 18, relates e and e ′ in three possible ways, let us see why this intuitive understanding of ր holds in all the three cases:

1. If (4) holds between e and e ′ , then e < e ′ and the intuition is trivially true. 2. If (5) holds, e ′ consumes some condition c read by e. Since c cannot be marked again once consumed, e needs to read before e ′ consumes. Notice that (5) does not force by itself to fire e in every run that fires e ′ , in contrast to (4). Only if both events fire it forces an order of occurrence. For instance, in Fig. 10 (a), we have e 1 ր e 2 . If both e 1 and e 2 fire, then surely e 1 fires first. But firing e 2 on some run does not, itself, imply that e 1 fires, e 2 can fire alone. 3. As for (6), the intuition vacuously holds: e, e ′ cannot both occur.

If we think of asymmetric conflict as a scheduling constraint, it should be clear that any set of events containing a cycle of asymmetric conflict can never be entirely contained in a run -otherwise any event in the cycle would have to fire before itself. The simplest cycles we can find arise when e # e ′ , where we have e ր e ′ ր e, a cycle of length two, due to (6). In ordinary ONs, every cycle of ր corresponds to a cycle of length two created by a symmetric conflict. Cycles of ր in (contextual) ONs may, however, have unbounded length: Fig. 10 shows two ONs with cycles of length two and three, that can be generalized to any length; even cycles of length two may be due to other causes than symmetric conflicts, as in Fig. 10 (b).

If three events e 1 , e 2 , e 3 satisfy e 1 ր e 2 ր e 3 , then it is not true that every run that fires e 3 also fires e 1 . It is not even true that, if both e 1 and e 3 fire, then e 1 fires before e 3 . Both statements are, however, true if all the three fire in the run. This illustrates a common pitfall about asymmetric conflicts. In contrast to the similarities between < i and <, not all intuitions behind ր are true for ր * .

Finally, notice that none of the intuitions given above about <, #, and ր is necessarily true for general c-nets. For instance, a run may mark twice one given place, and there may exist a run that fires two transitions in symmetric conflict.

A configuration of O is the set of events that a run of O fires. It can be defined formally as any set C ⊆ E satisfying Let us check that this formalization meets the intuitive definition. Assume that σ := e 1 e 2 . . . is a finite or infinite run of O and let C := {e 1 , e 2 , . . .} be the events in σ. By now, it should be clear that C is causally closed and induces no cycle in ր. As all events e ′ in asymmetric conflict to e fire before e, and only finitely many events fire before e in σ, (19) also holds.

Conversely, if C := {e 1 , . . .} is a configuration, then any linear extension σ := e 1 , e 2 , . . . of ր C , involving exactly the events in C is a run of O. This is because, first, ր is irreflexive in occurrence nets; second, ր * C is a partial order, due to (18), so a linear extension σ of ր C always exists; third, σ is a run because any finite prefix e 1 , . . . , e i-1 marks conditions enabling e i , which can easily be shown using (17) to (19). In particular, (19) is necessary to ensure that only finitely many events in C need to be fired before e i in σ. We call σ an interleaving of C.

All interleavings of a finite configuration C mark the same marking of O. We call such marking the cut of C, and define it as

cut(C) := ( m0 ∪ C • ) \ • C.
Remark that the cut is defined only for finite configurations; similarly, the marking reached by a run is only defined for finite runs.

The depth of an event e, denoted by depth(e), is the length of the longest <-chain of events in [e], and can be inductively defined as depth(e) := 0 if e enabled at m0

1 + max e ′ <e depth(e ′ ) otherwise (20)
The depth of a configuration C is the depth of the deepest event in the configuration, which Given two configurations C and C ′ , we say that C evolves to C ′ , written C ⊑ C ′ , iff C ⊆ C ′ and ¬(e ′ ր e) for all e ∈ C and e ′ ∈ C ′ \ C.

Note that ⊑ is not merely the subset relation between configurations (as it is in ordinary ONs). Intuitively, C ⊑ C ′ iff an interleaving of C can be extended with all events in C ′ \ C to form an interleaving of C ′ . Note also that ⊑ is transitive. For instance, in Fig. 5 (e), which is an occurrence net, we have {c} ⊑ {c, d}, and {c, a} ⊑ {c, a, d}. But we also have that {c, d} ⊑ {c, a, d}, an archetypical example of why ⊑ for c-nets is not just set inclusion.

An extension of a configuration C is any set X ⊆ E of events such that

• C ∩ X = ∅, and • C ∪ X is a configuration. • C ⊑ C ∪ X.
Configurations C, C ′ are in conflict, written C # C ′ , when there is no configuration C ′′ satisfying C ⊑ C ′′ and C ′ ⊑ C ′′ . Again in Fig. 5 (e) we have {c, d} # {c, a, d} and {c, a, d} # {c, b, d}.

Remark 5. The following statements are equivalent:

1. C # C ′ 2. C ⊑ C ∪ C ′ or C ′ ⊑ C ∪ C ′ 3.
There is e ∈ C and e ′ ∈ C ′ \ C such that e ′ ր e, or the symmetric condition holds.

Lemma 2. Let C 1 , C 2 , C 3 ∈ conf (O) be configurations. We have:

1. If ¬C 1 # C 2 , then C 1 ∪ C 2 is a configuration. 2. If ¬C 1 # C 2 and ¬C 2 # C 3 and ¬C 1 # C 3 , then ¬(C 1 # (C 2 ∪ C 3 )). 3. If C 1 # C 2 and C 1 ⊑ C 3 , then C 3 # C 2 .
Proof. We show each statement independently:

⊑, that C 1 ⊑ C 3 ⊑ C and C 2 ⊑ C, a contradiction to C 1 # C 2 . So necessarily C 3 # C 2 holds.
We finish this section with an important definition. Given occurrence nets O and O ′ := B ′ , E ′ , G ′ , D ′ , m′ 0 , we say that O is a prefix of O ′ , and write O O ′ , iff O satisfies:

• E ⊆ E ′ and E is causally closed in O ′ ; • B = m′ 0 ∪ E • ; • G and D are the restrictions of G ′ and D ′ to B ∪ E.
Note that O completely determined by its set of events E, which can be any causally closed subset of E ′ .

Branching Processes

The unfolding of a c-net N is an occurrence net O equipped with a homomorphism from O to N that is obtained by means of unrolling the cycles of N. Perhaps the most intuitive definition we can give is the following.

The unfolding of N := P, T, F, C, m 0 , denoted by U N , is a labelled occurrence net O, h , where O := B, Ẽ, G, D, m0 is an occurrence net and h : B ∪ Ẽ → P ∪ T is a homomorphism from O to N, defined by the following inductive rules:

p ∈ m 0 c := ⊥, p ∈ B h(c) := p c ∈ m0 Ini t ∈ T X, Y ⊆ B h(X) = • t h(Y) = t X ∪ Y is coverable e := X, Y, t ∈ Ẽ • e := X e := Y h(e) := t Ev e ∈ Ẽ h(e) = t t • = {p 1 , . . . , p n } c i := e, p i ∈ B e • := {c 1 , . . . , c n } h(c i ) := p i Cond
Although U N is the pair O, h , for simplicity we often identify U N and O.

The reader familiar with the unfolding construction of ordinary nets will notice that the only difference between this construction and the one for ordinary nets (e.g., Definition. 3.5 in [START_REF] Esparza | Unfoldings -A Partial-Order Approach to Model Checking[END_REF]) is that here, in the rule Ev, the set Y plays the role of context for an event, and we ask Y to be coverable. Remaining elements of the definition are standard.

In this definition, the nodes of U N are assigned unique, canonical names. Every condition c has the form e, p , where p is a place of N and e is the single event that produces c. If e is ⊥, then c has been constructed by the rule Ini, p is initially marked in N, and so is c in U N . If e is an event in Ẽ, then c has been constructed by the rule Cond. The unique names guarantee that exactly one condition c satisfying h(c) = p is added for each place p ∈ h(e) • , and also that no other event produces c.

Events are of the form X, Y, t , where t ∈ T is a transition of N and X, Y are sets of conditions h-labelled by the preset and context of t, respectively. All events are appended by the rule Ev, which guarantees that e is occurs in some run when asking that X ∪ Y is coverable. Although X, Y, • t, and t are sets, we remark that the premises h(X) = • t and h(Y) = t interpret them as multisets. In other words, for every p ∈ • t, exactly one c with with h(c) = p is to be present in X, and similarly for t. Finally observe that different events have either different labels or different presets or different contexts.

Figure 11 shows a prefix of the unfolding for the net shown in Fig. 7. Events and conditions are given explicit names, and the labelling h is given in parenthesis. Condition c 1 would be constructed by the above rules as ⊥, p 0 ; event e 5 we would be {c 3 }, {c 4 }, w 1 . Now consider transition s 1 in Fig. 7, it consumes the place p 1 and reads q 0 . There are two occurrences of s 1 in this unfolding prefix, e 3 and e 9 , and both consume the same occurrence of p 1 , namely c 3 . Observe, for instance, that there is no occurrence of s 1 consuming c 15 and reading c 9 , and this is because such conditions are not coverable. Any run that marks c 15 and c 9 needs to fire e 3 and e 4 , but [e 3 ] ∪ [e 4 ] contains a cycle of asymmetric conflict: e 3 ր e 2 ր e 4 ր e 1 ր e 3 .

We briefly argue that O and h are indeed an ON and a homomorphism. That O satisfies (13), ( 14) and ( 16) is immediate after the definition; that ր [e] is acyclic, (15), can easily be shown by induction on the structure of O. As for h, it is immediate to show it satisfies (10) and (12). Condition (11) asks

c 2 (q 0 ) e 8 ( f 2 ) c 9 (q 0 ) e 1 (t 1 ) e 3 (s 1 ) e 7 ( f 1 ) c 1 (p 0 ) c 3 (p 1 ) c 5 (p 2 ) c 7 (p 0 ) e 14 (t
c 6 (q 2 ) c 4 (q 1 )
Figure 11: Unfolding prefix of the c-net in Fig. 7; the labelling is given in parenthesis.

that h acts as a bijection between m0 and m 0 and holds because m 0 is safe, as we assumed in (9). Relaxing this is possible, at the cost of some impractical notation in the rule Ini.

A branching process of N is a labelled occurrence net P := O ′ , h ′ , where O ′ is an occurrence net and h ′ is a homomorphism from O ′ to N satisfying that for all events e, e ′ ∈ O ′ , h ′ (e) = h ′ (e ′ ) and • e = • e ′ and e = e ′ imply e = e ′ (21)

This property intuitively means that P does not duplicate events: for any reachable marking m of P and any transition of N enabled at h ′ (m), a single event e with h ′ (e) = t will be found among those enabled by m.

The unfolding U N is indeed a branching process, we have already argued why it satisfies the contrapositive of (21).

We lift the prefix order on occurrence nets to branching processes. Given two branching processes P 1 := O 1 , h 1 and P 2 := O 2 , h 2 , we say that P 1 is a prefix of P 2 , written P 1 P 2 , if O 1 O 2 and h 1 is h 2 restricted to O 1 . Abusing of notation, we will often say that actually O 1 , h 2 is a prefix of P 2 , which is safe due to h 1 being a restriction of h 2 to the nodes of O 1 .

Remark 6. O ′ , h ′ is a branching process of N iff it is (isomorphic to) a prefix of U N .
Proof. (Sketch) Obviously, every prefix of U N is a branching process. The opposite direction can be shown by induction on the depth of O ′ . If depth(O ′ ) = 0, the branching process consist only of the initial marking, and by (11) it is (isomorphic to) the initial marking of U N . Otherwise O ′ have some maximal (w.r.t. causality) event e with depth(e) ≥ 1. By the induction hypothesis C := [e] \ {e} is (isomorphic to) a configuration of U N , and mark(C) is a reachable marking of N that enables h(e). So e is (isomorphic to) an event of U N , and O ′ , h ′ is (isomorphic to) a prefix of U N .

In the light of Rmk. 6, branching processes will be also called unfolding prefixes or just prefixes. As we said, given any prefix O ′ , h ′ , we will also consider O ′ , h a prefix of U N (recall that h is the homomorphism in U N ).

The unfolding U N contains all behavioral information of the net. However, it is in general infinite and therefore of limited use for the purpose of automatic verification. Indeed, if N has at least one infinite run, U N will contain at least one infinite configuration.

In general, we are interested in computing a finite prefix of the unfolding and using it to reason about the behavior of the net. If such a prefix is too small, it may not contain enough information. Completeness criteria encode which information is to be preserved in the prefix. Different criteria have been proposed in the literature to address different verification problems, see [START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF] for a general discussion.

For bounded nets, however, there is always a finite unfolding prefix that contains sufficient information to characterize the reachable markings of the net (through the h-image of the prefix's reachable markings). This is usually formalized as follows. First, for any finite configuration C ∈ conf (U N ), one defines the marking of C in N as mark(C) := h(cut(C)), i.e., the marking of N that labels the marking cut(C) reached by any interleaving of C. Then, an unfolding prefix P is called marking-complete if for any marking m reachable in N there is a configuration C ∈ conf (P ) with mark(C) = m.

Marking-completeness often suffices for reachability-like problems. This will actually be the case for all applications investigated within this thesis, with the exception of the diagnosis problem in Ch. 6. In § 4.2, we discuss on the use of different criteria for checking deadlock-freeness.

Before finishing this section, let us remark some simple fact about the structure of U N . Consider two distinct, finite configurations C, C ′ of U N that reach the same marking mark(C) = mark(C ′ ). Since they reach the same marking of N, the behavior that U N displays after C and after C ′ must be the same. In other words, consider the two occurrence nets that one obtains after removing from U N all nodes in C and m0 ∪ C • , and similarly for C ′ . Such occurrence nets, suitably labelled with h restricted to each of them, are isomorphic; let f : Ẽ → Ẽ be such isomorphism. Note that f also preserves the value of (the respective restrictions of) h. They are, in fact, isomorphic to the unfolding of N with the initial marking m 0 replaced by mark(C).

As a result, for every extension I of C there is an isomorphic extension I ′ := f (I) of C ′ reaching the same marking mark(C ∪ I) = mark(C ′ ∪ I ′ ). For ordinary Petri nets, this is formalized, e.g., in Proposition 4.3 of [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. We will use extensively this simple fact in Ch. 6.

Theoretical foundations for constructing finite, complete unfolding prefixes of contextual nets have recently been proposed in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF]. While that work gave an abstract algorithm for the purpose, it left unresolved several important aspects, such as proposing an effective procedure for computing the possible extensions of the prefix. Moreover, it remained unclear whether the approach was useful in practice and which algorithms and data structures would be appropriate to implement it. In this chapter, we address these questions.

We provide one concrete method for computing contextual unfoldings, with a view to efficiency. We develop a concurrency relation on a notion of unfolding conditions enriched with histories, use it to characterize the possible extensions of the prefix, and provide an inductive characterization of this relation that lies at the heart of the efficient computation of prefix extensions. We include adequate orders in the framework of contextual unfoldings and compare our method the one independently proposed in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF].

This chapter includes and extends the results of [RSB11b; BBC+12].

introduction

Not surprisingly, contextual unfoldings are constructed using procedures lifted from the theory of ordinary net unfoldings. We first recall how ordinary unfoldings are constructed, mostly for the reader unfamiliar to the concerned key literature [McM93b; McM95b; ERV02; ER99; KKV03; EH08]. Recall that our goal is producing a finite and marking-complete unfolding prefix for a given c-net.

It is often insightful to recall how this could be done if, instead of a Petri net, we are given a finite, directed graph G and one vertex v of it, and the goal is producing a labelled tree that represents all vertices of G reachable from v. Each node of the tree would be labelled by one vertex of the digraph. One would start with a tree that only contains the root, a node labelled by v. From there, one would proceed iteratively. For each unprocessed node n of the tree, labelled by u, one would extend the tree with a node labelled by u ′ if the digraph has an edge from u to u ′ . We call all such nodes possible extensions; after adding them all, n would be declared processed. Different orders to choose the next node to process are possible (depth-first, breathfirst, etc.), we call them strategies.

If any vertex of G contained in a cycle is reachable from v, this construction would continue forever. But our goal is just visiting all reachable vertices, so we could declare cutoff any node of the tree whose label equals that of a node already present in the currently constructed part of the tree, and possible extensions would only be added for nodes that are not cutoffs. Since G is finite, this approach will always construct a finite tree that is complete, i.e., it contains a node labelled by u for every vertex u reachable from v.

This simple idea was first lifted to ordinary Petri nets by McMillan. His algorithm [START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF][START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF] constructs finite and complete unfolding prefixes for ordinary bounded Petri nets. As for digraphs, it starts with an un-folding prefix containing only the initial marking, appropriately labelled, and iteratively computes and appends possible extensions to the prefix. The nodes of the tree before correspond here to markings of the prefix. Every marking of the prefix is labelled by a reachable marking on the net, and every transition enabled by it correspond to a possible extension. Thus finding possible extensions requires, conceptually, enumerating all reachable markings of the prefix and searching for the transitions of the net enabled by the labelling of those markings.

Again the construction would not stop if the net contains a reachable loop, and again, the algorithm designates some events as cutoff, preventing the prefix from being extended after them. An event is a cutoff if the marking of its local configuration (see § 2.4.1) is labelled by a marking that equals that of the local configuration of another event. Because the net is bounded, finitely many markings are reachable and the construction always stops with a finite prefix. As before, the algorithm relies on some strategy to chose the next event to extend the prefix. For digraphs, all strategies yield complete prefixes, but not for Petri nets, see [START_REF] Esparza | A negative result on depth-first net unfoldings[END_REF][START_REF] Esparza | Unfoldings -A Partial-Order Approach to Model Checking[END_REF]. In [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF], a class of so called adequate strategies is presented that produce prefixes no larger than the reachability graph of the net.

The two key steps in McMillan's algorithm are thus (i) computing the possible extensions and (ii) deciding whether an event is a cutoff. Solutions for both were proposed by McMillan [McM93b;[START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF] and improved by others [ER99; ERV02; KKV03]. In particular, the use of concurrency relations to efficiently compute possible extension was proposed in [START_REF] Esparza | An Unfolding Algorithm for Synchronous Products of Transition Systems[END_REF].

Unfoldings for contextual nets can, conceptually, be constructed with McMillan's algorithm. For that, one first needs to appropriately lift the notion of cutoff and find an efficient algorithm for computing the extensions of the prefix.

A solution to the problem of choosing cutoffs in contextual unfoldings was given in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], at the price of making the underlying theory notably more complicated. In particular, computing a complete prefix required to annotate every event e with a subset of its histories; roughly speaking, a history of e is a set of events that must precede e in a possible execution. How to effectively store these histories was left open.

Moreover, [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] did not address how to effectively compute possible extensions. It remained unclear whether contextual unfolding could be implemented with reasonable efficiency, and how. For safe nets, the interest of computing a complete contextual prefix was not evident from a practical point of view: while the prefix can be exponentially smaller than the complete prefix of the corresponding PR-encoding, the intermediate structure used to produce it has asymptotically the same size. More precisely, the number of histories in the contextual prefix of a safe c-net matches the number of events in the prefix of the PR-encoding (for general bounded nets, this is not the case).

In this chapter we address these open issues and propose an algorithmic solution for constructing finite, marking-complete contextual net unfoldings. Our solution is based on concurrency relations. In particular, we make the following contributions:

• We provide key elements to implement contextual-net unfoldings efficiently, including the necessary results to maintain a concurrency relation and exploit it for computing the possible extensions. We compare our approach to the one independently proposed in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF].

• We generalise the results in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] in order to deal with a slight generalisation of the adequate orders from [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. Although not very surprising, this extension is quite relevant in practice as it can drastically reduce the size of the resulting prefixes.

We implemented both our approach and the one in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], aiming for a competitive verification tool. The resulting implementation will be described in Ch. 7. Experiments with it suggest that efficient contextual unfolding is possible and performs better than the PR-encoding, even for safe nets.

The chapter is structured as follows. § 3.2 recalls the notion of history and cutoff, introducing a number of technical results that will be necessary later in the chapter. In § 3.3 we lift adequate orders from ordinary nets to c-nets, and show that they yield marking-complete prefixes. An abstract unfolding procedure is presented in § 3.4, and it is shown to construct marking-complete prefixes under given conditions. The rest of the chapter is devoted to presenting theoretical results enabling efficient algorithms for finding possible extensions of the prefix. Section 3.5 explains possible methods for this task; one of them is the development of concurrency relations, and we propose one in § 3.6. We next characterize possible extensions of the prefix with this relation, in § 3.7. The concurrency relation has to be maintained as the prefix grows, and § 3.8 provides theoretical results for this. Our characterization of possible extensions allows to construct the same possible extension multiple times. We refine this characterization in § 3.9. In § § 3.10 and 3.11, we compare our approach to computing possible extensions and the one in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. We conclude in § 3.12.

pruning the unfolding

Finite, marking-complete unfolding prefixes are constructed iteratively. The two main tasks that the unfolder carries out during the construction are:

1. Identifying possible extensions, i.e., computing the events and conditions that shall be appended to the currently constructed prefix. 2. Deciding which events are the cutoff points, i.e., the events after which the construction does not need to continue because they do not contribute with new markings to the prefix.

In this section we focus on the second task. For ordinary nets, McMillan's algorithm identifies a set of so called cutoff events, and constructs the maximal prefix without cutoffs. Whether an event e is a cutoff depends on the marking mark([e]) reached by the local configuration [e] and the events already present in the prefix. Every event is thus identified with a single marking of N.

However, for c-nets every event has, loosely speaking, different local configurations and it is not clear, a priori, which should be taken in order to associate a marking to the event. Such local configurations are formally called histories, they will be defined below.

Considering only the local configuration [e] produces a finite prefix that unfortunately is not necessarily marking-complete, as observed in [START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF], see Fig. 12. Instead, considering all histories [START_REF] Winkowski | Reachability in Contextual Nets[END_REF] would yield a finite and marking-complete prefix, but an event may have infinitely many histories and the approach is not constructive.

A solution has been presented in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], where the authors proposed to consider only a finite subset of useful histories, showing that this suffices

c 1 (p 2 ) e 1 (t 2 ) e 3 (t 3 ) c 3 (p 4 ) c 6 (p 2 ) c 5 (p 3 ) e 2 (t 1 ) c 2 (p 1 ) p 2 t 2 p 1 t 1 p 3 t 3 p 4 (b) (a)
Figure 12: (a) A c-net; (b) a prefix of its unfolding. Applying McMillan's algorithm to (a) using only local configurations produces a prefix that is not marking-complete. In fact, it produces the prefix (b) without event e 3 . Event e 3 would be considered a cutoff, as its local configuration reaches the initial marking. Then {e 1 , e 2 , e 3 } is not a configuration of the built prefix, and marking {p 2 , p 3 } is unreachable on it.

to guarantee marking-completeness. This will be the approach followed in this chapter. The notion of history can thus be seen as a suitable generalization of McMillan's local configurations [START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF] to contextual unfoldings. Following [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], we now present the formal definition.

First, let us fix notation for the rest of the chapter. Unless otherwise stated we let N := P, T, F, C, m 0 be a finite, bounded c-net satisfying the general assumptions in p. 18. We let U N := B, Ẽ, G, D, m0 , h denote the full unfolding of N. The history of e in C is the set of events that fire before e in every possible firing sequence that involves all events in C. Such history will necessarily contain [e], but may contain other events of C as well. Notice that a history is always a configuration, as the definition claims: it is causally closed, free of cycles in ր, and satisfies (19) because C already satisfies it.

Definition 1 (history).

For instance, let C := {e 1 , e 2 , e 3 } be a configuration in Fig. 12 (b). The history of e 3 in C coincides with C; the history of e 2 is {e 1 , e 2 }, which coincides with [e 2 ]. Consider now Fig. 11 and let C := {e 2 , e 4 , e 8 , e 1 } be a configuration there. The history of e 4 in C is the set {e 2 , e 4 }. Indeed, it does not hold that e 1 ր e 4 or e 8 ր e 4 , so e 1 and e 8 must be excluded from the history. The history of e 1 in C is C \ {e 8 }, again because e 8 is not in asymmetric conflict to e 1 .

The local configuration [e] of any event e is always a history of e. While in Petri net unfoldings each event has exactly one history, a contextual unfolding may have multiple histories per event. For instance, in Fig. 12 (b), Hist(e 3 ) = {{e 1 , e 3 }, {e 1 , e 2 , e 3 }}.

Events may even have infinitely many histories. Consider the unfolding of the net shown in Fig. 13 (a), a prefix of which is shown in Fig. 13 (b). The unfolding produces infinitely many copies of transition t 1 as events

p 1 p 2 t 2 t 1 c 1 (p 1 ) c 3 (p 1 ) c 4 (p 1 ) c 5 (p 1 ) e 1 (t 1 ) e 3 (t 1 ) e 4 (t 1 ) c 2 (p 2 ) e 2 (t 2 ) (b) (a)
. . . e 1 , e 3 , e 4 . . . All of them are in asymmetric conflict with e 2 , whose histories are all infinitely many configurations that contain e 2 . Some technical results will be necessary for future developments in this chapter:

Remark 7. Let C be a configuration of U N , and e, e ′ ∈ C events in C. Then:

1. C[[e]] ⊑ C; (22) 2. ¬ (C[[e]] # C[[e ′ ]]); (23) 3. If e ր * C e ′ , then C[[e]] ⊑ C[[e ′ ]] (24) 4. For any A, B ⊆ C, it holds that ¬ ( ê∈A C[[ ê]]) # ( ê∈B C[[ ê]]) (25)
Proof. We show each statement independently:

1. This is a consequence of (25) and Rmk. In any case we reach a contradiction, so ¬(C 1 # C 2 ) holds.

Given a configuration H that is also a history, the event e of which H is a history is uniquely determined. That event e is, by definition, the ր-maximal event in H. However, it will be convenient to write the event together with the history, in the form of an enriched event.

Definition 2. If e ∈ Ẽ is an event and H ∈ Hist(e) a history of e, a pair e, H is called enriched event.

McMillan's algorithm labels every event with the marking of its local configuration, and we have already given the notion of history as a suitable generalization for c-net unfoldings. A second ingredient in the algorithm is an order on the configurations of the unfolding. It will be used to decide in which order events of U N will be appended to the prefix. Definition 3 (strategy). A strategy on U N is any strict partial order ≺ on the finite configurations of U N verifying that for all finite C, C ′ ∈ conf (U N ),

if C ⊏ C ′ then C ≺ C ′ .
For the rest of this chapter we fix an arbitrary strategy ≺ on U N . Strategies not only fix the order in which the events of U N are appended to the prefix. They parametrize the definition of the cutoff event set, i.e., different strategies identify different sets of cutoff events. For ordinary Petri nets, such identification is done through the local configuration of the event: to decide whether e is a cutoff, one needs to examine whether C ≺ [e] holds for certain configurations C of the prefix. For c-nets, we need to compare not only [e], but the possibly multiple histories of e to decide whether e should be included in the prefix. This amounts to lifting the notion of cutoff from events to histories or, in other words, to enriched events: Definition 4 (feasible and cutoff enriched events). An enriched event e, H is ≺-feasible if for all e ′ ∈ H with e ′ = e, the enriched event e ′ , H[[e ′ ]] is not ≺-cutoff. A ≺-feasible enriched event e, H is ≺-cutoff if either:

1. mark(H) = m 0 , or 2. there exists some ≺-feasible enriched event e ′ , H ′ ∈ U N , called corresponding, such that H ′ ≺ H and mark(H) = mark(H ′ ).

The idea of using enriched events as cutoffs is from [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], but our definition is more in line with [START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF][START_REF] Esparza | Unfoldings -A Partial-Order Approach to Model Checking[END_REF]. Intuitively, feasible events correspond to those explored by the unfolding algorithm. Cutoff events are those that will be discovered but not appended to the prefix, and feasible non-cutoff will be those appended to the unfolding prefix. We will come back to this in § 3.4.

Recall that we assumed the c-net N to be bounded. Due to this reach(N) is a finite set, and we can show the following:

Lemma 3. If e, H is ≺-feasible, then depth(H) < | reach(N)|.
Proof. Assume that there is some ≺-feasible enriched event e, H that sat- ]]) of n + 1 markings associated to those events, together N's initial marking m 0 . By the pigeonhole principle, such a sequence repeats a marking at least twice. Let e i be the event associated to the first repetition.

isfies depth(H) ≥ | reach(N)|. Let e 1 < i c 1 < i e 2 < i c 2 . . . c n-1 < i e n = e

Either mark(H[[e

i ]]) = m 0 and e i , H[[e i ]] is a ≺-cutoff, or there is some j < i such

that mark(H[[e j ]]) = mark(H[[e i ]]). Because e j < e i , by (24), we know that H[[e j ]] ⊑ H[[e i ]], which in turn implies that H[[e j ]] ≺ H[[e i ]]. Then e i , H[[e i ]

] is a ≺-cutoff as well, which is a contradiction to e, H being ≺-feasible.

We can now show that the sets of ≺-feasible and ≺-cutoff events in Def. 4 are well defined and unique: Lemma 4. Definition 4 identifies exactly one finite set of ≺-feasible enriched events and one finite set of ≺-cutoff events, for any given strategy ≺. 1: Enriched events associated to the events of Fig. 12 (

b).

Proof. There is finitely many ≺-feasible enriched events because their depth is bounded by | reach(N)| and there are finitely many events in U N of any given depth, and therefore finitely many histories using only those events. Now we show that for any given strategy ≺, Def. 4 defines a unique set of ≺-feasible and ≺-cutoff enriched events. For a contradiction, let I, L be a collection of, respectively, feasible and cutoff events, and let I ′ , L ′ be a different one. We show that I = I ′ , which in turn implies that L = L ′ . Because I and I are finite and different, the set I \ I ′ ∪ I ′ \ I is finite and non-empty. W.l.o.g., let e, H be an enriched event in

I \ I ′ such that H is ≺-minimal. Since e, H / ∈ I ′ , there is some e ′ ∈ H such that e ′ , H[[e ′ ]
] is in L ′ , also in I, but not in L; i.e., it is cutoff in the second collection, but feasible and non-cutoff in the first. Because it is cutoff in the second, there is some corresponding event in the second collection that is not feasible in the first -otherwise, e ′ , H[[e ′ ]] would be also cutoff in the first. That is, there exist some e ′′ , H ′′

∈ I ′ \ I such that H ′′ ≺ H[[e ′ ]] and mark(H ′′ ) = mark(H[[e ′ ]]). But then H ′′ ≺ H[[e ′ ]]
≺ H and H is not the ≺-minimal history of an enriched event in the difference between I and I, as we assumed.

Abusing the notation, we call an event e ∈ Ẽ ≺-feasible if some enriched event associated to it is ≺-feasible, i.e. if there is some history H ∈ Hist(e) such that e, H is ≺-feasible. Similarly, e is called ≺-cutoff if it is ≺-feasible and all its feasible histories correspond to ≺-cutoff enriched events, i.e., for all H ∈ Hist(e), if e, H is ≺-feasible, then it is also ≺-cutoff.

The intuition behind this definition is that an event will be part of the constructed unfolding prefix only if one feasible, non-cutoff history for that event exists; and will be left outside in the opposite case, i.e., if all feasible histories are also cutoffs.

An important remark is that the set of ≺-feasible events is causally closed. To see this, recall that the local configuration [e] of any event e is contained in any history H ∈ Hist(e). Since any ≺-feasible event e has at least one feasible history H, by Def. 4 every causally related event e ′ ∈ [e] has one feasible, non-cutoff history H[[e ′ ]]. As a result, the ≺-feasible events identify a well-defined unfolding prefix: Definition 5. The ≺-prefix is the unique unfolding prefix P ≺ N whose set of events is exactly the set of ≺-feasible events that are not ≺-cutoff.

The ≺-prefix of an ordinary net was first defined in [START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF], where it was called the canonical prefix.

We now present several examples. Consider the unfolding of Fig. 12 (a), a prefix of which is shown in Fig. 12 (b). Consider the size strategy ≺ 1 defined as 2: Some enriched events associated to the events of Fig. 13 (b).

C ≺ 1 C ′ iff |C| < |C ′ |.
According to the table, all the three events e 1 , e 2 , e 3 are feasible and not cutoff, as they have at least one feasible, non-cutoff history. They would therefore be part of the ≺ 1 -prefix. It is actually not difficult to see that the ≺ 1 -prefix only contains these three events. As for the unfolding of Fig. 13 (a), using the same strategy, we would have the enriched events listed in Table 2. In this case, all feasible enriched events associated to e 1 are cutoffs, so we declare e 1 cutoff; as for e 2 , among its feasible histories, at least one is not a cutoff, so e 2 is feasible and not cutoff. The ≺ 1 -prefix in this case would only contain the event e 2 .

adequate strategies and completeness

The shape and size of P ≺ N depends on the particular choice of the strategy ≺. By Lemma 4 we know that P ≺ N is finite for every strategy. In this section we show that for adequate strategies it is also marking-complete.

For contextual unfoldings, the only strategy that was known to generate marking-complete prefixes was the size strategy, defined in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] as:

C ≺ M C ′ iff |C| < |C ′ | (26)
This condition was originally introduced by McMillan [START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF] in his seminal paper on Petri net unfoldings. However, it is known that McMillan's order may create complete prefixes that are up to exponentially larger than the reachability graph [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. This is because ≺ M is a partial order: multiple enriched events may lead to the same marking, but if they are incomparable (because their histories have the same size), then none of them is a cutoff. Figure 14 illustrates a net for which this happens. Consider the two events labelled by t 1 and u 1 . For both, the local configuration produces marking p 2 and has size 1. Then their local configurations are incomparable with ≺ M and none of them is a cutoff. Similarly, any two events whose local configuration produces the marking p i , for 2 ≤ i ≤ n + 1, has the same size and is incomparable with ≺ M . As a result, none of the exponentially many feasible events is a cutoff.

It is therefore preferable to replace McMillan's order by a suitable finer order, ideally a total order, in which case the resulting prefix will have at most as many events as there are reachable markings in the net (and usually far fewer).

For ordinary nets, this problem was addressed in [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF], where adequate strategies were introduced (called adequate orders in [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]). Any adequate order will yield a complete prefix, and [ERV02] exhibits an adequate order that is total for safe nets. Below, in Def. 6, we present a slight

p 1 t 1 u 1 t 2 t 2 u 2 u 2 p 3 p 3 . . . . . . . . . . . . . . . p 2 p 2 p 3 p 3 . . . . . . . . . t 1 u 1 t 2 p 2 p 3 p 1 u 2 . . . p n t n u n p n+1 (a) (b)
Figure 14: A c-net (a) whose unfolding (b) is exponentially larger than the set of reachable markings.

generalisation of the adequate orders from [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF] that is more suitable for c-nets. We then show that these orders also yield complete prefixes.

Definition 6 (adequate strategy). An strategy ≺ is adequate if it satisfies:

1. ≺ is well founded; 2. ≺ is preserved by finite extensions, i.e., if C ≺ C ′ , and mark(C) = mark(C ′ ), then for any finite extension X of C there is some finite extension X ′ of C ′ such that a) C ∪ X ≺ C ′ ∪ X ′ , and b) mark(C ∪ X) = mark(C ∪ X).
The adequate strategies introduced in [ERV02] are slightly less general than in Def. 6. In particular, the second condition asked for the finite extension X ′ to be isomorphic to X. In [KKV03, Def. 2, item 3(b)], this condition was stated as in Def. 6, i.e., any finite extension suffices. Our notion of adequate strategy differs from the one in [KKV03] only on the fact that ≺ refines the evolution order ⊑ rather than subset inclusion ⊆. Note that for Petri net unfoldings C ⊂ C ′ implies C ⊏ C ′ , hence the two notions coincide. However, for contextual unfoldings this is not the case; for instance, in Fig. 12 {e 1 , e 3 } ⊏ {e 1 , e 2 , e 3 }. For c-nets, Def. 6 is thus a slight generalisation of both [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF][START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF].

Theorem 1. P ≺ N is marking-complete if ≺ is adequate. Proof. Let m be an arbitrary reachable marking of N. There exists a finite configuration C of U N such that mark(C) = m. Either C is a configuration of P ≺
N , and we are done, or C contains some ≺-cutoff event e. In the latter case, e, C[[e]] is ≺-cutoff and by Def. 4, its corresponding enriched event e ′ , H ′ satisfies

H ′ ≺ C[[e]], and mark(H ′ ) = mark(C[[e]]). Since C \ C[[e]] is a finite extension of C[[e]], by Def. 6 there is some finite extension X ′ of H ′ satisfying H ′ ∪ X ′ ≺ C, and mark(H ′ ∪ X ′ ) = mark(C).
We have found a finite configuration C ′ := H ′ ∪ X ′ of U N that reaches the same marking m and is ≺-smaller. If C ′ is not yet a configuration of P ≺ N , it suffices to iterate this argument finitely many times until we get a configuration of P ≺ N because ≺ is well-founded. Theorem 1 states that any strategy ≺ satisfying Def. 6 will yield a markingcomplete ≺-prefix. It is easy to see that ≺ M , defined in (26) is adequate, but it may give rise to very large prefixes.

The essence of the problem is that ≺ M is not a total order. Any total strategy orders any pair of ≺-feasible enriched events. Thus in any set of more than | reach(N)| enriched events, the histories of two of them share the same marking and one is smaller than the other; therefore one of them is a ≺-cutoff. This shows that Remark 8. If ≺ is total, the number of ≺-feasible enriched events that are not

≺-cutoff is bounded by | reach(N)|.
This remark entails that if ≺ is adequate and total, the ≺-prefix is markingcomplete and not larger than the reachability graph of N. At this point, the natural question is whether we can find an adequate and total order. In [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF], the order ≺ F is presented, and shown to be adequate and total for ordinary nets. Clearly, ≺ F is adequate for contextual nets according to our definition, and showing that it is total is straight-forward.

unfolding procedure

In previous sections we have defined P ≺ N and shown that it is (i) finite, (ii) marking-complete if ≺ is adequate, and (iii) have no more events than N has reachable markings if ≺ is total. Following [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], in this section we present a procedure for constructing P ≺ N . Histories had a prominent role in the definition of the ≺-prefix. Consequently, they are also key in its construction. To construct the ≺-prefix, one annotates events with a subset of their histories. This annotation is formalized by the function χ in our next definition: E,G,D,m0 , and χ : E → 2 2 E satisfies that for all e ∈ E:

Definition 7 (enriched prefix). [BCKS08] An enriched prefix (EP) is a tuple E := O, h ′ , χ such that O, h ′ is an unfolding prefix, O := B,
• ∅ = χ(e) ⊆ Hist(e),

and (27) • for all H ∈ χ(e) and e ′ ∈ H, we have H[[e

′ ]] ∈ χ(e ′ ). (28)
Condition ( 27) simply asks that every event is labelled by a non-empty set of histories of that event. Remark that it does not require χ(e) to include all potentially infinitely many histories in Hist(e).

The second condition (28) requires the labelling χ to be closed by the operation 'history of ': if χ(e) contains one history H, then any event in H must be labelled with its history in H. This property will allow us in § 3.7 to construct EPs incrementally.

For the rest of this chapter, we fix an arbitrary enriched prefix E := O, h, χ where O := B, E, G, D, m0 . This is in addition to the notation already fixed: the net N, the unfolding U N , and the strategy ≺. We take the labelling h of U N as the homomorphism for the underlying unfolding prefix O, h of E , which is a safe abuse of notation, as we explained at p. 27.

Let us define some notation for EPs. An enriched event e, H belongs to E , written e, H ∈ E , if e ∈ E and H ∈ χ(e). A configuration of E is a Algorithm 1 Contextual unfolding procedure Input: A bounded c-net N := P, T, F, C, m 0 satisfying the general assumptions in p. 18 and a strategy ≺.

Output: An enriched prefix E = O, h, χ , with O = B, E, G, D, m0 and χ : E → 2 2 E . Create n := |m 0 | new conditions c 1 , . . . , c n Set m0 := {c 1 , . . . , c n } Set h such that h( m0 ) = m 0 χ := ∅ X := pe(E ) while X = ∅ do Remove from X one enriched event e, H s.t. H is ≺-minimal if e, H is not ≺-cutoff then if e / ∈ E then Append e to O end if Append H to χ(e) Create n := |h(e) • | new conditions c 1 , . . . , c n Set e • := {c 1 , . . . , c n } Set h such that h(e • ) = h(e) • X = pe(E ) end if end while any configuration C of O satisfying C[[e]] ∈ χ(e) for all e ∈ C. We denote by C ∈ E that C is a configuration of E . Finally, we call E marking-complete iff for every reachable marking m of N there exists a configuration C ∈ E verifying mark(C) = m.
Unfolding prefixes of ordinary Petri nets are built incrementally. Similarly, in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] a complete contextual prefix is constructed by a saturation procedure that adds one enriched event at a time until there remains no addition that would contribute new markings. Such appended enriched events are called possible extensions:

Definition 8 (possible extension). An enriched event e, H is a possible exten- sion (PE) of E if e, H / ∈ E and e ′ , H[[e ′ ]] ∈ E for all e ′ ∈ H \ {e}.
We will denote by pe(E ) the set of possible extensions of E . We can now present an algorithm for constructing P ≺ N . Algorithm 1 takes as input a bounded c-net N and an arbitrary strategy ≺. It builds an enriched prefix E := O, h, χ whose size and shape depends on the choice of ≺. The algorithm can thus be seen as a family of algorithms, one for each strategy.

The construction proceeds iteratively. O is initially set as a copy of N's initial marking: an unfolding prefix with only conditions. X is initialized to the PEs of such a prefix, enriched events associated to events that consume from the initial marking. All such enriched events are necessarily ≺-feasible.

The loop iteratively extends the prefix with one enriched event whose history is ≺-minimal among all the PEs of the prefix at that time. Observe that, due to the choice of possible extensions in Def. 8, property (28) remains invariantly true on the successive versions of E N that the loop produces: (28) is clearly satisfied initially, when there are no events; and every addition of a PE maintains the property. Similarly, since ≺-cutoff extensions are skipped, the prefix only contains feasible (enriched) events.

An specialization of Algorithm 1, where the arbitrary strategy taken as input was instead the size strategy ≺ M , was first introduced in [BCKS08]. That specialization was there shown to produce finite and marking-complete prefixes. Here we show that it always terminates, producing the ≺-prefix, when invoked with arbitrary strategies: Theorem 2. Algorithm 1 always terminates and produces a prefix O, h, χ such that O, h = P ≺ N when invoked on a bounded c-net N and some strategy ≺. Proof. We first show that the algorithm only appends ≺-feasible enriched events to the prefix. The proof is by induction on the size of the history. Let e, H be the last enriched event that Algorithm 1 appended to the prefix.

If |H| = 1, then it is ≺-feasible by definition. Assume that |H| ≥ 2. All e ′ , H[[e ′ ]]
, where e ′ ∈ H, are already in the prefix and, by induction hypothesis, we can assume they are ≺-feasible. The algorithm never appends a ≺-cutoff enriched event, and as a result e, H is necessarily ≺-feasible.

We now show that the algorithm always terminates. We start by observing that any finite enriched prefix always has finitely many PEs. This is a consequence of the fact that every finite configuration of U N enables finitely many events, which in turn holds due to (21). Now, any time pe(•) is called within the loop, an enriched event is added to the prefix. Such enriched event is ≺-feasible and there are finitely many of them. Therefore, Algorithm 1 ever adds finitely many enriched events to the set X. As a result, the while loop makes finitely many iterations.

Finally, we show that every ≺-feasible, non ≺-cutoff enriched event is eventually added to the prefix. We do it by induction on the depth of the event. Let e, H be ≺-feasible and not ≺-cutoff. Assume that depth(e) = 1. Then H = {e}, and e, H is included in X on the first call to pe(•), just before the loop starts. Since finitely many events are ever added to X, e, H will eventually be appended to the prefix. Now assume that depth(e) > 2. By induction hypothesis, assume that all e ′ , H[[e ′ ]] with e ′ ∈ H have already been added to the prefix. Then e, H is by definition a PE and will be included in X on the next call to pe(•). Again, once an extension is in X it will eventually be extracted. Since e, H is not ≺-cutoff, it will also be appended to the prefix.

It follows that Algorithm 1 constructs complete prefixes when invoked with adequate strategies.

Corollary 1. Algorithm 1 constructs a finite, marking-complete unfolding prefix P ≺

N when invoked on N, ≺ if ≺ is adequate.

possible extensions

In the previous section, we deliberately left unspecified the algorithm to compute PEs. In this section, we discuss two existing approaches to compute PEs for ordinary unfoldings, explaining the issues that prevent lifting one of them to contextual unfoldings. This will serve as introduction to the developments in the next section, where we address these issues.

The main computational problem of Algorithm 1 is to identify the PEs in each iteration. For ordinary net unfolders, which do not deal with histories, this requires identifying sets M of conditions such that conc(M) and h(M) =

• t for some t ∈ T, cf. the inductive rule Ev on p. 26. Two approaches have been proposed to this respect for ordinary unfoldings:

1. Backwards Exploration. A given a set M ⊆ B of conditions from the prefix is coverable iff there is no two conditions from M in symmetric conflict. The flow relation in an unfolding prefix is acyclic, so exploring [M] in backwards direction, from M to the initial marking, suffices to determine whether conc(M) holds. This approach uses a working list, initialized to M. Then it iteratively extracts a node from the list and visits its causal immediate predecessors. All unvisited predecessors are appended to the working list; if an event is visited for the second time, it is not included in the working list. If a condition is visited twice, then a symmetric conflict has been found, and the algorithm stops. If the working list is eventually empty and no conflict has been found, then M is coverable. This algorithm runs in linear time on the prefix. 2. Concurrency Relations. [START_REF] Esparza | An Unfolding Algorithm for Synchronous Products of Transition Systems[END_REF] For ordinary unfoldings, it is known that conc(M) holds iff conc({c, c ′ }) holds for all pairs c, c ′ ∈ M. Deciding whether M is coverable thus reduces to decide whether {c, c ′ } is coverable for all such pairs. One can therefore construct a binary concurrency relation on conditions and use it for finding PEs. Moreover, this binary relation can be computed efficiently and incrementally during prefix construction. This idea is exploited by existing tools such as Mole [Sch] or Punf [Kho]. The latter unfolder can also employ backwards exploration.

Turning now the attention to c-net unfoldings, the first method can be applied seamlessly to contextual prefix construction. The set M is, in this case, coverable iff the set of events in [M] does not induce a cycle of asymmetric conflict. This can be easily detected by a depth-first search on [M]. One would explore the edges asymmetric conflict backwards, stopping as soon as a back edge is found, which indicates the existence of a cycle.

However, applying the second method to contextual unfolding entails some difficulties. Roughly speaking, these come from the fact that the above statement about conc(•) and binary concurrency relations is invalid for contextual unfoldings. Consider again the net shown in Fig. 10 (a) on p. 23, which is identical to its unfolding, and the set M := {c 4 , c 5 , c 6 }. Clearly, M is not coverable, but all the elements of M are pairwise coverable. For instance c 4 , c 5 may be covered by firing e 1 , then e 2 . In fact, [{c 4 , c 5 , c 6 }] = {e 1 , e 2 , e 3 } cannot be fired in the same run because e 1 ր e 2 ր e 3 ր e 1 , i.e., it includes a cycle of asymmetric-conflict and it is not a configuration.

a concurrency relation for efficient construction

In the following, we introduce a binary relation for c-net unfoldings in which pairwise concurrency does imply reachability of the whole set. This relation is defined on conditions enriched with histories.

Definition 9 (histories for conditions). Let c ∈ B be a condition.

• A generating history of c is ∅ if c ∈ m 0 , or H ∈ Hist(e), where {e} = • c. • A reading history of c is any H ∈ Hist(e) such that e ∈ c. • A compound history of c is any configuration H 1 ∪ H 2 , where H 1 and H 2 are histories of c verifying ¬(H 1 # H 2 ).
In general a history of c is any of the three preceding kinds of histories.

In words, for a condition c, not belonging to the initial marking, a generating history is any history of the unique event producing c. When c is in the initial marking it has only an empty generating history. A reading history is any history of the events reading c. Compound histories are conflict-free combinations of generating and (possibly multiple) reading histories.

If H is a history of c, we call c, H an enriched condition (EC), referred to as generating, reading, or compound condition, according to H. Our notation for ECs is similar to that for enriched events. We say that c, H ∈ E if for all e ∈ ( • c ∪ c) ∩ H it holds that H[[e]] ∈ χ(e), i.e., H is built from histories in χ. The mapping h is extended to enriched events and conditions by h( e, H ) := h(e) and h( c, H ) := h(c).

Definition 10 (concurrency for ECs). Two ECs c, H

, c ′ , H ′ are said to be concurrent, written c, H c ′ , H ′ , iff ¬(H # H ′ ) and c, c ′ ∈ cut(H ∪ H ′ ). ( 29
)
To illustrate the definition, we give some examples from Fig. 12.

• c 1 , ∅ c 3 , {e 1 } because c 1 / ∈ cut({e 1 }); • c 6 , {e 1 , e 3 } c 5 , {e 1 , e 2 } because {e 1 , e 3 } # {e 1 , e 2 }; • c 6 , {e 1 , e 3 } c 6 , {e 1 , e 2 , e 3 } because {e 1 , e 3 } # {e 1 , e 2 , e 3 }; • c 1 , ∅ c 2 , ∅ ; • c 3 , {e 1 } c 3 , {e 1 , e 2 } ;
Relation on ECs allows to recover full information about coverability of conditions, as it was possible for ordinary unfoldings. This is easy to see formally. Let M := {c 1 , . . . , c n } ⊆ B be a set of n conditions. Using Lemma 2, one can show that conc(M) holds iff there exists n histories H 1 , . . . , H n , one for each condition in M, such that c i , H i c j , H j holds for 1 ≤ i < j ≤ n, i.e., the associated ECs are pairwise concurrent. In other words, reachability of n ECs reduces to O (n 2 ) queries to a binary, as it was the case for ordinary nets. The price to pay now is that we need to keep track of histories for conditions.

Remark 9. For ECs ρ := c, H and ρ ′ := c ′ , H ′ , the statement ρ ρ ′ is equivalent to the conjunction of the next four statements:

1. ¬(∃e 1 ∈ H, ∃e 2 ∈ H ′ \ H, e 2 ր e 1 ) 2. ¬(∃e 1 ∈ H ′ , ∃e 2 ∈ H \ H ′ , e 2 ր e 1 ) 3. ¬(∃e ∈ H, c ′ ∈ • e) 4. ¬(∃e ∈ H ′ , c ∈ • e)
The following Lemma 5 will be useful in the subsequent proofs. It essentially states that all distinct histories of one event are in conflict, and that, as a consequence, no two distinct generating ECs are concurrent.

Lemma 5. Let H, H ′ be two histories of the same event e and c ∈ e • a condition in its postset. The following statements are equivalent:

1. ¬(H # H ′ ). 2. There is a configuration C such that H, H ′ ⊑ C. 3. Generating conditions ρ := c, H and ρ ′ := c, H ′ satisfy ρ ρ ′ . 4. H = H ′ .
Proof. By definition of #, in p. 25, 1) and 2) are equivalent. Also by definition, 3) implies 1); and 1) implies 3) because there is no way in which either H or H ′ can consume a condition in the preset of e, as e is ր-maximal in any of its histories. Trivially 4) implies 1), so we only show that 1) implies 4).

Assume that 1) holds but 4) not, and that H \ H ′ contains, w.l.o.g., some event e ′ . Since e ′ ր * H e, it is easy to see that there exists some e 1 ∈ H \ H ′ and e 2 ∈ H ′ with e 1 ր e 2 , which by Rmk. 5 implies H # H ′ , a contradiction.

We are now ready to present how can be used to compute PEs. The rest of the chapter is actually devoted to this point.

In § 3.7, we first characterize PEs in terms of in a way suitable for constructing them algorithmically once has been constructed. However, for each extension added to the prefix, new enriched conditions are appended, and one needs to update an stored copy of with the newly appended conditions. We present in § 3.8 an inductive characterization of that allows for this. Our characterization of PEs with allows to construct the same PEs from different collections of enriched conditions. In § 3.9, we refine the characterization in order to obtain a unique decomposition for each PE. We then compare from a theoretical point of view our approach and another one independently developed in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], discussing their benefits in § 3.10 and their memory usage in § 3.11.

Another approach for computing PEs, presented in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], has been developed independently and at the same time as we worked on the method presented in following sections. Our approach was originally presented in [RSB11b], where we additionally discussed implementation details and gave an experimental evaluation. On a latter publication [BBC+12], the authors of both approaches made a coherent presentation of both solutions, comparing their differences and discussing their merits.

Following [BBC+12], in the remaining sections of this chapter we interleave the presentation of both approaches. Each approach proposes a different solution to each of the multiple subproblems that arise in producing an efficient algorithm for computing PEs. Our exposition alternates the presentation of both approaches for each such subproblem, which, we think, eases the comparison of both solutions.

Before we proceed, let us recall a notion that will be necessary in the sequel, that of an ancestor:

Definition 11 (ancestor). [BBC+10] Let ρ = c, H be a reading history. The ancestor of ρ, denoted ρ ↑ , is the unique generating condition c, H ′ such that H ′ ⊑ H.
Note that indeed H ′ is uniquely determined due to Lemma 5.

characterizing possible extensions concurrency

Our first step is to characterize PEs in terms of concurrent ECs; this is the goal of this section.

As we explained above, we discuss two ways of computing PEs. We call them, for reasons that we explain below, the lazy and eager approach. The first one was introduced in [BBC+10], while the second one is a contribution of us, originally presented in [RSB11b].

The lazy approach avoids constructing compound ECs, therefore reducing the number of ECs constructed by the unfolding algorithm. The eager approach does use compound conditions, which saves work when searching for PEs. In the light of these approaches, compound ECs can be seen as pre-calculated coverability information that the eager approach computes and stores before starting to search for PEs. The lazy approach computes equivalent information on the fly, every time that a PE is searched, and discards it once the search is done. As a result, the same information is possibly computed several times. Although this can incur computation overheads, it has the benefit of using the memory less eagerly. The eager approach computes ECs only once and avoids the overhead, but may store unnecessary compound ECs in memory.

Lazy Approach

The lazy approach [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] is based on the observation that the history associated with an event can be constructed by taking generating and reading histories for places in the pre-set, and generating histories for places in the context. The following Prop. 1 employs this facts to characterize enriched events in terms of concurrent collections of generating and reading histories. The proposition is a modified version of the Lemma 1 in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. Some remarks seem to be necessary at this point. Proposition 1 modifies the Lemma 1 of [BBC+10] in several aspects. First, we remove one technical condition of Lemma 1 to make Prop. 1 suitable to for fair comparison to our contribution, the eager approach, introduced in Prop. 2. Second, we provide a characterization while Lemma 1 in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] only states half of this characterization: where Prop. 1 says 'iff ', Lemma 1 says 'only if '. Third, although we gave an original and dedicated proof of Prop. 2 (published in [START_REF] Rodríguez | Efficient contextual unfolding[END_REF], the long version of [RSB11b]), in [BBC+12] we rewrote it to reuse the proof of Prop. 1, and it will be this new, shorter proof the one we will give in § 3.7.2 for Prop. 2. For these three reasons, we present here a proof of Prop. 1.

Proposition 1 (possible extensions -lazy). A pair e, H is an enriched event iff there exist sets X p , X c of ECs such that

• h(X p ) = • t and h(X c ) = t, with h(e) = t;

(30) • X p contains only generating or reading ECs;

(31) • X c contains only generating ECs;

(32)

• X p ∪ X c has exactly one generating EC for each c ∈ ( • e ∪ e), ( 33
) • ρ ρ ′ holds for all ρ, ρ ′ ∈ X p ∪ X c ; (34) • finally, H = {e} ∪ c,H ′ ∈X p ∪X c H ′ . (35)
Proposition 1 allows to identify new possible extensions whenever a prefix is extended with new ECs. Compound conditions are avoided at the price of allowing X p to contain, for every c ∈ • e, an arbitrary number of reading conditions.

To illustrate the meaning of X p and X c in Prop. 1, consider Fig. 15. To create a history for event e, X p must contain generating histories for c 2 and c 3 , i.e., histories of events e 3 and e 4 . Optionally, X p may contain one or more reading histories of c 3 , coming from e 5 or e 6 or both. As for X c , it must contain a generating history of c 1 , coming from e 2 , but it cannot contain a reading history of c 1 . In fact, note that e 1 is not an asymmetric-conflict predecessor of e, hence it is not included in any history of e.

Proof. We prove Prop. 1 in two steps. First assume that e, H is an enriched event. We construct sets X p and X c that satisfy (30) to (35). We start defining X p . Property (31) requests X p to contain generating or reading conditions. We define

X p := X 1 ∪ X 2 ,
where X 1 (resp. X 2 ) are sets of generating (resp. reading) conditions obtained from the generating (resp. reading) histories of • e that extend to H:

X 1 := { c, ∅ : c ∈ • e ∩ m 0 } ∪ { c, H[[e ′ ]] : c ∈ • e \ m 0 ∧ {e ′ } = • c} X 2 := { c, H[[e ′ ]] : c ∈ • e ∧ e ′ ∈ c ∩ H}
For X c , we can only take the generating histories that conditions in e induce in H, as (32) requests:

X c := { c, ∅ : c ∈ e ∩ m 0 } ∪ { c, H[[e ′ ]] : c ∈ e \ m 0 ∧ {e ′ } = • c}
This choice of X p and X c evidently satisfies properties (30) to (33). We now show that they also satisfy (34) and ( 35): From all such e ′′ , pick one that is maximal w.r.t. <. According to the definition of ր in (4) to (6), this leaves three cases: there is a condition c such that either c ∈ • e and e ′′ ∈ • c, or c ∈ • e and e ′′ ∈ c, or c ∈ e and e ′′ ∈ • c. Moreover, since e ′′ ∈ H, we use (22) to conclude that H ′′ := H[[e ′′ ]] is a history such that H ′′ ⊑ H. Thus, in the first two cases, c, H ′′ ∈ X p , and in the third, c, H ′′ ∈ X c . Finally, e ′ ∈ H ′′ because e ′ ∈ H and e ′ ր * H e ′′ . This concludes one direction of the proof. As for the opposite direction, assume that there are sets X p , X c , and H fulfilling properties (30) to (35). We have to show that H is a history of e. To see this, it suffices to show that H is a configuration and that H[[e]] equals H.

• Property (34). Let c 1 , H 1 , c 2 , H 2 ∈ X p ∪ X c . By (23) we have that ¬(H 1 # H 2 ). Moreover, c 1 ∈ cut(H 1 ) and c 2 ∈ cut(H 2 ). Assume w.l.o.g. that c 1 / ∈ cut(H 1 ∪ H 2 ). Then there exists e ′ ∈ H 2 such that c 1 ∈ • e ′ . Since c 1 ∈ • e ∪ e,
• H is causally closed. Any H ′ such that e ′ , H ′ ∈ X p ∪ X c is causally closed.
Moreover, the choice of X p ensures that all causal predecessors of e are contained in H.

• ր H is acyclic. By contradiction, assume that there exists a simple cycle

e 1 ր H e 2 ր H • • • ր H e n ր H e 1 ,
for some n ≥ 2. Either e appears in the cycle or not. If it appears, then w.l.o.g. e 1 = e and e 2 ∈ H 2 , for some c 2 , H 2 ∈ X p ∪ X c . Now, e ր e 2 implies, by (4) to (6), either

-e < e 2 , or -e ∩ • e 2 = ∅, or -• e ∩ • e 2 = ∅. In all cases, H 2 consumes a token from some c 1 ∈ • e ∪ e. Due to (33), X p ∪ X c contains some tuple c 1 , H 1 , but c 1 , H 1 c 2 , H 2 because H 2 consumes c 1 , violating (34). Otherwise, if e does not ap- pear in the cycle, then w.l.o.g. e 2 ∈ H 2 and e 1 ∈ H 1 \ H 2 for some c 1 , H 1 , c 2 , H 2 ∈ X p ∪ X c
, where H 1 = H 2 . By Rmk. 5, we conclude that H 1 # H 2 , which violates (34).

• H[[e]] = H. We need to show that e ′ ր * H e holds for each e ′ ∈ H. Recall that the elements c ′ , H ′ ∈ X p ∪ X c are chosen such that H ′ is either empty or a history of some e ′′ such that e ′′ ր e. Thus, if e ′ = e, we have e ′ ր * H e ′′ ր e for some suitable e ′′ , and for e ′ = e the condition holds trivially.

Eager Approach

The eager approach, instead of attempting to combine generating and reading histories when computing a possible extension, explicitly produces all types of ECs, including compound ones. This means more ECs, but on the other hand less work when computing possible extensions.

Proposition 2 (possible extensions -eager). The pair e, H is an enriched event iff there exist sets X p , X c of ECs such that

• h(X p ) = • t and h(X c ) = t, with h(e) = t;
(36) • X p contains arbitrary ECs;

(37) • X c contains only generating ECs;

(38)

• X p ∪ X c contains exactly one EC for each c ∈ ( • e ∪ e); (39) • ρ ρ ′ holds for all ρ, ρ ′ ∈ X p ∪ X c ; (40) • finally, H = {e} ∪ c,H ′ ∈X p ∪X c H ′ .
(41)

Before we proceed with the proof, let us make some remarks. First, notice that |X p | = | • t| by (36) and (39), whereas no such bound exists in Prop. 1, where multiple reading ECs may be in X p for the same condition. Like Prop. 1, Prop. 2 allows to identify new possible extensions upon addition of new ECs.

As an example, consider again Fig. 15. The set X p must contain an arbitrary history for c 2 and c 3 . Concretely, for c 2 we can take only a generating history, from e 3 , while for c 3 we can use a generating history, from e 4 , a reading history, from e 5 , or a compound history, from the combination of reading histories of e 5 and e 6 . Instead, X c is still restricted to include generating histories only, in this case of c 1 .

Second, one can establish a relation between possible extensions according to Prop. 1 and Prop. 2. That is, for each enriched event we can relate the set X p identified by both propositions. Let X p be a set satisfying the conditions in Prop. 1. We define

Eager(X p ) := { c, c,H ∈X p H : c ∈ • e},
i.e., we merge all generating or reading histories associated to the same condition in • e, to produce generating, reading, or compound ECs. Remark that the elements of X p are concurrent, due to (34), which is necessary to form compound histories, as Def. 9 requests.

On the other hand, if X p is a set as in Prop. 2, let

Lazy(X p ) := { c, H[[e ′ ]] : c, H ∈ X p ∧ e ′ ∈ ( • c ∪ c) ∩ H} ∪ { c, ∅ : c ∈ • e ∩ m 0 }.
In this case we perform the reverse operation, splitting reading or compound histories. Namely, from each reading EC ρ ∈ X p we get two ECs: ρ and ρ ↑ , i.e., a copy of the EC and its ancestor, a generating EC. Similarly, from each compound condition we get the elementary reading ECs forming the compound, together with their ancestors.

We are now ready to state the proof of Prop. 2. As explained at the beginning of § 3.7.1, recall that we prove here Prop. 2 via a reduction to the proof of Prop. 1. See [START_REF] Rodríguez | Efficient contextual unfolding[END_REF], the long version of [RSB11b], for an original, dedicated proof of Prop. 2.

Proof. We shall prove that a collection of ECs satisfying the six conditions in Prop. 1 exists iff another collection exists, and satisfies the six properties in Prop. 2. We will define these collections, the reader may have guessed it, using Eager(•) and Lazy(•).

The proof has again two parts. From left to right, let X p , X c be a pair of sets of ECs as per Prop. 1. We define X ′ p := Eager(X p ) and prove that X ′ p , X c satisfy (36) to (41) in Prop. 2. Conditions (36) to ( 38) and (41) are immediate. For property (39), observe that Eager(•) produces a single history in X ′ p out of all the histories X p from the same condition, so the property holds.

As for property (40), it holds as a consequence of (34) and ( 24), in Rmk. 7. Let

ρ := c, H 1 ∪ . . . ∪ H m , ρ ′ := c ′ , H m+1 , ∪ . . . ∪ H n be ECs in X ′ p ∪ X c , such that c, H i , c ′ , H j ∈ X p ∪ X c for 1 ≤ i ≤ m < j ≤ n. By (34), the elements of X p ∪ X c are concurrent, so c, c ′ ∈ cut(H 1 ∪ . . . ∪ H n ). Moreover, defining suitable sets A, B in (24) it follows that ¬(H 1 ∪ . . . ∪ H m ) # (H m+1 ∪ . . . ∪ H n ), which implies that ρ ρ ′ holds.
This completes the left-to-right direction of the proof. For the opposite direction, let X p , X c be a pair of sets as per Prop. 2. Define X ′ p := Lazy(X p ). We show that X ′ p , X c satisfy all the six properties in Prop.

updating the concurrency relation

The previous section explains how to identify PEs: it suffices to find a set of concurrent ECs satisfying suitable technical conditions. We thus need a technique for efficiently computing the binary concurrency relation on ECs.

This section discusses a method to do this incrementally, i.e., by extending whenever the unfolding grows by the insertion of new ECs. Such extension will be possible thanks to the inductive characterization of that Prop. 3 and Prop. 4 provide.

Again, it shall be useful to contrast our approach with that for ordinary Petri nets. Let e be the last event appended to the unfolding prefix of an ordinary Petri net; let X := • e be its set of pre-conditions, and let c be a condition in the postset of e. One can show [START_REF] Esparza | An Unfolding Algorithm for Synchronous Products of Transition Systems[END_REF] that c is concurrent to

• any other condition in e • ,
• any other condition c ′ from the prefix if c ′ is concurrent to every condition in X, and

• no other condition among those currently in the prefix.

This characterization is at the heart of efficient unfolding construction for ordinary nets. It gives rise to a dynamic programming algorithm to compute concurrency: whenever c is appended to the prefix and we want to compute whether it is concurrent to any other c ′ , we reuse the concurrency information between c ′ and conditions in X to compute the answer. This characterization is not correct for c-nets, even when lifted to ECs. Consider Fig. 12 (b) and let ρ := c 6 , {e 1 , e 3 } ρ ′ := c 5 , {e 1 , e 2 } . be two ECs in that unfolding prefix. It should be clear that ρ ρ ′ , as {e 1 , e 3 } # {e 1 , e 2 }, violating (29). Now, ρ is a generating EC, whose history {e 1 , e 3 } was constructed, in terms of Prop. 2, using ρ := c 3 , {e 1 } . However ρ ρ ′ , which contradicts the above characterization. Intuitively, the problem is that ρ ′ contains an event, e 2 , that reads, without consuming, a condition in • e 3 , namely c 3 , and such event is not included in ρ. For computing the concurrency relation , we must therefore introduce an additional condition ensuring that such events are taken into account correctly.

The following two results show how to achieve this. Proposition 3 deals with generating and reading conditions, and Prop. 4 with compound conditions.

Proposition 3 (updating concurrency). Let e, H ∈ pe(E ) be a PE of E and X p , X c its sets of ECs as per Prop.

1 or Prop. 2. Let Y g := e • × {H} ρ := c, H ∈ Y g ∪ Y r , Y r := e × {H} ρ ′ := c ′ , H ′ ∈ E
be the sets of generating and reading ECs produced by e, H and two ECs, the second one, ρ ′ , from E . Then ρ ρ ′ holds iff

ρ ′ ∈ Y g ∪ Y r ∨ c ′ / ∈ • e ∧ • e ∩ H ′ ⊆ H ∧ ∀ ρ ∈ X p ∪ X c : ( ρ ρ ′ ) .
Before we proceed with the proof, let us put forward the intuition. In the above statement e, H is a possible extension of the EP E , which sooner or later will be added to E by Algorithm 1. When that happens, all ECs in Y g ∪ Y r will be included in E as well, and one needs to compute whether they are concurrent to any other EC already present in E . We thus characterize whether ρ ρ ′ holds for any ρ in Y g ∪ Y r and any arbitrary ρ ′ in E .

Proof. We prove both directions. From left to right, assume ρ ρ ′ holds and

ρ ′ / ∈ Y g ∪ Y
E . Otherwise, if H ′ [[e]] = H, then Lemma 5 implies that H ′ [[e]] # H. Since H ′ [[e]] ⊑ H ′ , this implies that H # H ′ , by Lemma 2. This is a contradiction to ρ ρ ′ .
This completes the left-to-right direction. For the opposite one, we show that if the right-hand side of Prop. 3 holds, then ρ ρ ′ holds as well.

Suppose

ρ ′ ∈ Y g ∪ Y r . Then H ′ = H, so ¬(H # H ′ ). Moreover, since c, c ′ ∈ e ∪ • e
, and H is a history for e, we have c, c ′ ∈ cut(H). Therefore, ρ ρ ′ as desired.

Let us now assume that the right-hand part of the disjunction holds and that ρ ρ ′ does not hold. Then either (i) There are three cases for e 2 ր e.

H # H ′ or c, c ′ / ∈ cut(H ∪ H ′ ).
• If e 2 < e, then e 2 ∈ H because H is causally closed, which contradicts e 2 ∈ H ′ \ H. • If e 2 ∩ • e = ∅, then again e 2 ∈ H because • e ∩ H ′ ⊆ H. • If • e 2 ∩ • e = ∅, then clearly ρ ′ ρ for some ρ ∈ X p .
(ii) There are three cases for e ր e 2 .

• If e < e 2 , then H ′ consumes all tokens from • e, so ρ ′ is not concurrent with any element of X p .

• If e ∩ • e 2 = ∅, then ρ ′ is not concurrent with some element of X c .

• If • e ∩ • e 2 = ∅, see (i). 2. If c ′ / ∈ cut(H ∪ H ′ ), then there exists e 1 ∈ H with c ′ ∈ • e 1 .
If e 1 = e, we would get ρ ρ ′ for some ρ ∈ X p ∪ X c . But if e 1 = e, then c ′ ∈ • e, contradicting our assumption.

3. If c / ∈ cut(H ∪ H ′ ), then there exists e 1 ∈ H ′ with c ∈ • e 1 . If ρ ∈ Y g , then H ′ consumes all of • e; if ρ ∈ Y r , then H ′ consumes some element of e.
In either case, we get non-concurrency between ρ ′ and some element of X p ∪ X c .

As a complement to Prop. 3, the following result allows to compute the concurrency relation for compound conditions.

Proposition 4 (updating concurrency -compound). Let

ρ 1 := c, H 1 ρ 2 := c, H 2 ρ := c, H 1 ∪ H 2 be ECs verifying ¬(H 1 # H 2 )
, and ρ be a compound EC. For any EC ρ ′ it holds that

ρ ρ ′ iff ρ 1 ρ ′ ∧ ρ 2 ρ ′ Proof. Let H := H 1 ∪ H 2 be the history in ρ and let ρ ′ := c ′ , H ′ .
From left to right, assume, for a contradiction, that ρ ρ ′ and w.l.o.g. ρ 1 ρ ′ . Then one of the four statements in Rmk. 9 must be false:

1.
# H ′ . Assuming e 2 ∈ H = H 1 ∪ H 2 leads to e 2 ∈ H 2 \ H 1 .
In turn, this implies H 1 # H 2 , a contradiction to our hypothesis.

3.

There is e ∈ H 1 such that c ′ ∈ • e. Then e ∈ H and H also consumes c ′ , a contradiction to ρ ρ ′ . 4. There is e ∈ H ′ such that c ∈ • e. This is a contradiction to ρ ρ ′ .

From right to left, assume ρ 1 ρ ′ , ρ 2 ρ ′ , and by contradiction ρ ρ ′ . We consider the four cases of Rmk. 9: ). In any case we reach a contradiction to our hypothesis. 4. There exists e ∈ H ′ such that c ∈ • e. This is a contradiction to ρ 1 ρ ′ .

unique possible extensions

Section 3.7 shows how possible extensions are constructed, in both lazy and eager fashions. Essentially, a history H for an event is constructed by taking generating histories for the conditions in e, while for the conditions in • e one takes a generating history and optionally some reading histories. In the eager case, the latter are combined to one single compound history. The optionality of the reading histories means that, in some cases, the same history H may be constructed in different ways, by combining different sets of ECs. Consider the unfolding in Fig. 16. Condition c has n + 1 different reading histories: H 0 := ∅, H 1 := {e 1 }, . . . , H n := {e 1 , . . . , e n }, while c ′ has one single history H n . Notice that we have c, H i c ′ , H n for all i = 0, . . . , n. Thus, there exists a multitude of possibilities to construct the enriched event e, H n ∪ {e} : there are 2 n collections satisfying Prop. 1 and n + 1 collections for Prop. 2.

In the following, we discuss how to remove this ambiguity, i.e., how additional constraints can be inserted into Prop. 1 or Prop. 2 so that every tuple e, H can be obtained from a unique collection of ECs. Roughly, the idea is simple: if one element of X p ∪ X c contains an event e ′ that reads from c ∈ • e, then that event must be contained in a reading or compound condition for c included in X p . In our example, this means we need to take all reading histories of c. That is, the unique collection associated to e, H n ∪ {e} in the lazy method would be the sets

X c := ∅ (42) X p := { c ′ , H n , c, ∅ , c, H 1 , . . . , c, H n }. (43)
Lazy would refuse any other pair of sets where X p does not contain some c, H i , for i = 1, . . . , n. Likewise, the eager method would construct a compound EC that includes all n reading histories of c, giving rise to the following associated sets:

X c := ∅ (44) X p := { c ′ , H n , c, H 1 ∪ . . . ∪ H n }. (45)
In both lazy and eager mode, this requires to compute an additional relationship between ECs. We recall how this is done in the lazy method and present a conceptually simpler solution for the eager method.

Lazy Approach: Subsumption

The lazy approach of [BBC+10] deals exclusively with generating and reading histories, and uses the notion of subsumption: Definition 12 (subsumption). [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] Let H ′ be a history of some e ′ . Let ρ := c, H be a generating or reading EC and ρ ′ := c ′ , H ′ be a reading EC, with c ′ ∈ e ′ . We say that ρ subsumes ρ ′ , written ρ ∝ ρ ′ if e ∈ H, c ′ ∈ cut(H), and

H ′ = H[[e ′ ]].
In other words, the subsuming condition ρ includes H ′ and reads but never consumes c ′ . For instance, in Fig. 16, we have that c ′ , H n ∝ c, H i , for all i = 1, . . . , n.

A suitable closeness condition involving subsumption can help in modifying Prop. 1 to provide a unique characterization of PEs. Proposition 5 characterizes enriched events using all conditions (30) to (35) from Prop. 1, and adds one new condition, (46), ensuring that the pair of sets X p , X c is unique. When applied, e.g., to the enriched event e, H n ∪ {e} in Fig. 16, it only accepts X p , X c as defined in (42) and (43). Indeed, a set X p which does not contain, e.g., c, H 1 would be rejected by (46): c ′ , H n subsumes c, H 1 , and the ancestor c, H 1 ↑ = c, ∅ is in X p , due to (33). So c, H 1 needs to be also in X p . In [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], any pair of sets X p , X c satisfying (46) is said to be subsumption-closed.

This new condition, (46), is the technical condition that we removed from the Lemma 1 of [BBC+10] to make Prop. 1, see the beginning of § 3.7.1 for a detailed explanation. Thus Prop. 1 plus (46) (roughly) corresponds to Lemma 1 in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. The next proposition additionally states that the collections X p , X c are unique for each enriched event, which was not stated in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], and provides a proof (no proof was given in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] and we are not aware of any publication containing them, except [BBC+12]).

Proposition 5 (unique lazy extensions). The pair e, H is an enriched event iff there exist sets X p , X c of ECs satisfying (30) to (35) and additionally

• for any ρ ∈ X p ∪ X c , if ρ ∝ ρ ′ and ρ ′ ↑ ∈ X p , then ρ ′ ∈ X p . (46)
Moreover, for any enriched event e, H there exists exactly one pair of sets X p , X c satisfying (30) to (35) and (46).

Proof. The "iff" part follows almost directly from Prop. 1. We just need to observe that any collection that does not satisfy (46) can be made subsumptionclosed by adding all subsumed ρ ′ according to (46). Observe that such additions never violate any condition in Prop. 1.

It remains to show the uniqueness of the pair X p , X c w.r.t. e, H . Let X ′ p , X ′ c be another pair of sets of ECs satisfying (30) to ( 35) and ( 46) for e, H . We show in the sequel that X p ⊆ X ′ p and X c ⊆ X ′ c . Once done, by symmetry, both collections must coincide.

Let ρ := c, H ∈ X p ∪ X c be an EC. We distinguish two cases. First, let ρ be a generating EC. By (33) there is another generating EC

ρ ′ = c, H ′ ∈ X ′ p ∪ X ′ c .
Because H and H ′ are either empty or histories of the same event in H, by (22), it holds that both evolve to H and so ρ ρ ′ . Then, by Lemma 5, ρ = ρ ′ ∈ X ′ p ∪ X ′ c . Second, let ρ be a reading EC, i.e., c ∈ • e and H is the history of some e ∈ • e. Since e ∈ H, there is in

X ′ p ∪ X ′ c some other ρ ′ := c ′ , H ′ ∈ X ′ p ∪ X ′ c that
= ρ ′′ ∈ X ′ p ∪ X ′ c .
It also suggests to compute and maintain not only the concurrency relation , but also the subsumption relation ∝ during the construction of the enriched prefix. To do this, one solution is investigating an inductive characterization that could allow to dynamically update the relation when new ECs are included in the enriched prefix, in a similar fashion to Prop. 3. This is done in Prop. 6, where ρ plays the role of that new EC.

Proposition 6 (updating subsumption). [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] Let e, H , X p , X c , Y g , Y r , ρ, and ρ ′ be as in Prop. 3, but such that X p , X c and e, H satisfy Prop. 5.

Then ρ ∝ ρ ′ iff ρ ′ ∈ Y r ∨ (∃ρ ′′ ∈ X p ∪ X c : ρ ′′ ∝ ρ ′ ∧ ρ ρ ′ )
We finish this section with an additional result. In Prop. 3 we gave an inductive characterization of . In [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], a different inductive characterization that uses the subsumption relation has been given too. Since they characterize the same relation, both are obviously equivalent. It it still natural to ask how the technical conditions of both relate.

We start recalling the characterization from [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. Let e, H , X p , X c , Y g , Y r , ρ, and ρ ′ be as in Prop. 6. Lemma 2 in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]

says that ρ ρ ′ iff either ρ ′ ∈ Y g ∪ Y r , or • c ′ /
∈ • e, and • for all ρ ∈ X p ∪ X c it holds that ρ ρ ′ , and

• if ρ ′ ∝ ρ ′′ and ρ ′′ ↑ ∈ X p , then ρ ′′ ∈ X p . ( 47
)
The phrasing of Lemma 2 here is actually different than in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF], due to the fact that is reflexive for us but defined as an irreflexive relation in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. The careful reader may quickly check that both statements are equivalent. Notation in [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF] is also quite different.

The main difference between Prop. 3 and the above characterization is that the technical condition

• e ∩ H ′ ⊆ H (48)
from Prop. 3 is substituted by (47). These two conditions should in principle be equivalent, and Prop. 7 confirms that this is the case.

Proposition 7 (concurrency vs. subsumption). Let e, H ∈ pe(E ) be a PE of E and X p , X c its sets of ECs as per Prop. 5. Let

Y g := e • × {H} ρ ′ := c ′ , H ′ ∈ E Y r := e × {H}
be the sets of generating and reading ECs produced by e, H and any EC ρ ′ from E satisfying

ρ ′ / ∈ Y g ∪ Y r and c ′ / ∈ • e and ∀ ρ ∈ X p ∪ X c : ( ρ ρ ′ ).
Then, the statements (47) and (48) are equivalent.

Proof. From (48) to (47), let e ′′ be in • e ∩ H ′ , i.e., e ′′ ∈ H ′ and there is

c 1 ∈ • e ∩ e ′′ . Let ρ ′′ := c 1 , H ′ [[e ′′ ]
] and note that ρ ′ does not consume c 1 , so by definition

ρ ′ ∝ ρ ′′ . Let ρ 1 = c 1 , H 1 ∈ X p be the generating condition associated with c 1 in X p . Denote ρ ′′ ↑ =: c 1 , H ′′ 1 . Recall that ρ 1 ρ ′ implies the existence of a configuration C such that H 1 ⊑ C and H ′′ 1 ⊑ H ′ [[e ′′ ]] ⊑ H ′ ⊑ C. Therefore ¬(H ′′ 1 # H 1 )
, and thus, by Lemma 5, H ′′ 1 = H 1 . Therefore, ρ 1 = ρ ′′ ↑ and thus, by (47) we have ρ ′′ ∈ X p and hence e ′′ ∈ H.

From (47) to (48), suppose that ρ ′ ∝ ρ ′′ where ρ ′′ := c 1 , H ′′ 1 , and

H ′′ 1 := H ′ [[e ′′ ]]
for some e ′′ ∈ H ′ . Suppose also that ρ 1 := c 1 , H 1 := ρ ′′ ↑ and ρ 1 ∈ X p . Now c 1 ∈ • e ∩ e ′′ , and by (7), one of the general assumptions in p. 18, we have that • e ∩ e = ∅, and so e ′′ = e. But e ′′ ∈ • e ∩ H ′ and by (48) we get e ′′ ∈ H, so there must be some

ρ 2 = c 2 , H 2 ∈ X p ∪ X c with e ′′ ∈ H 2 .
By assumption, ρ 2 ρ ′ , so there exists some configuration

C such that H 2 [[e ′′ ]] ⊑ H 2 ⊑ C and H ′′ 1 = H ′ [[e ′′ ]] ⊑ H ′ ⊑ C. This implies ¬(H 2 [[e ′′ ]] # H ′′ 1 )
, hence by Lemma 5 they are equal, so by definition ρ 2 ∝ ρ ′′ . Since X p , X c are subsumption-closed, we have ρ ′′ ∈ X p , as desired.

Eager Approach: Asymmetric Concurrency

We now show how possible extensions can be made unique in the eager approach. In the lazy case, the concept of subsumption was used to achieve this. Recall the intuition behind it: if one element of X p ∪ X c contains an event e ′ that reads from some c ∈ • e, then that event must be contained in a reading condition for c included in X p . For the eager case, this idea must be adapted to compound conditions, where the history of c may be a union of several of its readers. In this case, we demand that at least those readers of c contained elsewhere in X p ∪ X c are included in the (compound) history chosen for c in X p .

We introduce a new relation between ECs that captures this intuition. It is a refinement of that we call asymmetric concurrency (/ /). It turns out that unique possible extensions can be characterised using only this relation.

Definition 13 (asymmetric concurrency). For any two ECs ρ := c, H and

ρ ′ := c ′ , H ′ , we say that ρ is asymmetrically concurrent to ρ ′ , written ρ / / ρ ′ , iff ρ ρ ′ and c ∩ H ′ ⊆ H. ( 49
)
Notice that / / is an asymmetric relation. For instance, in Fig. 16 we have

c ∩ H 1 ⊆ H 2 but c ∩ H 2 = {e 1 , e 2 } ⊆ H 1 . Consequently c, H 2 / / c, H 1 holds but c, H 1 / / c, H 2 is false.
Observe how asymmetric concurrency can be used to satisfy the intuition stated at the beginning of this section. By asking that ρ / / ρ ′ for every ρ ∈ X p and every ρ ′ ∈ X p ∪ X c , one is indeed asking that all events that read the preset of e and are included in some history ρ ′ in X p ∪ X c are also included in ρ as well.

We will use this fact in Prop. 9 to produce a unique characterization of PEs, but first we need to establish a relation between and / / for generating conditions. The following technical result will be necessary later.

Proposition 8 (concurrency vs asymmetric concurrency). For ECs ρ, ρ ′ , if ρ is generating then ρ ρ ′ iff ρ / / ρ ′ or ρ ′ / / ρ.

Proof. Let ρ := c, H and let ρ ′ := c ′ , H ′ . We only need to prove the direction from left to right, the other trivially follows from Def. 13. So suppose by contradiction that ρ ρ ′ and neither ρ / / ρ ′ nor ρ ′ / / ρ. Thus, there exist e 1 ∈ (c ∩ H ′ ) \ H and e 2 ∈ (c ′ ∩ H) \ H ′ . So H is not empty, and it is in fact the history of some event e ∈ • c. Therefore e < i e 1 , so e must be in H ′ . Moreover, e 2 ∈ H \ H ′ , so e 2 = e and e 2 ր + e. This means H # H ′ , contradicting ρ ρ ′ .

We can now state a unique characterization of PEs suitable for the eager approach. This results shows that it is possible to entirely characterize PEs using only / /. Proposition 9 (unique eager extensions). The pair e, H is an enriched event iff there exist sets X p , X c of ECs satisfying

• h(X p ) = • t and h(X c ) = t, with h(e) = t;
(50) • X p contains arbitrary ECs;

(51) • X c contains only generating ECs;

(52) • X p ∪ X c contains exactly one EC for each c ∈ ( • e ∪ e);

(53) • ρ / / ρ ′ holds for all ρ ∈ X p and all ρ ′ ∈ X p ∪ X c ;

(54) • either ρ / / ρ ′ or ρ ′ / / ρ holds for all ρ, ρ ′ ∈ X c ;

(55)

• finally, H = {e} ∪ c,H ′ ∈X p ∪X c H ′ . (56)
Moreover, for any enriched event e, H there exists exactly one pair of sets X p , X c satisfying (50) to (56).

Proof. The "iff" follows almost directly from Prop. 2 and Prop. 8. In particular, properties (54) and (55) imply that ρ ρ ′ holds for all ρ, ρ ′ ∈ X p ∪ X c , i.e., they imply (40). Moreover, let X p , X c be some collection satisfying the conditions of Prop. 2 but not Prop. 9. Then there are

ρ 1 = c 1 , H 1 ∈ X p and ρ ′ = c 2 , H 2 ∈ X p ∪ X c with ρ 1 ρ 2 and some e ′ ∈ (c 1 ∩ H 2 ) \ H 1 . We have H 2 [[e ′ ]] ⊑ H and therefore ¬(H 1 # H 2 [[e ′ ]]). Thus ρ 1 can be replaced with the compound condition ρ ′ 1 = c 1 , H 1 ∪ H 2 [[e ′ ]
] in X p . This process can be repeated until (54) is satisfied.

It remains to show uniqueness. Suppose there exists another collection X ′ p , X ′ c for the same enriched event e, H . There must be some Let us now briefly discuss the practical computation of / /. First, observe that ρ / / ρ' implies ρ ρ ′ , by definition. Therefore is an overapproximation of / /, which enables the use of the following idea. We use Prop. 3 and Prop. 4 to compute and store . Then we check whether c ∩ H ′ ⊆ H and c ′ ∩ H ⊆ H ′ hold, on a single exploration of the events in H. The data structure used to store is slightly augmented with two bits for each pair in . Such bits store whether ρ / / ρ ′ and ρ ′ / / ρ holds. More details are discussed in § 7.1.3, on p. 113.

ρ 1 = c, H 1 ∈ X p ∪ X c and ρ 2 = c, H 2 ∈ X ′ p ∪ X ′ c with H 1 = H 2 and w.l.o.g. some e 1 ∈ H 1 \ H 2 . Since e 1 ∈ H, there must be some ρ 3 = c ′ , H 3 ∈ X ′ p ∪ X ′ c such that e 1 ∈ H 3 . If c ∈ • e
Because this method is available and seems to perform well in practice, we did not investigate an inductive characterization of / / in the style of Prop. 3.

discussion: lazy vs eager approach

In order to discover possible extensions of the form e, H , both approaches consider combinations of generating and reading histories for conditions c ∈ • e.

Consider Prop. 1. For every possible extension, the lazy approach takes one generating and possibly several reading histories for c, all of which must be concurrent. If the events in c have many different histories, or c is large, then many different combinations need to be checked for concurrency.

The eager characterization in Prop. 2 takes exactly one EC of arbitrary type, including compound, for c. A compound history is a set of concurrent reading histories, cf. Def. 9; thus a compound condition represents precomputed information needed to identify possible extensions. In this sense, the eager and the lazy approach can be thought of as different time/space tradeoffs.

We consider two examples in which eager beats lazy and vice versa. In Fig. 17 histories for c, while lazy checks all 2 n subsets of e 1 , . . . , e n only to find these n + 1 compound histories. This effect is actually increased if c ′ has many histories, eager thus becomes largely superior. Of course, an intelligent strategy may help lazy to avoid exploring all 2 n subsets one by one. However, even with a good strategy, lazy still has to enumerate at least the same combinations as eager; and since the problem of identifying the useful subsets is NP-complete [START_REF] Heljanko | Deadlock and reachability checking with finite complete prefixes[END_REF], there will always be instances where lazy becomes inefficient, whatever strategy is employed.

On the other hand, consider Fig. 17 (b). Again, c has n concurrent readers, which this time yields 2 n histories for c. Suppose that h(c) is an input place of some transition t. Now, if t also has h(c ′ ) and h(c ′′ ) in its preset, then no t-labelled event e that consumes c ′ and c ′′ will ever be generated in the unfolding, and all histories of c are effectively useless if h(c) has no other transition than t in its postset. Since those compound conditions also appear in the computation of the concurrency relation, they become a liability in terms of both memory and execution time. The lazy approach does not suffer from this problem here.

Both approaches therefore have their merits, and we implemented them both. We shall report on experiments in Ch. 7.

memory usage

We shall briefly discuss the memory usage arising from the methods proposed in this section. There are two major factors determining memory consumption:

• As some of our examples show, notably Fig. 9 (a) and Fig. 17 (b),a condition in the unfolding may have a number of histories exponential in the number of events reading from it. Thus, the memory usage for creating a finite unfolding prefix may be exponentially larger than the unfolding prefix that is eventually produced.

• Moreover, the memory needed to store the binary relations between ECs such as , ∝, and / / is quadratic on the number of these enriched conditions, in the worst case.

One could ask whether these memory blowups are really necessary. Let us first discuss this question with regard to the second point. In a concrete implementation, the binary relations , ∝, and / / could either be stored explicitly, at the cost of quadratic memory overhead, or decided individ-ually for each pair whenever necessary. These two approaches have been discussed in § 3.5, and referred under the name of, respectively, concurrency relations and backwards exploration. The second approach requires, for each query to the relation, to explore the prefix using the respective definitions, thus incurring higher computation time. We initially implemented the second approach [START_REF] Rodríguez | Implementation of a complete prefix unfolder for contextual nets[END_REF]. The running times were such that only small unfoldings with a few hundred events could be produced in reasonable time. We therefore chose to store the binary relations explicitly.

In [RS13a], we have introduced an improved algorithm to perform the backwards exploration. Essentially, it tries to reduce both the fragment of the prefix to be explored, and the number of times it is explored. Although the approach only works for ordinary unfoldings, and the prototype implementation was certainly limited, its performance was quite promising when compared to that of stored concurrency relations.

Histories, on the other hand, have the twofold purpose of allowing to identify both cutoff events and new PEs, as in § 3.7. In principle, one could imagine an additional time/space trade-off in which not only the concurrency relation but even the histories themselves are constructed on demand whenever one needs to cutoff the prefix or compute PEs. The would lead to an algorithm which consumes only linear space on the size of the unfolding prefix. Due to the unsatisfactory results with the backwards exploration approach, we did not consider this idea.

In any case, the memory usage is asymptotically the same as for the PRencoding. Section 7.1.1, on p. 112, contains some hints on how to store histories efficiently, and § 7.4, on p. 119, provides data on actual memory usage on several examples.

conclusion

We have made theoretical contributions to the computation of contextual unfoldings, opening the way to their practical use for verification. Our implementation of the methods introduced in this chapter will be presented in Ch. 7, together with experimental results and evaluations. Those will show that these methods are practical and outperform existing techniques on a wide number of cases.

Our main contribution is the eager approach to compute PEs. Technically, we have proposed to associate histories to conditions of the prefix. We presented a concurrency relation on conditions enriched with such histories, showed how it can be used to characterize PEs (eager method), and gave an inductive characterization of this relation, thus enabling the use of efficient algorithms to maintain the relation as the construction of the prefix progresses. Next, we refined the characterization of PEs using asymmetric concurrency. This novel notion simplifies the theoretical characterization w.r.t. to existing results and has the practical benefit of not requiring an ad-hoc algorithm for computing it.

Additionally, we compared our eager method to the lazy method, another approach to computing PEs developed independently [START_REF] Baldan | On the Computation of McMillan's Prefix for Contextual Nets and Graph Grammars[END_REF]. We compared both and discussed their merits on theoretical cases.

Unfolding-based methods need two ingredients: an efficient technique for constructing them, and efficient methods for analyzing the prefixes. We have provided the first ingredient in this quest. In the next chapter, we show that their succinctness helps in speeding up these analyses.

Moreover, it would also be interesting to investigate a mix between eager and lazy that tries to get the best of the two worlds. For instance, one could start with the eager approach and switch (selectively for some conditions) to lazy as soon the number of compound conditions exceeds a certain bound. This, and other ideas, remain to be tested.

Model checking based on unfoldings conceptually happens in two steps. First, one constructs an unfolding of the system; then one reduces the verification question to some analysis on the unfolding. A method to construct contextual unfoldings was presented in the previous chapter. Here we present a reduction of the coverability and deadlock-freeness problems into SAT. We study a number of optimizations of the encoding. In Ch. 7, we report on the impact of such optimizations and compare the performance of our encoding to other deadlock-checking tools.

This chapter presents results of [RS12b].

introduction

McMillan introduced unfoldings as a method for verifying properties of ordinary Petri nets. [START_REF] Esparza | Unfolding Based Algorithms for the Reachability Problem[END_REF] is an ad-hoc algorithm based on additional information obtained while computing the unfolding.

The previous decade has seen the emergence of powerful SAT solving algorithms. Programs like Minisat [START_REF] Eén | An Extensible SAT-solver[END_REF] employ advanced techniques such as clause learning, 2-watch propagation schemes, etc. It is natural to profit from these advances and reduce to SAT instead; all the more so because unfoldings are 1-safe nets, so the marking of a place naturally translates to a Boolean variable. Indeed, SAT solving has already been proposed for the similar problem of model-checking merged processes [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF], and [START_REF] Esparza | Unfoldings -A Partial-Order Approach to Model Checking[END_REF] gives an explicit SAT encoding for ordinary net unfoldings. However, we are not aware of a publicly available tool that uses this idea. In this chapter, we propose reachability and deadlock-freeness checking methods based on contextual unfoldings.

Our contributions are twofold: we investigate SAT-encodings of unfoldings, and we extend them to c-nets, proposing some optimizations. Building on advantages of contextual unfolding, i.e., faster construction and smaller size, we intend to produce faster verification methods. It is worth noting that the smaller size of c-net unfoldings does not automatically translate to an easier SAT problem, for the following reasons:

1. The presence of read arcs may cause so-called cycles of asymmetric conflict. Thus, a SAT encoding requires acyclicity constraints, which are not necessary for conventional unfoldings. 2. An event in a c-net unfolding can occur in multiple different execution contexts, called histories, and the constructions proposed in Ch. 3 require to annotate events with potentially many such histories. In contrast, every event of an ordinary net unfolding has only one history. Some verification algorithms for ordinary nets rely on this fact and do not easily adapt to c-nets.

In this chapter, we propose solutions for both problems. Our encoding does not refer to the histories at all, and the effect of the acyclicity constraints can be palliated by several strategies. Our algorithms have been implemented in the tool Cna, integrated in the Cunf Toolset, and will be experimentally evaluated in Ch. 7. The solving times of the SAT instances generated by the tool are better than previous approaches when the tool is applied to ordinary net unfoldings, and even better when used on c-net unfoldings.

The chapter is structured as follows. In § 4.2 we discuss how unfoldings can be used to check for deadlock and reachability. In, § 4.3, the core of the reduction into SAT is presented. The detection of cycles of symmetric conflict plays an important role in the problem we solve, § 4.4 discusses the solution we propose. In § § 4.5 to 4.7, we discuss the size of the encoding and present optimizations to it. Conclusions are drawn in § 4.8.

using c-net unfoldings for verification

In this section, we illustrate why some existing verification approaches for Petri net unfoldings do not adapt well to c-net unfoldings. In particular, we show that existing deadlock-checking techniques based on ordinary unfoldings [McM95b; MR97; Hel99c; KK07] do not lift straight-forwardly to c-net unfoldings. This will justify the completeness criterion considered in Ch. 3 for constructing unfolding prefixes.

We fix now notation for the rest of the chapter. Unless otherwise stated we let N := P, T, F, C, m 0 be a finite, bounded c-net satisfying the general assumptions in p. 18. We let U N := B, Ẽ, G, D, m0 , h denote the full unfolding of N and denote by E := O, h, χ an arbitrary enriched prefix for N.

Recall that a marking m of a net N is deadlocked if it does not enable any transition of N. The deadlock-checking problem is to decide whether N has at least one such marking.

In Ch. 3, we presented an algorithm for the construction of markingcomplete prefixes. Most of the existing deadlock-checking techniques based on ordinary unfoldings rely on prefixes that are complete w.r.t. a notion stronger than marking-completeness. We first lift this notion from ordinary unfoldings to contextual ones.

Consider the unfolding prefixes that Algorithm 1 would construct if it is modified to include all possible cutoff extensions in the prefix. Such extensions could be kept on a separate list and appended to the prefix after the main loop has terminated. Modified in this way, Algorithm 1 would produce an enriched prefix E that, besides being marking-complete, would satisfy the following: if a reachable marking m of N enables a transition t, then for any cutoff-free configuration C of E , if C reaches m, then there is an event e in the prefix such that h(e) = t and e is enabled by cut(C). Let us formalize this notion: Definition 14. Let E cut be a set of enriched events contained in E . We call E enable-complete w.r.t. E cut if for every reachable marking m of N, there is a finite configuration C ∈ conf (E ) such that, 1. C is free of enriched events in E cut , and 2. m = mark(C), and 3. for every event e of U N , if

C ′ := C ∪ {e} is a configuration, then E contains the enriched event e, C ′ [[e]] .
Conditions 1 and 2 ask that E stripped of E cut is marking-complete; 1 and 3 enforce the property we mentioned before.

A confusing point is that the prefix is enable-complete w.r.t. a set of enriched events and not per se. Unfolding prefixes are obtained by pruning the full unfolding U N at arbitrary points. Such pruning introduces cuts m that artificially enable fewer events than h( m), the associated marking in N. So any configuration with cutoffs may enable fewer events than its marking in N, and we need to restrict ourselves to configurations without cutoffs. The definition is therefore relative. When restricted to ordinary nets, enable-completeness coincides with the completeness criterion satisfied by canonical prefixes [START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF].

Remark 10. If E is enable-complete w.r.t. E cut , then N has a reachable deadlocked marking iff E has a configuration C free of enriched events in E cut such that cut(C) deadlocks.

Remark 10 is either directly [MR97; Hel99c; KK07] or indirectly [START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF] employed in existing deadlock-checking techniques for ordinary Petri nets. Now, the problem with generalizing to c-nets any of these techniques is that Rmk. 10 requires to reason about cutoffs, and therefore about histories. Crucially, an unfolding prefix with O (n) events could have O (2 n ) histories. Several approaches to overcome this are in principle possible, we discuss them now, keeping in mind that our goal is to encode the deadlock-checking problem into SAT. In the following, let E be an enable-complete enriched prefix.

reasoning about histories. We could produce a SAT encodings that explicitly handles the notion of history. Satisfying assignments of such formulas would encode configurations free of enriched events from the set

E 1 := { e, H ∈ E : e, H is cutoff}.
While the approach would be sound, even with a compact representation of histories such an encoding would probably be of exponential size on the number of events in E . Clearly, this approach does not profit from the additional compactness of c-net unfoldings.

approximating cutoffs by events. A second approach could be based on the idea of transferring the notion of cutoff from enriched events to events, so that the SAT encoding reasons only about events. Let us show why this is a bad idea.

Events may have multiple histories, some of which are cutoffs while others are not. Each event e can be found in exactly one of the following classes:

1. All feasible histories in Hist(e) are cutoffs. 2. Among the feasible histories in Hist(e), there is at least one cutoff and one non-cutoff.

No feasible history in

Hist(e) is a cutoff. e 2 (t 2 ) c 9 (q) c 8 (p) e 5 (t 5 ) e 1 (t 1 ) c 1 (p) c 3 (r) c 4 (r) c 6 (s) c 5 (s) e 3 (t 3 ) c 7 (s) e 4 (t 4 ) c 2 (q) t 1 t 2 t 3 t 4 s r t 5 q p (a) (b)
Figure 18: (a) A safe c-net N; and (b) an unfolding prefix P for N.

Observe that we restrict the attention to only the feasible histories in Hist(e).

Clearly the SAT encoding would forbid any event in the first class from being used in the satisfying configuration, and would allow all events in the third. As for those in the second, we now show that either including or forbidding them yields an unsound characterization of the deadlocked markings.

Assume that we allow events of the second class to be present in the satisfying configuration. This amounts to using the set E 2 := { e, H ∈ E : e is in the first class} of enriched events as cutoffs in Def. 14, i.e. not forbidding events in the second class. Although encoding E 2 in SAT is easy, as it does not require information about histories, E is not enable-complete w.r.t. E 2 , as we show below, and the resulting formula would incorrectly characterize the deadlocked markings of N.

Consider the c-net show in Fig. 18 (a), we will use it to show that E is not enable-complete w.r.t. E 2 . The c-net is free of deadlocks. An unfolding prefix P is shown in Fig. 18 (b), the mapping h is given in parentheses. Event e 1 has two histories, H 1 := {e 1 } and H 2 := {e 3 , e 1 }. Now fix the size strategy ≺ M , defined in (26) as C ≺ M C ′ iff |C| < |C ′ |. According to the framework of Ch. 3, both e 1 , H 1 and e 1 , H 2 are ≺ M -feasible, but e 1 , H 2 is ≺ M -cutoff while e 1 , H 1 is not. Indeed H 2 leads to the same marking {r, s} as e 2 , {e 2 } and {e 2 } ≺ M H 2 . An event is shown in black if all its feasible histories are cutoffs, i.e., if it belongs to the first class above. The prefix in Fig. 18 (b) is marking-complete and also enable-complete w.r.t. E 1 but not w.r.t. E 2 : consider the cut m = {c 3 , c 6 }, which is deadlocked in P. The configuration leading to m ′ contains a cutoff, namely e 1 , H 2 , but such enriched event is not included in E 2 , because e 1 is in the second class. As a result, its marking is interpreted by Def. 14 as a faithful representative of a marking of N, which is wrong, as h( m) = {r, s} enables transition t 5 in N.

Alternatively, one could forbid all events in the second class. This corresponds to using the set E 3 := { e, H ∈ E : e is in the first or second class} of enriched events as cutoff points in Def. 14. Now the problem is that E stripped of E 3 is not necessarily marking-complete, as Def. 14 asks. There is thus no hope to achieving enable-completeness w.r.t. E 3 , which intuitively forbids using too many enriched events. additional layer of cutoffs. A third option could be extending E with a further layer of infeasible enriched events. The resulting enriched prefix would be computed in two steps: (i) saturating the prefix with all histories arising from events already present on it; (ii) assuming that E ′ N is the prefix computed on the previous step, one would extend E ′ N with the set

E 4 := pe(E ′
N ) The enriched prefix E ′′ N resulting after the two steps would indeed be enablecomplete w.r.t. E 4 . Observe that by definition all events of E ′′ N having histories in E 4 have been added in step (ii), and all those histories are infeasible: we now have a safe correspondence between cutoffs and events. As a result, the SAT encoding would just need to forbid all such events. Although this approach seems feasible, it has the disadvantage of requiring a potentially larger (enriched) prefix.

using just marking-completeness. Another, perhaps simpler approach is simply relying on a marking-complete unfolding prefix. One can just check if a configuration C represents a deadlocked marking by looking at the transitions enabled by mark(C). Apart from being conceptually simpler, the main advantages are that we do not need histories at all. Moreover, according to Rmk. 8, the approach does not need a prefix with more events than reachable markings exist in N. In the next section, we provide a SAT encoding whose correctness relies on this idea.

Remark 11. Let P be a marking-complete prefix for N. Then N contains a deadlock iff P has either a reachable marking m such that h( m) is deadlocked.

sat-encodings of c-net unfoldings

In this section, we define two propositional formulas. The first one is satisfiable iff N has a reachable deadlocked marking, and the second iff it has a reachable marking that covers a given set of places. Our encodings relies on Rmk. 11 and requires a marking-complete unfolding prefix P. When this encoding is restricted to ordinary nets, it essentially coincides with the one given in [EH08, § 5.1.2]. We also give a number of optimizations of the encoding. Most constraints that we give translate directly into CNF.

For the rest of the chapter, we fix a marking-complete unfolding prefix P := B, E, G, D, m0 , h . Recall that additional notation has been fixed at the beginning of previous section. The SAT problem is as follows: given a formula φ of propositional logic, find whether there exists a satisfying assignment that makes φ true. Our goal is to construct from P and a given set M ⊆ P of places in N, propositional formulas • φ dead P , satisfiable iff N has a deadlocked reachable marking; • φ mark,M P , satisfiable iff N has a reachable marking m such that m(p) ≥ 1 for all p ∈ M.

Both formulas reason about reachable markings of N. Their satisfying assignments encode configurations of P that reach the requested markings. Both formulas are defined over variables e for every event e ∈ E and p for for every place p ∈ P, and have the form:

φ dead P := φ conf P ∧ φ dis P φ mark,M P := φ conf P ∧ φ cov,M

P

The first constraint φ conf P is present on both formulas, and enforces that any satisfying assignment represents a finite configuration C. Constraints φ dis P and φ cov,M P compute the marking mark(C) reached by the configuration and require, respectively, that mark(C) is deadlocked, or that it covers all places in M.

Recall that a finite configuration C is a set of events, causally closed and free of loops in the ր C relation, see (17) to (19) in p. 24. For efficiency reasons, we treat separately cycles in the symmetric and asymmetric conflict relation, and define: request C to be a causally closed set of events that has no pair of events in symmetric conflict:

φ conf P := φ causal
φ causal P := e∈E e ′ ∈ • ( • e∪e) (e → e ′ ), φ sym P := c∈C AMO(c • ),
where AMO(x 1 , . . . , x n ) is satisfied iff at most one of x 1 , . . . , x n is satisfied 1 (see § 7.2.2). The subformula φ sym P forbids symmetric conflicts, i.e., it ensures that any two events e, e ′ ∈ C satisfy ¬(e # e ′ ). Recall that due to (6), symmetric conflicts correspond to loops of length 2 in ր. Constraint φ asym P forbids all loops of asymmetric conflict not forbidden by φ sym P , as we detail in § 4.4. The formula φ dis P characterizes the marking reached by C and asks for it to be deadlocked. We define it as:

φ dis P := c∈B p= f (c) {e}= • c e ∧ e ′ ∈c • ¬e ′ → p ∧ t∈T p∈ • t∪t ¬p
This constraint is a conjunction of two main subformulas. Recall that φ conf P enforces any satisfying assignment to encode a configuration C. The lefthand side of the main conjunction computes a (super)set of the places marked by C. Intuitively, it says that any place p should be marked, i.e., variable p should be true, if it labels at least one condition c such that • c is in C but no event in c • is in C. The right-hand side subformula just asks that no transition of the original net is enabled at the (superset of the) marking computed by the left-hand side subformula. Notice that a variable p may be true even if p / ∈ mark(C). However, such an assignment can only serve to hide a deadlock, so this encoding is safe.

For coverability, we want to check whether N has a reachable marking m such that M ⊆ m, where M ⊆ P is given. We define constraint φ cov,M P as the conjunction of two subformulas:

φ cov,M P := p∈M f (c)=p c ∧ f (c)∈M c → e∈ • c e ∧ e∈c • ¬e
The first subformula ensures that for every place p in M, at least one condition labelled with p is marked. For any such condition, the second subformula constraints which events fire. If a condition c is chosen, then necessarily • c must be in C and none of the events in c • can be in C. Observe that the direction of the implication here and in φ dis P is the opposite. This yields correct results in both cases.

asymmetric conflict loops

We now explain φ asym P , which ensures that ր C is acyclic. As explained in § 2.1, we equate a relation with a directed graph in the natural way. Sym-1 Note that quite frequently, the actual implementation of the AMO constraint will introduce new auxiliary variables in φ dead P , as it is the case of the k-trees proposed in § 7.2.2. metric conflicts form cycles of length 2 in ր and are efficiently handled by the AMO constraints of φ sym P . In a Petri net, these are the only cycles that can occur. However, in a c-net there may also be other kind of cycles. Recall that the definition of ր considers three cases: (4), (5), and (6), the last one being symmetric conflict. For convenience, we explicitly repeat the first two cases. For events e, e ′ ∈ E, define

e ⋖ e ′ iff e • ∩ ( • e ′ ∩ e ′ ) = ∅ e ր ր e ′ iff e ∩ • e ′ = ∅ (57)
Indeed, observe that e ⋖ e ′ holds (resp. e ր ր e ′ holds) iff (4) holds (resp. (5) holds) between e and e ′ . In a c-net unfolding, every cycle of ր not involving events in symmetric conflict is also a cycle in the relation

R := ⋖ ∪ ր ր. ( 58
)
We show that these cycles occur naturally in well-known examples. Consider Fig. 19, which shows the beginning of an unfolding of Dekker's mutual-exclusion algorithm [START_REF] Montanari | Algorithms for Mutual Exclusion[END_REF], where only some events of interest are shown. In the beginning, both processes indicate their interest to enter the critical section by raising their flag (events e 1 , f 1 ). They then check whether the flag of the other process is low (events e 2 , f 2 ) and if so, proceed (e 3 ) and possibly repeat (e 4 , e 5 ). If both processes want to enter the critical section ( f ′ 2 ), some arbitration happens (not displayed). Two conflict cycles in this example are

e 1 ⋖ e 2 ր ր f 1 ⋖ f 2 ր ր e 1 and f 1 ⋖ f ′ 2 ր ր e 3 ⋖ e 4 ⋖ e 5 ր ր f 1 .
Several encodings have been proposed in the literature for acyclicity constraints, including transitive closure and ranks (see, e.g., [START_REF] Codish | A declarative encoding of telecommunications feature subscription in SAT[END_REF]). In the ranking method, one introduces for each event e additional Boolean variables that represent an integer, the so-called rank of e, up to r, where r is a large enough number. Then, for every pair (e, f ) ∈ R, one introduces a clause of the form

(e ∧ f) → s e, f
where s e, f is a new variable that, if true forces the rank of e to be less than the rank of f . This is enforced by an additional set of clauses that involve the ranks of e and f together with s e, f . Naturally, these clauses are only necessary if e and f are in the same SCC of R.

A lower bound for r is the length of the longest chain in ր that does not contain a cycle. However, finding whether any such chain of a given length exists is already a NP-complete problem. A simple upper bound for r is the size of the largest SCC of R.

If the ranks of events are represented in binary, the encoding involves O (|R| log r) literals. Integers up to r can be encoded in binary by log r Boolean variables. The clauses that enforce two rankings to be sorted involve a number of literals linear on log r, and every edge of R requires one such comparison. Alternatively, coding in unary the ranks yields an encoding of size O (|R|r). We refer the reader to § 7.2.3 for an experimental evaluation of the alternative encodings.

To further reduce the size of the encoding, observe the following. Let n = O (|P |) be the size of the prefix, as defined in § 2.2, in p. 16. Observe that |R| = O (n 2 ), because |ր ր| = O (n 2 ) even though |⋖| = O (n), as Fig. 20 illustrates. An straightforward application of the acyclicity encoding presented above to R produces a formula of size O (n 2 log n), if ranks are coded in binary. One can however use a trick to reduce to this to O (n log n), as we explain now.

The idea is to reduce the O (n 2 )-explosion in ր ր introducing additional nodes in the underlying graph. We explain it with an example, consider the occurrence net in Fig. 20. Here one would substitute the k 2 edges in (the underlying graph of) ր ր by one new node, which represents the single condition in the net, and 2k edges, k from the new node to all the events e i and k reaching it from the events f i .

Another idea for reduction is to exploit the fact that C is causally closed and that every cycle in R contains at least two edges stemming from ր ր. Consider the relation

R ′ := {(e, g) : ∃ f , h : e ր ր f ≤ g ր ր h}. ( 59
)
One can easily see that any causally closed set of events contains a cycle in R iff it contains a cycle in R ′ , so one can ask for acyclicity of R ′ instead of R.

On the other hand, R ′ may actually contain more pairs than R, and computing R ′ may take quadratic time in |E|. So instead, we reduce the size of R by a less drastic method that can run in linear time: An event e is eliminated from R by fusing its incoming and outgoing edges in R only if (i) e is not the source of a ր ր-edge and (ii) fusing the edges and eliminating e will not increase the number of edges in R.

Figure 19 demonstrates another important point. The unfolding contains two different cycles, both of which contain f 1 . Thus, all events in Fig. 19 belong to the same SCC in R. Indeed, we observe in our experiments that the SCCs of R tend to be large, often composed of thousands of events, but consist of many short, interlocking cycles. This suggests that an upper bound for r better than the size of R, even after reduction, may still be feasible. We therefore suggest another trick: first, check for deadlock or coverability

Subformula

Size Size altogether. This may result in false positives, i.e., a set of events leading to the requested marking that is not actually reachable because it contains a cycle in ր. If the SAT solver comes up with such a spurious solution, we repeat with φ asym P properly included. The experiments concerning these points are discussed in § 7.2.3.

φ causal P |E|q O (n) φ sym P |B|pk O (n) φ asym P (|G| + |D|) log(|E| + |B|) O (n log n) φ dis P |B|(1 + p) + |T|q O (n) φ mark,M P |B| + |B|(1 + p) O (n)

encoding size

In this section we examine the size of the formulas φ dead P and φ cov,M P . Although not all the formulas given in § 4.3 are in CNF, they translate directly to CNF, with the exception of φ sym P -for which we did not yet provide a definition. For instance, φ dis P involves a conjunction of subformulas of the form l 1 ∧ . . . ∧ l n → l 0 where all the l i are literals. Each such subformula is obviously equivalent to a clause of the form ¬l 1 ∨ . . . ∨ ¬l n ∨ l 0 .

Table 3 presents the sizes of the different subformulas of our encodings, i.e., the number of literals in each subformula when it is translated to CNF. Sizes are given in terms of a constant k, which depends on the particular implementation of the AMO constraints in φ sym P , and the three following parameters depending on P:

q := max e ∈ E | • e ∪ e| p := max c ∈ B |c • | n := |B| + |E| + |G| + |D|
It is almost immediate to see that all sub-constraints except φ asym P are linear on the size n of the unfolding prefix P. An AMO constraint for m variables can be implemented with a number of clauses and literals both linear on m, as we show in § 7.2.2.

The size O (n log n) of φ asym P often dominates the size of the encodings, although it can sometimes be completely omitted from it. Experiments concerning this will be presented in § 7.5.

reduction of stubborn events for deadlock checking

In SAT solving, the value of a variable that is either known or has been tentatively decided is propagated to simplify other clauses, see [START_REF] João | GRASP -a new search algorithm for satisfiability[END_REF][START_REF] Eén | An Extensible SAT-solver[END_REF]. This process is referred as propagation or unit propagation. In this section, we discuss an optimization that palliates a propagation problem of SAT checkers when solving φ dead P . We also explain why such an optimization is not applicable to φ cov,M P . Consider the occurrence net shown in Fig. 21, where certain events have been explicitly named (e 1 , e 2 , . . .) and only the label is given for conditions, in parenthesis. If e 1 fires, then nothing can prevent e 2 , e 3 , e 4 , and e 5 from firing. Thus, any configuration leading to a deadlock must either contain all

• • • • • • e 3 (p 3 ) (p 2 ) (p 1 ) (q 2 ) (q 1 ) (r 2 ) (r 1 )
e 4

e 5 e 1 e 2 (t) (s)

Figure 21: Stubborn events.

five events or none of them. However, e 1 is not guaranteed to fire due to the white event that consumes from its context. The formula φ dead P will consist of the following clauses for the named events and conditions in Fig. 21; we assume that the black event at the right is a cutoff (has no non-cutoff histories). For φ causal P , we have the clauses ¬e j ∨ e i for 1 ≤ i < j ≤ 4 and ¬e 5 ∨ e 3 and ¬e 5 ∨ e 4 . For φ sym P and φ asym P , no clauses will be generated. The left-hand side of the main conjunction in φ dis P will consist of the following clauses:

¬e 1 ∨ e 2 ∨ p 1 ¬e 2 ∨ e 4 ∨ q 1 ¬e 3 ∨ e 5 ∨ r 1 ¬e 1 ∨ e 3 ∨ p 2 ¬e 2 ∨ e 3 ∨ q 2 ¬e 3 ∨ e 4 ∨ r 2 ¬e 1 ∨ e 4 ∨ p 3 ¬e 4 ∨ e 5 ∨ s ¬e 5 ∨ t
The clauses forming the right-hand side are:

¬p 1 ¬q 2 ∨ ¬p 2 ¬q 1 ∨ ¬r 2 ∨ ¬p 3 ¬r 1 ∨

¬s ¬t

When this formula is presented to a SAT solver like Minisat, the unit clauses ¬p 1 and ¬t lead to some immediate simplifications. This propagation is handled very efficiently by modern solvers, and there is no gain in emulating this behavior while generating the SAT encoding.

Suppose that the solver then tries to set e 1 to true and propagates this decision. The remaining simplified clauses are shown below. Note that e 2 and ¬e 5 are implied as consequence of e 1 and the other simplifications.

¬e 4 ∨ e 3 e 3 ∨ p 2 e 4 ∨ p 3 e 4 ∨ q 1 e 3 ∨ q 2 ¬e 4 ∨ s ¬e 3 ∨ r 1 ¬e 3 ∨ e 4 ∨ r 2 ¬q 2 ∨ ¬p 2 ¬q 1 ∨ ¬r 2 ∨ ¬p 3 ¬r 1 ∨

¬s

In the remaining clauses, all variables appear both positively and negatively; the formula cannot be simplified any further. Notice, more importantly, that the solver is unable to find a conflict after tentatively setting e 1 to true when e 5 is set to false.

This happens because unit propagation in the proposed encoding is unable to detect that e 3 , e 4 , and e 5 are logical implications of e 1 . Even when a solver tentatively sets e 1 to true, unit propagation only infers that e 2 must also be true, but not e 3 or e 4 . It takes another decision, e.g., for e 3 or e 4 , to derive a contradiction and, depending on the solver, possibly multiple steps to decide that e 1 must necessarily be false.

On the other hand, such information is easy to detect on the unfolding structure, and we shall modify φ dead P in these cases. Let us call stubborn any event e satisfying ( • e ∪ e) • = {e}. Intuitively, once all events preceding e have fired, then firing e is unavoidable to find a deadlock. In Fig. 21, events e 2 , e 3 , e 4 , e 5 are all stubborn. Indeed, consider any deadlocked configuration C of P, and let e be any stubborn event verifying • ( • e ∪ e) ⊆ C. Then either e is in C or it is enabled at cut(C), since C contains all events preceding e. But the latter is not possible because C is a deadlock, so e must be in C, which proves that e ∈ C iff • ( • e ∪ e) ⊆ C (the other direction follows from the fact that C is causally closed).

This suggests that we could substitute every occurrence of e by a conjunction of the variables associated to the predecessors of e. We denote by E s the set of stubborn events, and define inductively the set of predecessors of any event e as pred(e) :=

• ( • e ∪ e) \ E s ∪ e ′ ∈ • ( • e∪e)∩E s pred(e ′ )
The definition is well-given as a consequence of < being well-founded. Corollary 2 can be exploited to modify φ dead P in two ways: for every stubborn event e, (i) add a clause e ′ ∈ • (e∪ • e) e ′ → e, or (ii) substitute e by e ′ ∈pred(e) e ′ . Method (i), when applied to Fig. 21, will allow to derive a contradiction when e 1 is made true. On the other hand, when the solver sets e 4 to false, no information about the other events can be obtained through unit propagation. Method (ii) will eliminate the stubborn events from the encoding altogether. The resulting formula, after an initial unit propagation phase by the SAT solver, allows to immediately derive ¬e 1 .

We briefly explain the changes to φ dead P motivated by method (ii):

φ sym P
is not affected because no stubborn event appears in any symmetric conflict, and neither is φ dis P , which is only over variables for places. In φ causal P , however, clauses e → e ′ are discarded if e is stubborn or replaced by e → e ′′ for every e ′′ ∈ pred(e) if e is not stubborn. In a clause e ∧ e ′ ∈c • ¬e ′ → p of φ mark,M P , we need to replace e by a conjunction over pred(e) if e is stubborn. In principle, the same needs to be done for e ′ . However, if |c • | ≥ 2, then no event in c • is stubborn, and nothing changes; but if c • = {e ′ } is a singleton, and e ′ is stubborn, then the clause is split into | pred(e ′ )| different clauses. by conjunctions, if applicable; thus, the formula will still require ranks for e and f even if e or f are not present. Method (ii) reduces the number of variables and either reduces (up to a linear factor) or increases (up to a quadratic factor) the number of clauses, as shown in Fig. 22. In (a), part of an occurrence net is shown. Without optimizations, n clauses of the form e → e i and n of the form e i → f are generated in φ causal P . Assuming that e 1 , . . . , e n are stubborn, method (ii) replaces these 2n clauses by one clause e → f. Similar reductions occur in φ dis P and φ mark,M P . On the other hand, φ causal P for (the fragment of) the occurrence net (b) has, when no optimization is used, n clauses of the form e i → e and n of the form e → f i , but n 2 clauses of the form e i → f j when method (ii) is used. Nonetheless, in our experiments we used method (ii) due to the better behavior of unit propagation in the resulting encodings, as explained above.

We remark that stubborn events are also treated specially in the stablemodels encoding of [START_REF] Heljanko | Using Logic Programs with Stable Model Semantics to Solve Deadlock and Reachability Problems for 1-Safe Petri Nets[END_REF]. While stable models are similar to SAT, the treatment in [START_REF] Heljanko | Using Logic Programs with Stable Model Semantics to Solve Deadlock and Reachability Problems for 1-Safe Petri Nets[END_REF] is simpler; its analogue in propositional logic would not eliminate stubborn events from the formula nor allow to directly conclude that e 1 cannot be fired.

It should be clear at this point that the optimization presented in this section only applies to the deadlock-checking encoding, not the coverabilitychecking encoding φ cov,M P . Indeed, only in deadlocked configurations stubborn events can be equated to the conjunction of their predecessors.

additional simplification

We briefly mention some possible simplifications of the formula. First, for a place p, if p • ∪ p = ∅, then p does not appear in φ dis P and no condition c with h(c) = p need to be considered on the left-hand side of the main conjunction in φ dis P . Similarly, during the construction of φ mark,M P , only events e such that h(e • ) or h( • e) contains some place of M shall be included in φ conf P . Secondly, a potentially more interesting simplification concerns subset checking. For two conditions c, d,

if c • ⊆ d • , then AMO(c • ) is implied by AMO(d • )
and can be omitted from φ sym P . Similarly, for two transition t, u where • t ⊆ • u, disabledness of t implies disabledness of u, so u can be omitted from φ dis P . We return to this point in § 7.2.1.

conclusions

We presented verification algorithms based on c-net unfoldings. Special attention was payed to the treatment of acyclicity in the asymmetric conflict relation and the optimization of the overall encoding. For acyclicity, we pro-posed to deal separately with symmetric and asymmetric conflict cycles, and gave three optimizations to reduce the size of the asymmetric conflict relation. General optimizations of the overall encoding included the reduction of stubborn events and the elimination of subsumed disabled transitions. These optimizations operate at the level of the unfolding, in Ch. 7 we will discuss additional optimizations at the level of the SAT solver. The encodings proposed here will be evaluated in Ch. 7. Experimental evaluation will show that solving times of these encodings beat the performance of existing unfolding-based deadlock-checking tools, a result that was not a foregone conclusion due to the richer structure of c-net unfoldings, in particular the presence of cycles and histories. Some of the optimizations proposed here will turn to be critical to achieve this.

C O N T E X T U A L M E R G E D P R O C E S S E S

Contextual unfoldings represent the state space of contextual nets. They cope with the state-space explosion due to concurrency and concurrent read access, as we have explained.

In this chapter, we integrate two compact representations: contextual unfolding prefixes and merged processes. The resulting representation, called contextual merged processes (CMP), combines the advantages of the original ones and copes with several important sources of state space explosion: concurrency, sequences of choices, and concurrent read accesses to shared resources. The chapter essentially presents theoretical results on the construction of CMPs and a reduction to SAT of the reachability problem based on CMPs. In Ch. 7 we demonstrate on a number of benchmarks that CMPs are more compact than either of the original representations.

This chapter is partially based on [RSK13].

introduction

We explained in Ch. 1 that model checking is an important and practical way of ensuring the correctness of a system. However, it suffers from the state-space explosion (SSE) problem.

There are several common sources of SSE. One of them is concurrency, and the unfolding technique was primarily designed for efficient verification of highly concurrent systems. Indeed, a marking-complete prefix is often exponentially smaller than the corresponding reachability graph because it represents concurrency directly rather than by multidimensional diamonds, as it is done in reachability graphs. However, unfoldings do not cope well with some other important sources of SSE. In what follows, we consider two such sources.

One important source of SSE are sequences of choices. For example, the smallest complete prefix of the Petri net in Fig. 23 is exponential in its size since no event can be declared a cutoff -intuitively, each reachable marking remembers its past, and so different runs cannot lead to the same marking.

Recently, a technique has emerged that address this source of SSE, among others. In [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF], a new condensed representation of Petri net behavior called merged processes (MPs) was proposed; it copes not only with concurrency, but also with sequences of choices. Moreover, this representation is sufficiently similar to the traditional unfoldings so that a large body of results developed for unfoldings can be re-used. The main idea behind MPs is to fuse some nodes in the unfolding prefix, and use the resulting net as the basis for verification. For example, the unfolding of the net shown in Fig. 23 Figure 24: A c-net (a) whose contextual unfolding is isomorphic to the c-net itself, but whose plain encoding into a Petri net has exponentially large merged process, since no place instances in its unfolding (b) can be merged, and so there are 2 n mp-events corresponding to transition t. For this c-net the PR encoding coincides with the plain one, and so has the same unfolding and MP.

for a safe Petri net, model checking of a reachability-like property (i.e., the existence of a reachable state satisfying a predicate given by a Boolean expression) can be efficiently performed on its MP, and in [KKKV06] a polynomial reduction of this problem to SAT is presented. Furthermore, an efficient unravelling algorithm that builds a complete MP of a given safe ordinary net has been proposed in [KM11; KM13]. The experimental results in [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF] indicate that this method is quite practical. Unfortunately, MPs do not cope well with concurrent read access. As illustrated in Fig. 24, the contextual unfolding of a system may be exponentially smaller than its merged process. Similarly, contextual unfoldings suffer from SSE resulting from sequences of choices, e.g., they do not offer any improvement for the Petri net in Fig. 23, as it contains no read arcs.

We observe that in fact contextual unfoldings and merged process are techniques that address orthogonal aspects of the SSE problem when compressing an unfolding prefix into a more compact structure. They can thus be combined into one that copes with all the mentioned sources of SSE, viz.

1. concurrency, 2. sequences of choices, and 3. concurrent read accesses to a shared resource.

Moreover, there are striking similarities between the main complications that had to be overcome in the theories of MPs and c-net unfoldings: events have multiple local configurations, or histories (which causes difficulties in detection of cutoff events) and certain cycles (in the flow relation in case of MPs and in the asymmetric conflict relation in case of c-net unfoldings) have to be prohibited in valid configurations. Hence, the combination of the two techniques is not only possible, but also very natural.

The chapter is organised as follows. In § 5.2, the notion of a contextual merged process is presented. With the help of an example, in § 5.3 we deepen on the differences between the various ways to unfold and merge a c-net, clarifying the notion of CMP. In § § 5.4 and 5.5, results to characterize the configurations of CMPs of safe c-nets and two encodings into SAT of the reachability problem using CMPs are presented. We use these results in § 5.6 to discuss the various ways to construct CMPS, and conclude in § 5.7.

contextual merged processes

In this section, we introduce the notion of contextual merged processes (CMPs) and discuss some of their properties. The results presented here generalize those of [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF]. In particular it turns out that the notion configuration of a contextual unfolding and mp-configuration of a merged process, defined in [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF], both of which introduce acyclicity constraints, can be seamlessly integrated into a common framework.

Let us now fix notation for the rest of the chapter. Unless otherwise stated we let N := P, T, F, C, m 0 be a finite c-net satisfying the general assumptions in p. 18. Remark that N is not even necessarily bounded. We let U N := B, Ẽ, G, D, m0 , h denote the full unfolding of N and denote by P := B, E, G, D, m0 , h an arbitrary unfolding prefix for N.

Recall that asymmetric conflict, causality, steps, runs, and reachable markings are, among other notions, preserved by homomorphisms, as a consequence of Lemma 1, on p. 19. The first step to define CMPs is the notion of occurrence depth.

Definition 15 (occurrence depth). Let x be a node of P. The occurrence depth of x, denoted od(x), is the maximum number of h(x)-labelled nodes in any path in the directed graph

( m0 ∪ [x] ∪ [x] • , < i )
starting at any initial condition and ending in x.

Recall that the cone [x] is finite and that < i is a partial order, so there is only a finite number of paths to evaluate, and the definition is well-given.

As an example, in Fig. 25 (b), consider the condition c 9 , and the associated digraph whose nodes are m0 ∪ [c 9 ] ∪ [c 9 ] • and whose edge relation is < i . The occurrence depth of c 9 is 2 because the digraph contains the path c 1 < i e 2 < i c 5 < i e 4 < i c 7 < i e 6 < i c 9 and both c 5 and c 9 have the same label p 3 .

A CMP is obtained from a branching process in two steps. First, all conditions that have the same label and occurrence depth are fused together (their initial markings are totalled); then all events that have the same label and environment (after fusing conditions) are merged. Conditions in the initial marking will have, by definition, occurrence depth 1. This is formalised as follows:

Definition 16 (Contextual Merged Process). The Contextual Merged Process (CMP) of P is the labelled c-net Q = B, E, G, D, m 0 , h , with Figure 25 shows a 1-safe net (taken from [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF]), its unfolding, and its unravelling. For the rest of this chapter, unless otherwise stated, we let Q = B, E, G, D, m 0 , h be the contextual merged processes of P and h the associated homomorphism from Q to N. We additionally let h denote the homomorphisms from P to Q.

• B ⊆ P × N, • E ⊆ T × 2 B × 2 B × 2 B , • h : B ∪ E → P ∪ T is a homomorphism from Q to N, where Q is defined as follows. First, let h : B ∪ E → B ∪ E be homomorphism from P to Q defined,
c 8 (p 2 ) c 6 (p 3 ) (b) c 1 (p 1 ) c 2 (p 4 ) e 1 (t 1 ) e 2 (t 2 ) c 3 (p 5 ) c 9 (p 3 ) e 6 (t 3 ) e 4 (t 4 ) c 7 (p 2 ) c 5 (p 3 ) c 4 (p 2 ) t 1 t 2 p 3 (a) p 2 p 4 v 5 (t 3 ) v 6 (t 4 ) p 1 1 v 1 (t 1 ) v 2 (t 2 ) v 3 (t 3 ) v 4 (t 4 ) p 1 3 p 2 2 p 2 3 (c)
The places of Q are called mp-conditions and its transitions mp-events. We shall write p d for an mp-condition p, d . Note that m 0 (p d ) equals m 0 (p) if d = 1 and is 0 otherwise. An mp-event e is an mp-cutoff if all events in h-1 ( e) are cutoffs. Recall from Ch. 3 that speaking about cutoffs requires to first fix an strategy on U N . Indeed, here we are assuming that one strategy ≺ has been fixed, and that P is in fact P ≺ N , which allows to speak about the cutoff events of P. We denote the set of mp-cutoffs by E cut .

Remark 12. The following properties hold for CMPs or c-net unfoldings:

1. In general, M N is not acyclic; see Fig. 25 (c).

There can be mp-events consuming conditions in the postset of an mp-cutoff.

3. There is at most one mp-condition p k resulting from fusing occurrences of place p at depth k ≥ 1. 4. For two mp-conditions p k and p k+1 , there is a directed path in the < i relation from the former to the latter. 5. Two different conditions c 1 and c 2 having the same label and occurrence depth are not causally related. Hence, if the original c-net is safe, then ր

[c 1 ]∪[c 2 ] contains a cycle. 6. h = h • h.

h and h are homomorphisms. 8. A sequence of transitions σ is a run of N iff there exists a run σ of M N such that σ = h( σ).

Additionally, if N is safe, we have:

9. h is injective when restricted to the events of a configuration. 10. Property 8 is true if we additionally require σ to be repetition-free.

Proof. Properties 1 and 2 are already true for merged processes of ordinary Petri nets; 3 and 4 are immediate after the definition.

5 If the original c-net is safe, and c 1 , c 2 have the same label and occurrence depth, then [c 1 ] ∪ [c 2 ] is not a configuration, since otherwise they would be concurrent, producing two occurrences of the associated place (they cannot be causally related). Since [c 1 ] ∪ [c 2 ] is finite, it contains a cycle in ր. 6 Any mp-event inherits the label associated to the events that were merged to produce it, so for any e ∈ E, we have h

(e) = h(h(e)). 7 By construction h(E) ⊆ E, h(B) ⊆ B, h(E) ⊆ T, and h(B) ⊆ P; so (10)

holds for h and h. Also trivially (11) holds: h( m0 ) = m 0 because mpconditions with depth 1 map, through h, to only conditions in m0 , and because m0 is 1-safe due to the general assumptions in p. 18. Similarly h( m 0 ) = m 0 because

m 0 = h( m0 ) = h(h( m 0 )) = h( m 0 )
. For the rest of the proof, let e ∈ E be an mp-event, e ∈ E any event such that h(e) = e, and t = h(e) = h( e). We now show that h restricted to • e is a bijection. Recall that • e is defined as h( • e), so we only need to show that h restricted to • e is injective. Let c, c ′ ∈ • e. If c = c ′ then h(c) = h(c ′ ), because h is a homomorphism. Then c and c ′ cannot be merged and h(c) = h(c ′ ). Analogous arguments prove that h restricted to e • or e is also bijective. Finally, we show that h restricted to • e is bijective. The proof for e • or e is similar. Let c, c ′ ∈ • e, and let c, c ′ ∈ • e such that h(c) = c and h(c

′ ) = c ′ . Because h is a homomorphism, h(c) = h(c ′ ). Then h(c) = h( c) = h(c ′ ) = h( c ′ ). Hence h restricted to • e is injective. To see why it is surjective, let p ∈ • t. Again, because h is a homomorphism, there is a single c ∈ • e such that h(c) = p. Let c = h(c). Recall that h(c) = h( c) = p.
Because h is a homomorphism, c ∈ • e, and so h restricted to • e is surjective.

8 For any run σ of M N , h( σ) is a run of N, by Lemma 1. For any run σ of N, there is, by the properties of U N , a run σ in U N such that h( σ) = σ.

Then σ := h( σ) is a run of M N that satisfies h( σ) = h( σ) = σ. 9 Let C be a configuration of P N . We prove that e = e ′ implies h(e) =

h(e ′ ) for all e, e ′ ∈ C. For an argument by contradiction, assume h(e) = h(e ′ ). Events e and e ′ have been merged into the same mp-event, so h(e) = h(e ′ ). Since e = e ′ , by (21) either • e = • e ′ or e = e ′ , which implies that there exists some c ∈ • e ∪ e and c ′ ∈ • e ′ ∪ e ′ such that c = c ′ but both c and c ′ are labelled by p and have occurrence depth k.

By property 5, [c] ∪ [c ′ ] contains a cycle in relation ր, but [c] ∪ [c ′ ] ⊆ C.
This is a contradiction. 10 Any repetition-free run σ of M N is, by property 8, such that h( σ) is a run of N. Now, let σ be a run of N. We know (cf. proof of property 8) that there is a run σ of U N with h( σ) = σ and that there is a run σ of M N verifying h( σ) = σ and h( σ) = σ. We now prove that σ is repetition-free. Recall that the set {e ∈ E | e fires in σ} is a configuration of U N , and that σ is repetition-free. If σ was not repetition-free, some mp-event e would fire two times, implying that there are two different events e, e ′ that fire in σ such that h(e) = h(e ′ ). This contradicts property 9.

Note that Property 9 is still true when h is restricted to the elements of m0 ∪ C ∪ C • . Indeed, h is bijective when restricted to m0 , because m 0 is safe, and two conditions c, c ′ ∈ C • cannot be merged because ր

[c]∪[c ′ ] would have cycles and [c] ∪ [c ′ ] ⊆ C. Definition 17 (mp-configuration). A multiset of mp-events C is an mp-configu- ration of Q if there exists a configuration C of U N verifying h(C) = C.
As it is the case for configurations of branching processes, any mp-configuration of a merged process represents a (concurrent) run of its mp-events, i.e., there exists at least one linear ordering of the mp-events of C that is a run of the merged process. This is because the same is true for configurations of the associated branching process and because h is a homomorphism.

Every finite firing sequence of U N consists of a set of events that form a configuration C, which, due to Def. 17, corresponds to an mp-configuration C of M N . However, the inverse statement is not true: a firing sequence of M N may consist of a multiset of events X that is not an mp-configuration since no C ∈ conf (U N ) satisfies h(C) = X. This already holds for ordinary nets, as the example in Fig. 25 shows: v 1 v 5 is a valid firing sequence of M N corresponding to events e 1 and e 6 of U N (i.e. h(e 1 ) = v 1 and h(e 6 ) = v 5 ) which do not form a configuration. However, h applied to v 1 v 5 still gives a valid firing sequence t 1 t 3 of N thanks to Rmk. 12 (8).

We shall regard a CMP Q as marking-complete when all the markings of N are represented, not by arbitrary runs of Q, but by those associated to mp-configurations of Q.

Definition 18 (marking-complete CMP). Let X be a finite multiset of mp-events. The cut and marking of X are respectively defined as the multisets cut(X)

:= ( m 0 + X • ) -• X mark(X) := h(cut(X)).
We call Q marking-complete if for each reachable marking m of N there exists a cutoff-free mp-configuration

C in Q satisfying mark( C) = m.
The intuition behind these definitions is as follows. If X is the multiset of mp-events associated to a finite run (i.e., the multiset M such that M( e) = n if e fires n times) then cut(X) is the marking reached by this run in the CMP, and mark(X) is the h-image of cut(X), i.e., the corresponding marking of N.

Observe that in the definition of a marking-complete CMP, one could ask for a finite run (rather than a configuration) that reaches a marking m. The resulting definition would be equivalent, but we preferred the current variant because it (i) mimics the analogous definition for unfoldings and (ii) avoids some unpleasant properties of runs: e.g., finite CMPs can have infinite runs and therefore infinitely many finite runs, which is impossible for configurations.

interplay between read-arcs and choice

Let us now illustrate the benefits of using CMPs on a concrete family of cnets. We compare the various approaches to unfold and merge such c-nets, and explain why CMPs, on this family, achieve such gains.

Our family of c-net examples is called n-Gen, and the instance for n = 2 is shown in Fig. 26. The net represents n processes that concurrently generate resources r i . Once all resources r i are produced, an action t consumes them all. Resource r i can be produced if one of two conditions is fulfilled, symbolised by transitions t i or t ′ i . Thus, t i , t ′ i share context with transitions t j and t ′ j , respectively, whenever j = i. For some n ≥ 1, let N c be the c-net n-Gen, N p its plain encoding, and N r its PR encoding. The unfoldings of the three nets and the MPs of N p and N r p ′ r 0 r 1

q 0 q 1 t ′ 0 t 0 t 1 t ′ 1 p v 1 v 3 v 0 v 2 p ′′ t Figure 26: The c-net 2-Gen.
blow up due to at least one of the following reasons, which we explain in the sequel: (a) choices between t i and t ′ i or (b) sequentialized read access to p and p ′ .

For (a), notice that process i can produce r i in two different ways. At least two occurrences of each r i are thus present in the unfolding of any of the three nets. Hence there are at least 2 n ways of choosing t's preset, i.e., at least 2 n occurrences of t and p ′′ in any of the three unfoldings.

Roughly speaking, (b) refers to the same phenomena that were demonstrated in Fig. 5 and discussed in § 1.4, on p. 8. While all t i are concurrent in N c , they are sequentialized in N p : they all consume and produce the same p. This creates conflicts between them, and as a result all their exponentially many interleavings are explicitly present in U N p . Importantly, any occurrence of t i that consumes an occurrence of p at depth d, produces an occurrence of p at depth d + 1.

In N r , even if all t i are still concurrent to each other, their occurrences produce two conditions with occurrence depths 1 and 2, each labelled by their respective private copy of p. For U N r , this again has the consequence of producing 2 n ways of choosing v 3 's preset, and 2 n events labelled by v 3 . More importantly, the private copies of t i cannot be merged with those of t j and they remain in Q N r . As a result, all 2 n occurrences of v 3 are also present in the MP of N r . This suggests that MPs of PR unfoldings may not yield, in general, much gain.

While the size of the contextual unfolding of N c explodes due to (a), it is unaffected by (b). On the other hand, the MP of N p effectively deals with (a), but only partially with (b). We now see why. Notice that there are O (2 n ) conditions labelled by p in U N p , all with occurrence depths between 1 and n + 1. In the MP, they are merged into the n + 1 mp-conditions p 1 , . . . , p n+1 . Since all instances of q i and r i have occurrence-depth 1, all the exponentially many events labelled by t i are merged into n mp-events, each consuming some p j and producing p j+1 , for 1 ≤ j ≤ n. This yields an MP of size O (n 2 ).

Finally, the CMP of N c deals effectively with both (a) and (b); it is, in fact, isomorphic to N. Roughly speaking, this is because the unfolding of N c already deals with (b), as we said, and the 'merging' solves (a). Thus, the CMP is polynomially more compact than the MP of N p and exponentially more than the MP of N r , or the unfoldings of N c , N p , or N r . See Table 4 for a summary.

O (n) O (n 2 ) O (2 n ) O (2 n ) O (2 n ) O (2 n )
While this example in itself is artificial, the underlying structures are quite simple and commonly occur in more complex c-nets, which explains some of the experimental results below.

characterizing reachability

In this section we present two results that pave the way to a practical reachability algorithm based on CMPs. We give, for safe nets, characterizations of sets of mp-events that correspond to reachable markings of N (Prop. 11) and to configurations of Q (Prop. 12). These characterizations will be used in the next section to produce SAT encodings of the reachability problem based on CMPs. In particular, they will serve to aid CMP-based model-checking, as well as the direct construction of CMPs.

We note that the problem of generalizing these approaches to bounded, but not safe, nets is still open even for merged processes without read arcs [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF].

Therefore we focus on the practically relevant class of safe c-nets. Here, the mapping h lifted to configurations of U N establishes an injective correspondence between the configurations of the unfolding and the mp-configurations of the unravelling. For each mp-configuration C there exists a unique configuration C of U N such that C = h(C).

Our first step is to characterize a subset of repetition-free runs of Q that is large enough to include all interleavings of all mp-configurations. It thus contains sufficient firing sequences to characterize the set of reachable markings of N, as discussed further below. Lemma 6. Assume N is safe, and let X be any set of mp-events of Q satisfying:

1. • X ∪ X ⊆ m 0 ∪ X • ,

and

(60) 2. ր X is acyclic.

(61)

Then any linear extension of ր X is a repetition-free firing sequence of Q. Moreover, any mp-configuration of Q satisfies (60) and (61).

Proof. Let e 1 , . . . , e n be a total order on X that is compatible with ր, i.e., such that e i ր e j implies i < j for all 1 ≤ i, j ≤ n. We prove, by induction on n, that such sequence is a run of Q.

We show that e 1 is enabled at the initial marking. Condition (60) says that all c ∈ • e 1 ∪ e 1 are initially marked or generated by some other mp-event in X. Since e 1 is ր-minimal, no event e j satisfies e j < e 1 , so c is initially marked.

We now show that, if e 1 , . . . , e k is a run, then e 1 , . . . , e k , e k+1 is a run too, for 1 ≤ k < n. Assume the hypothesis. Let C k := { e 1 , . . . , e k } and let m := cut( C k ) be the cut reached after firing e 1 , . . . , e k . We prove that any c ∈ • e k+1 ∪ e k+1 verifies c ∈ m. By condition 1, we know that c ∈ m 0 or c ∈ X • . Since any mp-event e j in the preset of c is such that e j ր e i , we know that

e j ∈ C k , and c ∈ C • k . So c ∈ C • k ∪ m 0 .
It remains to prove that c / ∈ • C k . If this was not the case, then some e l ∈ C k would be such that c ∈ • e l , and also such that e i ր e l , since either • e i ∩ • e l = ∅ or e i ∩ • e l = ∅. But then i < l, and e l / ∈ C k , a contradiction. So c ∈ (

C • k ∪ m 0 ) \ • C k = cut( C k )
, and e 1 , . . . , e k , e k+1 is a run.

As for the second statement, let C be an mp-configuration of Q and C a configuration of P such that h(C) = C. We show that C satisfies (60) and (61). Note that m 0 , C, and C • are sets rather than general multisets, essentially because N is safe and h restricted to C is injective.

• Since C is an mp-configuration, there is a linear order e 1 , . . . , e n on the mp-events of C that is a run of N. Let e i be any mp-event of C, and let c ∈ • e i ∪ e i be any mp-condition on its preset or context. We prove that either c ∈ m 0 or • c ∩ C = ∅. This is trivially true for e 1 , since it is enabled at the initial marking, so assume that i ≥ 2. The sequence e 1 , . . . , e i-1 is a run, let m be the marking it reaches. Then e i is enabled at m, so c ∈ m. So either c is initially marked or there is some mp-event e j ∈ C, 1 ≤ j < i, such that e j ∈ • c, which shows (60). • Since h restricted to C is injective, h-1 restricted to C is an injective function; furthermore, it is a homomorphism. The absence of cycles in ր C follows from the properties of homomorphisms. Specifically, if, by contradiction, it was possible to find a cycle e 1 ր . . . ր e n ր e 1 in C, then, using Lemma 1, we could also find the cycle

h-1 ( e 1 ) ր . . . ր h-1 ( e n ) ր h-1 ( e 1 )
in C, which would contradict (18). Lemma 6 identifies a subset of repetition-free runs of Q. Observe that not every repetition-free run satisfies the two conditions: v 1 v 3 v 4 is a repetitionfree run of Fig. 25 but {v 1 , v 3 , v 4 } violates (61). This means that Lemma 6 characterizes a strict subset of repetition-free runs, which is, however, large enough to contain all interleavings of all mp-configurations, and therefore enough runs for representing all reachable markings of N. This fact is exploited in Prop. 11.

A key detail in both results is that acyclicity of ր prohibits, at the same time, asymmetric conflicts inherent to c-net unfoldings, as those in Fig. 10, on p. 23, and cycles in the flow relation introduced by merging, as shown in Fig. 25 (c).

Using Lemma 6, we can now characterize the reachable markings of N in terms of a marking-complete CMP Q of N. In essence, the following result states that reach(N) is the h-image of the markings reached by a subset of Q's repetition-free runs. Proposition 11. If N is safe and Q marking-complete, a marking m is reachable in N iff there is a cutoff-free set X of mp-events of Q satisfying:

1. properties (60) and (61), and 2. m = mark(X).

(62)

Proof. Let m be a reachable marking of N. Then there is a mp-configuration X of Q, free of cutoffs and satisfying mark(X) = m. As Lemma 6 shows, X also satisfies (60) and (61).

For the opposite direction, if X satisfies all the three properties, it clearly identifies a marking m reachable in N. By Lemma 6, any linear extension of ր X is a run of Q, that reaches a cut cut(X) of Q. Such reachable marking of Q maps, through h, to a reachable marking of N, thanks to Lemma 1.

We now extend Lemma 6 with two additional constraints to fully characterize the mp-configurations of Q. The first condition asks that all mpconditions p 1 , . . . , p k-1 are present in the candidate set if p k is also present, and the second ensures that they are visited in the right order. Proposition 12. If N is safe, a set of mp-events C is an mp-configuration of Q iff it satisfies the following conditions, for any p k+1 ∈ C • with k ≥ 1:

1. (60) and (61) hold for C, and 2. p k ∈ m 0 ∪ C • , and (63)

3. the digraph ( m 0 ∪ C ∪ C • , < i ) has a path from p k to p k+1 .
(64)

Proof. Assume that C is an mp-configuration. By Lemma 6 it satisfies (60) and ( 61). We show it also satisfies ( 63) and ( 64), essentially due to the properties of h. Let C be the such that h(C) = C. Recall that m 0 , C, and C • are sets rather than general multisets.

• Assume that p k+1 ∈ C • , and let c ∈ B be the single condition in m0 ∪ C • such that h(c) = p k+1 . Condition c exists and is unique by property 9 in Rmk. 12. Since c has occurrence depth k + 1, there exists c ′ with occurrence depth k and label p, such that c ′ < c, and therefore c ′ ∈ m0 ∪ C • . Then h(c ′ ) = p k , and p k ∈ m 0 ∪ C • . This shows (63). • Let c and c ′ be as in the previous paragraph. Let e 1 , . . . , e l be events verifying c ′ < i e 1 , and e l < i c, and e • i ∩ ( • e i+1 ∪ e i+1 ) = ∅ for 1 ≤ i < l. They exists because c ′ < c, and they identify a path from c ′ to c in ( m0 ∪ C ∪ C • , < i ), that h maps to a path identified by h(e 1 ), . . . , h(e l ) from p k and p k+1 in the digraph ( m 0 ∪ C ∪ C • , < i ). This shows (64).

We now prove, by induction, the opposite direction. We show that any set C of mp-events satisfying the four properties above is an mp-configuration.

For the base case, assume that C = ∅. Clearly, ∅ is a configuration of U N , and h(∅) = ∅. For the inductive step, assume that the statement is true if C has at most n ≥ 0 mp-events, and let C be a set of n + 1 mp-events. Let e be any ր-maximal mp-event in C, which exists by (61), and let C ′ := C \ { e}. Recall that no mp-event e ′ ∈ C ′ satisfies e < e ′ because e is ր-maximal. We prove that C ′ satisfies all the four conditions above.

• Property (60). Assume that C ′ violates (60). Then there is some e ′ ∈ C ′ such that e • ∩ ( • e ′ ∪ e ′ ) = ∅. But this is not possible because e < e ′ . • Property (61) is trivially true for C ′ as it was already for C. • Property (63). For some k ≥ 1 and place p ∈ P, assume that

p k+1 ∈ C ′• but p k / ∈ m 0 ∪ C ′• . Then p k ∈ e • because p k ∈ m 0 ∪ C • . Since C satisfies (64), there is a path in ( m 0 ∪ C ∪ C • , < i ) from p k to p k+1
, so there exists some e ′ ∈ C with p k < e ′ < p k+1 . But then, e < e ′ , a contradiction, so p k ∈ C ′• .

• Property (64). To show that there is a path in ( m 0 ∪ C ′ ∪ C ′• , < i ) from p k to p k+1 , let e 1 , . . . , e l ∈ C be mp-events satisfying p k < i e 1 < . . . < e l < i p k+1 , and e • i ∩ ( • e i+1 ∩ e i+1 ) = ∅ for 1 = 1, . . . , l and for some l ≥ 1. We prove that e = e i , for any i = 1, . . . , l, and therefore e i ∈ C ′ . Obviously, for i = 1, . . . , l -1 we have that e = e i , since otherwise e i+1 would satisfy e < e i+1 , contradicting that e is ր-maximal in C. So we only have to check that e = e l . Assume, for a proof by contradiction, that e = e l . Then, p k+1 ∈ e • . Since p k+1 ∈ C ′• and because e / ∈ C ′ , there is some other e ′ ∈ C ′ such that p k+1 ∈ e ′• . So p k+1 has at least two different mp-events in its preset. Now, by Lemma 6, all events in C can be ordered to form a run of Q. Then, since N is safe, there exists some mp-event e ′′ ∈ C that consumes p k+1 . But e is ր-maximal in C, so necessarily e = e ′′ . So e consumes and produces p k+1 . Any event in h-1 ( e) obviously consumes one condition labelled by p and produces a different one, also labelled by p; and both conditions have been merged into p k+1 . This is a contradiction, both conditions have different occurrence depth.

Since C ′ satisfies all the three conditions, by induction hypothesis, there exists some configuration C ′ of U N such that h(C ′ ) = C ′ . In the sequel, we prove that there exists some event e enabled at cut(C ′ ) such that h(e) = e, and therefore h(

C ′ ∪ {e}) = C ′ ∪ { e} = C. Then C is an mp-configuration because C ′ ∪ {e} is a configuration.
Let m := cut(C ′ ) be the cut of C ′ , and m := cut( C ′ ) be the cut of C ′ . Recall that h(m) = m, because h is a homomorphism. The mp-event e is necessarily enabled at m. Then some transition h( e) is enabled at the marking h( m) = h(m) of N, and therefore, some event e exists in U N such that h(e) = h( e).

Note that e is unique, due to (21). We now show that h( • e) = • e, and h(e) = e, and h(e • ) = e • , which implies that h(e) = e.

• We prove that h( • e) = • e, the case for h(e) = e is analogous. Let c ∈ • e be a condition in the preset of e. We show that h(c) ∈ • e. Since e is enabled at m, then c ∈ m, and h(c) := p k ∈ m. Since h(e) = h( e), there exists some mp-condition p k ′ ∈ • e. Also, p k ′ ∈ m, because e is enabled at m. But p k = p k ′ , since otherwise h( m) would not be safe. This proves that h( • e) ⊆ • e. Recall that | • e| = | • e|, so necessarily h( • e) = • e.

• We prove that h(e

• ) = e • . Since |e • | = | e • |, because h(e) = h( e)
, and since h is injective when restricted to e • , we only need to prove that h(e • ) ⊆ e • . Let c ∈ e • be such that h(c) = p k . We know that some mpcondition p k ′ is present in e • . We prove that (i) k ≥ k ′ and (ii) k ′ ≥ k, and therefore k = k ′ .

i Because C satisfies (64), there is a path σ in the directed graph ( m 0 ∪ C ∪ C • , < i ) from some initial condition to p k ′ that visits p 1 , p 2 , . . . , p k ′ in that order. The last two elements of σ are e and p k ′ , and when removed from σ, the resulting path σ ′ is also a path in the graph

( m 0 ∪ C ′ ∪ C ′• , < i ).
Since C ′ is a configuration, h restricted to it is a bijection from C ′ to C ′ , and therefore σ ′ := h-1 ( σ ′ ), where h-1 denotes now the inverse of such restriction, is a path in the graph ( m0 ∪ C ′ ∪ C ′• , < i ) from some initial condition of m 0 to some element of • (e ∪ e). But this means that σ ′ followed by e, c is a path in ( m0 ∪ [c] ∪ [c] • , < i ) from the initial conditions to c where at least k ′ occurrences of p happen, so the occurrence depth of c is at least k ′ , and so k ≥ k ′ . ii For an argument by contradiction, assume that k > k ′ , and that therefore some condition c ′ < e is such that h(c ′ ) = p k ′ . By Lemma 1, we have p k ′ < e; moreover, there is an immediate causality path in m 0 ∪ C ∪ C • from p k ′ to e. Recall that, by def- inition we have e < p k ′ . So we have a causality cycle in C, a contradiction to (61).

encoding reachability into sat

In the previous section, two results, Prop. 11 and Prop. 12, helped to characterize reachable markings of N and configurations of Q in terms of suitably constrained sets of mp-events. Here, we turn these results into SAT formulas whose solutions encode runs of N or mp-configurations of Q.

Note that [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF] discusses the corresponding problems for ordinary MPs and Ch. 4 for contextual unfoldings. Remarkably, both problems require to encode acyclicity for different purposes, which are united into a single acyclicity constraint in our case.

Reachability via Arbitrary Runs

Assume we want to verify the coverability of a set m ⊆ P of places in N, and we have a marking-complete CMP Q of N. Proposition 11 gives nec- essary and sufficient conditions for m to be reachable; using this result, we define a propositional formula γ mark,M Q that is satisfiable iff m is coverable, although our formula can be very easily modified to check that m is reachable. The formula is over variables e for every mp-event e ∈ E and c gen , c con for every mp-condition c ∈ B. Actually, it will involve other variables, but this will be discussed later. The intuition behind the encoding is as follows. Any satisfying assignment of γ mark,M Q corresponds to a set X of mp-events that satisfy (60), (61), and a variant of (62). Specifically, if V is the set of variables in γ mark,M Q and v : V → {0, 1} is a satisfying assignment, then the set X := {e ∈ E : v(e) = 1} satisfies all the three properties. The formula is a conjunction of four subformulas,

γ mark,M Q := γ flow Q ∧ γ asym Q ∧ γ cov,M Q ∧ γ aux Q ,
where the first three of these are defined as follows:

γ flow Q := e∈ E, c∈ • e∪e e → c gen γ asym Q := ACY(∆ Q ) ∧ c∈ B AMO(c • ) γ cov,M Q := p∈m c∈ h -1 (p) c cut
The first formula, γ flow Q , enforces X to satisfy (60). Indeed, (60) asks that every mp-event has its preset and context covered by either conditions generated by X or the initial marking. Now, γ flow Q requests any such mp-condition c to be generated by X. Below we will see that c gen holds iff c is initially marked or at least one mp-event in the preset of c is in X.

The constraint γ asym Q enforces (61) to hold for X. As in Ch. 4, we separate the handling of symmetric and purely asymmetric conflict loops. The second part of the constraint forbids symmetric loops, its implementation is the same as in § 4.3. The first part forbids satisfying assignments that include cycles of ր. We come back to it later in this section.

Finally, γ cov,M Q constrains the satisfying assignment so that at least one mp-condition among those whose label is p, for every p ∈ m, is in the cut of X. Observe that this encodes coverability of m, in contrast to (62), which asks for reachability of m. The variable c cut holds iff c is generated by some mp-event in the satisfying assignment and it is not consumed. It is defined in γ aux Q , which is the conjunction of the following auxiliary subformulas:

c∈ B (c con ↔ e∈c • e) c∈ B\ m 0 (c gen ↔ e∈ • c e) c∈ B c cut ↔ (c gen ∧ ¬c con ) c∈ m 0 c gen For every mp-conditions c in Q, the variable c gen holds iff c is in m 0 ∪ X • ; similarly c con holds if c is in • X.
Although this SAT encoding naturally bears certain resemblance with the one presented in Ch. 4, this one requires a more careful treatment. For instance, any condition of an unfolding has a preset with zero or one events. However, mp-conditions may have presets with more than one mp-event. This requires to use dedicated variables for mp-conditions, like c gen or c con , to encode a property such as (60), which could be seen, roughly speaking, as the equivalent for CMPs of causal closure for unfoldings.

We now discuss γ asym Q in detail. This constraint implements (61), it requires satisfying assignments of γ mark,M Q to represent sets X such that ր X is acyclic. As we did in Ch. 4, we handle separately symmetric and asymmetric conflict cycles. The AMO(•) constraint forbids symmetric cycles. The constraint ACY(•) forbids all cycles of asymmetric conflict which do not contain a cycle of symmetric conflict, as we explain now.

Given a digraph G, the constraint ACY(G) contains one Boolean variable for each vertex of G. An assignment of truth to these variables satisfies ACY(G) iff the variables assigned true correspond to a set of vertices that induces an acyclic subgraph of G.

In γ asym Q

, we apply ACY(•) to the digraph ∆ Q , generated out of Q. This digraph contains vertices for each mp-event and mp-condition of Q. The intuition behind is that any set Y ⊆ E of mp-events in Q is ր-acyclic iff the set of vertices in ∆ Q associated to Y ∪ • Y ∪ Y • induces an acyclic subgraph. This is quite similar to what we did in Ch. 4, were we also needed to encode acyclicity of the asymmetric conflict relation. There, we had digraph whose nodes were only the events of the prefix and whose edges were, roughly speaking, the transitive reduction of causality on events. That graph was of linear size w.r.t. the prefix. In contrast, ∆ Q needs to include variables for mp-conditions in order to achieve linear size w.r.t. to Q.

We do not formally define ∆ Q , but a formal definition is easy to derive from the example in Fig. 27, on which we now elaborate. In Fig. 27 (a) we see a CMP, say Q; in (b) the associated digraph ∆ Q . The digraph contains one vertex for every mp-event of Q, and between one and two vertices for every mp-condition. Two vertices are necessary for ensuring the right order of occurrence for mp-events that have read arcs, as it will be clear shortly. Recall the definition of ր, in p. 18: mp-events e, e ′ satisfy e ր e ′ iff

e • ∩ ( • e ′ ∪ e ′ ) = ∅, or e ∩ • e ′ = ∅, or e # e ′ .
So given an mp-condition such as c 6 in Fig. 27 (a), the digraph needs to enforce that e 2 fires before, e.g., e 4 and e 6 , and that e 6 fires before, e.g., e 5 . We do this by introducing in ∆ Q two vertices c 6b and c 6a ('b' for before and 'a' for after), and edges as follows: for any mp-event producing c 6 , an edge from it to c 6b ; for any mp-event consuming c 6 , an edge from c 6a to the mpevent; read arcs from c 6 are are translated as pairs of edges, leaving c 6b and coming back to c 6a ; one edge is put from c 6b to c 6a . This construction allows any mp-event to optionally read c 6 without imposing an order among the possibly multiple readers, but enforcing that such readers happen after any mp-event in the preset of c 6 and before any event in the postset of c 6 . Some mp-conditions, such as c 8 , are only read and consumed, but not produced. For those, we only need one vertex in ∆ Q , and read arcs are translated as edges from the readers to the mp-condition. A similar situation happens in c 7 , where there is no consumer. In this case the read arc is translated by an edge in the opposite direction, see Fig. 27 (b).

Several optimizations are obvious to this encoding, such as removing nodes associated to mp-conditions with one incoming edge, but we do not discuss them here. Independently of whether they are used, the size of ∆ Q is linear on Q.

The constraint ACY(•) is implemented as in Ch. 4. It encodes the idea that if two nodes of the graph are selected, their ranks must be sorted. We note that mp-events are selected if the associated variable is true, and mpconditions are selected if c gen is true.

Reachability via Mp-Configurations

The encoding in the previous section does not require the selected set of events to be an mp-configuration; it only demands it to represent a repetitionfree firing sequence of the CMP.

In this section we produce a propositional formula whose models encode all and only the mp-configurations of Q that cover a given marking of N. The encoding is based on Prop. 12 and reuses all the constraints that compose γ mark,M Q , presented in the previous section. Specifically, given a set of places M ⊆ P, we define a propositional formula γ con,M Q whose satisfying assignments encode sets X of mp-events that satisfy (60), ( 61), ( 63), (64), and a variant of (62). The formula is a conjunction of two constraints:

γ con,M Q := γ mark,M Q ∧ γ no-gap Q .
The subformula γ mark,M Q requests M to be coverable by means of a repetitionfree run, and enforces (60), (61), and (62), as we have already seen; γ no-gap Q enforces (63) in a fairly obvious way:

γ no-gap Q := c:=p k ∈ B, c ′ :=p k-1 ∈ B, k≥1 c gen → c ′ gen .
We now discuss how (64) is encoded. This condition requests that X contains a path of immediate causality that visits all mp-conditions p 1 , p 2 , . . . , p n labelled with the same place p, by increasing order of depth. As in [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF], we enforce this property augmenting the digraph ∆ Q with additional edges. We first observe that asking for the presence of a path from p k to p k+1 is equivalent to forbidding a path from p k+1 to p k : Lemma 7. If N is safe, for any set C of mp-events satisfying (60), (61), and (63), the following statement is equivalent to (64): for k ≥ 1,

• the digraph ( m 0 ∪ C ∪ C • , < i ) has no path from p k+1 to p k .

(65)

Proof. First, remark the difference between both properties: (64) requests a path from p k to p k+1 , and (65) forbids a path from p k+1 to p k . We denote in the sequel the aforementioned digraph by G.

Trivially if C satisfies ( 61), (63), and (64), it also verifies (65). Otherwise, there would exist some p k and p k+1 such that the C contains a cycle of causality p k < p k+1 < p k , a contradiction to (61).

For the other direction, assume (65) holds but (64) is violated. We have mp-conditions p k and p k+1 in m 0 ∪ C that are mutually unreachable in G. We show this is a contradiction to N being safe. Let e 1 be any mp-event in • p k+1 ∩ C, which exists because k + 1 ≥ 2. Consider the set

C ′ := C \ { e ∈ C : p k+1 ⊳ * e}, where ⊳ denotes the relation < i ∩ ( C ∪ C • ) 2 .
That is, we remove from C all mp-events that can be reached from p k in G, observe that ⊳ is the edge relation of G. Obviously C ′ contains e 1 , otherwise C would violate (61). Also, m 0 ∪ C ′• contains p k as a consequence of p k not being reachable from p k+1 . It is also immediate to show that C ′ satisfies (60) and (61). As a result, any linear extension of ր C ′ is a run of Q that marks p k+1 . Now consider the set

C ′′ := C ′ \ { e ∈ C ′ : p k ⊳ * e},
i.e., we remove from C ′ all mp-events reachable from p k in G. Similarly, e 1 is in C ′′ because e 1 is unreachable from p k , and m 0 ∪ C ′′• contains p k , due to C ′ satisfying (61). So p k , p k+1 ∈ cut( C ′′ ). As before, C ′′ satisfies (60) and (61), so there is a run of Q that marks p k and p k+1 , a contradiction to N being safe.

With this result, our task is simple: given two mp-conditions c, c ′ , forbidding a path from c to c ′ amounts to including in ∆ Q an edge from c to c ′ ; if such a path is selected, this edge will close a cycle that γ asym Q will reject. So we enforce (64) by including one edge from p k to p k+1 , for every p k , p k+1 ∈ B, in the digraph ∆ Q .

constructing complete cmps

In this section, we discuss various algorithmic aspects of CMPs, in particular, how to construct a marking-complete CMP from a given safe c-net N.

Recall that a CMP is marking-complete if every reachable marking m of N is the h-image of the cut of some cutoff-free mp-configuration. We wish to construct such a CMP in order to analyze properties of N such as reachability or deadlock. It follows from Def. 16 that one can achieve this goal by (i) constructing a marking-complete unfolding prefix P and (ii) applying the construction from Def. 16 to P. This does not yield any gain for practical verification, as the unfolding prefix can be much larger than the CMP. It will be, however, the method we employ in § 7.6 to construct marking-complete CMPs in order to compare their sizes with unfoldings.

Another option is to construct a CMP directly from the c-net N. A similar approach for nets without read arcs was presented in [START_REF] Khomenko | An Algorithm for Direct Construction of Complete Merged Processes[END_REF][START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF]. No such implementation currently exists for CMPs; in the following we describe some key elements that are required for extending [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF] to CMPs.

A procedure for directly constructing the CMP would start with a CMP containing only the mp-conditions that represent the initial marking of N and extend it one mp-event at a time. To know whether the current CMP Q can be extended by an mp-event e, one has to identify an mp-configuration C of Q and check (i) whether C ∪ { e} is an mp-configuration of M N and (ii) whether e constitutes a cutoff.

Problem (i) is already solved, we can use the SAT encoding presented in § 5.5.2 to find mp-configurations C that enable a new event e. For (ii), observe that an mp-configuration H corresponds to some history H of an event e of U N with h(e) = e iff e is the maximal element of the relation ր H . The problem then corresponds to asking whether for all such H there exists another mp-configuration C such that mark( C) = mark( H) and C ≺ H. For C, H in Q, this problem can be encoded in 2QBF, which is more complicated than SAT but less so than QBF in general, and for which specialised solutions exist [START_REF] Darsh | A Comparative Study of 2QBF Algorithms[END_REF].

As Q grows, the number of possible candidates for H may increase. As a result, in general e cannot be designated a cutoff until the construction has been terminated. So e may become a cutoff as the construction progresses, and the algorithm has to re-checked periodically.

To summarize, the basic structure of the algorithm from [KM13] would remain unchanged, however one needs to use the encoding of § 5.5.2 to find mp-configurations rather than the non-contextual one explained in [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF].

conclusions

We have developed a new condensed representation of the state space of a contextual Petri net, called contextual merged processes. This representation combines the advantages of merged processes and contextual unfoldings, and copes with several important sources of state space explosion: concurrency, sequences of choices, and concurrent read accesses to shared resources. Experimental results in Ch. 7 will demonstrate that this representation is significantly more compact than either merged processes or contextual unfoldings.

We also proved a number of results which lay the foundation for model checking of reachability-like properties of safe c-nets based on CMPs. In particular, given a CMP, they allow one to reduce (in polynomial time) such a model checking problem to SAT. Furthermore, since the algorithm for direct construction of merged processes of safe Petri nets proposed in [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF] is based on model checking, it can be transferred to the contextual case, which would complete the verification flow based on CMPs.

Future work includes implementing the proposed model checking algorithm and porting the algorithm for direct construction of MPs proposed in [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF] to the contextual case. While the high-level structure of the latter algorithm remains the same, moving from Petri nets to c-nets entails several low-level changes in the nets representation, which pervade the whole code; thus, this porting requires significant implementation effort.

D I A G N O S I S

Like Ch. 4, this chapter focuses on analysis methods for concurrent systems, in this case, fault diagnosis. We present a methodology for the diagnosis of faults in concurrent, partially-observable systems.

The chapter extends and generalizes the unfolding-based diagnosis approaches by Benveniste et al. [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] as well as Esparza and Kern [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF]. The latter work focused only on the use of sequential observations. We remove this assumption and employ partially-ordered observations. Diagnosis infers information from the system execution in order to detect faults. A second contribution is extending the method to exploit the additional information provided by the assumption of fair behavior. Theoretical foundations and a decision procedure are presented. We define three unfolding prefixes such that the diagnosis problem reduces to the existence of certain configurations in them. Next we show that the existence of these configurations can easily be encoded in SAT.

The results contained this chapter hold for ordinary Petri nets, not contextual nets. We find this work already interesting for ordinary nets. Furthermore, the theory of the reveals relation, employed in characterizing weak diagnosis, is not yet ready for contextual nets.

This chapter presents results of [HRS13].

introduction

Diagnosis under partial observation is a classical problem in automatic control in general, and has received considerable attention in discrete event system (DES) theory, among other fields.

In formal verification, the objective is removing errors from a system under development. In contrast, fault diagnosis only tries to detect and report faults during execution. For certain systems, such as large telecommunication networks, with links and routers that can fail at any moment, it is just not possible to avoid faults during operation. Diagnosis plays here, as we explained in Ch. 1, a complementary role to verification.

Diagnosis thus monitor the system and tries to detect faults. In certain cases, however, the amount of information available to the monitor is not enough to determine in which stat the system currently is. For instance, on a large network, distant nodes often cannot send full log information due to limited available bandwidth. Also, system-on-chip devices are often constructed with only very few pins to transmit debugging information. So limited visibility of what the system is doing happens often in practice.

Fault diagnosis observes the visible part of the system execution and infers which states the system could currently be in, and more specifically, whether a fault has happened. Like verification, it assumes that a model of the system is available.

The classical setting [SSL+95; CL08] assumes that the observed system is an automaton with a transition set T. The automaton is equipped with a labeling λ : T → X ∪ {ε} which models the information observed by each execution: each transition is labelled by either some alarm or observable label from the set X, or by the empty string ε. The former transitions are called observable transitions, the latter unobservable, and the mapping is not necessarily assumed to be injective. When the system executes a sequence w ∈ T * of transitions, the monitor only sees λ(w). Some particular unobservable transition φ is a fault. Diagnosis is then the task of deciding, given an observation w ∈ X * , whether or not all possible behaviors that explain the observation, i.e., in λ -1 ( w), contain an occurrence of φ. 1 Diagnosis, in the strict sense, reasons exclusively about the past of the system.

Classical diagnosis thus assumes that observations are streams of alarms. However, different types of diagnosis emerge from the distinct architectures of both the system and its supervision, see [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF].

In centralized, non-sequential, or asynchronous diagnosis, there are several sensors, each of which observes (a fragment of) a concurrent or distributed system. Each sensor produces a sequence of observations, as above. However, the different streams from the multiple sensors reach the (centralizing) supervisor asynchronously; no assumption is made about the communication architecture or speed. One assumes that the architecture respects causality (if occurrence of a causally precedes that of a ′ , the supervisor sees a before a ′ ), and that the ordering of observations from the same sensor is respected. By contrast, for any two alarms a and a ′ recorded by distinct sensors, any interleaving of a and a ′ must be considered. Decentralized diagnosis involves several supervisors that cooperate to reach a global verdict on whether or not a fault has occurred. The supervisors emit local verdicts (e.g. yes/no) that are synthesized into a global one. In distributed diagnosis [FBHJ05; BHK06], several supervisors compute explanations in a distributed unfolding procedure.

In this chapter we focus on asynchronous diagnosis of concurrent systems. These are difficult to supervise using the classical approach because SSE appears in multiple places as a consequence of using automata models. First, modelling a concurrent system by an automaton provokes SSE due to concurrency. But also, explanations are not in general streams of alarms, but rather sets of streams of alarms (one per sensor), or more in general labelled partial orders. Partially ordered observations must be first interleaved before using them under the classical approach, yielding again a combinatorial explosion.

Partially ordered observations and Petri net models of the system are employed in this work. The use of models that reflect the local and distributed nature of the observed system, such as Petri nets, is not only helpful in terms of computational efficiency, but also conceptually [START_REF] Fabre | Partial Order Techniques for Distributed Discrete Event Systems: Why You Cannot Avoid Using Them[END_REF]. In [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] diagnosis has been extended to asynchronous models using Petri net unfoldings and partially ordered observations. Roughly speaking, from a given observation, a prefix of the unfolding is identified that contains all explanations. The diagnosis method in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] assumes, however, that the model of the system has no unobservable loops, i.e., every infinite execution produces infinitely many alarms. This assumption is removed in [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF], but a new one, not present in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF], is introduced. The method from [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] assumes that observations are sequences of alarms instead of labelled partial orders.

Here, we extend [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] to remove the assumption of sequential observations. Our approach extends that of [BFHJ03; EK12] or [START_REF] Haar | Diagnosis with Petri Net Unfoldings[END_REF] and is also based on unfoldings. As second aspect our extension, not considered in any of the aforementioned works, is the introduction of weak fairness.

In concurrent systems, certain events and properties can be implied, or revealed by others if some notion of fairness is assumed. Naturally, every event that causally precedes another, is revealed by the latter; but fairness allows to infer more. For instance, consider the occurrence net shown in Fig. 29. Under the assumption that only the ⊆-maximal configurations correspond to the runs of the system that we may observe, one may clearly conclude that any run containing a also contains c, as a has disabled b and c has to fire, by assumption.

The additional assumption that we need is that of weakly fair behavior: on weakly fair runs, a transition t that becomes enabled at some point cannot stay enabled forever; eventually, either t or another conflicting transition t ′ must fire. Call t ′ , or t itself, a spoiler of t; for the run to be weakly fair, some spoiler of t must fire. Weak fairness is also often called progress. The notion of spoiler will play an important role in this chapter.

Diagnosis under the assumption of weakly fair behaviour is called weak diagnosis. We say that an observation w weakly diagnoses fault φ iff all weakly fair runs that explain w contain φ. Thus we aim at extending the frameworks of [BFHJ03; EK12] to weak diagnosis, and providing a decision procedure for the weak diagnosis problem.

Both [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] and [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] use Petri net unfoldings under certain restrictions: [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] accepts partial-order observations, but refuses models with unobservable loops; [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] accepts the latter, thanks to dedicated cutoff criteria, but refuses the former. Our work uses both features, additionally accounting for weak fairness in the diagnosis procedure. We generalize the cutoff criteria of [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] to the partially ordered observations from [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF], and extend the generalization to include fairness.

The chapter is organized as follows. In § 6.2 we recall basic notions and explain how our notation for contextual nets specializes for the case of ordinary Petri nets. In § 6.3, we present the diagnosis framework and formally define the problem that we solve. In § 6.4, theoretical foundations are presented, supporting the definition of a decision procedure, in § 6.5, for the weak diagnosis problem. This procedure is based on SAT solving. In § 6.6, we conclude and discuss future work.

basic notions

In this section, we establish notations and recall how definitions introduced in Ch. 2 specialize for ordinary Petri nets. We also discuss the notions of weak fairness and labelled partial orders, and prove some statements about them that will be used in the rest of the chapter. petri nets A Petri net is a c-net with an empty context relation. In this chapter we will denote a Petri net by a tuple N := P, T, F, m 0 , where we have indeed omitted the empty context relation. The immediate causality relation < i for Petri nets, defined for c-nets in (2) and (3), on p. 17, coincides now with the flow relation F, and the causality relation is, as before, the transitive closure of < i . The asymmetric conflict relation, similarly, reduces to the relation # ∪ (< i 2 ∩ (T × T)), as Rmk. 2 states. At any rate, we will not use asymmetric conflict in this chapter, as symmetric conflict suffices to express the conflicts that may relate events.

The axioms for occurrence nets, (13) to (16) on p. 22, are defined as before, with the particularity that (15) reduces to asking that every event e in the net is such that [e] is conflict-free, i.e., it contains no two events in symmetric conflict. Let O := B, E, G, m0 be an occurrence net. The configurations of O are all causally-closed, conflict-free set of events. Indeed, the axiom (18), which forbids cycles of asymmetric conflict for configurations of a contextual ON, reduces to forbidding the presence of conflicting events. By conf (O) we denote the set of all such configurations.

We define specific notation for this chapter. For an event e ∈ E and configuration C of O, we say that C enables e, written C e , iff e / ∈ C and (C ∪ {e}) ∈ conf (O).

Two nodes x, y of O are concurrent, written x y, if neither x ≤ y, nor y ≤ x, nor x # y holds. Observe that we reuse here the symbol from Ch. 3 to denote a different relation, here between nodes of O, while in Ch. 3 it denoted the concurrency relation between enriched conditions of an enriched prefix.

weak fairness Runs represent a sequential view of the executions of a net, whereas configurations represent the concurrent point of view. We give and relate the definitions of weak fairness for both.

Let N = P, T, F, m 0 be a finite Petri net, and

U N = B, Ẽ, G, m0 , h its unfolding. A configuration of U N is weakly fair if it is ⊆-maximal in conf (U N ).
Recall that the evolution order ⊑ between configurations of contextual unfoldings reduces to set inclusion for ordinary unfoldings. We denote by Ω(U N ) the set of weakly fair configurations, or Ω if no confusion can arise.

Lemma 8. A configuration ω is weakly fair iff it does not enable any event.

Proof. If ω ∈ Ω enables e, then ω ∪ {e} is a configuration, and ω is not maximal, a contradiction. If ω is not weakly fair, then there exists a configuration C that is a proper superset of ω. Pick some <-minimal event e from C \ ω.

By assumption, all causal predecessors of e are in ω, so all conditions in • e are either initial or receive a token from some event in ω. Since C is a configuration, it is conflict-free. So no event in ω will remove a token from • e, and ω enables e.

Here we assume, for the sake of simplicity, that all weakly fair configurations of U N are infinite. This entails no loss of generality, finite weakly fair configurations correspond to deadlocks that can be detected and processed separately -for instance, by adding a looping transition.

A spoiler of a transition t of N is any t ′ ∈ T such that • t ∩ • t ′ = ∅ (including t itself). We write spoilers(t) for the set of such transitions. Following Vogler [START_REF] Vogler | Fairness and Partial Order Semantics[END_REF], who adapts the concept of weakly fair termination [START_REF] Francez | Fairness[END_REF] to a Petri net setting, we say that an infinite run σ = t 1 t 2 . . . ∈ T ω of N is weakly fair if its marking sequence m 0 , m 1 , . . . satisfies that for all i ∈ N and all t ∈ T, if m i enables t, then there exists j > i such that t j ∈ spoilers(t). In other words, any t enabled at some point along σ either fires eventually, or some other transition that consumes from its preset is fired. For runs of an occurrence net O, such as U N , we can make the following, stronger statement.

Lemma 9. Let σ be a weakly fair run of O and m 0 , m 1 . . . its marking sequence. For all i ∈ N and all e ∈ E, if m i enables e, then ∃k > i ∀j ≥ k : m j does not enable e.

Proof. The statement follows from the definition of weakly fair runs and the fact that < is acyclic for O; once a token from • e is consumed, it cannot be replaced, and e remains disabled forever.

Finally, we observe that weakly fair runs and weakly fair configurations are related in the following way: Lemma 10. Every weakly fair run of U N is an interleaving of some ω ∈ Ω. Conversely, all interleavings of every ω ∈ Ω are weakly fair.

Proof. Let σ = e 1 e 2 . . . be an (infinite) weakly fair run and ω := { e i : i ≥ 1 }.

Since no e i can fire without its causal predecessors putting tokens into its preset, ω is causally closed. Due to the acyclic structure of U N , no condition can receive a token twice, no event will be repeated in σ, so no two events can consume from the same place, therefore ω is conflict-free and hence a configuration. Now suppose ω is not weakly fair, then by Lemma 8 it enables some event e. Arguing like in the proof of Lemma 8, we can conclude that all conditions in • e are either initial or will receive tokens from events in ω, and that no event in ω consumes from • e. Thus, some marking m i in the marking sequence for σ enables e, and then e is never disabled, which contradicts the weak fairness property for σ.

For the converse, let σ be an interleaving of a weakly fair configuration ω. Suppose that σ is not weakly fair; then some event e eventually becomes enabled during σ but neither e nor any conflicting event is in ω. Now, e can only become enabled if all its causal predecessors are in ω and put tokens into its preset, so ω ∪ {e} is also causally closed. Thus, ω ∪ {e} is a configuration, which contradicts maximality of ω. labelled partial orders An alphabet is a finite set X, whose elements are called letters. A labelled partial order (LPO) over X is a tuple α = S, < , λ where < ⊆ S × S is an irreflexive and transitive (hence antisymmetric) relation on S, and λ : S → X a labelling map. The size

|α| of α is |S|. Let α ′ = S ′ , < ′ , λ ′ be an LPO over X. A homomorphism from α to α ′ is a function h : S → S ′ verifying • λ(a) = λ ′ (h(a)), and (66)
• a < b implies h(a) < ′ h(b) for all a, b ∈ S. ( 67
)
An isomorphism between α and α ′ is a bijective homomorphism h from α to α ′ where h -1 is a homomorphism from α ′ to α. We say that α is compatible with α ′ if there exists a bijective function f : S → S ′ such that

• λ(a) = λ ′ ( f (a)), and (68)
• a < b implies ¬( f (b) < ′ f (a)) for all a, b ∈ S. ( 69
)
Observe that (67) and (69) are not equivalent, and f must be bijective. Denote by compat(α) the set of LPOs compatible with α.

Lemma 11. Given LPOs α, α ′ , if there is a bijective homomorphism h from α ′ to α, then compat(α) ⊆ compat(α ′ ).

Proof. Let A := S A , < A , λ A ∈ compat(α), and let f 1 : S A → S be the associated bijection. Let f 2 := h -1 be the (bijective) inverse of h. We show that f := f 2 • f 1 satisfies (68) and (69) from A to α ′ . For a, b ∈ S A , we prove that:

• f is bijective, as it is the composition of two bijections.

• λ A (a) = λ ′ ( f (a)
). This is because f 1 (by definition) and f 2 (by construction from h) preserve labels. Lemma 12. LPOs α and α ′ are isomorphic iff compat(α) = compat(α ′ ).

• a < A b implies ¬( f (b) < ′ f (a)). Assume that a < A b and f (b) < ′ f (a). Let a α := f 1 (a), and b α := f 1 (b). We know that ¬(b α < a α ) holds by definition of f 1 . But by definition of h also b α = h( f (b)) < h( f (a)) = a α holds, a contradiction.
Proof sketch. One direction is trivial, the other is reasoning by cases on the possible orderings in the LPOs, after establishing that S and S ′ have the same size.

reveals and diagnosis

All diagnosis strives to detect 'hidden' events, but we aim at diagnosing also latent but inevitable events, possibly in the future of the system evolution.

That is, we wish to diagnose exactly whether every weakly fair run that is compatible with the observations so far, contains a fault occurrence. By the above, we thus need to consider all weakly fair configurations in Ω that contain an explanation of the current observation as a prefix. Let us formalize these notions.

Reveals Relations

In occurrence nets, given two events e, e ′ , we say [Haa07; BCH11; HKS13]) that e reveals e ′ , written e ⊲ e ′ , iff e ∈ ω ⇒ e ′ ∈ ω for all ω ∈ Ω, that is, the occurrence of e entails that e ′ inevitably will occur, or has already occurred. For instance, in Fig. 29, which shows an unfolding prefix of Fig. 28, we have e 5 ⊲ e 1 , and e 4 ⊲ e 6 , and e 3 ⊲ e 2 . After the occurrence of e 5 , the occurrence of e 3 has become impossible; in a weakly fair execution, e 1 must thus necessarily occur. Similarly, when e 4 occurs, e 6 must already have occurred previously (⊲ -1 includes and extends causal precedence). Also, all weakly fair configurations containing e 3 must contain e 2 . Note that ⊲ is not a causal or temporal relation. Any revealed event can be, with respect to the event that reveals it, in the past (as for e 4 ⊲ e 6 ), be concurrent (as in e 5 ⊲ e 1 ), or in the future (as in e 3 ⊲ e 2 ).

It is shown in [START_REF] Haar | Types of Asynchronous Diagnosability and the Reveals-Relation in Occurrence Nets[END_REF] that one can characterize ⊲ by:

x ⊲ y iff #[y] ⊆ #[x],
Figure 29: A prefix of the unfolding for the net in Fig. 28. Events are named according to the corresponding transition (via the mapping h): e i , e ′ i , e ′′ i etc. for the occurrences of t i . Observation labels are as in Fig. 28.

where #[u] := {z ∈ E : z # u}. That is, x ⊲ y iff every event that prevents y, and these are contained in #[y], is also prevented by x, i.e., lies in #[x]. This binary relation ⊲ can be computed, for 1-safe Petri nets, on a finite prefix whose height is bounded [START_REF] Haar | Computing the reveals relation in occurrence nets[END_REF].

The binary reveals relation helps in detecting invisible events; however, for diagnosis purposes, it is not strong enough. We shall need more general relation that relates sets to sets, namely the extended-reveals relation --⊲ introduced by Balaguer et al. [START_REF] Balaguer | Building Tight Occurrence Nets from Reveals Relations[END_REF]. Assume that in Fig. 29, a and b are observable labels, and that we actually do observe their occurrence. From inspection of Fig. 29, we know that (i) e 5 is bound to occur, and (ii) one of the two instances of φ, either e 4 or e ′ 4 , are inevitable. However, the binary relation ⊲ does not permit to deduce (i) and (ii): while the conjunction of e 1 and e 11 makes e 5 inevitable, we have neither e 1 ⊲ e 5 nor e 11 ⊲ e 5 individually; also, the disjunction of e 4 or e ′ 4 is certain once e 5 is assured, but neither e 4 or e ′ are revealed individually. To account for such situations, following [START_REF] Balaguer | Building Tight Occurrence Nets from Reveals Relations[END_REF] we say, for sets of events A, B, that A extended-reveals B, written A --⊲ B, iff every weakly fair configuration that contains A also 'hits' B, i.e.,

A --⊲ B iff ∀ω ∈ Ω : (A ⊆ ω ⇒ B ∩ ω = ∅).

Diagnosis from Partial Observation

We fix now, for the rest of the chapter, the following framework. Let N := P, T, F, m 0 be a finite, safe Petri net satisfying the general assumptions on p. 18, and let U N := B, Ẽ, G, m0 , h be its unfolding. We denote by Ω the set of weakly fair configurations of U N and assume that all of them are infinite. Let ε denote a unique 'empty' symbol, and let X denote a nonempty observation (or alarm) alphabet where ε / ∈ X. Let λ : T → X ∪ {ε} be the mapping associating transitions of N with observations or ε, and φ ∈ T the unique fault transition. We let

T obs := T \ T ubs T ubs := λ -1 (ε)
be the sets of observable and unobservable transitions of N, and E obs := h -1 (T obs ) E ubs := h -1 (T ubs ) be the sets of observable and unobservable events of U N . Naturally, we assume that φ is unobservable, i.e., φ ∈ T ubs , and define the set of fault events as

E φ := h -1 (φ).
Observe that E φ ⊆ E ubs . We extend λ to Ẽ and, by abuse of notation, define λ(e) := λ(h(e)) for all e ∈ Ẽ.

We now define the notion of observation pattern, or simply observation. Observations are LPOs over an observation alphabet. LPOs allow to capture linearly ordered observations, produced by a single sensor that observes the interleaving of the system; or sets of linear orders, produced by a number of sensors that locally observe each concurrent process of a distributed system; or yet others. This allows to work in an asynchronous setting as in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF], but without the need to enumerate the interleavings of observation patterns, as opposed to the approach of [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF]. For the rest of the chapter, fix a finite observation pattern α := S α , < α , λ α over the observation alphabet X.

Given N and α, where α is the observation of some execution of N, our goal is to determine whether that execution contains a fault, assuming that runs of N are weakly fair. So we need to consider all those weakly fair configurations of U N that are compatible with α. We formalize this in two steps. First, we associate every configuration C with an LPO lpo(C) := S, < ′ , λ ′ , where S := C ∩ E obs are the observable events in C, < ′ is the restriction to S of the causal order < on U N , and λ ′ : S → X is the restriction of λ to S. Since < ′ and λ ′ are restrictions of < and λ, it is safe to confuse them here, and so we will.

Second, we define the observations of C as the set In the context of Fig. 28, any observation containing a label c or d clearly diagnoses φ. This is because once any transition labelled by them (t 6 or t 8 ) has fired, p 7 is marked. By fairness, necessarily t 1 and t 11 need to fire, marking p 9 and p 10 , which together with p 7 enable t 4 , the faulty transition.

What is more, and may serve to see the power of weak diagnosis here, is that observing a and b also weakly diagnoses φ. In fact, every weakly fair configuration that allows to observe a and b must contain an occurrence of t 5 , which marks p 4 and forces to fire either t 6 or t 7 . By the same argument as above, the fault is bounded to happen. On the other hand, observing only a or even a sequence a k is not sufficient for diagnosing φ (consider a weakly fair run composed only of occurrences of t 1 , t 9 and t 10 ).

The diagnosis problem is to decide, given N and an observation α, whether or not α weakly diagnoses φ. One of the keys to solve it is deciding relation (70) for a given configuration.

a solution using extended reveals

By Def. 19 and definition of --⊲, α diagnoses φ iff

∀C ∈ expl(α) ∀ω ∈ Ω : (C ⊆ ω ⇒ E φ ∩ ω = ∅) (71)
Swapping the two ∀, this can be equivalently rephrased as:

∀ω ∈ Ω : (∃C ∈ expl(α) : C ⊆ ω) ⇒ E φ ∩ ω = ∅ (72)
In this section we derive an algorithm for deciding the negation of (72), i.e., given α, the algorithm decides whether or not there is some ω ∈ Ω that contains an explanation C ∈ expl(α) and such that ω ∩ E φ = ∅. Deriving this algorithm needs to overcome two obstacles:

1. expl(α) may be infinite due to unobservable loops. In Fig. 29, a is explained by any configuration in which t 9 and t 10 fire any number of times, followed by e 1 . 2. Ω is an infinite set in general, which we need to finitely represent while still being able to check for set inclusion or whether E φ ∩ ω = ∅ for each weakly fair ω.

The main ideas behind our solution can be summarized as follows. Following [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF], we fix the first problem by showing that it is sufficient for deciding (72) to search for C within a finite subset of expl(α), instead of the entire, potentially infinite set of explanations. Because this subset is finite, there exists an unfolding prefix that contains it entirely (P α ), and we will see how to construct it. Once such a configuration C has been found, the algorithm needs to decide if it can be extended into a fault-free, weakly fair ω ∈ Ω. We show (Lemma 15) that this is the case iff two configurations C 1 ⊂ C 2 exist such that both of them reach the same marking, both are free of faults, C 2 disables every event enabled by C 1 , and C ⊆ C 1 . This result does not quite yet give an algorithm, as, e.g., C 2 could be unboundedly large. To fix this, we define two finite unfolding prefixes P 1 N and P 2 N verifying that (i), P 1 N is contained in P 2 N and, (ii), the aforementioned C 1 , C 2 exist iff configurations C1 ∈ conf (P 1 N ) and C2 ∈ conf (P 2 N ) exist and satisfy (again) that C1 , C2 reach the same marking, both are free of faults, C2 disables all events enabled by C1 , and some other technical condition asking (modulo details) that C ⊆ C1 . This 'iff' is shown in Lemma 17. These two prefixes can be seen as fixing the second problem mentioned above. Our main result, Theorem 3, formalizes these ideas; § 6.5 derives a decision procedure from them.

Succinct Explanations

In this section, we define, following [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF], a finite subclass of explanations of α and show, in Lemma 14, that this class is sufficient for deciding (72), i.e., that the existential quantification of C in (72) can be restricted to this finite class.

Definition 20. Configuration C ∈ conf (U N ) is verbose if it contains two events e, e ′ ∈ C satisfying • e ′ < e, and (73)
• mark([e ′ ]) = mark([e]), and (74)

• obs([e ′ ]) = obs([e]). (75) If C is not verbose, it is succinct.
Intuitively, C is verbose if it contains the occurrence of some loop of N consisting entirely of unobservable transitions. In Fig. 28, t 2 , t 3 is an unobservable loop, that produces the verbose configuration {e 1 , e ′ 3 , e ′ 2 } in Fig. 29 (set e, e ′ of Def. 20 as e := e ′ 2 and e ′ := e 1 ). Observe that lpo([e ′ ]) is isomorphic to lpo([e]), by (75) and Lemma 12, and that [e ′ ] ⊆ [e], by (73). This means that all events in [e] \ [e ′ ] are unobservable, see Fig. 30 (a). It also means that lpo([e]) = lpo([e ′ ]), i.e., the LPO isomorphism is the identity function on C restricted to observable events. Finally, observe that (74) does not imply (73), even for 1-safe nets. 2Def. 20 is different from the equivalent definition in [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] only in that obs(C) is defined differently: here, it is a set of LPOs while in [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] it is the set of sequences λ(σ) where σ is an interleaving of C.

We now introduce the notion of peeling a configuration, which will be necessary in subsequent proofs. Intuitively, if C is a verbose explanation of some α, peeling corresponds to finding a shorter explanation C ′ where unnecessary (unobservable) fragments of C have been removed. Peeling C one time yields a shorter explanation of α that reaches the same marking as C. The new configuration may not yet be succinct, but since the operation reduces the size of the explanation, finite explanations need to be peeled only finite number of times until getting a succinct explanation.

Let us formalise this idea. Let C be verbose and finite, and let e, e ′ ∈ C be events satisfying (73)-(75). Let I := C \ [e]. We define peel e,e ′ (C) as the configuration

C ′ := [e ′ ] ∪ I ′ ,
where I ′ is the isomorphic copy of I that continues U N just after cut([e ′ ]).

Recall that I ′ is well defined, as we have explained in § 2.4.

2. Since |[e ′ ]| < |[e]|, we have |C ′ | < |C|. So if C ′ is
still verbose, we only need to peel again finitely many times before obtaining a succinct configuration. We denote by peelmax(C) the set of succinct configurations resulting from peeling C as many times as necessary (choosing any e, e ′ that satisfy (73)-(75) every time we peel).3 Lemma 13 implies that peelmax(C) are explanations of α if C is.

Lemma 13. For any verbose configuration C with C ′ := peel e,e ′ (C), it holds that:

• mark(C) = mark(C ′ ) (76) • obs(C) ⊆ obs(C ′ ) (77) • C ′ ∩ E φ = ∅ ⇒ C ∩ E φ = ∅ (78)
Proof. Let e, e ′ ∈ C be events satisfying (73)-(75). Recall that C has the form [e] ⊎ I, and C ′ the form [e ′ ] ⊎ I ′ . ( 76) is a consequence of (74) and the fact that I, I ′ are isomorphic. Showing (77) is more laborious. Let lpo(C) := S, <, λ and lpo(C ′ ) := S ′ , <, λ . In the sequel we define a mapping g : S ′ → S and prove that g is a bijective homomorphism from lpo(C ′ ) to lpo(C). (77) then follows by Lemma 11.

Let f 1 be the LPO isomorphism between lpo([e]) and lpo([e ′ ]). Recall that f 1 is actually the identity function. Let f 2 : I ′ → I be the isomorphism between I ′ and I. Define g := f 1 ∪ f ′ 2 where f ′ 2 is the restriction of f 2 to S ′ , i.e., the observable events of C ′ .

Observe that g is bijective because it is the union of two bijections whose domains and codomains are disjoint; it satisfies (66) because so do f 1 and f 2 . Finally, for e 1 , e 2 ∈ S ′ with e 1 < e 2 , we show that (67) holds. There are three cases:

• e 1 , e 2 ∈ [e ′ ]. Then g(e 1 ) = e 1 < e 2 = g(e 2 ).

• e 1 , e 2 ∈ I ′ . Since the isomorphism f 2 preserves causality, we have g(e 1 ) = f 2 (e 1 ) < f 2 (e 2 ) = g(e 2 ). • e 1 ∈ [e ′ ] and e 2 ∈ I ′ . Then there is some c ∈ cut([e ′ ]) such that e 1 < c < e 2 . Since N is safe and by (74), there is a single condition

c ′ ∈ cut([e]) such that h(c) = h(c ′ ), where h is U N 's labelling. It does not hold that c # c ′ or c c ′ , because [c] ∪ [c ′ ] ⊆ C and N is safe. So c ≤ c ′ holds, since c ′ < c contradicts e ′ < e. Since [e 2 ] consumes c, necessarily [ f 2 (e 2 )
] consumes c ′ , as I ′ and I are isomorphic. We therefore have:

g(e 1 ) = f 1 (e 1 ) = e 1 < c ≤ c ′ < f 2 (e 2 ) = g(e 2 )
As for (78), let ẽ ∈ C ′ ∩ E φ be some fault.

If ẽ ∈ [e ′ ] ⊆ C, then ẽ ∈ C. If ẽ ∈ I ′ , then f 2 ( ẽ) ∈ I ⊆ C is also fault, because f 2 preserves transition labels. In both cases C ∩ E φ = ∅.
We define the set of succinct explanations of α as

succexpl(α) := {C ∈ expl(α) : C is succinct} Proposition 13. succexpl(α) is finite.
Proof. Since N is finite, there are finitely many events in U N of depth less or equal to any given n ∈ N, and thus finitely many configurations made up of such events. Assume now there are infinitely many succinct explanations of α. Because of the above, there must be a succinct explanation C that contains e ∈ C such that depth(e) = k(|α| + 1), where k is the number of reachable markings in the net. Let e 1 < . . . < e |α|+1 = e be the events of some causality chain from the initial marking m0 to e, such that mark(e 1 ) = . . . = mark(e |α|+1 ), which exist by the pigeonhole principle. Since only |α| events in C are observable, [e i+1 ] \ [e i ] ⊆ E ubs holds for some i. So C contains two causally related events, whose local configurations have the same LPO, thus the same observation (Lemma 12), and reach the same marking. Then C is verbose, a contradiction.

The previous proof works even if (73) is removed from Def. 20. However, (73) is required for the following statement.

Proposition 14. The shortest explanations of α (in number of events) are succinct.

Proof. If C is an explanation of α and it is verbose, then peelmax(C) are shorter explanations of α, so no shortest explanation can be found among the verbose ones. The main lemma of this subsection shows that (72) can be rephrased into (79), eliminating the need to examine all potentially infinitely many explanations of α.

Lemma 14. Observation pattern α diagnoses φ iff ∀ω ∈ Ω : (∃C ∈ succexpl(α) : C ⊆ ω) ⇒ E φ ∩ ω = ∅ (79)
Proof. (72) and (79) differ only in that succexpl(α) has replaced expl(α). Trivially, (72) implies (79). Assume that (79) holds and let ω ∈ Ω, C ∈ expl(α) be such that C ⊆ ω. We show that ω ∩ E φ = ∅. If C is succinct, we are done, so assume C is verbose and let C ′ ∈ peelmax(C). By (76), we can append an isomorphic copy I of ω \ C to C ′ , yielding a weakly fair configuration ω ′ := C ′ ∪ I. By (77), C ′ is a succinct explanation of α. Because C ′ ⊆ ω ′ and (79), it holds that

ω ′ ∩ E φ = ∅. If C ′ ∩ E φ = ∅, by (78), we have C ∩ E φ = ∅. If I ∩ E φ = ∅, then ω \ C must contain a fault because it is isomorphic to I.
In any case, ω ∩ E φ = ∅.

Characterizing Weakly Fair Configurations

We now investigate a finite characterization of the weakly fair configurations in Ω that allows to reason about (i) inclusion of (succinct) explanations and (ii) absence of faults.

According to (79), α does not diagnose φ iff we can find a fault-free, weakly fair configuration ω that contains a succinct explanation. The next lemma establishes a characterization of such weakly fair configurations, where the spoilers of an event play an important role.

The main idea is simple: given a finite configuration C that plays the role of the explanation, a fault-free, weakly fair configuration that extends C exists iff one can find configurations C 1 , C 2 with C 1 ⊆ C 2 , both free of faults, extending C, reaching the same marking, and such that C 2 \ C 1 disables all events enabled by C 1 . Since both reach the same marking, the fragment C 2 \ C 1 can then be iterated infinitely often without ever leaving any event enabled:

Lemma 15. Let C be a finite configuration. There exists a weakly fair

ω ∈ Ω such that C ⊆ ω and ω ∩ E φ = ∅ iff there are C 1 , C 2 ∈ conf (U N ) satisfying • C ⊆ C 1 ⊆ C 2 ,

and

(80)

• mark(C 1 ) = mark(C 2 ), and (81)
• ∀e ∈ E : C 1 e ⇒ spoilers(e) ∩ C 2 = ∅, and (82)

• C 2 ∩ E φ = ∅. (83)
Proof. Let ω ∈ Ω be weakly fair, such that C ⊆ ω and ω ∩ E φ = ∅. Let σ = e 1 e 2 . . . be any weakly fair interleaving of ω, and e n the last event of C in σ. By the pigeonhole principle there are infinitely many n ≤ n 1 < n 2 < n 3 < . . . ∈ N such that mark(σ n 1 ) = mark(σ n 2 ) = mark(σ n 3 ) = . . . where σ i denotes the run e 1 e 2 . . . e i . Let C 1 be the restriction of ω to σ n 1 . Because σ is weakly fair, there is some i ∈ N such that σ n i contains one spoiler for every event enabled by C 1 (Lemma 9). Let C 2 be the restriction of ω to σ n i . Then C 1 , C 2 satisfy (80)-(83).

For the opposite direction, let C 1 , C 2 be configurations satisfying (80)-( 83). We construct a fault-free, weakly fair ω ∈ Ω. For convenience, we write ploop(C 1 , C 2 ) for all pairs C 1 , C 2 ∈ conf (U N ) satisfying (80) and (81). Since mark(C 1 ) = mark(C 2 ), we can append an isomorphic copy of C 2 \ C 1 to C 2 , yielding C 3 , such that ploop(C 2 , C 3 ) and C 3 ∩ E φ = ∅ hold. Iterating this construction, one can obtain a family (C n ) n∈N of configurations satisfying ploop(C n , C n+1 ) and C n ∩ E φ = ∅ for all n ∈ N. We now let ω := n∈N C n be the configuration resulting from their union. We prove that ω does not enable any event, and thus ω ∈ Ω by Lemma 8. By contradiction, let e be any event enabled by ω. It is therefore enabled by C i for some i ∈ N. Since the unfolding after cut(C i ) is isomorphic to the unfolding after cut(C 1 ), there is some e ′ isomorphic to e that is enabled by C 1 . By construction, spoilers(e ′ ) ∩ C 2 = ∅, so there is some e

′ in C 2 \ C 1 that disables e ′ . Because C i+1 \ C i is isomorphic to C 2 \ C 1 ,
there is some spoiler of e in C i+1 \ C i , and ω does not enable e, a contradiction.

As an example, consider the weakly fair run (t 1 , t 9 , t 10 ) ω in Fig. 28. It is represented in Fig. 29 by the fault-free, weakly fair configuration ω := {e 1 , e 9 , e 10 , e ′ 1 , . . .} ∈ Ω. Setting C := ∅, Lemma 15 implies the existence of C 1 = ∅ and C 2 = {e 1 , e 9 , e 10 }.

While Lemma 15 identifies a method for finding fault-free, weakly fair configurations that extend a given configuration, there are still infinitely many configurations C 1 , C 2 to consider. We would thus like to define a finite unfolding prefix of U N such that, C 1 , C 2 exist and verify (80) to (83) iff there are small copies of C 1 , C 2 among the configurations of such a prefix and they still satisfy (80) to (83).

A first approach would be considering a finite prefix that is large enough to contain such small copies. Observe that C 1 is a superset of C. This means that C should be included in the prefix, and C could be any succinct explanation, so the prefix should include all succinct explanations. Conceptually, it should also unfold enough to see all markings that can be reached from any explanation (to find C 1 ), and all markings that can be reached from those ones (to find C 2 ). Such a prefix would probably be very large. Fortunately, the same information that this prefix carries can be represented in, not one, but two unfolding prefixes.

Assume that we already have a prefix P α that contains all succinct explanations. In order to find configurations C 1 , C 2 as in Lemma 15, we first need to search for any configuration C 1 such that C ⊆ C 1 . The key observation is that such C 1 exists iff mark(C 1 ) is reachable from mark(C) without firing faulty events, as (83) requests. So we do not need to extend P α into a larger prefix where to find C 1 . Essentially, all that we need is a prefix that has the following property: marking m ′ is reachable from marking m in N iff the prefix contains configurations C m ⊆ C m ′ such that mark(C m ) = m and mark(C m ′ ) = m ′ . Such prefix can actually be understood as two overlapping prefixes, an small prefix where C m is to be found and a large prefix, which extends the small one, and where C m ′ is to be found. This idea is used by [START_REF] Haar | Computing the reveals relation in occurrence nets[END_REF] for a similar purpose.

Next, we need to find a suitable C 2 , which by Lemma 15 must include C 1 and fire at least one spoiler for each event enabled by C 1 . This requires to reason not only about the possibility of reaching one marking from another one, but also about which events have been disabled on the way, or which spoilers have been fired. We show in the sequel how to construct the aforementioned small and large to convey complete information with regard to this stronger requirement.

So we need to define two prefixes. For the small one, any finite, markingcomplete prefix will be enough. Intuitively, the first prefix just needs to represent all possible reachable markings. We explained in Ch. 3 how to construct marking-complete prefixes for contextual nets, and methods and tools to construct them for ordinary nets have already been described [EH08; ERV02; McM93b], so we will not emphasize this point. We denote by

P 1 N := B 1 , E 1 , G 1 ,
m0 some finite, marking-complete prefix of U N . For any configuration C of U N , we denote by C E 1 the set C ∩ E 1 of events in C that are also in P 1

N . Then we need to define a prefix P 2 N that includes P 1 N and preserves not only reachability of markings but also the capability of a configuration to spoil previously enabled events, i.e., those events that can take the role of C 2 in (82). The prefix P 2 N will be defined using the following notion of cutoff, which is relative to P 1 N :

Definition 21. Event e ∈ E is an sp-cutoff w.r.t. P 1 N if there is e ′ ∈ E such that, setting D := [e] \ [e ′ ],
we have e ′ < e, and

• h( • D \ D • ) = h(D • \ • D), and
(84)

• B 1 ∩ • D = ∅. (85)
The main intuition behind this cutoff criterion is that an event e should be considered cutoff if it spoils the same events, among all those enabled by any C 1 ∈ conf (P 1 N ), that some other event e ′ which reaches the same marking and is a causal predecessor of e.

Intuitively, this is achieved by Def. 21 in the following way, which we illustrate in Fig. 30 (b). The set D in Def. 21 is the difference between [e] and [e ′ ], and (85) ensures that e and e ′ consume exactly the same conditions generated by events of P 1 N . As a result, both events are in conflict with exactly the same events enabled by any configuration of P 1 N . On the other hand, that both events reach the same marking is a consequence of (84), which implies that mark([e ′ ]) = mark([e]), as Lemma 16 shows: Lemma 16. Let e be an sp-cutoff, and e ′ as in Def. 21. For all C ∈ conf (P

1 N ), if C ∪ [e] is a configuration, then mark(C ∪ [e]) = mark(C ∪ [e ′ ]).
Proof. (sketch) Show by cases, using (84)-(85), that

f (( m0 ∪ C • ∪ [e] • ) \ ( • C ∪ • [e])) = f (( m0 ∪ C • ∪ [e ′ ] • ) \ ( • C ∪ • [e ′ ])
).

An important remark is that no event in P 1 N can be an sp-cutoff, as otherwise the difference set D would consume at least one condition in B 1 . We can now define

P 2 N := B 2 , E 2 , G 2 , m0
as the largest unfolding prefix that contains no sp-cutoff events, i.e., E 2 is the ⊆-maximal set of events that is causally closed and contains no sp-cutoff. It is immediate to see that P 2 N is well-defined, in particular that it is unique. Because no sp-cutoff is contained in P 1 N , we get that P 1 N is a prefix of P 2 N .

Proposition 15. P 2 N is finite.

Proof. Assume E 2 is infinite. As in the proof of Prop. 13, we can find infinitely many events e 1 < e 2 < . . . in E 2 . Because T and the number of reachable markings in N are finite, we can furthermore assume that h(e 1 ) = h(e 2 ) = . . . and mark([e 1 ]) = mark([e 2 ]) = . . . Define the sequence of difference sets

D i = [e i ] \ [e i+1 ], for i ≥ 1. Since D i = ∅ for all i ≥ 1, we have • D i = ∅. For i < j, • D i ∩ • D j = ∅, otherwise [e j ] would have conflicts. Since B 1 is finite, the number of D i s consuming from B 1 must be finite. So there is some k ≥ 1 such that B 1 ∩ • D i = ∅ holds for all i ≥ k.
Then e k+1 is an sp-cutoff, a contradiction.

We have now defined two finite unfoldings prefixes, P 1 N and P 2 N , where P 1

N is a prefix of P 2 N . Our next goal is showing that, roughly speaking, configurations C 1 , C 2 that satisfy Lemma 15 exist iff it is possible to find representatives of them in P 1 N , P 2 N . Specifically, we want to show that for any given C 1 ∈ conf (P 1 N ), there exists some C 2 ∈ conf (U N ) that satisfies (80) to (83) iff there is some C ′ 2 ∈ conf (P 2 N ) such that C 1 , C ′ 2 satisfy (80) to (83). To define C ′ 2 we introduce the notion of trimming a configuration, and prove some properties of this transformation.

Any configuration C of U N that contains some sp-cutoff e can be trimmed in a way analogous to the way verbose configurations can be peeled into succinct configurations, cf. Lemma 13. Trimming C corresponds to finding some smaller configuration C ′ that preserves the aforementioned spoiling capabilities.

Formally, let C be any configuration that contains an sp-cutoff e and event e ′ ∈ C as in Def. 21. Consider the configuration C E 1 ∪ [e] ⊆ C. Since C E 1 is a configuration of P 1 N , by Lemma 16, we have that

mark(C E 1 ∪ [e]) = mark(C E 1 ∪ [e ′ ]). So we can partition C as (C E 1 ∪ [e]) and I := C \ (C E 1 ∪ [e]
), and define trim e,e ′ (C) as the configuration

C ′ := (C E 1 ∪ [e ′ ]) ∪ I ′ , where I ′ is the isomorphic copy of I after cut(C E 1 ∪ [e ′ ]).
Lemma 17. Let C ′ := trim e,e ′ (C) for any configuration C of U N . We have:

• mark(C) = mark(C ′ ) (86) • C ∩ E 1 ⊆ C ′ ∩ E 1 (87) • C ∩ E φ = ∅ ⇒ C ′ ∩ E φ = ∅ (88) • ∀e ∈ B • 1 : spoilers(e) ∩ C = ∅ ⇒ spoilers(e) ∩ C ′ = ∅ (89) • |C ′ | < |C| (90)
Proof. (87), (88), and (90) hold by construction of C ′ . ( 86) is a consequence of the fact that

U N stripped of C E 1 ∪ [e] is isomorphic to U N stripped of C E 1 ∪ [e ′ ].
So isomorphic sets of events I and I ′ yield the same marking of N.

As for (89), let e, e ′ ∈ C be as in Def. 21, let ê ∈ B • 1 , and let ê † ∈ spoilers( ê) ∩ C. Three cases are possible:

• ê † ∈ (C ∩ E 1 ) ∪ [e ′ ]. Then by construction, ê † ∈ C ′ . • ê † ∈ [e] \ [e ′ ].
Not possible, entails contradiction to (85).

• ê † ∈ I. Let c ∈ • ê † ∩ B 1 be any condition in B 1 consumed by ê † . We show that c ∈ cut(C E 1 ∪ [e ′ ]). This is because c ∈ m0 ∪ (C ∩ E 1 ) • (since C is causally closed), and also c / ∈ • (C E 1 ∪ [e ′ ]) (since the only event ê † in C that consumes c is in I). With analogous reasoning, one shows that c ∈ cut(C E 1 ∪ [e]). Now, because I, starting from cut(C E 1 ∪ [e]), is isomorphic to I ′ , starting from cut(C E 1 ∪ [e ′ ]
), and c belongs to both cuts, if ê † consumes from c, its isomorphic event in I ′ also consumes from c and hence spoils ê.

Trimming decrements the number of events (90), so if trim e,e ′ (C) still has a sp-cutoff we can trim again finitely many times until getting a configuration free of sp-cutoff events, choosing any e, e ′ as in Def. 21 every time we trim. Let trimmax(C) denote the set of such configurations. Again, we conjecture that trimmax(C) is a singleton, but this is not important for our purposes.

Since it has no sp-cutoff, trimmax(C) are always configurations of P 2 N . We can now define the configuration C ′ 2 that we have mentioned, above, when motivating the investigation of trimming configurations. We said that C ′ 2 needs to be in conf (P 2 N ) and that C 1 , C ′ 2 needs to satisfy (80) to (83). Taking C ′ 2 := trimmax(C 2 ) we get the desired result, which can be proved using Lemma 17.

We can now state the main result of the chapter:

Theorem 3. Observation pattern α does not diagnose φ iff there exist configura- tions C, C ′ 1 ∈ conf (U N ), C 1 ∈ conf (P 1 N ), C 2 ∈ conf (P 2 N ) satisfying the

following properties:

• C is a succinct explanation of α, and (91)

• C ⊆ C ′ 1 , and (92) • C 1 ⊆ C 2 , and (93)
• mark(C ′ 1 ) = mark(C 1 ) = mark(C 2 ), and (94)
• ∀e ∈ E : C 1 e ⇒ spoilers(e) ∩ C 2 = ∅, and (95) • there is no fault event in either C ′ 1 or C 2 . (96)

Proof. By (79), if α does not diagnose φ, there is a fault-free, weakly fair configuration ω ∈ Ω and some succinct explanation C ∈ succexpl(α) with C ⊆ ω. By Lemma 15, there are configurations C1 , C2 that satisfy (80)-(83). Define C 1 ∈ conf (P 1 N ) as any configuration in P 1 N that reaches mark( C1 ). Now let C ′ 2 denote C 1 ∪ I where I is an isomorphic copy of C2 \ C1 starting at cut(C 1 ). Define C 2 as either C ′ 2 if C ′ 2 contains no sp-cutoff or as any configuration in trimmax(C ′ 2 ) otherwise. In both cases, C 2 ∈ conf (P 2 N ). Define C ′ 1 ⊆ ω as any configuration satisfying (92) whose marking is mark( C1 ), which exists because ω repeats mark( C1 ) infinitely often.

(91) and (92) holds by definition of C,

C ′ 1 . By construction, C 1 ⊆ C ′ 2 . If C ′
2 has sp-cutoffs and C 2 is taken from trimmax(C ′ 2 ), by (87) and the fact that C 1 ⊆ E 1 , we have C 1 ⊆ C 2 . So (93) holds in any case. (94) holds by construction of C ′ 1 , C 1 , (81), and (86). Because ω is fault-free, C ′ 1 is as well. By (83), C1 , C2 are fault free, and so is C ′ 2 (by isomorphism). Then, by (88), C 2 is fault-free. This shows (96). As for (95), we observe the following. C1 , C2 satisfy (82). Since C1 cannot contain any spoiler of the events it enables, all such spoilers are in C2 \ C1 . Then, C ′ 2 disables all events enabled by C

1 because C ′ 2 \ C 1 is isomorphic to C2 \ C1 . Now, because C 1 ⊆ E 1 , all such events are in B • 1 .
Then by (89), C 2 disables all them, and (95) holds. If C, C ′ 1 , C 1 , C 2 exist and verify (91)-( 96), by Lemma 15 some fault-free, weakly fair configuration ω ∈ Ω exists and repeats infinitely often the marking mark(C 1 ) = mark(C ′ 1 ). Construct another weakly fair configuration ω ′ := C ′ 1 ∪ I ∈ Ω where I is an isomorphic copy of ω \ C 1 starting at cut(C ′ 1 ). Now, ω ′ contains a succinct explanation and is fault-free because so was C ′ 1 , and by isomorphism between ω \ C 1 and I.

In other words, Theorem 3 states that α does not diagnose φ iff one can find suitable configurations C 1 , C 2 in certain finite unfolding prefixes and a succinct explanation C of α such that mark(C 1 ) can be reached from mark(C) without executing fault events. There are only finitely many succinct explanations of α, and we can decide whether one marking is reachable from another without executing faults using the next proposition. So Theorem 3 suggests a decision algorithm for the diagnosis problem that we shall investigate in § 6.5.

Proposition 16. There exist fault-free configurations C, C ′ in U N such that C ⊆ C ′ iff there are fault-free configurations Ĉ ⊆ Ĉ′ of, respectively, P 1 N , P 2 N , that satisfy

• mark(C) = mark( Ĉ), and

• mark(C ′ ) = mark( Ĉ′ ).

Proof sketch. P 1 N is marking-complete and we can find the requested faultfree Ĉ in conf (P 1 N ), see the proof of Proposition 4.9 (a) in [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. Let Ĉ′′ := Ĉ ∪ I where I is an isomorphic copy of C ′ \ C starting at cut( Ĉ). Let Ĉ′ := Ĉ′′ if Ĉ′′ ⊆ E 2 , or Ĉ′ ∈ trimmax( Ĉ′′ ) otherwise. Then Ĉ, Ĉ′ satisfy the proposition by ( 86)-(88).

a decision procedure for diagnosis

Theorem 3 states a set of necessary and sufficient conditions that characterize whether or not a given observation α diagnoses φ. In this section, we present a method for deciding if these conditions hold. We discuss which information is needed in order to decide them ( § 6.5.1), and how to obtain that information ( § 6.5.2). Based on this, we present an encoding of the diagnosis problem into SAT ( § 6.5.3).

Preparation

Given the observation α, we need to decide whether all conditions in Theorem 3 hold. Our goal is to minimize the work that is sensitive to changes in α, in particular when α is extended by additional observations. However, (91) and (92) seem to require constructing not only the prefix containing all succinct explanations, but also a large section of the unfolding beyond each of these explanations. Fortunately, this can be avoided thanks to Prop. 16 and the fact that C ′ 1 and C 1 in Theorem 3 do not depend on C being an explanation of α, merely on the fact that C ′ 1 is a fault-free extension of C. So, we only require that mark(C ′ 1 ) is reachable from mark(C) without executing faults, and replace (92) by:

∃C ′ : mark(C) = mark(C ′ ) ∧ C ′ ⊆ C ′ 1 (97)
Hence it suffices to construct only two unfolding prefixes:

• One prefix P α containing all succinct explanations of α, used to search for C. • Prefix P 2 N P 1 N , to check for the existence of a weakly fair configuration starting from a given marking (see Lemma 17), and whether one marking is reachable from another (see Prop. 16). We shall search for C ′ , C 1 in P 1 N and for C ′ 1 , C 2 in P 2 N . Observe that restricting the construction of these prefixes to their fault-free parts automatically satisfies (96). Also, notice that P α depends only on the observation, whereas P 2 N depends only on N. So P 2 N can be constructed off-line, before α is acquired.

Constructing the Prefixes

We now explain how to compute the prefixes P 2 N and P α . There exist wellknown algorithms [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF] and efficient tools [Sch; Kho] for constructing Petri net unfoldings. For our constructions, the iterative structure of these algorithms can be maintained, it suffices to replace the criteria for cutoffs.

Constructing P α

We need to restrict the unfolding construction as follows:

1. exclude fault events to ensure (96); 2. restrict to explanations of α; and 3. preserve all succinct explanations and eliminate all verbose ones.

For the first and second points, we synchronize N with a net representing α = S, <, λ . Let S min (resp. S max ) be the elements without predecessor (resp. successor) in S. We re-translate α into an occurrence net O α = P α , S, F α , m α , whose events are S and whose causal relation is <. The definition of O α is quite standard, we only remark that P α := P min ⊎ P mid ⊎ P max is partitioned in three sets, where P max (resp. P min ) is the postset (resp. preset) conditions of S max (resp. S min ).

We then compose N = P, T, F, m 0 and O α into a Petri net N α = P ′ , T o ∪ T u , G, m ′ 0 , where:

• P ′ = P ∪ P α ; • T o = { t, s : t ∈ T obs , s ∈ S, λ(t) = λ(s) }; • T u = T ubs \ {φ}; • for t, s ∈ T o , • t, s = • t ∪ • s and t, s • = t • ∪ s • • for t ∈ T u , • t and t • remain as in N; • m ′ 0 = m 0 ∪ m α .
Intuitively, N α adds the places of O α to N in order to record which parts of α have been seen during an execution. The observable transitions of N and O α are synchronized to ensure that no run contradict α or add further observable events, and faults are excluded. Consider the unfolding U N α . Projecting each event labelled with a tuple t, s to t instead, then each configuration C of U N α is also a configuration of U N ; moreover C explains α iff mark(C) contains P max .

It remains to ensure the third point. Thanks to Def. 20 it suffices to cut the construction of U N α at any event e such that there is another event e ′ < e with mark([e ′ ]) = mark ([e]). Indeed, this ensures both (74) and (75) as no observable event has occurred after e ′ . By the pigeon-hole principle on the finitely many reachable marking in N, this cutoff criterion is guaranteed to yield a finite prefix P α . 6.5.2.2 Constructing P 2 N We construct P 2 N in two phases. First, P 1 N is obtained by the usual unfolding methods for marking-complete prefixes (e.g., [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]). Then, we extend P 1 N by additional events, using Def. 21 as a cutoff criterion. Observe that deciding whether e ∈ E is an sp-cutoff entirely depends information contained in [e]. In particular any strategy for extending the prefix during construction can be used.

Encoding Diagnosis into SAT

We propose an encoding of the diagnosis problem into SAT. Given prefixes P 1 N , P 2 N , P α , computed as per § 6.5.2, we construct a formula ϕ that is satisfi- able iff α does not diagnose φ. This approach immediately gives a decision procedure via efficient SAT solving. Not surprisingly, one can show (via reduction from the reachability problem for unfolding prefixes) that finding the configurations C, C ′ , C 1 , C ′ 1 , C 2 discussed in § 6.5.1 in these prefixes is NP-hard.

A SAT-based decision procedure for deadlock and coverability has been proposed in Ch. 4. There, a satisfying assignment represents one configuration with suitable properties. While we re-use this idea, the specificities of diagnosis require to encode multiple configurations and relate them according to Theorem 3.

For an unfolding prefix P := B, E, G, m0 , h of N or N α , and a label l, we define the following collections of Boolean variables:

v(l) := {v l x : x ∈ B ∪ E}, m(l) := {m l p : p ∈ P}.
Intuitively, all variables in v(l) will encode a configuration that we will identify by l, and those in m(l) a marking referred by l. For labels l, l ′ , we define the following predicates. First we have the predicate config(l, P ) :=

e∈E e ′ ∈ • • e (v l e ⇒ v l e ′ ) ∧ c∈B,{e 1 ,...,e n }= • c amo(v l e 1 , . . . , v l e n ) ∧ c∈B v l c ⇔ e∈ • c v l e ∧ e∈c •
¬v l e , which demands v(l) to represent a configuration of P and its cut. The first conjunct requests the configuration to be causally closed; the second one asks for absence of symmetric conflicts and the third one defines the configuration's cut. Observe that these formulas are quite close to those presented in § 4.3, on p. 63. Next we have

subset(l, l ′ , P ) := e∈E (v l e ⇒ v l ′ e ),
which asks that l-labelled events are a subset of l ′ -labelled events. The predicate

mark(l, l ′ , P ) := p∈P m l p ⇔ c∈ f -1 (p) v l ′ c
computes the marking of a configuration represented by v(l). It asks that m(l) reflects the marking associated with the cut of v(l), assuming that v(l) encodes a configuration of P. Similarly,

enables(l, l ′ , P ) := e∈E v l ′ e ⇔ ( c∈ • e v l c )
assumes that config(l, P ) holds, and forces the variable v l ′ e associated to an event e to be true iff e is enabled in the configuration represented by v(l). The predicate

spoils(l, l ′ , P ) := e∈E v l ′ e ⇒ ( e ′ ∈( • e) • v l e ′ )
holds iff v(l) has one spoiler for each event true in v(l ′ ) and explains(l) :=

p∈P max f (c)=p v l c
requests that the configuration referred by l is a succinct explanation of α.

All these predicates are linear except for spoils(•), which can easily be made linear by introducing new variables for conditions. Also, remark that the amo() constraint in config() can be implemented in linear size, as we will explain in § 7.2.2. Also, not all of them are directly given in CNF, but a linear translation is always possible.

We can now turn to the encoding of Theorem 3, where (92) is replaced by (97), as discussed in § 6.5.1.

Fix labels m, m ′ , C, C ′ , C ′ 1 , C 1 , C 2 , D.
Each of these labels identifies (the collection of Boolean variables representing) a configuration or a marking, except for D, which represents a set of events. For instance C represents the configuration C, note the different typography. Our formula ϕ is the conjunction of the following constraints:

1. config(C, P α ) ∧ mark(m, C, P α ) ∧ explains(C) 2. config(C ′ , P 1 N ) ∧ mark(m, C ′ , P 1 N ) 3. config(C ′ 1 , P 2 N ) ∧ mark(m ′ , C ′ 1 , P 1 N ) 4. config(C 1 , P 1 N ) ∧ mark(m ′ , C 1 , P 2 N ) 5. config(C 2 , P 2 N ) ∧ mark(m ′ , C 2 , P 2 N ) 6. subset(C ′ , C ′ 1 , P 1 N ) ∧ subset(C 1 , C 2 , P 2 N ) 7. enables(C 1 , D, P 2 N ) ∧ spoils(C 2 , D, P 2 N )
Only 1) actually depends on α, whereas remaining constraints can be built before α is known. 7) corresponds to (95), the others to (93), (94), and (97). Conditions (91) and (96) of Theorem 3 are guaranteed by construction.

conclusion

We presented an unfolding-based decision procedure for solving the problem of weak diagnosis in partially observable safe Petri nets.

Weak diagnosis exploits indirect dependencies, captured by the reveals relations, to determine the inevitability of a fault. We stress that despite its name, 'weak' diagnosis is actually stronger than conventional diagnosis as in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF]. Whereas in [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] an observation can only be used to detect faults having occurred in the past, weak diagnosis captures also faults that are concurrent or in the future of the observation, under weak fairness. The requirement of [START_REF] Benveniste | Diagnosis of Asynchronous Discrete Event Systems: A Net Unfolding Approach[END_REF] that no unobservable cycle is present in the system is also dropped, thanks to a characterization of the succinct explanations, that bound the unfolding prefix needed to perform diagnosis. The results here contain those of [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF] and strengthen the existing approaches to the more powerful capability of weak diagnosis. We have shown how diagnosis can be performed using an algorithmic construction, and given an encoding into SAT.

While the chapter provides many of the ingredients necessary for an implementation, a practical obstacle to overcome could be the sizes of the prefixes required. As for prefix P 2 N , note that it contains all system behaviors, but can be constructed off-line once and for all. The size of P 2 N can be exponential in the size of the net; however, it is known that unfoldings tend to be much smaller than this for systems that exhibit a high degree of concurrency. In general, the weak-diagnosis problem for Petri nets is PSPACE-complete (hardness follows by reduction from the reachability problem, membership by the fact that a fault-free weakly fair run matching the observation pattern can be nondeterministically simulated in linear space).

The prefix containing all the succinct explanations must be created online, but contains only the behaviors compatible with the observation. Notice that it can alternatively be obtained by producing a marking-complete unfolding of the net N α from § 6.5.2, which should result in a reduction of its size. In this work, we omitted this possibility for the sake of a simpler presentation. Also, representing both prefixes as merged processes should result in a dramatic reduction of their size.

Future work also includes verification of weak diagnosability [HBFJ03; Haa07; Haa09; Haa10; AMH12] based on the results here. Further, local projections of observations, as exploited in [START_REF] Esparza | Reactive and Proactive Diagnosis of Distributed Systems Using Net Unfoldings[END_REF], are interesting, especially in the context of distributed diagnosis.

T O O L S A N D E X P E R I M E N T S

In Ch. 3 to 5 we presented methods for representing and analyzing the state space of a contextual net. Implementations supporting these methods have been made. In this chapter we report on these implementations and evaluate them on a standard benchmark suite.

Specifically, we present implementation details of the algorithm introduced in Ch. 3; we evaluate the optimizations proposed for the SAT encoding of Ch. 4; and we evaluate how compact are the contextual merged processes of Ch. 5 with respect to the various ways to unfold and merge a contextual net. This chapter is based on [RSB11b; BBC+12; RS12b; RSK13; RS13b].

All implementations discussed here are distributed with the Cunf Toolset, a collective name for a set of programs to carry out verification based c-net unfoldings. The toolset includes one program for constructing unfoldings, the unfolder Cunf, one program for analyzing coverability and deadlock, called Cna, and a number of programs for handling, e.g., contextual merged processes, format conversions, etc. All tools have been developed entirely within the frame of this thesis and are publicly available under http://code.google.com/p/cunf/ The manual of the Cunf Toolset is included in this manuscript on App. A.

The outline of the chapter is as follows. In § § 7.1 and 7.2 the implementations of Cunf and Cna are described. All benchmarks considered in this work are discussed in § 7.3, and the experimental evaluations of the different tools are presented in § § 7.4 to 7.6. In § 7.7 we study the performance of merged processes and unfoldings on a model of Disktra's mutual exclusion algorithm [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF].

prefix construction: the cunf unfolder

In Ch. 3 we presented two approaches for constructing complete prefixes for contextual nets. We implemented both of them, in this section we mainly describe the eager approach to computing possible extensions. Specifically, based on the results of Ch. 3 we present concrete data structures to represent histories and algorithms for computing possible extensions and updating the concurrency relation.

The resulting tool, called Cunf, and included in the Cunf Toolset, expects as input a 1-safe c-net and produces as output a complete unfolding prefix. Recall that the theory developed in Ch. 3 stands for bounded nets, not necessarily 1-safe. The tool, as many other unfolders, is restricted to 1-safe nets, as our examples of interest are in this domain. Moreover, this choice simplifies the implementation of certain data structures and algorithms.

Notice that there exists efficient tools for the unfolding of ordinary Petri nets, such as Mole [Sch] or Punf [Kho] -which as Cunf, can only deal with 1-safe nets. While much experience was gained from experimenting with the mature code of Mole, Cunf is not an extension of it. The issues of asymmetric conflict and histories permeate every aspect of the construction so that we went for a completely new implementation in C language, comprising around 6.600 lines of code in version 1.6. Cunf matches the performance of dedicated Petri net unfolders like Mole [Sch] or Punf [Kho] on ordinary Petri nets, and additionally handles contextual unfoldings.

In this section, we review some features such as data structures and implementation details relevant to handling the complications imposed by contextual unfoldings. These helped to produce an efficient tool. Experiments with Cunf are reported in § 7.4.

The History Graph

Recall from Ch. 3 that the construction of a marking-complete enriched prefix E requires to deal with enriched events and enriched conditions. Recall that those are tuples e, H and c, H where H is a history of e or c.

Cunf needs to store them, and it does so in a graph structure. The construction algorithm iteratively extends the enriched prefix with new enriched events and conditions, so our data structure needs to be easy to extend when E is extended.

Formally, the history graph associated with E is a labelled directed graph H E such that 1. the nodes are the enriched events of E ; 2. there is an edge e, H → e ′ , H ′ iff e ′ ∈ H and The second condition states simply that H E has an edge from enriched event e, H to e ′ , H ′ iff some enriched condition c, H ′ was used to construct e, H in the sense of the eager or lazy methods of Prop. 9 and Prop. 5 in § 3.7.

H ′ = H[[e ′ ]]
This structure allows Cunf to perform many operations efficiently: every enriched event appended to H E enlarges the graph by just one node plus some edges; common parts of histories are shared. We can easily enumerate the events of H ∈ χ(e) by following backwards the edges from node e, H . The graph also represents, implicitly, the relation ⊏.

The unfolder also stores for every event e the set of histories χ(e) currently present in E . This is done by means of a list of pointers to the corresponding nodes of H E that are labelled by e. This list is stored in the data structure that represent events. Given a condition c, we can enumerate its generating and reading histories similarly.

Compound conditions are stored in a shared-tree-like structure, where leaves represent reading histories and internal nodes compound histories. An internal node has two children, one of which is a leaf, the other either internal or a leaf. One easily sees that a compound history of c corresponds, w.l.o.g., to a union H 1 ∪ . . . ∪ H n of reading histories. Every internal node represents such a union, and the structure allows sharing if one compound history contains another.

Possible Extensions

Computing the possible extensions (PE) of the prefix is the central task of any unfolder. This section explains which algorithms Cunf uses for this purpose.

Cunf behaves similar to Mole or other unfolders in its flow of logic, but its actions are on enriched events and enriched conditions. The tool implements Algorithm 1. There, we denoted by pe(E ) the set of PEs of E , formally defined in Def. 8, on p. 39. According to the eager approach to characterize PEs, presented in § 3.9.2, on p. 54, this set can be computed using the following steps, whose correctness relies on the Prop. 9. For any given transition t of N, do the following:

1. Let {p 1 , . . . , p n } := • t and {p ′ 1 , . . . , p ′ m } := t be all places in the preset and context of t. 2. Search for all sets of ECs in E of the form X p := {ρ 1 , . . . , ρ n } and X c := {ρ ′ 1 , . . . , ρ ′ m } that satisfy all the following requirements: a) X c contains only generating ECs; b) h(ρ i ) = p i and h(ρ ′ j ) = p ′ j for all i = 1, . . . , n and j = 1, . . . , m. c) ρ / / ρ ′ holds for all ρ in X p and all ρ ′ in X p ∪ X c ; d) ρ ρ ′ holds for all ρ, ρ ′ in X c ; 3. For any pair of sets X p , X c found in the previous step, the pair e, H is a PE of E , where e is a (possibly new) event whose preset and context are all conditions in, respectively, X p and X c , and H is defined as

H := {e} ∪ c,H ′ ∈X p ∪X c H ′ .
These steps compute all extensions e, H such that h(e) = t. In principle, the function pe(E ) just needs to repeat the above steps for every transition t in N, and return all found PEs. Cunf computes PEs using an optimized version of these steps, explained now. This optimization has already been described for ordinary unfoldings [START_REF] Khomenko | Towards an Efficient Algorithm for Unfolding Petri Nets[END_REF]. Observe that Algorithm 1 can be easily modified so that pe(E ) does not need to return all possible extensions of E , but just those which are possible due to the last EC appended to E . Indeed, after including a new EC ρ in the prefix, the only new PEs that pe(•) will return w.r.t. the last time it was called are those for which ρ is in X p or X c . So step 2 above can restrict the search in this way, and pe(•) can be modified to return PEs constructed using ρ, which now has to be passed to the function. Naturally, in Algorithm 1 we have to update the set X of possible extensions differently. Before, Algorithm 1 used the statement X = pe(E ), which now needs to be updated to X = X ∪ pe(E , ρ). Another consequence of this optimization is that pe(•) needs to be called after each EC ρ included in the prefix, and not just once after each enriched event is added. Extending the prefix with one enriched event e, H entails adding as many ECs as conditions there are in the postset of e, as we explain in § 7.1.3.

Concurrency Relation

We have seen how Cunf computes PEs and stores them in the history graph. Upon their discovery, PEs are kept in a heap, which allows to efficiently find the ≺-minimal history among those in PE, as Algorithm 1 requires.

Extending the prefix with a PE e, H gives rise to various types of ECs for whom Cunf needs to compute the concurrency relation. Namely, for every condition c ∈ e • , we have a new generating EC c, H and for every c ′ ∈ e, a new reading EC c ′ , H , and perhaps other compound ECs derived from c ′ , H . We saw in § 7.1.2 that Cunf needs to compute the relations and / / in order to find possible extensions. The key results for their efficient computation are Prop. 3 and Prop. 4, which give an inductive characterization of the relation . Based on them, both and / / can be computed, as we demonstrate below.

Several alternatives for handling are available. Roughly speaking, one could transform Prop. 3 and Prop. 4 into a recursive function that, given two ECs, returns whether they are concurrent, recursively calling itself as necessary. However, following the approach of Mole and Punf1 , Cunf incrementally computes and stores in memory both and / /, instead of resorting to a recursive computation. This requires updating the stored version of the relation as the prefix grows. We detail now how Prop. 3 and Prop. 4 are used to efficiently compute this update. We comment on the recursive computation of in Ch. 8.

Let c(ρ) denote the set of enriched conditions ρ ′ verifying ρ ρ ′ . The relation is generally sparse and Cunf stores c(ρ) as a list. However, for the purpose of the following, c(ρ) could also be a row in a matrix representing the relation . Once computed, Cunf can check whether ρ ρ ′ by either searching for ρ ′ in c(ρ) or for ρ in c(ρ ′ ).

For reading and generating enriched conditions ρ, Cunf computes c(ρ) using Prop. 3 as follows. It initially sets c(ρ) to Y p ∪ Y c . Next, it computes the intersection of c(ρ ′ ) for all ρ ′ ∈ X p ∪ X c , and filters out those c ′ , H ′ for which • e ∩ H ′ ⊆ H holds. In order to compute this condition without actually traversing H and H ′ , we use the sets r(H) and s(H) computed earlier (see above). These are defined as

r(H) := {e ′ ∈ H : e ′ ∩ cut(H) = ∅} s(H) := {e ′ ∈ H : e ′ ∈ • e}. Then • e ∩ H ′ ⊆ H holds iff • e \ s(H) ∩ r(H ′ ) = ∅,
which can be computed traversing • e and s(H) one time, and checking r(H ′ ) for every ρ ′ . Note that, while the other steps have their counterparts in Petri net unfoldings, this step is new and specific to c-nets. However, we find that this implementation keeps the overhead very small. In summary, this allows to compute c(ρ) for every ρ appended to the prefix. Cunf uses the vector c(ρ) to additionally store / /. This is done using the lowest two bits of each pointer in c(ρ), which are are "abused" to store whether ρ / / ρ ′ or ρ ′ / / ρ holds. Computing these two bits requires testing logical conditions of the form c ∩ H ′ ⊆ H for any ρ ′ ∈ c(ρ). This test is done similarly to the aforementioned test, it also uses the lists s(H) and r(H).

As for compound conditions ρ built using ρ 1 and ρ 2 , Cunf computes c(ρ) as the intersection of c(ρ 1 ) and c(ρ 2 ), which relies on Prop. 4.

Certain enriched conditions ρ = c, H need not to be included in the concurrency relation. It is safe, for instance, to leave c(ρ) empty if ρ is generating and f (c) • ∪ f (c) = ∅, or if H is a cutoff. We can also avoid computing c(ρ) if ρ is reading or compound and f (c

) • = ∅, even if f (c) = ∅.

Splitting the Concurrency Relation

Let ρ = c, H be an enriched condition. As mentioned in § 7.1.3, Cunf constructs the list c(ρ) of enriched conditions ρ ′ such that ρ ρ ′ . We found that the performance of the tool benefits greatly in some cases by splitting c(ρ) into two sets:

c 1 (ρ) := { c, H ′ : ρ c, H ′ } c 2 (ρ) := c(ρ) \ c 1 (ρ).
In other words, c 1 (ρ) contains the concurrent pairs for the same condition c and c 2 (ρ) the others. This simple split helps in several places. Suppose, for instance, that ρ is a new enriched condition that we have just added to the prefix.

• If ρ is reading or generating (where H is a history for an event e),

Cunf uses the algorithm of § 7.1.3 to compute c(ρ). There, for any ρ ′ in X p , any c ′ , H ′ ∈ c 1 (ρ ′ ) is such that c ′ ∈ • e, so all ECs in c 1 (ρ ′ ) can be excluded from consideration in the intersection of vectors the algorithm performs.

• Next, in the eager approach, we may use ρ to generate compound conditions. For this, we now simply take all ρ ′ = c, H ′ from c 1 (ρ) and create a new compound condition

ρ ′′ = c, H ∪ H ′ . Moreover, we have that c 1 (ρ ′′ ) = c 1 (ρ) ∩ c 1 (ρ ′ ) and c 2 (ρ ′′ ) = c 2 (ρ) ∩ c 2 (ρ ′ ).
• Finally, Cunf uses new ECs ρ to search for PEs by means of the algorithm in § 7.1.2. In order to find the sets X p , X c , Cunf can restrict the search of ECs to c 2 (ρ) rather than c(ρ) in certain cases.

Strategies

Algorithm 1 is parametrized by an strategy, i.e., an order on the finite configurations of the unfolding. Although this order is defined for finite configurations, observe that Algorithm 1, and consequently Cunf, only uses it on histories. Cunf implements three different strategies, and uses by default the ERV strategy. See § A.3.2 to learn how to instruct Cunf to use one particular strategy. numerous examples shows that the computational cost of doing this is quite low. We note that Cunf implements the order < F as defined in [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF] as well as the slight variation implemented in Mole, which is also adequate and total, but different from < F .

The size and Parikh vectors of any history H is computed as soon as the enriched event e, H in which it takes part is discovered as a PE. The marking mark(H) of the history is also computed at this stage, it will be relevant for deciding whether the PE is a cutoff. The lists r(H), s(H) that we mentioned in § 7.1.3 are also computed at this point during two linear traversals of H.

prefix analysis: the tool cna

In Chapter 4, a SAT encoding of the coverability and deadlock-freeness problem has been presented. We implemented this encoding into the tool Cna (Contextual Net Analyzer), distributed within the Cunf Toolset. The manual of this tool is included in App. A.

Cna inputs unfoldings generated with Cunf and searches for reachable markings of the original c-net that enable no transition (deadlocks) or mark a set of given places (coverability). The tool constructs the propositional formulas φ mark,M P or φ dead P presented in § 4.3. We briefly recall the structure of φ mark,M P and φ dead P . Both formulas request that satisfying assignments represent configurations of the unfolding, which each of them additionally constraints to be those who cover the places in M, for φ mark,M P , or those reaching a deadlocked marking, for φ dead P . In encoding configurations, multiple at-most-one constraints are used to forbid symmetric conflicts, and one acyclicity constraint is employed to forbid cycles of asymmetric conflict.

Satisfying assignments to these formulas encode the (offending) firing sequences searched by the tool. The tool relies on Minisat [START_REF] Eén | An Extensible SAT-solver[END_REF] to solve the formula, and displays a firing sequence of the original c-net if one is found. Notice that once the unfolding is built, it can serve to answer multiple queries.

A number of optimizations and variants of the SAT encodings were proposed in § 4.3. In this section, we empirically evaluate their impact on the solving time. We have employed as benchmarks the set of safe nets referred in § 7.3.

Stubborn Event Elimination and Subset Reduction

Over the set of ordinary nets considered in § 7.5, we found that removing stubborn events reduces the accumulated SAT solving time by 27%. When applied together with the subset optimization from § 4.7, this grows to 30%. For c-nets, we measured a 14% reduction when stubborn events are removed from the encoding without acyclicity constraints but only a 6% reduction if additionally the subset optimizations are applied. Experiments over the encoding with acyclicity were similar.

These experiments suggest that removal of stubborn events has a positive impact on performance, while subset optimization has very limited, even negative impact. For the following experiments, we applied only the stubborn event optimization. In average, the proposed method eliminates 66% of the nodes and 26% of the edges, seeming thus to be more effective at reducing the number of nodes rather than the number of edges, which in turn becomes a reduction in the number of variables rather than the number of clauses of the encoding.

However, in some examples, the remaining SCCs are still rather large, on the order of tens of thousands of events, and in these cases φ asym P negatively impacts the solving time of the formula φ mark,M P or φ dead P where it is included. We therefore implemented a two-stage approach. First we generate and solve all subformulas of φ mark,M P or φ dead P except φ asym P , which is entirely omitted. This may of course produce a satisfying assignment that is not a configuration, but if the formula is already unsatisfiable, then φ mark,M P or φ dead P would also be unsatisfiable if φ asym P had been included. Only when this first stage yields a false positive, a second stage with φ asym P is used to obtain a definitive result. This approach was very successful: in over 100 different nets from various sources that we tried, only 2 (small) nets yielded a false positive. The experiments presented in the following use this two-stage approach.

SAT-solver Settings

Minisat allows the user to tweak certain aspects of the SAT-solving algorithm. It is tempting to do so in order to exploit knowledge about the problem domain.

In φ dead P for instance, the chosen configuration C determines the marking m. The subformula φ dis P introduces one variable for each place of the net. Minisat can be instructed to search a solution by actively choosing values only for a subset of variables, the so-called decision variables. By default, all variables are decision variables. In φ dead P it is safe to exclude variables associated to places from being decision variables, as their value is safely propagated from the values to variables for events. We tried removing these variables from being decision variables, however the effect on the running time was negative overall.

Similarly, we tried to exploit the causal structure of P by instructing Minisat to prefer deciding the values of events with few (resp. many) causal predecessors first. This, too, tended to impact the solving time negatively.

Thirdly, we measured the impact of choosing the polarity of the variables (i.e., whether Minisat first tries setting them to true or false). While this had a positive impact on certain examples, other examples were very negatively affected. Overall, the default settings of Minisat proved to be very good and did not benefit from our adjustments.

benchmarks

A number of experiments are performed on the next three sections, all of them over a set of benchmarks that are discussed now.

We have employed a set of [START_REF] Esparza | Implementing LTL Model Checking with Net Unfoldings[END_REF]). In all preceding bibliographic references, and specially in [Cor96; MR97; Kho03], detailed explanations about the models are offered, so we will not reproduce them here again. See also [START_REF] Best | Partial Order Verification with PEP[END_REF] for additional information.

These nets are not specifically geared towards using the contextual unfolding approach, though read arcs occur naturally here, as we explain below. They were already favourable for unfoldings, and have various characteristics that allowed to test many aspects of our implementations, thus ensuring their robustness.

For each net N in the set, we first obtained the c-net N ′ by substituting pairs of arcs (p, t) and (t, p) in N by read arcs. Evidently, the plain encoding of N ′ is N. Secondly, we obtained the PR-encoding N ′′ of N ′ . Some benchmarks have also been contributed by the author, although not all of them are used for experiments reported in this manuscript. Most of the nets are in fact parametric collections of nets, generated by an script included in the distribution of the Cunf Toolset, see App. A. The parametric collections include Dijkstra's mutual exclusion algorithm [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF], described in detail in § 7.7, Asynchronous Conway's game of life [START_REF] Gardner | Mathematical games: The fantastic combinations of John Conway's new solitaire game 'Life[END_REF], on a square grid of parametric dimension, and Asynchronous Random Boolean Networks, a generalization of random Boolean networks [START_REF] Gershenson | Introduction to Random Boolean Networks[END_REF]. The last two collections have not been used in this manuscript.

experiments with cunf

In order to experimentally evaluate the tool Cunf, we performed a series of experiments with the benchmarks of § 7.3. Those put to test many features of the implementation, thus improving the robustness of the tool. We were interested in the following questions:

• Is the contextual unfolding procedure efficient?

• What is the size of the unfoldings, compared to Petri net unfoldings? • How do the various approaches (lazy, eager, PR, plain encoding) compare?

Concerning the second and third point, it is worth noting that we could contrive examples to show arbitrarily large differences between various approaches. As far as the size of the final unfolding is concerned, Fig. 5, on p. 9 already shows that contextual unfoldings may be up to exponentially more succinct than Petri net unfoldings. As far as running time is concerned, § 3.10 contains examples that would distinguish the eager and the lazy approach in both senses. To see how the running time of the contextual approaches can be superior to the plain encoding, consider the net in Fig. 31, where transition t reads from two places p 1 and p 2 . Both places have an additional reading transition, so they each have one (empty) generating history, two reading histories, and one compound history. The contextual unfolding is isomorphic to the net itself. If one expands the context of transition t to k places like p 1 and p 2 , then the contextual approaches produce the prefix in time linear to k. The plain encoding, on the other hand, will create an exponential number of events for t, each corresponding to some set of transitions that have previously read from t.

In order to abstract from such artefacts and get numbers from more realistic examples, we considered the benchmarks referred in § 7.3. Recall that these nets are not specifically geared towards using contextual approaches, although they had various characteristics that allowed to test many aspects of the implementation.

Let N be any c-net in the benchmark, N p its plain encoding and N r its place-replication encoding. We first compared Mole [Sch] and Cunf on the nets N p and N r , which are ordinary nets, without read arcs. The object of this exercise was to establish whether Cunf was working reasonably efficient on known examples. Indeed, its running times were always within 70% and 140% of those of Mole, the differences due to minor implementation choices. To abstract from these details, we used Cunf for all further comparisons.

We then used Cunf to produce marking-complete prefixes of N, N p , and N r , using both lazy and eager methods and the order ≺ F from [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. Table 6 summarizes the results. 2The columns in the table are subdivided into three parts, corresponding to the contextual net, its PR-encoding, and its plain encoding. For contextual nets, we first give the number of events and conditions contained in the marking-complete prefix (columns |E| and |B|, in thousands). These prefixes include cutoff events, which means that the number for |E| is actually somewhat larger than what is strictly required by Rmk. 8.

The column marked |E cut | provides the percentage of such events; this percentage could be subtracted from |E| to obtain the prefix that is strictly necessary to characterize, e.g., coverability as in Ch. 4. Cunf does need to compute those cutoff events anyway, so their inclusion in the output prefix hardly affects the running time.

The column | • e| gives the average preset size of an event. The four columns mentioned so far are identical for the eager and the lazy approach. For the eager approach, we then list the number of compound conditions (causing additional memory overhead of the eager approach w.r.t. lazy) and the running time3 in seconds (t E ) as well as (maximum virtual) memory consumption in megabytes (m E ). For lazy, we list running times (t L ) and memory consumption (m L ) relative to the eager approach, i.e., a factor less than 1 means a faster/less memory-consuming computation, and a factor larger than 1 a slower/more memory-consuming one.

For the PR-encoding and the plain encoding, the data for number of events and conditions, running times, memory consumption, and average preset size (only PR) is also given relative to the eager approach. We additionally provide the percentage of cutoff events (|E cut |). Notice that the number of enriched events in lazy and eager equals the number of events in PR, cf. the discussion on § 1.4. The ratio between number of events in contextual and number of events in PR is thus the average number of histories per event in the contextual approach. We make the following observations:

• We first look at the comparison between lazy and eager. It turns out that in this set of benchmarks, many examples did not exhibit any compound conditions (despite the presence of many read arcs), e.g., because reading actions took place sequentially, or multiple potential readers happened to be in conflict with one another. In those examples, the differences between the two versions are due to the different implementations of the possible extensions (see § 3.7) and the various relations that must be maintained (see § 3.9), sometimes slightly favouring one approach, sometimes the other. Significant differences arise where (like in key_4) there are many compound conditions; here lazy has some memory savings but performs very badly. An effect to the contrary like in Fig. 17 (b), while in principle possible, did not manifest itself in our benchmarks.

• Compared with PR, the eager approach is consistently more efficient.

In several cases (such as elevator_4 or rw_2w1r), PR is orders of magnitudes slower. This clear tendency is slightly surprising given that the enriched contextual prefix has essentially the same size as the prefix of the PR-encoding. We experimentally traced the difference to the enlarged presets of certain transitions in the PR-encoding (see Fig. 9 in p. 21), causing combinatorial overhead and increasing the number of conditions in the concurrency relation.4 Indeed, high running times for PR seem to coincide with high numbers in the | • e| column for PR (recall that this number is relative to the one for contextual).

• Both the eager approach and the plain unfolding handle all examples gracefully. The factors of the running times are between 0.7 and 4.2, meaning eager is between 40% slower and 4 times faster w.r.t. plain. The prefixes produced by the contextual unfolding methods are smaller than in the plain approach in half the cases. Interestingly, these are not always the same as those on which they run faster: for elevator_4 and rw_12.sync, the same number of events is produced more quickly. Here, the read arcs are arranged in such a way that each event still has only one history; the time saving comes from the fact that the contextual approach produces fewer conditions and hence a smaller concurrency relation. For key_4 and rw_1w3r, the contextual methods produce smaller unfoldings but take longer to run, due some overhead in the computation of the / / relation.

To summarize, this set of benchmarks contained examples where lazy and PR performed badly, whereas eager and plain handled all cases gracefully. The eager approach was the fastest overall, and for all examples its running time was within factor 2 of the fastest approach for that example. The prefixes produced by the contextual methods can be significantly smaller than for their Petri net encodings, which make them suitable candidates for subsequent analysis methods, such as those in Ch. 4.

experiments with cna

The tool Cna, presented in § 7.2, implements the techniques for deadlock and coverability checking of Ch. 4. This section experimentally compares the efficiency of the tool with that of other well-established deadlock-checking methods based on unfoldings. The effects of using ordinary nets and c-net are evaluated over the benchmark discussed in § 7.3.

In [START_REF] Khomenko | Verification of bounded Petri nets using integer programming[END_REF], Khomenko and Koutny compared three versions of their deadlock checking method, implemented in the tool Clp, against the methods by McMillan [START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF], Melzer and Römer [START_REF] Melzer | Deadlock Checking Using Net Unfoldings[END_REF], and Heljanko [START_REF] Heljanko | Using Logic Programs with Stable Model Semantics to Solve Deadlock and Reachability Problems for 1-Safe Petri Nets[END_REF].

In their benchmarks, the first version of their algorithm 5 outperformed the other methods on almost all examples. We experimentally confirmed this conclusion. Moreover, we learnt of an unpublished SAT-based tool by V. Khomenko which is said to be slower than Clp. 6 We therefore compare our technique with the first method of Clp. 7

Table 7 presents the results on the aforementioned standard suite. We used Mole [Sch] to produce finite complete prefixes of the Petri nets and Cunf to do the same for c-nets. 8 The running times for Mole and Cunf are given in the respective columns, together with the number of events |E and conditions |B| of the generated prefix. In ordinary Petri nets, the column labelled Clp shows the running times of Clp on the unfolding prefix constructed with Mole. For both ordinary and contextual nets, the column labelled SAT provides the running times of Minisat on the formulas produced by Cna, using the settings discussed in § 7.2. Times are given in seconds, and represent averages over 10 runs; this was essential to obtain running times that reasonably repeatable.

We do not provide the translation times to generate linear equation systems (for Clp) or SAT formulas (for Minisat). Those times would not be very representative since both translators are potentially suboptimal. The constraints generated by Cna are of linear size w.r.t. the unfolding prefix, Column std in Tables 1 and2 Compared to Clp, SAT checking performs well over Petri nets, solving the problems twice as fast on aggregate. Concerning the comparison of SAT checking between Petri nets and c-nets, another advantage of 13% for deadlock verification is obtained. More significantly, the time for generating c-net unfoldings is 30% less than for Petri nets. This advantage is not huge, but recall that these benchmarks are already favourable examples for Petri net unfoldings and were not specifically designed to exploit the advantages of cnets. Contextual unfolding construction and verification performs very well, for instance, on ftp_1.sync and furnace_4.sync, where unfoldings run twice faster and deadlock checking one order of magnitude faster.

The two-stage approach was essential for performance: while the acyclic constraints had a big impact only on a few examples (notably byzagr4_1b, dme, and rw*), that effect would have nullified the advantage of smaller unfoldings.

experiments with contextual merged processes

This section reports on experimental results comparing the sizes of CMPs, merged processes (MPs), and complete unfolding prefixes for a number of benchmarks from § 7.3. All these methods construct a representation of the state space of the net. The goal here is comparing the relative compression factors of these various representations. We do not yet have an implementation of the direct construction algorithm for CMPs, so we cannot compare at this stage the times to construct them.

To elaborate the comparison, unfoldings and merged processes were constructed.9 For every net in the benchmark, we considered the equivalent c-net and the PR-encoding of the c-net, constructed as explained in § 7.3. We then constructed the unfoldings of the three nets, and merged them into the corresponding merged processes. The following consistent setup was used to produce both unfoldings and MPs.

• The total adequate strategy proposed in [START_REF] Khomenko | An Algorithm for Direct Construction of Complete Merged Processes[END_REF] was used to construct unfoldings. This strategy is not implemented in Cunf, so other tools were used to construct contextual unfoldings, as explained below.

• All configurations were allowed as cutoff correspondents, not only the local ones. When constructing ordinary unfoldings, usually only the local configurations are authorized to be the corresponding configurations. Similarly, in § 3.2, the ≺-cutoff enriched events in Def. 4 on p. 34 were defined using only histories as corresponding configurations. The idea of using general corresponding configurations originates from [START_REF] Heljanko | Minimizing Finite Complete Prefixes[END_REF]. We are aware of only one unfolder, Punf [Kho], that implements the approach10 , which requires to integrate a SAT solver in the unfolder. However, in existing direct construction methods for MPs, the SAT solver is already necessary for other purposes, cf. Ch. 5, so using general configurations is rather natural and entails no performance penalty. To make the comparison fair to merged processes, we thus employ non-local corresponding configurations.

• The cutoff (mp-)events and post-cutoff (mp-)conditions has not been counted.

This setup has been used to facilitate the comparison with future experiments on the direct construction algorithm of CMPs, and to avoid similar problems in comparing experimental results as those explained in [START_REF] Khomenko | An Algorithm for Direct Construction of Complete Merged Processes[END_REF].

The marking-complete unfolding prefixes of the plain and PR encodings have been constructed using Punf [Kho]. The plain and PR MPs have been merged from the corresponding unfolding prefixes with Mci2mp, a tool developed by V. Khomenko. Similarly, CMPs were merged from the corresponding contextual unfolding prefixes using Cmerge, a tool developed by the author that essentially implements the merging operation of Def. 16 on events and conditions. The direct construction algorithms for MPs and CMPs would yield the same results.

Contextual prefixes could not be computed with Cunf, so we constructed them by compressing the PR ones with Stefan Schwoon's tool PRCompress. The tool a marking-complete contextual prefix P of a c-net N out of a marking-complete prefix P ′ of the PR encoding N r . It applies a folding operation to P ′ , defined by the repeated iteration of the following steps:

1. All conditions that were created due to a consume-produce loop are merged and their flow arcs replaced by a read arc; 2. The PR encoding N r contains multiple replicas of certain places in N.

The tool next merges all conditions in the postset of any event if all them are labelled with those replicas. More specifically, any set of conditions is merged if, (i) it is contained in the postset of an arbitrary event, and (ii) the conditions in the set are labelled by all place replicas of any place in N. The resulting new conditions is labelled by the place of N. 3. All events with the same label and the same preset are merged, and so are their postsets.

The resulting c-net prefix P has the same reachable markings as P ′ and is therefore marking-complete. Indeed, applying this operation to the prefix shown in Fig. 5 (f), which is the unfolding of Fig. 5 (c), would yield the c-net unfolding Fig. 5 (e).

Recall the following theoretical guarantees:

• The c-net unfolding prefix is never larger than the PR prefix.

• The plain/PR/contextual MP is never larger than the corresponding unfolding prefix.

Table 8 compares the sizes of plain, PR and contextual unfolding prefixes and MPs. The 4 th and 5 th columns from the left are, respectively, the number of read arcs in the net and place replicas in its PR encoding. 11 The numbers of conditions and events for the plain and PR unfoldings are normalised w.r.t. that of the contextual unfolding. Similarly, mp-conditions and mp-events of the plain and PR MPs are normalised w.r.t. those of the CMPs. The last three columns show the compression gains of CMPs w.r.t. plain and contextual unfolding prefixes, and the gain of plain MPs w.r.t. plain unfolding prefixes.

One can see that CMPs are the most compact of all the considered representations.12 Comparing the three columns on MPs, on certain examples, such as Dme and RW, the reduction in the number of mp-conditions is substantial, while the number of mp-events remains the same. Furthermore, on some benchmarks, notably Key(4), CMPs have significant advantages over

∝ n 2 ∝ n 2 ∝ n 3 ∝ n 3 ∝ 3 n ∝ 5 n ∝ 5 n
for the family of c-nets n-Gen, discussed in § 5.3, PR MPs seem to be less efficient than plain MPs on n-Dijkstra. We note that this example exhibits some of the features explained in § 5.3. For instance, process 0 can transition from l 5,0 to l 2,0 if there exists another process i with c i = f . Thus, for n ≥ 3 there would be a choice between multiple (i.e., n -1) transitions in parallel to implement the check, a structure also found in the n-Gen example. We note that such structures would also naturally ensue from other mutual exclusion algorithms that typically involve checking for the presence of some other event with a certain property.

C O N C L U S I O N A N D P E R S P E C T I V E S

The study of asymmetric event structures has, not surprisingly, focused so far on foundational aspects. The publication of [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] was a turning point, making in principle possible the use of these structures in practical verification. The question then was whether this is profitable.

This dissertation demonstrates that asymmetric event structures can be rendered practical and outperform existing techniques on non-trivial classes of systems. They have, we believe, a rightful place in research on concurrency, also from an efficiency point of view.

The manuscript makes theoretical and practical contributions to model checking and fault diagnosis, focused on improving their scalability. In particular, the methods and tools proposed here open the way to using contextual unfoldings for practical verification.

Unfolding-based verification conceptually takes place in two steps. First, an unfolding of the system is constructed, carrying all information relevant to deciding the verification question. Then the unfolding is analyzed, to actually answer the verification question.

unfolding construction. For this step, we provide in Ch. 3 one concrete method for computing contextual unfoldings, and develop contextual merged processes in Ch. 5. Both techniques aim at representing compactly the state space of contextual Petri nets, achieving different degrees of compression, and both were studied with a view to efficiency. Experimental evaluation of these methods has been carried out, the results were reported in Ch. 7.

For contextual unfolding construction, the main contribution presented here is the eager approach to compute possible extensions. We proposed to associate histories to conditions of the prefix and presented a concurrency relation on conditions enriched with such histories. We showed how to characterize and compute possible extensions with this relation and gave key results for computing the relation itself. This notion of concurrency was then refined into asymmetric concurrency, providing not only a more uniform and simple characterization of possible extensions, but also a faster algorithm for their computation.

We implemented the eager algorithm into the Cunf Toolset, a set of competitive verification tools entirely developed during this thesis, striving to make the implementation fast and robust. These tools have been tested and profiled over a large set of benchmarks. Important implementation details were reported in Ch. 7. Experiments show that not only are contextual unfoldings more compact than ordinary ones, but they can be computed with the same or better efficiency, in particular with respect to alternative approaches based on encoding contextual nets into ordinary nets.

Formal verification of concurrent systems faces diverse sources of statespace explosion. Contextual unfoldings mitigate the combinatorial explosion due to concurrency and concurrent read access. We have proposed contextual merged processes, which additionally cope with the explosion due to sequences of choices. We proved a number of results which lay the foundation for their construction and their use in model checking of reachability-like properties. Experiments showed that they can be orders of magnitude more compact than contextual unfoldings. unfolding analysis. Once a representation of the system is available, either in the form of an unfolding or a merged process, formal verification reduces to a particular analysis of the representation. Methods for answering reachability and deadlock-freeness queries using both contextual unfoldings and contextual merged processes were presented in Ch. 4 and Ch. 5, and partially evaluated in Ch. 7. In both cases, the problem in question was reduced to SAT. Additionally, a method was presented in Ch. 6 to perform weak diagnosis of faults under fairness constraints using ordinary unfoldings.

Our SAT encodings for reachability and deadlock are quite concise, due to the aforementioned compactness of contextual unfoldings and merged processes. The performance of modern SAT solvers is however only loosely related to the encoding size. Optimizations were necessary to make the presented deadlock-checking method competitive compared to existing methods. Among all proposed ones, particular attention was put on the acyclicity constraint, as it often dominates the size of the encoding. Once implemented in the Cunf Toolset, the approach was compared with other unfolding-based techniques, showing that the method is practical and outperforms existing techniques on a wide number of cases.

Weak diagnosis explores the fair executions of the system that are compatible with a given observation and determines whether an unobservable fault is inevitable. We stress that despite its name, weak diagnosis is actually stronger than conventional diagnosis. Our results in Ch. 6 allow to decide whether a given observation weakly diagnoses a fault. They require to build two unfolding prefixes, one to represent all behaviors compatible with the observation and another one to represent all fair behaviors. We then reduced the weak diagnosis problem to a SAT instance generated out of these prefixes.

perspectives. Along the manuscript, we have already mentioned ideas for short-term future work extending of the results presented. We now present additional ideas for extension and some more broader perspectives of future work. The following are ideas for future work that follow up the developments in this manuscript:

• The algorithm for direct construction of ordinary merged processes proposed in [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF] is based on a procedure for reachability checking. The results in § 5.5 lay the foundation for reachability checking with CMPs. The major ingredient for transferring [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF] to the contextual case is thus ready. An important problem yet to be solved is finding a total strategy that has good encoding into SAT, as the one presented in [START_REF] Khomenko | Direct Construction of Complete Merged Processes[END_REF].

• While the SAT-based analysis techniques for unfoldings and merged processes presented here exploit the compactness of these representations, they include a new acyclicity constraint which is not necessary in ordinary nets. This constraint dominates the size of the encoding and often reduces the performance of the solver. Improvements on it may significantly speed up solving times. • Most of the time spent for the construction of an unfolding is employed in computing the concurrency relation. More efficient algorithms for constructing concurrency relations thus have direct impact on the unfolding time. The concurrency relation itself is used for two purposes: (1) to find, ultimately, possible extensions, and (2) to update the relation itself. However, there are pairs in the relation which never contribute, even indirectly, to any of these purposes, and their computation could be avoided -for the advanced reader, think of a net with two isolated components which have large unfoldings. Algorithms and data structures to compute only the necessary fragment of the relation are likely to speed up unfolding construction.

• We intend to produce an implementation of the presented diagnosis approach. While many of its ingredients are available by minor modifications of existing tools and verification infrastructure, e.g., [Sch], a practical obstacle to overcome could be the sizes of the prefixes required in order to perform diagnosis.

Existing literature on unfoldings, including the works behind this dissertation, have focused on finite nets with finite state space [START_REF] Esparza | Unfoldings -A Partial-Order Approach to Model Checking[END_REF]. Moreover, the algorithmics of unfoldings, and tools implementing them, have almost exclusively focused on 1-safe nets [ERV02; ER99; EH08; KM13], as non-safeness is a well known source of explosion for unfoldings [START_REF] Khomenko | Merged Processes -a New Condensed Representation of Petri Net Behaviour[END_REF]. An exception to this is [START_REF] Aziz Abdulla | SAT-Solving the Coverability Problem for Petri Nets[END_REF], where the coverability problem of an unbounded Petri net is solved using backwards unfoldings.

Leveraging on the efficiency of unfolding algorithms for safe nets, an interesting perspective is the investigation of unfoldings for 1-safe, infinite Petri nets. Since they are safe, their algorithmics are likely to be efficient. Because they are infinite, certain verification questions could be reduced to them. For instance, straightforward semantics could be given to non-recursive Boolean programs with unbounded thread creation [START_REF] Cook | Verification of Boolean programs with unbounded thread creation[END_REF], reducing safety properties to coverability queries on the net.

The coverability problem for these infinite nets is of course undecidable. However, this should not prevent us from making an abstract interpretation of them. Under reasonable assumptions, such as finite-enabling1 , such nets can readily be given unfolding semantics. Next, the coverability problem could be overapproximated by a finite prefix constructed with a suitable cutoff criteria. In the definition these criteria, the theory of canonical prefixes [START_REF] Khomenko | Canonical prefixes of Petri net unfoldings[END_REF] will arguably provide a supporting framework.

Although read arcs seem not to play a central role in such extension, they would arguably contribute to more compact unfoldings.

A second perspective would be related to partial-order reduction techniques, also referred as model checking using representatives [START_REF] Peled | All from one, one for all: on model checking using representatives[END_REF]. These techniques and unfoldings are often presented as two classes of approaches to cope with the state explosion problem derived from concurrency. Although they are applied to the similar problems, we are not aware of any work comparing them. Understanding better the connections between the two would not only be of interest for practitioners trying to decide which to use for a particular problem, but arguably also for theoreticians seeking for better representations of concurrent state spaces. We intend to carry out an study in this direction. unfolding of its plain encoding. For instance, Fig. 33 (a) is a c-net and (b) its plain encoding. The unfolding of (b) is (c), but the unfolding of (a) is a c-net isomorphic to (a). If (a) was generalized to n reading transitions (copies of t 2 ), we would still have an isomorphic contextual unfolding, but (c) would blow up. See [BBC+12] for more details. An unfolding is suitable for checking certain properties of the net giving rise to it, such as reachability or deadlock-freeness. Checking these directly on the net is computationally difficult (PSPACE-complete). Building the unfolding is (for highly concurrent systems) efficient, and checking these properties using the unfolding is also easy -NP-complete. Together, unfolding construction and unfolding analysis is almost always faster than verification based on the reachability graph. Also notice that we can check many properties once the unfolding is built.

Cunf implements the c-net unfolding procedure proposed by Baldan et al. in [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF]. The algorithms and data structures actually implemented have been partially described in [RSB11b;BBC+12]. While the theoretical results of [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], [RSB11b; BBC+12] allow for unfolding bounded c-nets in general, Cunf can only unfold 1-safe c-nets (i.e., no reachable marking puts more than one token on every place), and for the time being the tool will blindly assume the input is 1-safe -the unfolding could be wrong if this is not fulfilled. In [START_REF] Rodríguez | Implementation of a complete prefix unfolder for contextual nets[END_REF], and old and inefficient version of the tool is described.

Cna, whose name stands for Contextual Net Analyzer, checks for place coverability or deadlock-freedom of a c-net by examining its unfolding. The tool reduces these problems to the satisfiability of a propositional formula that it generates out of the unfolding, and uses Minisat [START_REF] Eén | An Extensible SAT-solver[END_REF] as a backend to solve the formula. The algorithms used by Cna has been described in [RS12b].

a.2 author and contact

The Cunf Toolset is developed and maintained by César Rodríguez LSV, ENS de Cachan 61, avenue du Président Wilson 94235 Cachan Cedex France e-mail: cesar.rodriguez@lsv.ens-cachan.fr Website : http://www.lsv.ens-cachan.fr/~rodriguez/ If you experience any difficulty using the tool, or found a bug, or just wish to let me know that you are using it, send me an e-mail.

a.3 installation

The Cunf Toolset has only been tested in Linux and Mac OS X; it should run well in other Unix systems. You can choose to install precompiled binaries or compile and install from the source code.

Cna requires the Minisat solver to be installed in your machine, and available in the $PATH. For your convenience, Minisat v.2.2.0 is distributed with the precompiled binaries and can be found in the minisat/ folder of the repository.

a.3.1 From Precompiled Binaries

From the following address, choose the latest version (1.6) of the bundle with precompiled binaries that suits your machine, download, and unpack it: https://code.google.com/p/cunf/downloads/list Then follow the next steps:

1. Copy all files in the bin/ folder to any folder in your computer pointed by your $PATH.2 2. The folder lib/ptnet/ contains a Python module that should be correctly installed in your system for Cna and other Python scripts to work. Copy it to, either,

• any folder pointed by your installation-dependent Python's default Module Search Path,3

• or any folder pointed by (one of the paths in) the environment variable $PYTHONPATH,

• or the same folder where you copied Cna and the other Python scripts, as Python will first search for modules in that folder.

a.3.2 Compilation and Installation from the Source Code

First, get the source code. You have two options:

1. Download and unpack the boundle containing the source code of version 1.6 of the tool, from https://code.google.com/p/cunf/downloads/list 2. Clone the Git repository where the development takes place, running the command:

git clone https://code.google.com/p/cunf/ Cunf is written in C, the source code is the src/ and include/ folders of the tool repository. Cna is written in Python, and uses the ptnet Python module, both are located in the tools/ folder.

The compilation is handled by make, the following targets are available:

all Compiles Cunf and Minisat, leaving the respective binaries in the files src/main and minisat/core/minisat. dist Builds all necessary files and creates the folder dist/, containing the binaries and libraries ready to be installed -the same files that are distribued from the boundle in § A.3.1.

Some compilation-time options can be tweaked in include/config.h, here you have a description: config_debug Define this macro to compile debugging code. Cunf will perform extensive assertions aiming at finding bugs in the code and corrupt data structures. It will additionally dump verbose debugging information during the unfolding computation. Switching on the option will considerably increase Cunf's running times. config_mcmillan Define this macro to use McMillan's adequate order [START_REF] Mcmillan | A technique of state space search based on unfolding[END_REF] when Cunf picks possible extensions to extend the unfolding prefix. One and only one of the macros CONFIG_MCMILLAN, CONFIG_PARIKH, CONFIG_ERV or CONFIG_ERV_MOLE can be active. Recall that this is not a total order. config_erv Selects the ≺ F total adequate order of [START_REF] Esparza | An Improvement of McMillan's Unfolding Algorithm[END_REF]. config_parikh Selects the Parikh order of [EH08, definition 4.46]. Although this this is an adequate order, it is not total, and may produce prefixes larger than any of the other available total orders. However, it always produces prefixes smaller than when using CONFIG_MCMILLAN. config_erv_mole Selects the adequate order used in the Mole unfolder [Sch]. This is a minor, non-documented modification of the order ≺ F . It makes possible to compare the unfolding prefixes computed by Cunf and Mole. Refer to the function h_cmp, in src/h.c, for more details. config_nodelist_step Defines the number of items to be allocated together whenever certain dynamic linked-lists need to grow. Among other uses, these lists are used to store markings.

To generate the binaries, execute $ make dist and follow the steps in § A.3.1 with the folder dist. Observe that your installed copy of Cna will not work before you install the ptnet module, as indicated in § A.3.1. You can of course run Cna from the tools/ folder, since Python first searches for modules in the same directory where the executable is located.

a.4 getting started

In this section we explain the usage of the Cunf Toolset with a simple, wellknown example.

Figure 34 shows a c-net representing a variant of Dekker's mutual exclusion algorithm for two processes, represented by numbers 0 and 1 in the figure . A process may fire try and set a flag to signal intention to enter the critical section. It can then enter the critical section p3 if the other process is For the purposes of this presentation, let us just give it a shorter name:

$ cp examples/dekker/dek02.ll_net dek02.ll_net This file, as any other c-net in the examples/ folder, is formated in a simple modification of the PEP's low-level Petri net format, which will be described in § A.6. For historical reasons, this is the only input format of the Cunf Toolset. The toolset comes, however, with scripts to translate the output format of some graphical editors, like Coloane [LIP] or PIPE2 v2.5 [START_REF] Bonet | PIPE v2.5: A Petri Net Tool for Performance Modelling[END_REF], see § A.7 for more details.

a.4.1 Constructing Unfoldings with Cunf

Assume we wish to check if dek02.ll_net is deadlock-free, or whether mutual exclusion is guaranteed. We first build its unfolding using Cunf, and store it in the file u.cuf: $ cunf -o u.cuf dek02.ll_net By default Cunf outputs in CUF03 format (documented in § A.6). A number of statistics about the computation of the unfolding and the size and shape of the output are printed just before the tool terminates. We can distinguish the following lines: The first line above is the number of histories generated by Cunf (you may see [BBC+12] for a definition), and gives a rough idea of the size of the internal object Cunf had to build in order to produce the unfolding. The unfolding itself has the number of events (transitions) and conditions (places) reported in the next two lines.

Cunf's unfolding algorithm builds and maintains a concurrency relation that the tool internally needs for constructing the unfolding. Explaining the purpose of this relation is out of the scope of this manual (see [BBC+12]). It is, however, important to say that computation of this relation often takes most of the time consumed by the tool. In the line co(r) 5.25

Cunf reports that every element over which the relation is defined was related to an average of 5.25 other elements. In general, the higher this number is, the slower Cunf's unfolding algorithm proceeds. More details in [BBC+12, section 7].

Next in the list is the average number of conditions in the preset, context, and postset of every event. The last line reports the number of cut-off (enriched) events present in the internal object constructed by Cunf.

a.4.2 Deadlock and Coverability Analysis with Cna

After the construction of the unfolding, we can proceed to its analysis. We use now Cna to ask, for instance, about the presence of deadlocks: $ cna -d u.cuf answer : NO , the net is deadlock-free clauses : 52 event variables : 4 reductions : bin 4-tree sccs : [(4, 4, 4, 4)] variables : 30

Option -d instructs Cna to look for deadlocks. By default, it will build and solve a propositional formula associated to the unfolding, and will internally invoke Minisat to solve it. If called with -n, Cna will instead dump the formula and exit. Option -c checks for coverability, in this case, of places p3/1 and p3/0: $ cna u.cuf -c 'p3/1' 'p3/0' answer : NO , no rechable marking covers 'p3/0' 'p3/1' [...] Observe that p3/i is marked iff process i is in the critical section. We may also ask if it is possible to find one process trying to enter the critical section while the other is already in, which is naturally possible: $ cna u.cuf -c 'p1/0' 'p3/1' answer : YES, places 'p1/0' 'p3/1' are coverable clauses : 39 event variables : 4 reductions : bin 4-tree sccs : [(4, 4, 4, 4)] trace : 'try/1:e0' 'enter/1:e3' 'try/0:e1' variables : 22

The trace indicates the firing sequence of the c-net (or the unfolding) that makes possible to cover the requested places. The lines labelled by clauses and variables inform about the size of the SAT formula fed to Minisat. Notice that in this example, the construction of the CUF03 file is necessary only once, while Cna can be applied many times. For most problems, the former step is the bottleneck whereas Cna works very fast thanks to efficient SAT solving techniques. For cases where only one coverability query is needed, the option -t of Cunf checks whether a given transition is firable, and stops computing the unfolding if the answer is yes. This can be used to check if the set of places in the preset of a (intentionally inserted) transition is coverable.

Notice the line starting with reductions. Cna applies several optimizations to the SAT encoding it produces. The word bin means that it is using binary rankings to encode certain acyclicity constraint; 4-tree says that Cna used 4-trees to encode the absence of symmetric conflicts (technical details in [RS12b], [START_REF] Rodríguez | Verification of Petri Nets with Read Arcs[END_REF]). Run the tool without arguments to obtain a full list of all the optimizations available, and information about them. This information is available in § A.5.2. The effect of almost all them is described in [START_REF] Rodríguez | Verification of Petri Nets with Read Arcs[END_REF].

a.4.3 More on Dekker's Algorithm

How the unfolding grows as we add more processes to our model of the Dekker's algorithm?

First, observe that when the 2-process example in Fig. 34 is generalized to n processes, O (2 n ) markings are reachable in these c-nets -for a net of size O (n 2 ). Several instances of the protocol are distributed in the folder examples/dekker/. We can easily run Cunf on some of them and retain the unfolding size:

$ for i in 10 20 30 40 50; do cunf examples/dekker/dek$i.ll_net | grep events done events 120 events 440 events 960 events 1680 events 2600

We see that the numbers roughly follow an square progression on the number of processes involved, i.e., linear on the number of transitions of the c-net.

a.4.4 Producing Graphics of C-nets and Unfoldings

The Cunf Toolset is distributed with a number of scripts capable of producing images depicting a c-net or an unfolding. These scripts actually rely on the tool dot from the Graphviz project [Gra] to actually produce the image. Say that we want to see the c-net dek02.ll_net which we unfolded in the previous sections. We first generate a dot script out of the net, using the tool pep2dot, included in the src/ directory of the source code (and also in the precompiled distribution):

$ src/pep2dot dek02.ll_net > dek02.dot Then use dot tool, like this: $ dot -T pdf < dek02.dot > dek02.pdf

The file dek02.pdf depicts the c-net. Similarly, if we wish to see the unfolding, we could type: $ tools/cuf2pep.py < u.cuf > u.ll_net $ src/pep2dot u.ll_net > u.dot $ dot -T pdf < u.dot > u.pdf

The first command has converted the cuf file in to a ll_net file, and subsequent commands are like before. The cuf2pep.py script is also included in the precompiled distribution. The resulting PDF is shown in Fig. 35. Regular arrows are in black, and read arcs are depicted in red. The initially marked conditions are the four top ones, and cut-off events have an asterisk in the name.

Actually, the make machinery included in the source code already knows how to produce PDF or even JPEG images of the c-nets or unfoldingspretty much in the same way it knows how produce an object file out of a C source file. You just need to type make followed from the desired file. For instance, we can obtain a JPEG image of the c-net with:

The same is true for building unfoldings. To build the unfolding of a net abc.ll_net you just need to make the file abc.unf.cuf: Observe that make make is removing, in the last line, all intermediate files it has generated -because you did not ask for any of them. The file generated by the previous command is shown in Fig. 36.

$
If you wish to know other transformation rules make knows, have a look to the end of the file defs.mk, located at the root of the repository. examples/dijkstra/ This folder contains c-nets that model Dijkstra's mutual exclusion algorithm [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF] for a number of processes varying between 2 and 6. These nets have been generated using the script tools/mkdijkstra.py, included in the source code (but not the bundle of precompiled binaries). examples/corbett/ This is a superset of the of the popular benchmarks compiled by Corbett [START_REF] James | Evaluating Deadlock Detection Methods for Concurrent Software[END_REF]. An short description of them can be found in [Kho03, pp. 29-31] The nets are distributed in four sub-folders. The folder cont/ contains contextual nets, and plain/ contains the plain encodings of the nets in cont/. Similarly, the folder pr/ contains the Place-Replication encoding [START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF] of the same c-nets. The folder other/ contains ordinary Petri nets.

The folder tools/ of the source code contains a number of scripts (all them have names starting by mk) to generate several families of nets, other Dijkstra's or Dekker's mutual exclusion models. This folder is not distributed with the bundle of precompiled binaries. Cunf expects an optional list of command-line options followed by the name of the input file to be provided as command-line arguments:

cunf [OPTIONS] NETFILE

Run the tool without arguments to obtain the list of available options. They are the next:

-t name Optional. Stop the unfolding construction as soon as the transition NAME is unfolded for the first time, and output the unfolding prefix currently built. The prefix will include exactly one occurrence of the transition, if it has been found, or zero occurrences -and it will be a marking-complete, cf. [BBC+12]. -d depth Optional. DEPTH is a natural number. Don't include in the unfolding prefix enriched events whose history has a depth greater or equal than DEPTH. The depth of a history H is the maximum natural n for which there exist events e 1 , . . . , e n in H such that e 1 ր e 2 ր . . . ր e n , where ր is the asymmetric conflict relation, as defined in [BBC+12]. -o file Optional. Write the unfolding prefix to the file FILE. If not provided, Cunf will obtain the path to write the unfolding from the input file. It will strip the string ll_net from the INPUT file and will concatenate the string unf.dot. -f format Optional. FORMAT shall be one of cuf, dot, or fancy. See § A.6.2. a.5.2 Cna Run Cna without arguments to obtain help about its command-line syntax. The tool expects a mandatory CUF file and an optional OUTFILE where it will write its textual output (standard output if not given):

cna [CUF] [OUTFILE] [OPTIONS]

Here is the list of OPTIONS it accepts:

-h, -help Show a help message and exit. k-tree (where 1 < k < 10) Use k-trees to implement the at-most-one constraints in the encoding of symmetric conflicts. If none of the options 'seq', 'log', or 'pair' is present, 4-tree will be used. seq Use the sequential encoding of [START_REF] Sinz | Towards an Optimal CNF Encoding of Boolean Cardinality Constraints[END_REF] for symmetric conflicts. log Use the logaritmic encoding of [START_REF] Frisch | Solving Non-Boolean Satisfiability Problems with Stochastic Local Search: A Comparison of Encodings[END_REF] for symmetric conflicts. pair Use pairwise encoding for symmetric conflicts. stb Use elimination of stubborn events, see [START_REF] Rodríguez | Verification of Petri Nets with Read Arcs[END_REF] for a detailed, technical description of the optimization. sub Reduce the symmetric and disabled constraints to certain maximal sets. nocy Do not produce constraints to check for cycles in the asymmetric conflict relation. bin Generate acyclicity constraints using ranks with binary encoding, see [START_REF] Codish | A declarative encoding of telecommunications feature subscription in SAT[END_REF]. If none of the options 'nocy', 'trans', or 'unary' is present, 'bin' will be used. unary Generate acyclicity constraints using ranks with unary encoding. trans Generate acyclicity constraints encoding transitive closure. sccred Reduce the SCCs before generating the acyclicity constraints.

-n file, -dont-solve file Dump the propositional formula to FILE and exit, instead of running the solver and displaying the result.

a.6 file formats a.6.1 The ll_net Format Cunf accepts a c-net as input, represented in a slightly modified version of the PEP's low-level format. We describe here this modification. We assume the reader is familiar with the PEP's low-level format [PEP; BG]. The input file should be formated in the low-level net syntax extended with one additional section, which specifies the context relation. The new section contains a list of read arcs, each one specified in the same way as either the place-transition arcs in section PT or the transition-place arcs in section TP. The new section is headed by the keyword RA, standing for Read Arcs.

Sections in the low-level net format must be placed in certain order. The new RA section must appear after the section TP (transition to place arcs) and before the (optional) section PTP (phantom transition to place arcs). Figure 37 shows an example, together with the graphical representation of the c-net. Cunf can write its output, the unfolding of the input c-net, in several formats. By default, it will write a cuf file, but other formats can be selected with the option -f:

dot For historical reasons, Cunf is able to write dot scripts, suitable for the dot tool. Scripts to produce dot input out any cuf or file are included in the source and precompiled distributions. fancy This also produces a dot file, but every event in the resulting graphical representation of the unfolding is annotated by the histories that Cunf had to construct. This is right now the only way of extracting information about the history-enriched unfolding prefix that Cunf constructs -apart from compiling the tool with CONFIG_DEBUG and parsing the debugging output. cuf The default output format, called CUF03, is binary and similar to the MCI format of PEP. C and Python code for dealing with CUF03 files is available in the repository. The standard reference defining the CUF03 format is the comment in the the line 263 of the file src/output.c, just before the function write_cuf. All technical details of the file format are explained there.

a.7 producing input for cunf

Most of the c-nets on which the Cunf Toolset has been used has been generated programmatically. It is the case, for instance, of the dekNN.ll_net nets in § A.4. Sometimes it is interesting, however, to draw a c-net and perform some analysis on it. The Cunf Toolset has currently no graphical user interface, and there is no plan for it to be available in the future. The Cunf Toolset is however integrated in the Cosyverif [Cos] tool, which includes a graphical interface and which will internally invoke the Cunf Toolset in several mouse clicks. There is also plans to include the Cunf Toolset as a verification engine of Tapaal [START_REF] David | TAPAAL 2.0: Integrated Development Environment for Timed-Arc Petri Nets[END_REF].

a.7.1 Graphically

A simple way of producing c-nets for Cunf is using the Coloane graphical editor [LIP]. This is the same editor used in the Cosyverify tool, but can be installed as an stand-alone program. Once you have edited your c-net in Coloane, see Fig. 38 (observe that you can also introduce read arcs), rightclick on the model name in the Projet Explorer window, and then click on Export. Export the c-net in GRML format. 4Once your file, say net.grml (the extension is important), is in GRML format, use the script grml2pep.py to convert the file into ll_net format. If you read § A.4.4, you will be unsurprised to know that the make machinery of the Cunf Toolset sources also knows about GRML files. You can, alternatively, type: $ make net.ll_net or even directly $ make net.unf.cuf

L I S T O F F I G U R E S

A Petri net modelling a mutual exclusion algorithm. Figure 2 Non-sequential semantics of the Petri net in Fig. 1. . Figure 3 The finite, complete unfolding prefix constructed by McMillan's algorithm for Fig. 1. . . . . . . . . . . . . Figure 4 A Petri net with exponentially large unfolding prefix. Figure 5 Three models of a system exhibiting concurrent read access, and their unfoldings. . . . . . . . . . . . . . . . Figure 6 Contextual nets where steps semantics disagree. . . . Figure 7 A c-net with four read arcs. . . . . . . . . . . . . . . . Figure 8 Illustrating causality, symmetric, and asymmetric conflict. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Figure 9 (a) A c-net; (b) its plain encoding N ′ ; (c) and its Place-Replication encoding N ′′ . . . . . . . . . . . . . . . . . . Figure 10 Two occurrence nets illustrating a circular asymmetric conflict of length 3 (a) and two (b). . . . . . . . . . Figure 11 Unfolding prefix of the c-net in Fig. 7; the labelling is given in parenthesis. . . . . . . . . . . . . . . . . . . . Figure 12 McMillan's algorithm fails in contextual nets. . . . . . Figure 13 (a) a c-net; (b) a prefix of its unfolding. Event e 2 has infinitely many histories. . . . . . . . . . . . . . . . . . Figure 14 A c-net (a) whose unfolding (b) is exponentially larger than the set of reachable markings. . . . . . . . . . . . Figure 15 Predecessors w.r.t. asymmetric conflict of an event e. Figure 16 The characterization in § 3.7 allows multiple constructions of the enriched event e, {e 1 , . . . , e n , e} . . . . . . Figure 17 Good examples for the eager (a) and the lazy (b) approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . Figure 18 Safe c-net and unfolding prefix. . . . . . . . . . . . . . Figure 19 Partial unfolding of Dekker's algorithm with asymmetric cycles. . . . . . . . . . . . . . . . . . . . . . . . . Figure 20 An occurrence net of size O (k) where |ր ր| = k 2 . . . . Figure 21 Stubborn events. . . . . . . . . . . . . . . . . . . . . . . Figure 22 Good (a) and bad (b) cases for the stubborn event optimization . . . . . . . . . . . . . . . . . . . . . . . . Figure 23 A Petri net with exponentially large unfolding prefix. Figure 24 Contextual Merged Processes are compact. . . . . . . Figure 25 (a) A net; (b) its unfolding; (c) its unravelling. . . . . Figure 26 The c-net 2-Gen. . . . . . . . . . . . . . . . . . . . . . . Figure 27 Illustrating the digraph ∆ Q . . . . . . . . . . . . . . . . Figure 28 Running example of Ch. 6 -the Petri net. . . . . . . Figure 29 Running example of Ch. 6 -the unfolding. . . . . . Figure 30 Unobservable events in verbose configurations. . . . Figure 31 Pairs of independent readers . . . . . . . . . . . . . . Figure 32 The net 2-Dijkstra. . . . . . . . . . . . . . . . . . . . . Figure 33 (

The unfolding of Fig. 34. . . . . . . . . . . . . . . . . . Figure 36 The unfolding of examples/dijkstra/dij02.ll_net. Figure 37 Example of the ll_net format with read arcs, and graphical representation of the encoded c-net. . . . . Figure 38 The . See text for interpretation. . Table 4 Growth of contextual, plain, and PR unfoldings and MPs for the collection of c-nets n-Gen. . . . . . . . . . Table 5 Reduction of the asymmetric-conflict relation. . . . . Table 6 Experimental results of Cunf. . . . . . . . . . . . . . . Table 7 Experimental results obtained with Cna. . . . . . . . Table 8 Comparing unfoldings, MPs, and CMPs. . . . . . . . Table 9 Unfolding and merging sizes of plain and PR encodings of n-Dijkstra. . . . . . . . . . . . . . . . . . . . .

1 .

 1 Lack of robust, high-quality tool support [HB96; ADKT11; Was12]. 2. Inherent complexity of the verification task hinders scalability to problems of industrial size [ADKT11]. 3. Lack of representative benchmarks to drive tool quality and allow realistic evaluation of the proposed methods [HB96; Par10]. 4. The growing gap between the concepts, needs, and views of research in formal methods and industrial practice [Gla96; Par10].

1 Figure 1 :

 11 Figure 1: A Petri net modelling a mutual exclusion algorithm.

1 Figure 2 :

 12 Figure 2: Non-sequential semantics of the Petri net in Fig. 1. In (a), (b), (c), and (d), four different processes are shown. (e) is a prefix of the infinite (thus the bottom dots) unfolding, all shown processes are embedded in it.

Figure 3 :

 3 Figure 3: The finite, complete unfolding prefix constructed by McMillan's algorithm for Fig. 1.

Figure 4 :

 4 Figure 4: A Petri net with exponentially large unfolding prefix.

Figure 5 :

 5 Figure 5: Three models (a), (b), and (c), of a system exhibiting concurrent read access, together with their respective unfoldings semantics (d), (e), and (f).

Figure 9 :

 9 Figure 9: (a) A c-net; (b) its plain encoding N ′ ; (c) and its Place-Replication encoding N ′′

Figure 10 :

 10 Figure 10: Two occurrence nets illustrating a circular asymmetric conflict of length 3 (a) and two (b).

  depth(C) := sup e∈C depth(e); and similarly for the depth of an occurrence net O: depth(O) := sup e∈E depth(e).

  [START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF] Let C be a configuration of U N and e ∈ C one of its events. We call the configuration C[[e]], defined as C[[e]] := {e ′ ∈ C : e ′ (ր C ) * e}, the history of e in C. Moreover, we denote by Hist(e) := {C[[e]] : C ∈ conf (U N ) ∧ e ∈ C} the set of histories of e.

Figure 13 :

 13 Figure 13: (a) a c-net; (b) a prefix of its unfolding. Event e 2 has infinitely many histories.

Figure 15 :

 15 Figure 15: Predecessors w.r.t. asymmetric conflict of an event e.

Figure 16 :

 16 Figure 16: The characterization in § 3.7 allows multiple constructions of the enriched event e, {e 1 , . . . , e n , e} .

  (a), condition c has a sequence of n readers and hence n reading or compound histories {e 1 , . . . , e i }, for i = 1, . . . , n and one empty generating history. For each history H of c ′ , eager simply combines H with the n + 1

Figure 17 :

 17 Figure 17: Good examples for the eager (a) and the lazy (b) approach.

Figure 19 :

 19 Figure 19: Partial unfolding of Dekker's algorithm with asymmetric cycles.

Figure 20 :

 20 Figure 20: An occurrence net of size O (k) where |ր ր| = k 2 .

Proposition 10 .

 10 If e is stubborn, then any deadlocked configuration C of P verifies that e ∈ C iff pred(e) ⊆ C. Proof. Notice that pred(e) ⊆ [e]. If e ∈ C, then obviously pred(e) ⊆ C. We prove the opposite direction by induction on the size of [e]. base. Let e be such that |[e]| = 1. Since C deadlocks, • e ∪ e ⊆ cut(C) holds. Some event in C has thus consumed some condition of • e ∪ e ⊆ m 0 , and it can only be e because it is stubborn. step. Let k ∈ N be k ≥ 2 and assume that the statement is true if |[e]| < k. Let now e be such that |[e]| = k. Again, since C deadlocks, • e ∪ e ⊆ cut(C) holds. Since no event different than e can consume • e ∪ e, either e ∈ C or there exist e ′ ∈ • ( • e ∪ e) such that e ′ / ∈ C. In the first case we are done. In the second we reach a contradiction, as we see now. First notice than e ′ has to be stubborn, since otherwise e ′ ∈ pred(e) and pred(e) ⊆ C, a contradiction. Because e ′ is stubborn and such that |[e ′ ]| < k (since e ′ < e) and pred(e ′ ) ⊆ pred(e) ⊆ C, the induction hypothesis applies, implying that e ′ ∈ C. But this is a contradiction. Corollary 2. φ dead P ≡ φ dead P ∧ e∈E s (e ↔ e ′ ∈pred(e) e ′ )

  For φ asym P , in a clause of the form e ∧ f → [[e < f]], both e and f are replaced

Figure 22 :

 22 Figure 22: Good (a) and bad (b) cases for the stubborn event optimization

  for b ∈ B and e ∈ E, by h(b) := h(b), od(b) h(e) := h(e), h( • e), h(e), h(e • ) . Then Q is defined by 1. B := h(B); 2. E := h(E); 3. G, D are such that for every e = t, X, Y, Z ∈ E we have • e := X e := Y e • := Z; 4. for all p ∈ P, m 0 ( p, 1 ) := 1 and m 0 ( p, d ) := 0 if d > 1. 5. h maps every node of Q to the first component of the tuple. The unravelling, denoted M N , is the contextual merged process of U N .

1 Figure 25 :

 125 Figure 25: (a) A net; (b) its unfolding; (c) its unravelling.

Figure 27 :

 27 Figure 27: (a) A CMP Q together with (b) its associated digraph ∆ Q .

Figure 28 :

 28 Figure 28: A safe Petri net with partial observation. The inscription of a transition indicates its name; the label next to it is either a Latin letter or empty (ε), in which case the transition is invisible. Transition t 4 is the invisible fault transition, which is called φ in the text and whose label is ε.

  obs(C) := compat(lpo(C)), i.e., the set of all (LPOs modelling) observations compatible to the LPO of C. Conversely, we say that C explains observation α if α ∈ obs(C), and define expl(α) := {C ∈ conf (U N ) : α ∈ obs(C)}. As a consequence of Lemma 12, for configurations C, C ′ , we have obs(C) = obs(C ′ ) iff lpo(C) is isomorphic to lpo(C ′ ). Definition 19. An observation pattern α weakly diagnoses φ iff for all C ∈ expl(α), C --⊲ E φ . (70) Since weak diagnosis is the only form of diagnosis we consider, we henceforth simply speak of diagnosis.

Prop. 14

 14 would still work if (73) is replaced by the more general condition |[e ′ ]| < |[e]|, but then (77) would become false.

Figure 30 :

 30 Figure 30: The lined area in (a) represents unobservable, ε-labelled, events of a verbose explanation. In (b), the lined area depicts D := [e] \ [e ′ ] in Def. 21, which does not consume any condition in B 1 .

  and either a) (e ′• ∪ e ′ ) ∩ • e = ∅, or b) e ′• ∩ e = ∅; 3. each node e, H is labelled by e.

Figure 31 :

 31 Figure 31: Pairs of independent readers

(

p 5 Figure 33 :

 533 Figure 33: (a) a c-net; (b) its encoding into a Petri net; (c) unfolding of (b)

Figure 34 :

 34 Figure 34: A variant of Dekker's mutual exclusion algorithm for two processes

Figure 35 :

 35 Figure 35: The unfolding of Fig. 34.

a. 4 . 5

 45 Finding More Examples More examples are distributed in the examples/ folder in the bundle of § A.3.1 or the (generated) dist/examples/ folder in the source code:

Figure 36 :

 36 Figure 36: The unfolding of examples/dijkstra/dij02.ll_net.

  -d, -deadlock Optional. Default: no. Tell whether or not a deadlocked marking is reachable. At least one of -d or -c must be given. -c place [place ...], -cover place [place ...] Optional. Default: no. Tell whether or not the list of PLACEs are coverable. You may consider quoting place names if they contain spaces. At least one of -d or -c must be given. -r reduc [reduc ...], -reduce reduc [reduc ...] The default is: 4-tree bin. Use REDUCtions of the propositional formula generated by the tool that improve running time of the SAT solver. The following options are available:

Figure 37 :

 37 Figure 37: Example of the ll_net format with read arcs, and graphical representation of the encoded c-net.

Figure 38 :Figure 39 :

 3839 Figure 38: The Coloane graphical editor can export c-nets for the Cunf Toolset.

  Figure1A Petri net modelling a mutual exclusion algorithm. Figure2Non-sequential semantics of the Petri net in Fig.1. . Figure3The finite, complete unfolding prefix constructed by McMillan's algorithm for Fig.1. . . . . . . . . . . . . Figure4A Petri net with exponentially large unfolding prefix. Figure5Three models of a system exhibiting concurrent read access, and their unfoldings. . . . . . . . . . . . . . . . Figure6Contextual nets where steps semantics disagree. . . . Figure7A c-net with four read arcs. . . . . . . . . . . . . . . . Figure8Illustrating causality, symmetric, and asymmetric conflict. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Figure9(a) A c-net; (b) its plain encoding N ′ ; (c) and its Place-Replication encoding N ′′ . . . . . . . . . . . . . . . . . . Figure10Two occurrence nets illustrating a circular asymmetric conflict of length 3 (a) and two (b). . . . . . . . . . Figure11Unfolding prefix of the c-net in Fig.7; the labelling is given in parenthesis. . . . . . . . . . . . . . . . . . . . Figure12McMillan's algorithm fails in contextual nets. . . . . . Figure13(a) a c-net; (b) a prefix of its unfolding. Event e 2 has infinitely many histories. . . . . . . . . . . . . . . . . . Figure14A c-net (a) whose unfolding (b) is exponentially larger than the set of reachable markings. . . . . . . . . . . . Figure15Predecessors w.r.t. asymmetric conflict of an event e. Figure16The characterization in § 3.7 allows multiple constructions of the enriched event e, {e 1 , . . . , e n , e} . . . . . . Figure17Good examples for the eager (a) and the lazy (b) approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . Figure18Safe c-net and unfolding prefix. . . . . . . . . . . . . . Figure19Partial unfolding of Dekker's algorithm with asymmetric cycles. . . . . . . . . . . . . . . . . . . . . . . . . Figure20An occurrence net of size O (k) where |ր ր| = k 2 . . . . Figure21Stubborn events. . . . . . . . . . . . . . . . . . . . . . . Figure22Good (a) and bad (b) cases for the stubborn event optimization . . . . . . . . . . . . . . . . . . . . . . . . Figure23A Petri net with exponentially large unfolding prefix. Figure24Contextual Merged Processes are compact. . . . . . . Figure25(a) A net; (b) its unfolding; (c) its unravelling. . . . . Figure26The c-net 2-Gen. . . . . . . . . . . . . . . . . . . . . . . Figure27Illustrating the digraph ∆ Q . . . . . . . . . . . . . . . . Figure28Running example of Ch. 6 -the Petri net. . . . . . . Figure29Running example of Ch. 6 -the unfolding. . . . . . Figure30Unobservable events in verbose configurations. . . . Figure31Pairs of independent readers . . . . . . . . . . . . . . Figure32The net 2-Dijkstra. . . . . . . . . . . . . . . . . . . . . Figure33(a) a c-net; (b) its encoding into a Petri net; (c) unfolding of (b) . . . . . . . . . . . . . . . . . . . . . . . . . . Figure34A variant of Dekker's mutual exclusion algorithm for two processes . . . . . . . . . . . . . . . . . . . . . . .

  are embedded in this unfolding

	mutex			mutex idle 2			mutex
			idle 1		idle 1		idle 2
	idle 1	idle 2	start 1	start 2	start 1		start 2
		waiting 1				waiting 2
			enter 1	waiting 2	waiting 1	enter 2
			cs 1				cs 2
						mutex	exit 2
							idle 2
		mutex
	idle 1		idle 2				idle 2
	start 1		start 2				start 2
	waiting 1						waiting 2
	enter 1	waiting 2				enter 2
	cs 1						cs 2
	exit 1	mutex					exit 2
	idle 1						idle 2
	start 1	enter 2	ent. 1		start 2
	waiting 1	cs 2					waiting 2
				. . .	. . .	. . .	. . .

  Asynchronous digital circuits (ACs) are massively concurrent systems. Hazard checking in ACs[START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF][START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF] is another promising application. A network of asynchronous Boolean gates can be modelled by a c-net, where each gadget encoding a gate contains many read arcs. Hazards are unsafe behaviors of ACs, whose existence reduces to a coverability question on the c-net[START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF]. In our experiments, we observed that signal changes in the circuit could propagate in many different orders, which were distinguished by Petrinet unfoldings but not by c-net unfoldings, reducing the unfolding size.

• Asynchronous circuits. • Concurrent Boolean programs. Software verification often employs abstract representations of programs, such as Boolean programs [BR00]. A Boolean program is simply a program that only uses Boolean variables. A set of non-recursive Boolean programs communicating with shared memory can readily be encoded into a safe contextual net, where read arcs do reading or testing operations on variables. Any expression reading a global variable is a potential concurrent reading action. This application remains to be studied.

1 .

 1 We check that (17) to (19) hold on C 1 ∪ C 2 . Clearly it is causally closed, as both C 1 and C 2 are. C 1 ∪ C 2 satisfies (19) because for all e ∈ C 1 ∪ C 2 , all events e ′ ∈ C 1 ∪ C 2 such that e ′ ր e need to be such that e ′ < e. Indeed, e # e ′ or e ′ ∩ • e = ∅ cannot hold because they entail C 1 # C 2 . There exist e 1 ∈ C 1 and e 2 ∈ (C 2 ∪ C 3 ) \ C 1 satisfying e 2 ր e 1 .Then either C 1 # C 2 or C 1 # C 3 , a contradiction in any case. b) There exist e 1 ∈ C 2 ∪ C 3 and e 2 ∈ C 1 \ (C 2 ∪ C 3 ) satisfying e 2 ր e 1 . If C 1 # C 2 , then there is no configuration C such that C 1 ⊑ C and C 2 ⊑ C. So if one assumes that ¬C 3 # C 2 , then C 3 ∪ C 2 is a configuration. Then taking C := C 3 ∪ C 2 we have, using Rmk. 5 and transitivity of

	As a result, (19) holds just because it holds independently for C 1 and C 2 . Similarly, the existence of a cycle in ր C 1 ∪C 2 entails C 1 # C 2 , so (18) holds as well.
	2. We know that C 2 ∪ C 3 is a configuration. For a proof by contradiction, assume that C 1 # (C 2 ∪ C 3 ) holds. Two cases are possible:
	a) Analogous argument.
	3.

  1 )

				e 2 (t 2 )
		e 5 (w 1 )	e 6 (w 2 )	e 4 (s 2 )
	c 15 (p 1 )	c 8 (p 0 ) e 9 (s 1 ) c 11 (p 2 )		c 10 (q 0 ) e 10 (t 2 ) c 12 (q 1 )
		c 13 (p 0 ) e 11 (w 1 )	e 12 (w 2 )
				e 13 (s 2 )
				c 14 (q 2 )

  There exist e ∈ C 2 and e ′ ∈ C 1 \ C 2 satisfying e ′ ր e. Analogous argument.

	5 (2). If we take in (25) A =
	{e}, B = C, we derive that ¬C[[e]] # C. This, together with Rmk. 5 (2)
	imply that C[[e]] ⊑ (C ∪ C[[e]]).
	2. Again, this follows after (25), taking A = {e} and B = {e ′ }. 3. Let H := C[[e]] and H ′ := C[[e ′ ]]. If e ր * C e ′ , then e ∈ H ′ . (24) is a consequence of (22) and the fact that H = H ′ [[e]], which in turn holds because for any e ′′ ∈ C, e ′′ ր * C e iff e ′′ ր * H ′ e, which can be easily shown by induction.
	4. Let C 1 := ê∈A C[[ ê]] and C 2 := ê∈B C[[ ê]]. By contradiction, assume that C 1 # C 2 . Then by Rmk. 5 (3) we have two cases:
	a) There exist e ∈ C 1 and e ′ ∈ C 2 \ C 1 such that e ′ ր e. As e ∈ C 1 , there is some ê ∈ A such that e ր * C ê; but then e ′ ր * C ê, which implies that e ′ ∈ C 1 holds. This is a contradiction. b)

  be a chain of immediate causality in H, where n ≥ | reach(N)|. Consider the sequence m 0 , mark(H[[e 1 ]]), . . . , mark(H[[e n

Table 1

 1 lists all enriched events associated to the events of the prefix in Fig.12 (b), and specifies whether they are feasible or cutoffs w.r.t. ≺ 1 . } feasible, non-cutoff {e 1 , e 2 } unfeasible {e 1 , e 3 , e 2 } unfeasible

	Event	Histories	Enriched event is	Corresponding
	e 1 e 3 e 4	{e 1 } {e 1 , e 3 } {e 1 , e 3 , e 4 }	feasible, cutoff unfeasible unfeasible	m0
	e 2	{e 2

Table

  we have e ր e ′ . Moreover, e ′ ∈ H 2 ⊆ H, where the configuration H is a history of e, therefore by definition e ′ ր

* H e. Then H contains an asymmetric conflict cycle, a contradiction. • Property (35). Recall that any e ′ ∈ H satisfies e ′ ր * H e. So either e ′ = e or there exists e ′′ ∈ H such that e ′ ր * H e ′′ and e ′′ ր e.

  1. The first four properties, (30) to (33) are immediate from the definition of X ′ p , X c . Property (34) follows from pairwise concurrency in X p , X c , Lemma 2 and Rmk. 7. As for (35), we need to show that every event e ′ ∈ H is included in one of the elements of X ′ p ∪ X c . For e ′ = e, this is immediate. Otherwise there exists a chain e ′ ր H . . . ր H e ′′ ր H e such that e ′′ ∈ • ( • e) ∪ • e ∪ • (e). The definition of X ′ p and X c implies that their union contains at least one tuple c, H[[e ′′ ]] , where e ′ ∈ H[[e ′′ ]].

  r holds as well. Since ¬(H # H ′ ), there exists a configuration C such that H ⊑ C and H ′ ⊑ C. 1. Clearly, c ′ / ∈ • e is implied by c ′ ∈ cut(H ∪ H ′ ). 2. Let e ′′ be an event in • e ∩ H ′ . Then e ′′ ր e. Since ¬(H # H ′ ), and due to Rmk. 5, e ′′ cannot be in H ′ \ H, so e ′′ ∈ H. 3. Let ρ := c, H ∈ X p ∪ X c be an arbitrary EC used to construct e, H . Then H ⊑ H ⊑ C, therefore ¬( H # H ′ ). Moreover c ′ ∈ cut( H ∪ H ′ ), as otherwise there would exist e ∈ H that consumes c ′ , which would contradict c ′ ∈ cut(H ∪ H ′ ). It remains to show that c ∈ cut( H ∪ H ′ ). Let e ′ be the single event such that H ′ ∈ Hist(e ′ ). For a proof by contradiction, assume that there is e ′′ ∈ H ′ such that c ∈ • e ′′ . We will show in the sequel that e / ∈ H ′ . This implies that e = e ′ , and also that either (5) or (6) holds between e and e ′′ , so necessarily e ր e ′′ , with e ∈ H \ H ′ and e ′′ ∈ H ′ . In turn, by Rmk. 5, this means that H # H ′ , a contradic- tion. So we want to show that e / ∈ H ′ . We proceed by contradiction. Assume that e ∈ H ′ . Then either H ′ [[e]] = H or not. If H ′ [[e]] = H, then by (22) H ⊑ H ′ . But then because e ′ , H ′ ∈ E and using (28), this means that e, H ∈ E , a contradiction to the fact that e, H is a PE of

  There is e 1 ∈ H ′ and e 2 ∈ H 1 \ H ′ verifying e 2 ր e 1 . As e 2 ∈ H \ H ′ , we have H # H ′ , a contradiction to ρ ρ ′ . 2. There is e 1 ∈ H 1 and e 2 ∈ H ′ \ H 1 verifying e 2 ր e 1 . As H 1 ⊆ H, we have e 1 ∈ H. Regarding e 2 , we have two cases: either e 2 / ∈ H or e 2 ∈ H. Assuming the former immediately leads us to the contradiction H

1 .

 1 There exist e 1 ∈ H and e 2 ∈ H ′ \ H verifying e 2 ր e 1 . Then either e 1 ∈ H 1 , and H 1 # H ′ holds, or e 1 ∈ H 2 and H 2 # H ′ holds. In any case we reach a contradiction to our hypothesis. 2. There exist e 1 ∈ H ′ and e 2 ∈ H \ H ′ verifying e 2 ր e 1 . Same argument as before, regarding e 2 instead of e 1 . 3. There exists e ∈ H such that c ′ ∈ • e. Either e ∈ H 1 and ¬(ρ 1 ρ ′ ) or e ∈ H 2 and ¬(ρ 2 ρ ′

  ′′ . Moreover, it is easy to see that ρ ′′ ↑ ∈ X ′ p and thus the subsumption closure property (46) of X ′ p , X ′ c leads us to conclude that ρ ′′ ∈ X ′ p . To conclude, observe that H ′ [[ e]] ⊑ H ′ ⊑ H and H ⊑ H, and thus by Lemma 5, H ′ [[ e]] = H, since they are both histories of event e. Therefore ρ

contains e, i.e., e ∈ H ′ . Of course, c and c ′ do not need to be the same condition. Now, clearly c ∈ cut( H ′ ), as otherwise H ′ would consume c ∈ • e. Therefore, ρ ′ subsumes the reading EC of c with the history of e in H ′ . That is, ρ ′ ∝ c, H ′ [[ e]] =: ρ

  and e 1 ∈ c, then ρ 2 ∈ X p . But ρ 2 / / ρ 3 would be violated. So let c ∈ e ∪ • e. If e 1 ∈ • c, then H 2 would not be a history of c. The final possibility is that e 1 ր + e ′ for some e ′ ∈ • c ∪ c) and e ′ ∈ H 2 . But then H 2 # H 3 .

  He showed that for a bounded net N, one can use a finite unfolding prefix P to check certain properties of N such as reachability of markings or deadlock-freeness. The publication of his work [McM93b] triggered a large body of research on unfoldings, in particular on their use for verification [McM95a; MR97; Hel99c; KK00; EH01; ES01]. Recall that given a finite complete prefix P of a bounded net N, deciding deadlock-freeness, reachability, or coverability on N is NP-complete, see [McM93b]. Consequently, previous works on deadlock-checking of ordinary nets have proposed reductions to different NP-complete problems: McMillan [McM93b; McM95b] employed a branch-and-bound method, Heljanko [Hel99d; Hel99c] a stable-models encoding, and Melzer and Römer [MR97] used mixed integer linear programming, later improved by Khomenko and Koutny [KK00; KK07]. The technique used by Esparza and Schröter

Table 3 :

 3 Size of φ dead

		P	and φ cov,M P	. See text for interpretation.
	while omitting φ P asym	from φ dead P	or φ cov,M P

  will collapse back to the original net after the fusion. It turns out that

	contextual merged processes
	q 1 t 1	. . .	t n q n	q 1 t 1	p 1	. . .	p n	t n q n
	p 1	p n			p 1		p n
	(a)	t		(b)
					t t	t t
		. . .

Figure 23: A Petri net with exponentially large unfolding prefix.

Table 4 :

 4 Growth of contextual, plain, and PR unfoldings and MPs for the collection of c-nets n-Gen.

	Merged Processes		Unfoldings
	Ctx	Plain	PR	Ctx	Plain	PR

1 .

 1 Size strategy. The order ≺ M , defined in (26), was introduced by McMil- lan[START_REF] Kenneth | Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits[END_REF]. Cunf stores the size of every history in the history graph H E , so the implementation of this strategy is obvious. 2. Parikh strategy. [EH08, p. 64] Cunf first compares the sizes of both histories, declaring them sorted if they are different. If not, it compares lexicographically the Parikh vectors [EH08] of both configurations. Such vector have also been computed and stored on each history, so at this point Cunf only needs to perform the lexicographic comparison. Recall that this strategy is adequate but not total. 3. ERV strategy. [ERV02] This strategy is the order < F defined in [ERV02] which, as explained in Ch. 3, it is adequate and total for contextual unfoldings. It first compares the configurations with the Parikh strategy. If this suffices to sort them, < F returns the result. If not, Cunf computes and compares the Foata normal forms [ERV02] of both configurations. Unlike the size or Parikh vectors of histories, Foata normal forms are computed every time they are needed. Code profiling over

Table 5 :

 5 Reduction of the asymmetric-conflict relation. -nets unfoldings with at least one cycle in R. More precisely, we show the size of the largest SCC, in most examples there is in fact only one non-trivial SCC.

		Before		After		Ratio after/before
	Net	Nodes Edges Nodes Edges Nodes	Edges
	bds_1.sync	192	271	27	52	0.14	0.19
	bds_1.fsa	66	89	9	16	0.14	0.18
	byzagr4_1b	3197 64501	2348 61088	0.73	0.95
	dme7	2541 9856	1571 8557	0.62	0.87
	dme8	3648 15232	2179 13314	0.60	0.87
	dme9	5031 22572	2936 19908	0.58	0.88
	dme10	6720 32320	3836 28726	0.57	0.89
	dme11	8745 44968	4918 40301	0.56	0.90
	key_3.sync	3	3	2	2	0.67	0.67
	q_1.sync	189 4095	126 4032	0.67	0.98
	rw_12.sync	3	3	2	2	0.67	0.67
	rw_2w1r	1766 8877	915 7447	0.52	0.84
	tion for six c

  1-safe nets that have previously served as benchmarks in the literature on Petri net unfoldings, e.g. [McM93b; MR97; Hel99c; Kho03; Sch06]. Most of the examples were originally collected by J. C. Corbett [Cor96], but the set also includes nets contributed by K. McMillan [McM93b; McM95b], S. Melzer and S. Römer [MR97], S. Merkel [Mer97], and M. Heiner, P. Deussen, K. Schmidt, C. Schröter (see

Table 6 :

 6 Experimental results. Data for the eager approach are absolute numbers, whereas for lazy, place-replication, and plain unfolding the ratio w.r.t. eager is given; see the text for more information.

	mmgt_4.fsa	key_4	furnace_4	ftp_1.sync	elevator_4	dpd_7.sync	byzagr4_1b	bds_1.sync	Name	Benchmark
	46.9k 92.1k	16% 1.7 4.8k 7.9k	68% 1.6 94.4k 147.4k	26% 1.9 50.9k 96.6k	44% 1.7 16.9k 28.6k	25% 2.1 10.4k 21.4k	4% 2.9 8.0k 17.6k	40% 1.5 1.8k 2.8k	|E| |B| |E cut | | • e|	Contextual unfolding
		23.3k 1.58 110 711 0.4	0 19.04 266 0.7 0.9	0 24.81 296 0.6 1.0	0 1.24 71 1.1 0.9	0 0.98 59 1.2 1.0	72 2.60 163 1.4 1.0	0 0.11 17 1.5 0.9	comp. t E m E t L m L	Eager Lazy
		4.6 5.5 19% 13.4 6.4 0.7	1.1 1.9 70% 1.8 1.7 2.1	1.0 1.6 26% 1.6 2.5 6.3	1.0 13.7 44% 22.4 358 66.3	1.0 1.4 25% 1.4 1.2 1.4	1.0 1.4 4% 1.9 3.4 1.5	2.3 4.8 40% 2.3 2.1 1.9	|E| |B| |E cut | | • e| t R m R	PR unfolding
		14.6 17.7 46% 0.8 1.1	1.2 1.8 69% 0.9 1.4	1.8 2.8 37% 2.0 1.9	1.0 1.7 44% 1.8 1.1	1.0 1.4 25% 1.0 1.2	1.8 2.4 5% 1.4 1.5	7.0 13.5 67% 4.2 2.5	|E| |B| |E cut | t P m P	Plain unfolding

  in[START_REF] Khomenko | Verification of bounded Petri nets using integer programming[END_REF]. According to the author, V. Khomenko. All experiments have been performed using Cunf and Cna v.1.4, Mole v.1.0.6, both compiled with gcc 4.4.5, version 301 of Clp, and Minisat v.2.2.0. Our machine has twelve 64bit Intel Xeon CPUs, running at 2.67GHz, 50GB RAM and executes Linux 2.6.32-5. The running times of Mole and Cunf are comparable on Petri nets, but Mole produces prefixes in a format suitable for Clp.

Table 7 :

 7 Comparison of deadlock-checking methods; the Res(ult) is L(ive) or D(ead) except for the acyclicity constraint, which is of size O (n log n). Optimized times for Cna should arguably be of fractions of a second.

	∑	q_1.sync	mmgt_4.fsa	key_4	elevator_4	rw_2w1r	rw_1w3r	rw_12.sync	furnace_4	ftp_1.sync	dpd_7.sync	dme11	byzagr4_1b	bds_1.sync	Name		Benchmark
		D	D	D	D	L	L	L	L	L	L	L	L	L	Result
	106.52 4.25 2.05	1.76 10716 30087 <0.01 0.02	1.16 46902 92940 0.02 0.04	1.68 69600 139206 0.07 0.08	2.58 16856 47743 0.24 0.03	0.22 9363 18575 0.04 0.34	0.30 15432 28207 0.11 0.22	3.95 98361 295152 0.08 0.02	37.44 114477 264823 1.29 0.19	45.37 91730 275099 1.13 0.38	1.21 10354 29939 0.10 0.18	6.56 9185 31186 0.60 0.28	3.71 14724 42276 0.53 0.26	0.58 12900 37306 0.04 0.01	Time |E| |B| Time Time	Mole Clp SAT	Petri net unfoldings
	72.23 1.75	1.54 10716 20567 0.01	1.17 46902 92076 0.05	2.07 4754 7862 <0.01	1.51 16856 28593 0.06	0.32 9363 15304 0.58	0.36 14521 24174 0.40	3.96 98361 196796 0.02	19.11 94413 147438 0.12	26.85 50928 96617 0.05	1.09 10354 21359 0.02	10.86 9185 16710 0.25	3.25 8044 17603 0.19	0.14 1830 2771 <0.01	Time |E| |B| Time	Cunf SAT	C-net unfoldings

Table 8 :

 8 Comparing unfoldings, MPs, and CMPs.

	Gains	a/d b/d a/c	21.73 5.73 19.12	3.22 1.64 2.23	46.11 25.57 44.78	2.65 1.23 2.04	85.74 82.51 81.61	2.88 1.59 2.20	2.04 1.66 1.62	1.31 1.31 1.26	3.53 3.53 3.38	6.64 6.64 6.36	10.64 10.64 10.19	15.53 15.53 14.87	1.85 1.85 1.85	3.53 3.53 3.53	6.48 6.48 6.48	11.38 11.38 11.38	2.27 2.18 2.21	3.66 3.45 3.47	6.09 5.66 5.95	3.92 1.82 1.57	19.93 4.33 4.83	113.82 12.54 21.63	1.00 1.00 1.00	1.61 1.61 1.61	4.01 4.01 4.01	11.68 11.68 11.68	1.45 1.45 1.45	3.39 3.36 3.37	9.54 9.17 9.39	4.95 4.95 4.90	2.44 1.89 2.20	1.99 1.61 1.85	1.75 1.47 1.66	1.61 1.38 1.54
		Ctx | B| | E| (d)	70 44	115 127	529 303	69 43	254 455	102 112	92 73	195 90	389 180	583 270	777 360	971 450	56 46	125 135	263 346	556 841	43 33	75 94	106 221	112 105	151 186	190 290	57 38	99 155	141 355	183 638	77 65	113 165	160 368	159 371	107 55	182 80	257 105	332 130
	Merged process	Plain | B| | E| (c) PR | B| | E|	1.11 1.14 1.36 1.07	1.33 1.44 3.83 1.31	1.23 1.03 1.85 1.22	1.13 1.30 1.22 1.19	1.02 1.05 1.19 1.00	1.32 1.31 3.25 1.27	1.12 1.26 1.23 1.27	1.55 1.04 1.55 1.04	1.56 1.04 1.56 1.04	1.56 1.04 1.56 1.04	1.56 1.04 1.56 1.04	1.56 1.04 1.56 1.04	1.02 1.00 1.38 1.00	1.01 1.00 2.02 1.00	1.00 1.00 2.90 1.00	1.00 1.00 3.98 1.00	1.09 1.03 1.23 1.00	1.07 1.05 1.19 1.02	1.07 1.02 1.17 1.01	1.22 2.50 1.59 1.17	1.21 4.13 1.64 2.34	1.21 5.26 1.67 9.92	1.00 1.00 1.00 1.00	1.00 1.00 1.00 1.00	1.00 1.00 1.00 1.00	1.00 1.00 1.00 1.00	1.26 1.00 2.03 1.00	1.26 1.01 1.45 1.00	1.24 1.02 1.93 1.00	1.35 1.01 4.76 0.99	1.06 1.11 1.10 1.11	1.03 1.08 1.06 1.08	1.02 1.06 1.04 1.06	1.02 1.05 1.03 1.05
		Ctx |B| |E| (b)	424 252	286 208	17019 7748	99 53	73516 37540	247 178	187 121	293 118	1337 636	3517 1794	7217 3832	12821 6990	152 85	858 477	4050 2241	17360 9567	130 72	582 324	2265 1250	302 191	1276 806	5806 3637	79 38	502 250	2849 1424	14900 7450	142 94	845 554	5100 3376	2836 1838	188 104	263 129	338 154	413 179
		PR |B| |E|	2.60 2.14	7.00 1.70	1.41 1.00	2.22 2.04	1.02 1.00	5.42 1.62	1.51 1.23	1.61 1.00	1.73 1.00	1.79 1.00	1.83 1.00	1.86 1.00	1.34 1.00	1.85 1.00	2.66 1.00	4.08 1.00	1.18 1.00	1.14 1.00	1.12 1.00	1.72 1.27	2.81 2.19	5.56 4.43	1.00 1.00	1.00 1.00	1.00 1.00	1.00 1.00	1.78 1.00	1.30 1.00	1.60 1.00	3.36 1.00	1.35 1.29	1.25 1.23	1.19 1.19	1.16 1.17
	Unfolding	Plain |B| |E| (a)	4.50 3.79	2.84 1.97	2.38 1.80	2.19 2.15	1.06 1.04	2.62 1.81	1.41 1.23	1.61 1.00	1.73 1.00	1.79 1.00	1.83 1.00	1.86 1.00	1.02 1.00	1.03 1.00	1.03 1.00	1.04 1.00	1.12 1.04	1.14 1.06	1.14 1.08	2.74 2.16	5.81 4.60	11.37 9.08	1.00 1.00	1.00 1.00	1.00 1.00	1.00 1.00	1.23 1.00	1.19 1.01	1.19 1.04	1.21 1.00	1.32 1.29	1.23 1.23	1.18 1.19	1.15 1.17
	Benchmark	Name Net Stats. |P| |T| |C| Repl.	Bds 53 59 24 15 Brujin 86 165 158 142 Byz 504 409 376 284 Eisenbahn 44 44 6 3 Ftp 176 529 39 33 Knuth 78 137 114 98 Mutual 49 41 12 4	Dme(2) 135 98 132 0 Dme(4) 269 196 264 0 Dme(6) 403 294 396 0 Dme(8) 537 392 528 0 Dme(10) 671 490 660 0	Elev(1) 63 99 18 11 Elev(2) 146 299 59 47 Elev(3) 327 783 160 141 Elev(4) 736 1939 405 375	Furn(1) 27 37 9 5 Furn(2) 40 65 11 6 Furn(3) 53 99 13 7	Key(2) 94 92 32 31 Key(3) 129 133 48 47 Key(4) 164 174 64 63	Mmgt(1) 50 58 1 0 Mmgt(2) 86 114 2 0 Mmgt(3) 122 172 3 0 Mmgt(4) 158 232 4 0	RW(1,1) 84 208 123 75 RW(2,1) 72 88 27 16 RW(3,1) 106 270 129 81 RW(1,2) 209 1482 1132 717	Sentest(25) 104 55 8 Sentest(50) 179 80 8 Sentest(75) 254 105 8 Sentest(100) 329 130 8 5 5 5 5

Table 9 :

 9 Unfolding and MP sizes of n-Dijkstra, its plain, and PR encodings. Last row obtained through regression analysis, see the text.

	Net		Merged Processes	Unfoldings
	n	|T|	Ctx	Plain	PR	Ctx	Plain	PR
	2	18	31	42	40	35	54	54
	3	36	64	113	121	131	371	364
	4	60	105	220	278	406	2080	1998
	5	90	155	375	582	1139	10463	9822
	6	126	214	589	1198	3000	49331	44993

  c)

	p 1	p 2	p 3	p 1	p 2	p 3	p 1	p 2	p 3
		t 1			t 1				t 1
	t 2	p 4 t 4	t 3 p 6	t 2 p 5	p 4 t 4	t 3 p 6	p 5 t 2	p 4 p 4 p 4	p 6 t 3
		p 7			p 7	p 5 t 2	p 4			p 4	p 6 t 3
							t 4	t 4	t 4	t 4	t 4
	(a)			(b)			p 7	p 7	p 7	p 7	p 7

  make dist $ make dist/examples/dijkstra/dij03.unf.cuf UNF dist/examples/dijkstra/dij03.Of course, more complex transformations can be achieved. For instance, we could generate a PDF depicting the unfolding of a c-net without explicitly generating the cuf file: saiph:cunf$ make dist/examples/dijkstra/dij02.unf.pdf UNF dist/examples/dijkstra/dij02.ll_net time 0.001 mem 0 [...] C2P dist/examples/dijkstra/dij02.unf.cuf P2D dist/examples/dijkstra/dij02.unf.ll_net DOT dist/examples/dijkstra/dij02.unf.dot rm dist/examples/dijkstra/dij02.unf.ll_net dist/examples/dijkstra/dij02.unf.dot dist/examples/dijkstra/dij02.unf.cuf

		ll_net
	time	0.013
	mem	2
	[...]

Table 1

 1 Coloane graphical editor can export c-nets for the Cunf Toolset. . . . . . . . . . . . . . . . . . . . . . Figure 39 A c-net programmatically produced with the ptnet Python module. . . . . . . . . . . . . . . . . . . . . . . Enriched events of Fig. 12. . . . . . . . . . . . . . . . . Table 2 Some enriched events from Fig. 13. . . . . . . . . . . .

	L I S T O F TA B L E S
	Table 3	Size of φ dead P	and φ cov,M P

That is, one for which the reachability graph is finite.

As it can always be ensured, introducing a new safe initial marking from which a set of transitions produce the unsafe previous initial marking.

See def.

in[START_REF] Baldan | McMillan's complete prefix for contextual nets[END_REF], def. 5.24 in[START_REF] Baldan | Contextual Petri nets, asymmetric event structures, and processes[END_REF], and def. 3.1 in[START_REF] Winkowski | Reachability in Contextual Nets[END_REF]. In contrast, acyclicity of < in[START_REF] Vogler | Unfolding and Finite Prefix for Nets with Read Arcs[END_REF] is also derived from the definition of ONs. However, their definition of asymmetric conflict is slightly different from ours, and we prefer to have a new proof.

2.4 unfoldings

The problem is also stated assuming that the automaton has a set of faults, and the goal is to see if any explanation at least contains one, but this does not alter the problem much.

More precisely, there is a 1-safe net whose unfolding contains a configuration that has two events, e and e ′ , such that mark([e ′ ]) = mark([e]) but ¬(e ′ < e).

We conjecture that peelmax(C) is a singleton, but do not rely on it in the sequel.

Punf can actually also use the backwards exploration algorithm explained in § 3.5.

Experiments performed using Cunf v.1.4, compiled with gcc 4.4.5. Our machine has twelve 64bit Intel Xeon CPUs, running at 2.67GHz, 50GB RAM and executes Linux 2.6.32-5.

Actually, the CPU time, as reported by the Unix time command.

Another interesting point here concerns the theoretical compexity of computing possible extensions. Deciding whether a given contextual prefix P can be extended with an occurrence of transition t is NP-complete. The algorithm employed in Cunf, see § 7.1.2, is exponential in | • t ∪ t| and polynomial in |P |. Thus larger presets should be accompained by exponentially slower PE computations. However, we did not observe this theoretical explosion, and so, we conclude that it must have remained small in comparison to the overhead of computing a larger concurrency relation.

All the benchmarks and tools referenced in this section are publicly available from http://www.lsv.ens-cachan.fr/~rodriguez/experiments/pn2013/.

Together with the implementation of[START_REF] Heljanko | Minimizing Finite Complete Prefixes[END_REF], which works after unfolding.

More precisely, ∑ p∈P,|p|>1 (|p| -1).

Though the PR MP of RW(1,2) has four mp-events fewer, it has many more mp-conditions.

That is, only finitely many transitions are enabled at any reachable marking.

The careful reader may notice that there are more events in Fig.33 (c) than reachable markings in Fig.33 (b). This is a matter of presentation. (c) is actually the full unfolding[BBC+12] of (b), while the term unfolding in this document refers to the finite marking-complete unfolding prefix that one can build using a total adequate order[BBC+12]. In other words, (c) contains some cut-off events (actually only 1) that, when removed, would yield a marking-complete prefix not larger than the state-space of (b).

In particular, the Minisat tool has to be somewhere where the system(3) C-library function will find it.

To discover the actual search path that Python is using run the command: echo 'import sys; print sys.path' | python.

The dialog could incorrectly display GML, instead of GRML.

AMO Constraint

We briefly discuss the At-Most-One (AMO) constraint, used in φ sym P , in Ch. 4 but also in γ asym Q , in Ch. 5. The constraint AMO(x 1 , . . . , x n ) can be trivially implemented by 1≤i<j≤n (¬x i ∨ ¬x j ).

However, this pairwise encoding is quadratic, and the SAT performance suffered for examples with large conflict sets when this was used.

A survey of better encodings can be found in [START_REF] Chen | A new SAT encoding of the at-most-one constraint[END_REF]. Cna employs a k-tree encoding, that introduces O (n) additional variables and adds O (n) clauses. The k-tree encoding on variables x 1 , . . . , x n is an AMO constraint denoted by T k y (x 1 , . . . , x n ) that we specify here for k = 2:

Here, y, y Constraining the k new variables y i can be done by means of the pairwise encoding or by a new k ′ -tree encoding (with k ′ < k). For k = 2, this encoding can be optimized to yield 3n -5 clauses and n -1 new variables.

The base case, when n = 1, produces one clause with two literals; the inductive case produces three with two literals each. Because the encoding produces O (n) clauses, with two literals each, the number of literals generated by the encoding is also O (n).

We observed an overall improvement when replacing the pairwise with the k-tree encoding. The accumulated SAT solving time on our benchmarks under values of k = 2, . . . , 8 was minimal for k = 4. Experiments over c-nets on the encoding suggested k = 4 as a good candidate, as well. We therefore used 4-tree encodings in φ sym P for the following experiments.

Acyclicity Checking

Section 4.4 explained that φ asym P encodes cycle-freeness of configuration C w.r.t. the relation R = < i ∪ ր ր. We investigated three encodings suggested in [START_REF] Codish | A declarative encoding of telecommunications feature subscription in SAT[END_REF]: transitive closure, unary ranks, and binary ranks. The latter clearly outperformed the others. In the binary rank encoding, every event is associated with a rank, i.e., an integer up to some bound r, that is represented by ⌈log 2 r⌉ Boolean variables. A number of constraints ensure that the rank of event e is less than the rank of event f if (e, f ) ∈ R. If n is the number of events in P, the resulting SAT encoding is of size O (n log n) if ranks are encoded in binary.

Moreover, § 4.4 proposed a method to reduce the size of R. Table 5 shows the size of the direct asymmetric conflict relation before and after this reduc- both plain and PR MPs. Interestingly, in this case the PR MP is significantly larger than even the plain MP, which seems to be due to place replication making the subsequent merging much less efficient. As CMPs do not suffer from this problem, they come as a clear winner in such cases.

a case study: dijkstra's mutual exclusion algorithm

In this section we analyze the performance of merged processes and unfoldings of contextual nets on a well-known concurrent algorithm for mutual exclusion due to Dijkstra [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF]. We start with a condensed technical explanation of the algorithm, see [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF] for more details. We encoded Dijkstra's algorithm into a c-net as follows. We denote by n-Dijkstra the c-net that encodes Dijkstra's algorithm running on n processes. The entries of arrays b, c are represented by two places, e.g., b i =t and b i = f . Variable k is encoded by n places of the form k=0, k=1, . . . , k=n-1. Places l 0,i , . . . , l 6,i encode the instruction pointer of thread i. Figure 32 shows the fragment of 2-Dijkstra that encodes thread 0. Roughly, each transition represent one instruction of the original algorithm [START_REF] Dijkstra | Solution of a problem in concurrent programming control[END_REF], updating the instruction pointer and the variables affected by the instruction. Transitions encoding conditional instructions, like k = 0?, or ∀j = 0, c j = t? employ read arcs to the places coding the variables involved in the predicate.

MPs of n-Dijkstra, and in particular CMPs, exhibit a very good growth with respect to n. Table 9 shows the figures, obtained under the same setting as in § 7.6. While all unfoldings are exponential in n and |T|, all the MPs are of polynomial size. The sizes of the plain and PR unfoldings seem to increase by a factor of 5 for each process added. The contextual unfolding reduces this factor down to 3. The plain and PR MPs seems to fit a polynomial curve of degree close to 3. The CMP seems to grow linearly with n 2 , i.e. linear with |T|, the number of transitions in the net. As it was the case

This is both a user guide and a tutorial of the Cunf Toolset. The Cunf Toolset is a toolset for carrying out unfolding-based verification of Petri nets extended with read arcs, also called contextual nets (c-nets). Unfoldings fully represent the state-space (reachable markings) of a c-net by a partial order rather than by a set of interleavings; they are often exponentially smaller than the reachablity graph, and never larger than it. Additionally, c-net unfoldings can be exponentially more compact than those of corresponding Petri nets. The toolset specifically contains one unfolding-construction tool and one reachablity and deadlock-checking tool.

a.1 introduction

The Cunf Toolset is a set of programs for carrying out unfolding-based verification of Petri nets extended with read arcs, a.k.a. contextual nets, or c-nets. The package specifically contains the following tools:

1. Cunf: constructs the unfolding of a c-net; 2. Cna: performs reachability and deadlock analysis using unfoldings constructed by Cunf. 3. Scripts such as pep2dot or grml2pep to do format conversion between various Petri net formats, unfolding formats, etc.

Petri nets are a modelling language for concurrent systems. The reader unfamiliar to the topic could perhaps start with [START_REF] Wikipedia | Petri net -Wikipedia, The Free Encyclopedia[END_REF] or [START_REF] Murata | Petri nets: Properties, analysis and applications[END_REF].

Contextual nets are Petri nets where, in addition to the ordinary arrows between places and transitions, one may find read arcs. These allow transitions to verify that tokens exist in a place before firing, but don't consume them when firing. Transitions can then be thought of reading a context required to fire, hence the name. See Section 2 of [BBC+12] for a brief formalization and [START_REF] Montanari | Contextual nets[END_REF] for more details.

Observe that every Petri net is a contextual net (without read arcs). Also notice that for every c-net we obtain an equivalent Petri net after substituting read arcs for pairs of consume-produce loops. We call this Petri net the plain encoding of the c-net. An example of this encoding is shown in Fig. 33.

The unfolding of a c-net is another well-defined c-net of acyclic structure that fully represents the behavior (reachable markings) of the first, see Fig. 33 (c) for an example. A c-net unfolding is at most as big as the reachablity graph of the c-net. 1 Because unfoldings represent behavior by partial orders rathen than by interleavings, for highly concurrent c-nets, unfoldings are often much (exponentially) smaller, which makes for natural interest in them for the verification of concurrent systems.

C-net unfoldings bring additional advantages w.r.t. ordinary Petri net unfoldings. The unfolding of a c-net can be exponentially smaller than the