Automata for True Concurrency Properties

. We present an automata-theoretic framework for the model checking of true concurrency properties. These are speciﬁed in a ﬁx-point logic, corresponding to history-preserving bisimilarity, capable of describing events in computations and their dependencies. The models of the logic are event structures or any formalism which can be given a causal semantics, like Petri nets. Given a formula and an event structure satisfying suitable regularity conditions we show how to construct a parity tree automaton whose language is non-empty if and only if the event structure satisﬁes the formula. The automaton, due to the nature of event structure models, is usually inﬁnite. We discuss how it can be quotiented to an equivalent ﬁnite automaton, where emptiness can be checked eﬀectively. In order to show the applicability of the approach, we discuss how it instantiates to ﬁnite safe Petri nets. As a proof of concept we provide a model checking tool implementing the technique.


Introduction
Behavioural logics with the corresponding verification techniques are a cornerstone of automated verification. For concurrent and distributed systems, so called true concurrent models can be an appropriate choice, since they describe not only the possible steps in the evolution of the system but also their causal dependencies. A widely used foundational model in this class is given by Winskel's event structures [1]. They describe the behaviour of a system in terms of events in computations and two dependency relations: a partial order modelling causality and an additional relation modelling conflict. A survey on the use of such causal models can be found in [2]. Recently they have been used in the study of concurrency in weak memory models [3,4], for process mining and differencing [5], in the study of atomicity [6] and of information flow [7] properties.
Event-based logics have been recently introduced [20,21], capable of uniformly characterising the equivalences in the true concurrent spectrum. Their formulae include variables which are bound to events in computations and describe their dependencies. While the relation between operational models, behavioural equivalences and event-based true concurrent logics is well understood, the corresponding model checking problem has received limited attention.
We focus on the logic referred to as L hp in [20], corresponding to a classical equivalence in the spectrum, i.e., history preserving (hp-)bisimilarity [22][23][24].
Decidability of model checking is not obvious since event structure models are infinite even for finite state systems and the possibility of expressing properties that depends on the past often leads to undecidability [25]. In a recent paper [26] we proved the decidability of the problem for the alternation free fragment of the logic L hp over a class of event structures satisfying a suitable regularity condition [27] referred to as strong regularity. The proof relies on a tableaubased model checking procedure. Despite the infiniteness of the model, a suitable stop condition can be identified, ensuring that a successful finite tableau can be generated if and only if the formula is satisfied by the model.
Besides the limitation to the alternation free fragment of L hp , a shortcoming of the approach is that a direct implementation of the procedure can be extremely inefficient. Roughly speaking, the problem is that in the search of a successful tableau, branches which are, in some sense, equivalent are explored several times.
In this paper we devise an automata-theoretic technique, in the style of [28], for model checking L hp that works for the full logic, without constraints on the alternation depth. Besides providing an alternative approach for model-checking L hp , amenable of a more efficient implementation, this generalises the decidability result of [26] to the full logic L hp . Given a formula in L hp and a strongly regular event structure, the procedure generates a parity tree automaton. Satisfiability is reduced to emptiness in the sense that the event structure satisfies the formula if and only if the automaton accepts a non-empty language.
The result is not directly usable for practical purposes since the automaton is infinite for any non-trivial event structure. However an equivalence on states can be defined such that the quotiented automaton accepts the same language as the original one. Whenever such equivalence is of finite index the quotiented automaton is finite, so that satisfaction of the formula can be checked effectively on the quotient. We show that for all strongly regular event structures a canonical equivalence always exists that is of finite index.
The procedure is developed abstractly on event structures. A concrete algorithm on some formalism requires the effectiveness of the chosen equivalence on states. We develop a concrete instantiation of the algorithm on finite safe Petri nets. It is implemented in a tool, wishfully called True concurrency workbench (TCWB), written in Haskell. Roughly, the search of an accepting run in the automaton can be seen as an optimisation of the procedure for building a successful tableau in [26] where the graph structure underlying the automaton helps in the reuse of the information discovered. Some tests reveal that the TCWB is way more efficient than the direct implementation of the tableau-based procedure (which could not manage most of the examples in the TCWB repository).
The rest of the paper is structured as follows. In Sect. 2 we review event structures, strong regularity and the logic L hp of interest in the paper. In Sect. 3 we introduce (infinite state) parity tree automata and we show how the model checking problem for L hp on strongly regular pes can be reduced to the nonemptiness of the language of such automata. In Sect. 4 we discuss the instantiation of the approach to Petri nets. Finally, in Sect. 5 we discuss some related work and outline directions of future research. Due to space limitations, proofs are only sketched.

Event Structures and True Concurrent Logic
We introduce prime event structures [1] and the subclass of strongly regular event structures on which our model checking approach will be developed. Then we present the logic for true concurrency of interest in the paper.
In the following, we will assume that the components of a pes E are named as in the definition above, possibly with subscripts. The concept of concurrent computation for pess is captured by the notion of configuration.

Definition 2 (configuration).
A configuration of a pes E is a finite set of events C ⊆ E consistent (i.e., ¬(e#e ) for all e, e ∈ C) and causally closed (i.e., e ⊆ C for all e ∈ C). We denote by C(E) the set of configurations of E.
The evolution of a pes can be represented by a transition system over configurations, with the empty configuration as initial state.  Transitions are labelled by the executed event e. In addition, they report its label λ(e), a subset of causes X and a set of events Y ⊆ C concurrent with e. When X or Y are empty they are normally often, i.e., e.g., we write C

Definition 3 (transition system). Let E be a pes and let C ∈ C(E). Given
The pes modelling a non-trivial system is normally infinite. We will work on a subclass identified by finitarity requirements on the possible substructures.

Definition 4 (residual). Let E be a pes. For a configuration
The residual of E can be seen as a pes, endowed with the restriction of causality and conflict of E. Intuitively, it represents the pes that remains to be executed after the computation expressed by C. Given C ∈ C(E) and X ⊆ C, we denote by E[C] ∪ X the pes obtained from E[C] by adding the events in X with the causal dependencies they had in the original pes E.

Definition 5 (strong regularity).
A pes E is called strongly regular when it is bounded and for each k ∈ N the set {E[C] ∪ {e 1 , . . . , e k } | C ∈ C(E) ∧ e 1 , . . . , e k ∈ C} is finite up to isomorphism of pess.
Strong regularity [26] is obtained from the notion of regularity in [27], by replacing residuals with residuals extended with a bounded number of events from the past. Intuitively, this is important since we are interested in history dependent properties. We will later show in Sect. 4 that the pess associated with finite safe Petri nets, i.e., the regular trace pess [27], are strongly regular.
A simple pes is depicted in Fig. 1a. Graphically, curly lines represent immediate conflicts and the causal partial order proceeds upwards along the straight lines. Events are denoted by their labels, possibly with superscripts. For instance, in E N , the events a 0 and b 0 , labelled by a and b, respectively, are in conflict. Event c 0 causes the events a i and it is concurrent with b i for all i ∈ N. It is an infinite pes associated with the Petri net N in Fig. 1b in a way that will be discussed in Sect. 4.1, hence it is strongly regular by Corollary 1. It has five (equivalence classes of) residuals extended with an event from the past

True Concurrent Logic
The logic of interest for this paper, originally defined in [20], is a Hennessy-Milner style logic that allows one to specify the dependencies (causality and concurrency) between events in computation.
Logic formulae include event variables, from a fixed denumerable set Var , denoted by x, y, . . .. Tuples of variables like x 1 , . . . , x n will be denoted by a corresponding boldface letter x and, abusing the notation, tuples will be often used as sets. The logic includes diamond and box modalities. The formula |x, y < a z| ϕ holds in a configuration when an a-labelled event e is enabled which causally depends on the events bound to x and is concurrent with those in y. Event e is executed and then the formula ϕ must hold, with e bound to variable z. Dually, [[x, y < a z]] ϕ is satisfied when all a-labelled events causally dependent on x and concurrent with y bring to a configuration where ϕ holds.
For dealing with fixpoint operators we fix a denumerable set X a of abstract propositions, ranged over by X, Y , . . . . Each abstract proposition X has an arity ar (X) and it represents a formula with ar (X) (unnamed) free event variables. Then, for x such that |x| = ar (X), we write X(x) to indicate the abstract proposition X whose free event variables are named x. Definition 6 (syntax). The syntax of L hp over the sets of event variables Var , abstract propositions X a and labels Λ is defined as follows: For a formula ϕ we denote by fv (ϕ) its free event variables, defined in the obvious way. Just note that the modalities act as binders for the variable representing the event executed, hence fv ( |x, For formulae νX(x).ϕ and μX(x).ϕ we require that fv (ϕ) = x. The free propositions in ϕ not bound by μ or ν, are denoted by fp(ϕ). When both fv (ϕ) and fp(ϕ) are empty we say that ϕ is closed. When x or y are empty are omitted, e.g., we write |a z| ϕ for |∅, ∅ < a z| ϕ.
For example, the formula ϕ 1 = |c x| ( |x < a y| T ∧ |x < b z| T) requires that, after the execution of a c-labelled event, one can choose between a causally dependent a-labelled event and a concurrent b-labelled event. It is satisfied by E N in Fig. 1a. Instead ϕ 2 = |c x| ( |x < a y| T ∧ |x < b z| T) requiring both events to be concurrent would be false. Moving to infinite computations, consider , expressing that all non-empty causal chains of b-labelled events reach a state where it is possible to execute two concurrent events labelled c and b, respectively. Then ϕ 3 holds in E N . Another formula satisfied by E N is requiring the existence of an infinite causal chain of b-labelled events, concurrent with a c-labelled event.
The logic L hp is interpreted over pess. The satisfaction of a formula is defined with respect to a configuration C and a (total) function η : Var → E, called an environment, that binds free variables in ϕ to events in C. Namely, if Env E denotes the set of environments, the semantics of a formula will be a set of pairs in C(E)×Env E . The semantics of L hp also depends on a proposition environment π : X → 2 C(E)×Env E which provides an interpretation for propositions. In order to ensure that the semantics of a formula only depends on the events associated with its free variables and is independent on the naming of the variables, it is required that if (C, η) ∈ π(X(x)) and η (y) = η(x) pointwise, then (C, η ) ∈ π(X(y)). We denote by PEnv E the set of proposition environments, ranged over by π.
We can now give the semantics of logic L hp . Given an event environment η and an event e we write η[x → e] for the updated environment which maps x to e. Similarly, for a proposition environment π and S ⊆ C(E) × Env E , we write π[Z(x) → S] for the corresponding update.
The semantics of boolean operators is standard. The formula |x, y < a z| ϕ holds in (C, η) when configuration C enables an a-labelled event e that causally depends on (at least) the events bound to the variables in x and concurrent with (at least) those bound to the variables in y and, once executed, it produces a new configuration C = C ∪ {e} which, paired with the environment η = η[z → e], satisfies the formula ϕ. Dually, [[x, y < a z]] ϕ holds when all a-labelled events executable from C, caused by x and concurrent with y bring to a configuration where ϕ is satisfied.
The fixpoints corresponding to the formulae νZ(x).ϕ and μZ(x).ϕ are guaranteed to exist by Knaster-Tarski theorem, since the set 2 C(E)×Env E ordered by subset inclusion is a complete lattice and the functions f ϕ,Z(x),π are monotonic.

Automata-Based Model Checker
We introduce nondeterministic parity tree automata and we show how the model checking problem for L hp on strongly regular pess can be reduced to the nonemptiness of the language of such automata. The automaton naturally generated from a pes and a formula has an infinite number of states. We discuss how the automaton can be quotiented to a finite one accepting the same language and thus potentially useful for model checking purposes.

Infinite Parity Tree Automata
Automata on infinite trees revealed to be a powerful tool to various problems in the setting of branching temporal logics. Here we focus on nondeterministic parity tree automata [29], with some (slightly) non-standard features. We work on k-trees (rather than on binary trees), a choice that will simplify the presentation, and we allow for possibly infinite state automata.
When automata are used for model checking purposes it is standard to restrict to unlabelled trees. A k-bounded branching tree or k-tree, for short, is a subset T ⊆ [1, k] , such that Elements of T are the nodes of the tree. The empty string corresponds to the root. A string of the form wi corresponds to the i-th child of w. Hence by (2) each branch is infinite and by (3) the presence of the i-th child implies the presence of the j-th children for j ≤ i.
Given a k-tree T , a run of A on T is a labelling of T over the states r : T → Q consistent with the transition relation, i.e., such that r( ) = q 0 and for all u ∈ T , with m children, there is a transition r(u) − → (r(u1), . . . , r(um)) in A. A path in the run r is an infinite sequence of states p = (q 0 , q 1 , . . .) labelling a complete path from the root in the tree. It is called accepting if there exists an even number l ∈ [0, h] such that the set {j | q j ∈ F l } is infinite and the set {j | q j ∈ l<i≤h F i } is finite. The run r is accepting if all paths are accepting.

Definition 9 (language of an NPA). Let A be an NPA. The language of A, denoted by L(A), consists of the trees T which admit an accepting run.
Observe that for a k-bounded NPA, the language L(A) is a set of k-trees. The possibility of having an infinite number of states and the associated acceptance condition are somehow non-standard. However, it is easy to see that whenever an NPA is finite, the acceptance condition coincides with the standard one requiring a single state with maximal even priority to occur infinitely often.
Since NPAs are nondeterministic, different runs (possibly infinitely many) can exist for the same input tree. Still, the non-emptiness problem, also for our k-ary variant, is decidable when the number of states is finite (and solvable by a corresponding parity game [30]).

Infinite NPAs for Model Checking
We show how, given a pes and a closed formula in L hp , we can build an NPA in a way that, for strongly regular pess, the satisfaction of ϕ in E reduces to the non-emptiness of the automaton language. The construction is inspired by that in [28] for the mu-calculus.
The acceptance condition for the automaton will refer to the fixpoint alternation in the formulae of L hp . We adapt a definition from [28]. A fixpoint formula αX(y).ϕ , for α ∈ {ν, μ}, is called an α-formula. Hereafter α ranges over {ν, μ}. Given an α-formula ϕ = αX(y).ϕ , we say that a subformula ψ of ϕ is a direct active subformula, written ψ d ϕ, if the abstract proposition X appears free in ψ. The transitive closure of d is a partial order and when ψ * d ϕ we say that ψ is an active subformula of ϕ. We denote by sf (ϕ) the set of subformulae of a formula ϕ and by sf α (ϕ) the set of active α-subformulae.
Hereafter we assume that in every formula different bound propositions have different names, so that we can refer to the fixpoint subformula quantifying an abstract proposition. This requirement can always be fulfilled by alpha-renaming.
Hereafter, if X and X are abstract propositions quantified in α-subformulae αX(x). ϕ and α X (x ). ϕ , we will write ad(X) for ad(αX(x). ϕ) and X d X for αX(x). ϕ d α X (x ). ϕ . Moreover, given a pes E, for a pair (C, η) ∈ C(E) × Env E and variables x, y, z, we define (x, y < az)-successors of (C, η), as We can now illustrate the construction of the NPA for a formula and a pes. NPA for a formula). Let E be a bounded pes and let ϕ ∈ L hp be a closed formula. The NPA for E and ϕ is A E,ϕ = Q, − →, q 0 , F defined as follows. The set of states

The acceptance condition is
the set of all subformulae of ϕ in a context where they are trivially true, and States of A E,ϕ are triples (C, η, ϕ) consisting of a configuration C, an environment η and a subformula ψ of the original formula ϕ. The intuition is that a transition reduces the satisfaction of a formula in a state to that of subformulae in possibly updated states. It can just decompose the formula, as it happens for ∧ or ∨, check the satisfaction of a modal operator, thus changing the state consequently, or unfold a fixpoint.
The automaton A E,ϕ is bounded but normally infinite (whenever the pes E is infinite and the formula ϕ includes some non-trivial fixpoint).
We next show that for a strongly regular pes the satisfaction of the formula ϕ on the pes E reduces to the non-emptiness of the language of A E,ϕ .

Theorem 1 (model checking via non-emptiness). Let E be a strongly regular pes and letφ be a closed formula in L hp . Then L(A E,φ ) = ∅ iff E |=φ.
We next provide an outline of the proof. A basic ingredient is an equivalence that can be defined on the NPA. As a first step we introduce a generalised notion of residual in which the relation with some selected events in the past is kept.

Definition 11 (pointed residual). Given a pes E and a set X, a X-pointed
configuration is a pair C, ζ where C ∈ C(E) and ζ : X → C is a function. We say that the X-pointed configurations C, ζ , C , ζ have isomorphic pointed residuals, written E[ C, ζ ] ≈ E[ C , ζ ] if there is an isomorphism of pess ι :

E[C] → E[C ] such that for all x ∈ X, e ∈ E[C] we have ζ(x) ≤ e iff ζ (x) ≤ ι(e).
Then two states are deemed equivalent if they involve the same subformula (up to renaming of the event variables) and the configurations, pointed by the free variables in the formulae, have isomorphic residuals. This resembles the notion of contextualised equivalence used on tableau judgments in [26].
Definition 12 (future equivalence). Let E be a pes, ϕ be a formula and let q i = (C i , η i , ψ i ), i ∈ {1, 2} be two states of the NPA A E,ϕ . We say that q 1 and q 2 are future equivalent, written q 1 ≈ f q 2 , if there exists a formula ψ and substitutions σ i : fv (ψ) → fv (ψ i ) such that ψσ i = ψ i , for i ∈ {1, 2}, and the fv (ψ)-pointed configurations C i , η i • σ i have isomorphic pointed residuals.
It can be shown that, given q i = (C i , η i , ψ i ), i ∈ {1, 2} as above, for all proposition environments π (satisfying a technical property of saturation) we have that ( Additionally, using strong regularity, one can prove that the semantics of fixpoint formulae is properly captured by finite approximants and that equivalence ≈ f is of finite index. These are fundamental building bricks in the proof of Theorem 1 which, roughly, proceeds as follows. Assume that the language L(A E,ϕ ) = ∅. Then there is an accepting run r over some k-tree T . Since ϕ is finite, in each infinite path there are infinitely many Since ≈ f is of finite index, infinitely many such states are equivalent. Then one deduces that, for some h, the subformula ψ i h is satisfied in (C i h , η i h ). For fixpoint subformulae, this requires to show that, since the run is accepting, the subformula of maximal alternation depth that repeats infinitely often is a νformula and use the fact that, as mentioned before, its semantics can be finitely approximated. Then, by a form of backward soundness of the transitions, we get that all the nodes, including the root, contain formulae which are satisfied.
For the converse implication, assume that E |= ϕ. Starting from the initial state q 0 = (∅, η, ϕ) where the formula is satisfied, and using the automaton transitions, we can build a k-tree T and a run where for each state (C , η , ψ) the subformula ψ is satisfied in (C , η ) and such run can be proved to be accepting.

Quotienting the Automaton
In order to have an effective procedure for checking the satisfaction of a formula we need to build a suitable quotient of the NPA, with respect to an equivalence which preserves emptiness. A simple but important observation is that it is sufficient to require that the equivalence is a bisimulation in the following sense. An analogous notion is studied in [31] in the setting of nondeterministic tree automata over finite trees.

Definition 13 (bisimulation). Given an NPA A, a symmetric relation R ⊆ Q × Q over the set of states is a bisimulation if for all
Given an NPA A and an equivalence ≡ on the set of states which is a bisimulation, we define the quotient as . . . , q m ) and F /≡ = (F 0/≡ , . . . , F h/≡ ). An NPA and its quotient accept exactly the same language.

Theorem 2 (language preservation). Let A be an NPA and let ≡ be an equivalence on the set of states which is a bisimulation. Then L(A /≡ ) = L(A).
When ≡ is of finite index, the quotient A E,ϕ /≡ is finite and, exploiting Theorems 1 and 2, we can verify whether E |= ϕ by checking the emptiness of the language accepted by A E,ϕ /≡ . Clearly a concrete algorithm will not first generate the infinite state NPA and then take the quotient, but it rather performs the quotient on the fly: whenever a new state would be equivalent to one already generated, the transition loops back to the existing state.
Whenever E is strongly regular, the future equivalence on states (see Definition 12) provides a bisimulation equivalence of finite index over A E,ϕ .

Lemma 1 (≈ f is a bisimulation). Let E be a strongly regular pes and let ϕ be a closed formula in L hp . Then the future equivalence ≈ f on A E,ϕ is a bisimulation and it is of finite index.
An obstacle towards the use of the quotiented NPA for model checking purposes is the fact that the future equivalence could be hard to compute (or even undecidable). In order to make the construction effective we need a decidable bisimulation equivalence on the NPA and the effectiveness of the set of successors of a state. This is further discussed in the next section.

Model Checking Petri Nets
We show how the model checking approach outlined before can be instantiated on finite safe Petri nets, a classical model of concurrency and distribution [32], by identifying a suitable effective bisimulation equivalence on the NPA.

Petri Nets and Their Event Structure Semantics
A Petri net is a tuple N = (P, T, F, M 0 ) where P , T are disjoint sets of places and transitions, respectively, F : (P × T ) ∪ (T × P ) → {0, 1} is the flow function, and M 0 is the initial marking, i.e., the initial state of the net. We assume that the set of transitions is a subset of a fixed set T with a labelling λ N : T → Λ.
A marking of N is a function M : P → N, indicating for each place the number of tokens in the place. A transition t ∈ T is enabled at a marking M if M (p) ≥ F (p, t) for all p ∈ P . In this case it can be fired leading to a new marking M defined by M (p) = M (p) + F (t, p) − F (p, t) for all places p ∈ P . This is written M [t M . We denote by R(N ) the set of markings reachable in N via a sequence of firings starting from the initial marking. We say that a marking M is coverable if there exists M ∈ R(N ) such that M ≤ M , pointwise. A net N is safe if for every reachable marking M ∈ R(N ) and all p ∈ P we have M (p) ≤ 1. Hereafter we will consider only safe nets. Hence markings will be often confused with the corresponding subset of places {p | M (p) = 1} ⊆ P . For x ∈ P ∪ T the pre-set and post-set are defined • x = {y ∈ P ∪ T | F (y, x) = 1} and x • = {y ∈ P ∪ T | F (x, y) = 1} respectively.
An example of Petri net can be found in Fig. 1b. Graphically places and transitions are drawn as circles and rectangles, respectively, while the flow function is rendered by means of directed arcs connecting places and transitions. Markings are represented by inserting tokens (black dots) in the corresponding places.
The concurrent behaviour of a Petri net can be represented by its unfolding U(N ), an acyclic net constructed inductively starting from the initial marking of N and then adding, at each step, an occurrence of each enabled transition. N = (P, T, F, m 0 ) be a safe net. Define the net

Definition 14 (unfolding). Let
where ⊥ is an element not belonging to P , T or F . The unfolding is the least net U(N ) = (P (ω) , T (ω) , F (ω) ) containing U (0) and such that -if t ∈ T , the set of places X ⊆ P (ω) is coverable and π 1 (X) = • t, then e = (t, X) ∈ T (ω) ; -for any e = (t, Places and transitions in the unfolding represent tokens and firing of transitions, respectively, of the original net. The projection π 1 over the first component maps places and transitions of the unfolding to the corresponding items of the original net N . The initial marking is implicitly identified as the set of minimal places. For historical reasons transitions and places in the unfolding are also called events and conditions, respectively. One can define causality ≤ N over the unfolding as the transitive closure of the flow relation. Conflict is the relation e#e if • e ∩ • e = ∅, inherited along causality. The events T (ω) of the unfolding of a finite safe net, endowed with causality and conflict, form a pes, denoted E(N ). The transitions of a configuration C ∈ C(E(N )) can be fired in any order compatible with causality, producing a marking ; in turn, this corresponds to a reachable marking of N given by M(C) = π 1 (C • ). As an example, the unfolding U(N ) of the running example net N and the corresponding pes can be found in Figs. 1c and a.

Automata Model Checking for Petri Nets
The pes associated with a safe Petri net is known to be regular [27]. We next prove that it is also strongly regular and thus we can apply the theory developed so far for model checking L hp over safe Petri nets.
Let N = S, T, F, M 0 be a safe Petri net. A basic observation is that the residual of the pes E(N ) with respect to a configuration C ∈ C(E(N )) is uniquely determined by the marking produced by C. This correspondence can be extended to pointed configurations by considering markings which additionally record, for the events of interest in the past, the places in the marking which are caused by such events. This motivates the definition below.

Definition 15 (pointed marking).
Let N = S, T, F, M 0 be a safe Petri net. Given a set X, a X-pointed marking is a pair M, r with r : Pointed configurations producing the same pointed marking have isomorphic pointed residuals.

Proposition 1 (pointed markings vs residuals).
Let N = S, T, F, M 0 be a safe Petri net. Given a set X and two X-pointed configurations By the previous result the pes associated with a finite safe Petri net is strongly regular. Indeed, the number of residuals of X-pointed configurations, up to isomorphism, by Proposition 1, is smaller than the number of X-pointed markings, which is clearly finite since the net is safe.

Corollary 1 (strong regularity). Let N be finite safe Petri net. Then the corresponding pes E(N ) is strongly regular.
In order to instantiate the model checking framework to finite safe Petri nets, the idea is to take an equivalence over the infinite NPA by abstracting the (pointed) configurations associated with its states to pointed markings.
Using Proposition 1 we can immediately prove that ≈ m refines ≈ f . Moreover we can show that ≈ m is a bisimulation in the sense of Definition 13.

Proposition 2 (marking equivalence is a bisimulation). Let N be a finite safe Petri net and let ϕ be a closed formula in L hp . The equivalence ≈ m on the automaton A E(N ),ϕ is a bisimulation and it is of finite index.
Relying on Propositions 1 and 2 we provide an explicit construction of the quotient automaton A E(N ),ϕ /≈m . We introduce a convenient notation for transitions between pointed markings. Given the variables x, y, a set X such that x ∪ y ⊆ X and an X-pointed marking M, r , we write M, r for all x ∈ x we have r(x) ∩ • t = ∅ and for all y ∈ y it holds r(y) ∩ • t = ∅ and r is defined by r (z) = t • and r (w) = (r(w) ∩ M ) ∪ {s | r(w) ∩ • t = ∅ ∧ s ∈ t • }, for w = z. In words, from the pointed marking M, r transition t is fired and "pointed" by variable z. Transition t is required to consume tokens caused by x and not to consume tokens caused by y, in order to be itself caused by x and independent from y. After the firing, variables which were causes of some p ∈ • t become causes of the places in t • and, clearly, z causes t • .

Construction 1 (quotient NPA).
Let N be a finite safe Petri net and let ϕ ∈ L hp be a closed formula. The quotient NPA A E(N ),ϕ /≈m is defined as follows.
The initial state q 0 = (M 0 , ∅, ϕ). The transition relation is defined, for any state q = (M, r, ψ) ∈ Q, by: The acceptance condition is as in Definition 10.

A Prototype Tool
The algorithm for model checking Petri nets outlined before is implemented in the prototype tool TCWB (True Concurrency Workbench) [33], written in Haskell. The tool inputs a safe Petri net N and a closed formula ϕ of L hp and outputs the truth value of the formula on the initial marking of N . The algorithm builds the quotient NPA A E(N ),ϕ /≈m "on demand", i.e., the states of the automaton are generated when they are explored in the search of an accepting run. A path is recognised as successful when it includes a loop where a * d -maximal subformula is T, a [[ ]]-subformula or a ν-subformula. In this way only the fragment of A E(N ),ϕ /≈m relevant to decide the satisfaction of ϕ is built.
Given a net N = (P, T, F, M 0 ) and a formula ϕ, the number of states in the quotient automaton A E(N ),ϕ /≈m can be bounded as follows. Recall that a state consists of a triple (M, r, ψ) where ψ ∈ sf (ϕ), M is a reachable marking and r : fv (ψ) → 2 M is a function. This leads to an upper bound O(|sf (ϕ)|·|R(N )|·2 |P |·v ), where v = max {|fv (ψ)| : ψ ∈ sf (ϕ)} is the largest number of event variables appearing free in a subformula of ϕ. In turn, since |R(N )| ≤ 2 |P | , this is bounded by O(|sf (ϕ)|·2 |P |·(v+1) ). The size of the automaton is thus exponential in the size of the net and linear in the size of the formula. Moving from the interleaving fragment of the logic (where v = 0) to formulae capable of expressing true concurrent properties thus causes an exponential blow up. However, note that the worst case scenario requires all transitions to be related by causality and concurrency to all places in any possible way, something that should be quite unlikely in practice. Indeed, despite the fact that the tool is very preliminary and more tweaks and optimisations could improve its efficiency, for the practical tests we performed the execution time seems to be typically well below than the theoretical worst case upper bound.

Conclusions
We introduced an automata-theoretic framework for the model checking of the logic for true concurrency L hp , representing the logical counterpart of a classical true concurrent equivalence, i.e., history preserving bisimilarity. The approach is developed abstractly for strongly regular pess, that include regular trace pess. A concrete model-checking procedure requires the identification of an effective bisimulation equivalence for the construction of the quotient automaton. We showed how this can be done for finite safe Petri nets. The technique is implemented in a proof-of-concept tool.
We proved that the class of regular trace pess is included in that of strongly regular pess which in turn is included in the class of regular pess. The precise relation of strongly regular pess with the other two classes is still unclear and interesting in view of [34] that recently showed that regular trace pess are strictly included in regular pess, disproving Thiagarajan's conjecture.
Several other papers deal with model checking for logics on event structures. In [35] a technique is proposed for model checking a CTL-style logic with modalities for immediate causality and conflict on a subclass of pess. The logic is quite different from ours as formulae are satisfied by single events, the idea being that an event, with its causes, represents the local state of a component. The procedure involves the construction of a finite representation of the pes associated with a program which has some conceptual relation with our quotienting phase. In [19] the author shows that first order logic and Monadic Trace Logic (MTL), a restricted form of monadic second order (MSO) logic are decidable on regular trace event structures. The possibility of directly observing conflicts in MTL and thus of distinguishing behaviourally equivalent pess (e.g., the pess consisting of a single or two conflicting copies of an event), and the presence in L hp of propositions which are non-monadic with respect to event variables, make these logics not immediate to compare. Still, a deeper investigation is definitively worth to pursue, especially in view of the fact that, in the propositional case, the mucalculus corresponds to the bisimulation invariant fragment of MSO logic [36].
The work summarised in [18] develops a game theoretic approach for modelchecking a concurrent logic over partial order models. It has been observed in [20] that such logic is incomparable to L hp . Preliminary investigations shows that our model-checking framework could be adapted to such a logic and, more generally, to a logic joining the expressive power of the two. Moreover, further exploring the potentialities of a game theoretic approach in our setting represents an interesting venue of further research.
Compared to our previous work [26], we extended the range of the technique to the full logic L hp , without limitations concerning the alternation depth of formulae. Relaxing the restriction to strongly regular pess, instead, appears to be quite problematic unless one is willing to deal with transfinite runs which, however, would be of very limited practical interest.
The tool is still very preliminary. As suggested by its (wishful) name (inspired by the classical Edinburgh Concurrency Workbench [37]) we would like to bring the TCWB to a more mature stage, working on optimisations and adding an interface that gives access to a richer set of commands.