A presentation summarizing a decade of research on declarative, constraint-based process modeling. In particular, the presentation focuses on the usage of linear temporal logic on finite traces, and the corresponding automata-theoretic characterization, to support constraint-based processes during their entire lifecycle, from model consistency to enactment, monitoring, and discovery.
Recombination DNA Technology (Nucleic Acid Hybridization )
10 Years Playing with Declare and Temporal Logics on Finite Traces
1. s
10 years playing with Declare
and temporal logics
over finite
traces
marco montali
free university of bozen-bolzano
TU/e
14/05/2019
RWTH
16/05/2019
2. Types of Processes
Not all business processes are the same
• Even within one organization, business processes can be
very different in terms of their essential properties.
• Business processes can be characterized through three
dimensions:
• complexity
• predictability
• repetitiveness
6. Flexibility vs Control
Flexibility: degree to which users can make local
decisions about how to execute processes.
Control: degree to which a system makes
centralized decisions about how to execute
processes. Universe of Traces
Compliant
Traces
Flexibility
8. Trends in BPM
modeling
• Variable BPs
• Metaphor: rules/constraints
Dec t i
lar
a
ev
Imperative modeling
• Traditional, repetitive BPs
• Metaphor: flow-chart
12. Imperative Modeling
Focus: howthings must be done
• Explicit description of the process control-flow
Closedmodeling
• All that is not explicitly modeled is forbidden
• Exceptions/uncommon behaviors have to be
explicitly enumerated at design time
21. Choreography Example
• An order can be finalized at most once
• Once an order is finalized, it must be confirmed or rejected
• A confirmed order may be rejected later on (due to “late”
problems), but not vice-versa: a rejection cannot be reverted.
• An order can be confirmed only if it shipped before.
• An order may be rejected autonomously by the seller.
However, if the warehouse notifies the seller of a shipment
issue, then the seller has to reject the order.
• The warehouse decision is firm: “Ship” and “Notify shipment
issue” are mutually exclusive.
24. Constraint-Based Modeling
Focus: whathas to be accomplished
• Explicit description of the relevant business constraints
• behavioral constraints, best practices, norms, rules, …
Openmodeling
• All behaviors are possible unless they are explicitly
forbidden
• Control-flow left implicit
28. Declare
• A constraint-based extensible language
for flexible process modeling
• An execution engine for constraint-based
processes
http://www.win.tue.nl/declare/
• Originally proposed by Pesic and van der
Aalst
• Formalized by Pesic and van der Aalst,
and by _
31. 0..1
Modeling in Declare
Finalize order
Confirm
order
Reject
order
Ship
Notify
shipment issue
Once an order is finalized, it must
be confirmed or rejected
33. 0..1
Modeling in Declare
Finalize order
Confirm
order
Reject
order
Ship
Notify
shipment issue
A confirmed order may be rejected
later on, but not vice-versa
34. 0..1
Modeling in Declare
Finalize order
Confirm
order
Reject
order
Ship
Notify
shipment issue
if the warehouse notifies the seller of a shipment issue,
then the seller has to reject the order
An order can be confirmed only if it
shipped before
37. The Origin of Declare…
Patterns in
Linear
Temporal
Logic
38. Linear Temporal Logic (LTL)
…
' ::= A | ¬' | '1 ^ '2 | ' | '1U'2
Atomic propositions
Boolean connectives
At next step φ holds
Eventually φ2 holds, and φ1 holds until φ2 does
φ eventually holds
φ always holds
φ1 holds forever or until φ2 does
Models:
infinite traces
' ::= A | ¬' | '1 ^ '2 | ' | '1U'2
' ::= A | ¬' | '1 ^ '2 | ' | '1U'2
| '1 ^ '2 | ' | '1U'2
'2 | ' | '1U'2
⌃' ⌘ true U'
⇤' ⌘ ¬⌃¬'
'1W'2 = '1U'2 _ ⇤'1⇤' ⌘ ¬⌃¬'
39. Formalizing Declare
• Tasks as propositions
• At each moment, only one task is executed
• Each Declare template becomes an LTL pattern
ba
ba
ba
…
¬bWa
¬(⌃a ^ ⌃b)
⇤(a ! ⌃b)
40. Formalizing Declare
A Declare model becomes an “LTL” formula:
• Conjunction of all constraint formulae
• Constraint formula grounds “LTL” template on its tasks
41. Formalizing Declare
moored
under way
using engine
under way
sailing
constrained by
her draught
A Declare model becomes an “LTL” formula:
• Conjunction of all constraint formulae
• Constraint formula grounds “LTL” template on its tasks
42. Formalizing Declare
moored
under way
using engine
under way
sailing
constrained by
her draught
⇤(m ! ⌃e)
^¬(⌃e ^ ⌃s)
^¬cWs
A Declare model becomes an “LTL” formula:
• Conjunction of all constraint formulae
• Constraint formula grounds “LTL” template on its tasks
46. Interestingly, in AI…
Extensive adoption of linear temporal logics in reasoning about
actions and planning
Finite vs infinite semantics, often blurring this distinction…
• Temporally extended goals [BacchusKabanza96]: infinite/finite
• Trajectory constraints [PDDL 3.0]: finite
• Declarative control knowledge on trajectories [BaierMcIlraith06]:
finite
• Procedural control knowledge on trajectories
[BaierFritzMcIlraith07]: finite
• Temporal specifications in planning domains
[CalvaneseDeGiacomoVardi02]: infinite
• Planning via model checking [DeGiacomoVardi99]: finite
47. Linear Temporal Logic over
Finite Traces (LTLf)
' ::= A | ¬' | '1 ^ '2 | ' | '1U'2
Models:
finite traces
Same syntax of LTL, but different semantics!
In LTL, there is always a next moment… in LTLf, no!
φ always holds from current to the last instant
The next step exists and at next step φ holds
(weak next)
If the next step exists, then at next step φ holds
last instant in the trace
'1 ^ '2 | ' | '1U'2
⇤'
Last ⌘ ¬ true
' ⌘ ¬ ¬'
52. Infinite vs Finite Traces
On infinite traces
⇤(a ! ⌃b) ^ ⇤(b ! ⌃a)
b a b …
…a a b…
53. Infinite vs Finite Traces
On infinite traces
On finite traces
⇤(a ! ⌃b) ^ ⇤(b ! ⌃a)
b aa
b a b …
…a a b…
b
a
(inconsistent
in Declare!)
54. Infinite vs Finite Traces
Büchi automaton accepting
its infinite traces
NFA accepting
its finite traces
⇤(a ! ⌃b) ^ ⇤(b ! ⌃a)
22 A. Russo – Constraint-based Declarative Processes
S0
S1 S2
S3
!A ∧ !B
A ∧ B!A
B
A ∧ B
A ∧ B
true
true
trueA ∧ B
B
A
B
S1S0
trueA ∧ B
!A ∧ !B
A ∧ B
true
S0
!A ∧ !B
A B
response
response
a) Constraint model b) Buchi automaton
true
C
55. Look the Same, not the Same
Many researchers: misled by the lift from infinite to finite traces
• Naive approach to LTLf: LTL interpreted over a trace where
eventually nothing happens (keeping the input formula unaltered)
In [De Giacomo, De Masellis, _, AAAI2014], we studied why!
• People typically focus on “patterns”, not on the entire logic
• Many LTL patterns in BPM, reasoning about actions, planning, etc.
are “insensitive to infinity”: naive approach works!
56. Formal Properties of LTLf
• Expressiveness: FO over finite traces, i.e., star-free RE
• Reasoning: satisfiability, validity, logical implication
PSPACE-complete
• Model checking: linear in the TS, PSPACE-complete in
the formula
Hence, reasoning/model checking as difficult as in the
infinite-trace case… but there is a catch!
57. Main Catch
LTLf NFA
nondeterministic
DFA
deterministic
LTLf2aut determin.
'
Reasoning can be carried out with automata on finite words!can be translated into equivalent nfa:
t |= Ï i t œ L(AÏ)
nfa (exponential)
ponential)
dfa corresponding to ltlf /ldlf are in fact small!
oning into automata based procedures!
Can be implemented
and run!
[De Giacomo et al., BPM 2014]
67. Correctness
• In BPM: typically assessed via model checking
• In the case of Declare: satisfiability
• Correct Declare model: admits a trace
satisfying all constraints
• (i.e., its LTLf formula) is satisfiable
• How to check?
Language emptiness of the corresponding NFA
69. Enactment of a Process
1. History recognition: given the
history of a running instance,
compute the current state (or reject)
2. Todo list: given the current state, tell
which tasks can(not) be executed
next
(including possibility of termination)
3. Update: given a state and a task,
determine the new state
S
a
b
c
S
SnewS
a
initial
80. …
…
…
RV-LTL Truth Values
Refined analysis of the “truth
value” of a constraint, looking into
(all) possible futures
Consider a partial trace t, and a
constraint C
t
C
satisfied?
……
C
satisfied?
81. RV-LTL Truth Values
• C is permanently satisfied if t
satisfies C and no matter how t is
extended, C will stay satisfied
• C is temporarily satisfied if t
satisfies C but there is a
continuation of t that violates C
…
…
t
…
…
…
t
82. RV-LTL Truth Values
• C is temporarily violated if t
violates C but there is a
continuation that leads to satisfy C
• C is permanently violated if t
violates C and no matter how t is
extended, C will stay violated
t
…
…
…
…
…
83. How to Construct
RV-LTL Monitors?
In the literature…
• Ad-hoc extensions of the standard automata-
theretic characterization of linear temporal
logics
• Mainly studied for LTL over infinite traces: a
partial trace is a prefix of an infinite suffix
• Can be adjusted to LTLf, but they require
anyway a detour tu Büchi automata
84. A Key Observation
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
85. Suitability of the Constraint Specification Language
ldlf
Linear Dynamic
Logic over
finite traces
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
A Key Observation
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
86. Suitability of the Constraint Specification Language
ldlf
Linear Dynamic
Logic over
finite traces
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
A Key Observation
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
LTLf with regular expressions
inside <> and []
(a là PDL)
87. Suitability of the Constraint Specification Language
ldlf
Linear Dynamic
Logic over
finite traces
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
Back and Forth
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
88. Suitability of the Constraint Specification Language
ldlf
Linear Dynamic
Logic over
finite traces
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
Back and Forth
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
89. Suitability of the Constraint Specification Language
ldlf
Linear Dynamic
Logic over
finite traces
ltlf
MSOL over
finite traces
FOL over
finite traces
Regular
expressions
Star-free
regular
expressions
pspace
complexity
Nondet.
finite-state
automata
(nfa)
• ltlf : declarative, but lacking expressiveness.
• Regular expressions: rich formalism, but low-level.
(t)ake-off (r)each ((r|other)ú
(t(t|other)ú
r)(r|other)ú
)ú
Back and Forth
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
Suitability of the Constraint Specification Language
ltlf
FOL over
finite traces
Star-free
regular
expressions
non-trimmed
90. Automata for LDLfFrom ldlf to nfa
Direct calculation of nfa corresponding to ldlf formula Ï
Algorithm
1: algorithm ldlf 2nfa()
2: input ltlf formula Ï
3: output nfa AÏ = (2P
, S, {s0}, Í, {sf })
4: s0 Ω {"Ï"} Û single initial state
5: sf Ω ÿ Û single final state
6: S Ω {s0, sf }, Í Ω ÿ
7: while (S or Í change) do
8: if (q œ S and qÕ
|=
w
("Â"œq) ”("Â", ))
9: S Ω S fi {qÕ
} Û update set of states
10: Í Ω Í fi {(q, , qÕ
)} Û update transition relation
Note
• Standard nfa.
• No detour to Büchi automata.
• Easy to code.
• Implemented!
Auxiliary rules
”("tt", ) = true
”(" ", ) = false
”("„", ) =
I
true if |= „
false if ”|= „
(„ propositional)
”("Ï1 · Ï2", ) = ”("Ï1", ) · ”("Ï2", )
”("Ï1 ‚ Ï2", ) = ”("Ï1", ) ‚ ”("Ï2", )
”("È„ÍÏ", ) =
Y
_]
_[
"Ï" if last ”œ and |= „ („ propositional)
”("Ï", ‘) if last œ and |= „
false if ”|= „
”("ÈÂ?ÍÏ", ) = ”("Â", ) · ”("Ï", )
”("Èfl1 + fl2ÍÏ", ) = ”("Èfl1ÍÏ", ) ‚ ”("Èfl2ÍÏ", )
”("Èfl1; fl2ÍÏ", ) = ”("Èfl1ÍÈfl2ÍÏ", )
”("Èflú
ÍÏ", ) =
I
”("Ï", ) if fl is test-only
”("Ï", ) ‚ ”("ÈflÍÈflúÍÏ", ) o/w
”("[„]Ï", ) =
Y
_]
_[
"Ï" if last ”œ and |= „ („ propositional)
”("Ï", ‘) if last œ and |= „ („ propositional)
true if ”|= „
”("[Â?]Ï", ) = ”("nnf (¬Â)", ) ‚ ”("Ï", )
”("[fl1 + fl2]Ï", ) = ”("[fl1]Ï", ) · ”("[fl2]Ï", )
”("[fl1; fl2]Ï", ) = ”("[fl1][fl2]Ï", )
”("[flú
]Ï", ) =
I
”("Ï", ) if fl is test-only
”("Ï", ) · ”("[fl][flú]Ï", ) o/w
Marco Montali (unibz) Monitoring Business Metaconstraints BPM 2014 22 / 26
[De Giacomo et al., BPM 2014]
91. Black Magic with LDLf
Runtime ldlf Monitors
Check partial trace fi = e1, . . . , en against formula Ï.
From ad-hoc techniques . . .
e1 . . . en |=
C
Ï
D
RV =
Y
___]
___[
temp_true
temp_false
true
false
. . . To standard techniques
e1 . . . en |=
Y
______]
______[
Ïtemp_true
Ïtemp_false
Ïtrue
Ïfalse
95. Coloring Automata
Coloring simply amounts to reachability checks!
• State permanently satisfied: it is final and cannot
reach a non-final state
• State temporarily satisfied: it is final but can reach a
non-final state
• State temporarily violated: it is non-final but can reach
a final state
• State permanently violated: it is non-final and cannot
reach a final state
96. Declare Enactment
Information about single constraints
• Translate each constraint into LTLf
• Compute the corresponding colored DFAs (local automata)
Hidden dependencies
• We need the global automaton for the entire model. Either:
• Take the “conjunction formula” of all constraints and get
the DFA
• Compute the intersection of the local DFAs
97. Local Automata
moored
under way
using engine
under way
sailing
constrained by
her draught
0
s
c
not {c,s}
true1
0 true
00 1
m
e
not m not e
s
e
not s
true00
not {s,e}
1
2
3
e
s
not e
1
2
98. Global Colored Automaton
By carefully intersecting local DFAs: we get a
global DFA that retains all “local colors”.
This is… an execution engine!
99. An Engine for Declare
1. Compute the global, coloured DFA A
2. s = initial state of A
3. Loop
A. Block all activities that would lead to a permanent violation
if executed in s
B. Highlight constraints that are permanently satisfied in s
C. Highlight constraints that are temporarily violated
• If no temporarily violated constraint: allow for completing the
process
D. Wait until an allowed activity a is executed
E. fetch s’ s.t. <s,a,s’> belongs to A
F. s = s’ 99
100. Implemented in ProM!
Monitoring
The same approach can be used for monitoring (just observe and
return the RV-LTL state of constraints and of the entire model)
• With LDLf, we can predicate about the truth value of constraints!
• Direct support for
meta-constraints
• Compensation constraints
• Contrary-to-duty constraints
• Dynamic activation/
disablement of constraints
104. Basic Idea of Existing
Algorithms
• Apply heuristics to guess a constraint
• Check the support of the constraint
• Check the interestingness factor of the
constraint
• Combine these two metrics to decide whether to
keep the constraint or not
• Iterate and prune
105. Problems
• Correctness of the overall declarative model (for
constraints with <100% support)
• Minimality of the overall declarative model (redundant
constraints)
• How to determine whether a constraint is
interesting or not
All these questions: successfully attacked with logics and
automata!
107. Why is a Trace Interesting
for a Constraint?
• Because it “interacts” with the constraint
• Semantically:
• It flips the RV-LTL state of the constraint
• It changes the set of allowed transitions
• Non-vacuous satisfaction = satisfaction + interestingness
• A much easier treatment than in the infinite-trace case (see
works on vacuity checking in LTL)
111. Conclusion
• BPM struggles to balance flexibility and control
• Constraint-based approaches and temporal logics over finite traces
offer a declarative, solid approach
• The automata-theoretic foundations lead to a “correct by design”
computation mechanism to assist humans during the entire process
lifecycle
• A lot of open challenges!
• Mix declarative and imperative approaches
• Connection with AI tasks: synthesis (adversarial process
execution, partial observability, …)
• Redesign all reasoning tasks in the presence of data
112. And the Story Continues…
Object-Centric Behavioral Constraints
(joint work with Wil van der Aalst, Guangming Li, Alessandro Artale)
OrderItem Package
Pick
Item
Pay
Order
Get
Package
0..1 ** 0..1
113. Acknowledgments
• Wil van der Aalst
• Maja Pesic
• Federico Chesani
• Paola Mello
• Fabrizio Maggi
• Michael Westergaard
• Giuseppe De Giacomo
• Claudio di Ciccio
• Jan Mendling
114. Some References
Declare and its formalizations
• M. Pesic and W. van der Aalst, A Declarative Approach for Flexible Business
Processes Management, in BPM Workshops. Vol. 4103 of LNCS, pp. 169-180.
Springer, 2007.
• M. Montali, M. Pesic, W. M. P. van der Aalst, F. Chesani, P. Mello, and S. Storari,
Declarative specification and verification of service choreographies, ACM
Trans. Web, vol. 4, pp. 3:1–3:62, 2010.
• M. Montali. Specification and Verification of Declarative Open Interaction
Models: a Logic- Based Approach, vol. 56 of LNBIP. Springer, 2010.
• M. Westergaard, Better Algorithms for Analyzing and Enacting Declarative
Workflow Languages Using LTL, in BPM, vol. 6896 of LNCS, pp. 83-98. Springer,
2010.
• Giuseppe De Giacomo, Riccardo De Masellis, Marco Montali,
Reasoning on LTL on Finite Traces: Insensitivity to Infiniteness, in AAAI, pp.
1027-1033. AAAI Press, 2014.
115. Some References
Declare Execution Environment
• M. Pesic, H. Schonenberg, and W. M. P. van der Aalst, DECLARE:
Full Support for Loosely-Structured Processes, in EDOC, pp.
287–300. IEEE Computer Society, 2007.
• M. Pesic, M. Schonenberg, N. Sidorova, and W. van der Aalst,
Constraint-Based Workflow Models: Change Made Easy, in
CoopIS, vol. 4803 of LNCS, pp. 77-94. Springer, 2007.
• M. Pesic, H. Schonenberg, and W. Aalst, The Declare Service, in
Modern Business Process Automation, Springer, 2010, pp. 327-343.
• M. Westergaard, F. M. Maggi, Declare: A Tool Suite for
Declarative Workflow Modeling and Enactment, BPM (Demos)
2011.
116. Some References
Monitoring Declare constraints
• F. M. Maggi, M. Montali, M. Westergaard, and W. M. P. van der Aalst,
Monitoring Business Constraints with Linear Temporal Logic: An
Approach Based on Colored Automata, in BPM, volume 6896 of LNCS, pp.
132-147. Springer, 2011.
• F. M. Maggi, M. Westergaard, M. Montali, W. M. P. van der Aalst,
Runtime Verification of LTL-Based Declarative Process Models.:
Proceedings of RV, volume 7186 of LNCS, pp. 131-146. Springer, 2011.
• M. Montali, F. M. Maggi, F. Chesani, P. Mello, W. M. P. van der Aalst,
Monitoring business constraints with the event calculus. ACM Trans. on
Intelligent Systems and Technology 5(1): 17, 2013.
• G. De Giacomo, R. De Masellis, M. Grasso, F. M. Maggi, M. Montali,
Monitoring Business Metaconstraints Based on LTL and LDL for Finite
Traces, in BPM, volume 8659 of LNCS, pp. 1-17. Springer, 2014.
117. Some References
Discovering Declare constraints
• F. Chesani, E. Lamma, P. Mello, M. Montali, F. Riguzzi, S. Storari, Exploiting Inductive Logic Programming
Techniques for Declarative Process Mining. Trans. Petri Nets and Other Models of Concurrency 2: 278-295,
2009.
• F. Maria Maggi, A. J. Mooij, W. M. P. van der Aalst, User-guided discovery of declarative process models.
In CIDM, pp. 192-199. IEEE Press, 2011.
• F. M. Maggi, R. P. J. Chandra Bose, W. M. P. van der Aalst, Efficient Discovery of Understandable
Declarative Process Models from Event Logs. In CAiSE, volume 7908 of LNCS, pp. 270-285. Springer,
2012.
• F. M. Maggi, M. Dumas, L. García-Bañuelos, M. Montali, Discovering Data-Aware Declarative Process
Models from Event Logs. In BPM, volume 8094 of LNCS, pp. 81-96. Springer, 2013.
• C. Di Ciccio, M. Mecella, On the Discovery of Declarative Control Flows for Artful Processes. ACM Trans.
Management Inf. Syst. 5(4): 24:1-24:37, 2015.
• C. Di Ciccio, F. M. Maggi, M. Montali, J. Mendling, Ensuring Model Consistency in Declarative Process
Discovery. In BPM, volume 9253 of LNCS, pp. 144-159. Springer, 2015.
• C. Di Ciccio, F. M. Maggi, M. Montali, J. Mendling, Semantical Vacuity Detection in Declarative Process
Mining. In BPM, volume 9850 of LNCS, pp. 158-175. Springer, 2016.
• Claudio Di Ciccio, Fabrizio Maria Maggi, Marco Montali, Jan Mendling:
Resolving inconsistencies and redundancies in declarative process models. Inf. Syst. 64: 425-446, 2017.