Abstract: A method for process mining comprises accessing a base model for a process, generating a set of rules characterizing relations between tasks in an event log, specifying tasks that together fail to complete an instance of the process, and applying an abductive reasoning process using the set of rules and the specified tasks to identify one or more ways of completing the process instance. The method can output ways of completing the process instance that are not consistent with any single trace within the event log corresponding to a completed process instance. The method can be used for operation support, monitoring and guiding operation support, or assisting in sorting of events by case.