labelled transition systems are a fundamental modelling formalism in many areas of computer science and one often needs to compare two or more such systems in applications . for example , in doing state compression prior to model checking one wants to ensure that the compressed system yields the same model checks as the uncompressed one .
similarly , if one system is a specification and another one its implementation , then program correctness can be established by proving these systems to be equivalent . by the same token , if two systems are not equivalent , one may want to know to what degree this is so , e.g.  in a risk analysis of a safety - critical system .
this paper chooses bisimulation as the notion of equivalence of labelled transition systems .
bisimulation is an established , sufficiently fine - grained notion of equivalence between labelled transition systems @xcite so any approximative notions , e.g.  testing @xcite , have bisimulation as a well accepted point of reference .
since quantitative aspects ought to be invariant under bisimulation , we stipulate that the quotient of all labelled transition systems with respect to bisimulation is the right conceptual space for reasoning about and comparing quantitative aspects of labelled transition systems .    if two labelled transition systems are not bisimilar , one may require a quantitative measure of such differences and such a measure has many applications .
we mention security protocols @xcite , where one system is the specification and the other is an implementation and where we may wish to quantify illicit information flow @xcite or the effort needed to expose implementation flaws ; modal specifications @xcite , where a specification captures a possibly infinite set of mutually non - bisimilar labelled transition systems ; and requirements engineering @xcite , where each system may be the modal specification of a particular viewpoint and _ consistency measures on modal specifications _ are sought .
one principal aim of this paper is to unify several strands of established work in one integrated framework : metric semantics of processes  la bakker & zucker @xcite ; use of hennessy - milner logic , domain theory and transition systems  la abramsky @xcite ; means of under - specifying and refining processes  la larsen & thomsen @xcite ; and representations of classical topological spaces as maximal - point spaces of domains  la lawson @xcite . to that end
, we use a domain @xmath0 , defined in @xcite and shown to be a universal model for finitely - branching modal transition systems and fully abstract for their refinement in loc .
specifically , we discover that the metric induced by the lawson topology on @xmath0 is a generalization of the one in @xcite to modal transition systems ; that the subspace of maximal elements of @xmath0 is a stone space with respect to the lawson ( or scott ) topology ; and that this stone space is an isomorphic representation of the quotient of all labelled transition systems modulo bisimulation , so the topology and metric carry over to that quotient .
since a stone space has a _ complete _ ultra - metric , our model has labelled transition systems that are not image - finite , allowing the modelling of continuous state spaces , but all labelled transition systems can be approximated by image - finite ones to any degree of precision .
the compactness of this quotient space then makes it possible to study the topological structure of sets of implementations for modal transition systems , the second principal aim of this paper .
in particular , our topological analysis shows that 3-valued model checking @xcite reasons about compact sets of labelled transition systems , namely the set of all 2-valued refinements of a given 3-valued system .
we propose two measures , a pessimistic and an optimistic one , for how close any refining labelled transition systems of two such 3-valued systems can be .
using compactness , we prove that the optimistic measure is zero iff the two 3-valued systems in question have a common refinement .
our concepts and results are also _ robust under a change of representation _ , e.g.  in moving from event - based to state - based systems or those that combine state and event information .
it would be of interest to see whether results similar to the ones of this paper are obtainable for systems that explicitly represent time , probability ( e.g.  as done in @xcite ) or other quantitative information .    in section  [ section : domain ] we review modal transition systems , their refinement , and a fully abstract domain model for these notions .
section  [ section : stone ] establishes the central result of this paper , showing that the maximal - points space of the fully abstract domain of section  [ section : domain ] is a stone space and the quotient of all labelled transition systems with respect to bisimulation . in section
[ section : applications ] we give three applications of the compactness of this maximal - points space : a compactness theorem for hennessy - milner logic on compact sets of implementations , an abstract interpretation of compact sets of implementations as scott - closed sets of modal transition systems , and a robust consistency measure for modal transition systems .
section  [ section : related ] states related work , and section  [ section : conclude ] concludes .
modal transition systems @xcite are defined like labelled transition systems , except that transitions come in two modes that specify whether such transitions must or may be implemented . a refinement relation between modal transition systems
therefore associates to a modal transition system those refining labelled transition systems in which all implementation choices have been resolved . in this section
we formalize these notions and present the domain of @xcite as a faithful mathematical model of the model - checking framework of modal transition systems .
we define larsen & thomsen s modal transition systems @xcite , their refinement and other key concepts formally and present the domain @xmath0 which is a fully abstract model of such systems and their refinement @xcite .
our results are shown within that domain . in this paper , let @xmath1 be a fixed finite set of events and @xmath2 the set of finite words over @xmath3 with @xmath4 denoting the word of length zero .
the labelled transition systems considered here have events from @xmath3 only .
the structural properties of our domain model require that we also define dams more general notion of mixed transition systems @xcite .    a modal transition system @xmath5 has two transition relations @xmath6 on a set of states @xmath7 . the sets @xmath8 and @xmath9 specify _ contractual promises or expectations _ about the reactive capacity and incapacity of implementations , respectively .
these guarantees are to be understood with respect to the refinement of states .
we write `` _ a _ '' in @xmath10 to denote * a*sserted behavior and `` _ c _ '' in @xmath11 to denote * c*onsistent behavior and use these annotations in judgments @xmath12 and @xmath13 below with the same meaning .    in figure
[ fig : ref ] we see a contractual guarantee that any state refining @xmath14 can not have a transition labelled with @xmath15 to a state refining @xmath16 as the triple @xmath17 is not in @xmath18 .
there is a contractual guarantee that any state refining @xmath19 has a @xmath8-transition labelled with @xmath15 to all states that refine @xmath14 or @xmath20 .    1 .   *
a _ mixed transition system _ @xcite is a triple @xmath21 such that , for every _ mode _ @xmath22 , the pair @xmath23 is a _ labelled transition system _ , i.e.  @xmath24 . *
if @xmath25 , then @xmath5 is a _ modal _
transition system @xcite .
* we call @xmath5 _ image - finite _
iff for all @xmath26 , @xmath27 , and @xmath28 the set @xmath29 is finite . * a mixed transition system @xmath5 with a designated initial state @xmath30
is _ pointed _ , written @xmath31 .
* we call elements of @xmath8 _ must - transitions _ and elements of @xmath32 _ may - transitions_. 2
.   let @xmath33 be a mixed transition system . *
a relation @xmath34 is a _ refinement within @xmath5 _
@xcite iff @xmath35 implies , for all @xmath27 , 1 .
if @xmath36 , there exists some @xmath37 such that @xmath38 ; and 2 .
if @xmath39 , there exists some @xmath40 such that @xmath38 .
* we write @xmath41 or @xmath42 if there is some refinement @xmath43 with @xmath35 . in that case ,
@xmath44 _ refines _ ( _ is abstracted by _ ) @xmath45 .
* states @xmath45 and @xmath44 are _ refinement - equivalent _ iff ( @xmath46 and @xmath47 ) . * let @xmath48 mean that @xmath49 refines @xmath30 in the mixed transition system that is the disjoint union of @xmath5 and @xmath50 ; @xmath31 and @xmath51 are refinement - equivalent iff @xmath30 and @xmath49 are refinement - equivalent in that union . * the _ implementations _ of @xmath31 are those pointed modal transition systems without may - transitions that refine @xmath31 .    as the union @xmath52 of all refinements within @xmath5 is also a refinement within @xmath5
, @xmath52 is the greatest refinement relation within @xmath5 .
please note that we use the relational inverse of the @xmath43 in @xcite , as done in @xcite , so our @xmath53 is written as @xmath54 in @xcite .
larsen & thomsen s modal transition systems and their refinement @xcite are partial versions of labelled transition systems and bisimulation @xcite .
a modal transition system represents those labelled transition systems that refine it , the implementations of @xmath5 .
this representation is sound , for if a modal transition system @xmath5 refines a modal transition system @xmath50 , all labelled transition systems that refine @xmath5 also refine @xmath50 as @xmath55 is transitive
.    1 .   figures  [ fig : ref ] and  [ fig : reftwo ] depict modal transition systems , where dashed and solid lines depict may - transitions and must - transitions , respectively .
the refinement @xmath43 identifies states with the same activity ; e.g.  drinks with tomdrinks and bobdrinks etc .
the mixed transition system on the left of figure  [ fig : mixed ] is not a modal transition system but is refinement - equivalent to the modal transition system on the right of figure  [ fig : mixed ] .    #
1#2#3#4#5 @font    ( 3471,2056)(0,-10 ) ( 957,1129)(2982,1129 ) ( 2862.000,1099.000)(2982.000,1129.000)(2862.000,1159.000)(2898.000,1129.000)(2862.000,1099.000 ) ( 597,1039)(1542,364 ) ( 1426.915,409.337)(1542.000,364.000)(1461.789,458.161)(1473.646,412.824)(1426.915,409.337 ) ( 3297,994)(2037,364 ) ( 2130.915,444.498)(2037.000,364.000)(2157.748,390.833)(2112.132,401.566)(2130.915,444.498 ) ( 3207,1309)(1722,1759)(822,1309 ) ( 915.915,1389.498)(822.000,1309.000)(942.748,1335.833)(897.132,1346.566)(915.915,1389.498 ) ( 462,1309)(12,1579)(372,2029)(597,1354 ) ( 530.592,1458.355)(597.000,1354.000)(587.513,1477.329)(570.437,1433.689)(530.592,1458.355 ) ( 1632,274)(597,274)(597,859 ) ( 627.000,739.000)(597.000,859.000)(567.000,739.000)(597.000,775.000)(627.000,739.000 ) ( 2172,274)(3297,274)(3297,814 ) ( 3327.000,694.000)(3297.000,814.000)(3267.000,694.000)(3297.000,730.000)(3327.000,694.000 ) ( 1677,184)(0,0)[lb ] ( 372,1084)(0,0)[lb ] ( 3072,1084)(0,0)[lb ] ( 1677,1219)(0,0)[lb ] ( 1092,769)(0,0)[lb ] ( 2217,769)(0,0)[lb ] ( 687,49)(0,0)[lb ] ( 2352,49)(0,0)[lb ] ( 2397,1669)(0,0)[lb ] ( 552,1804)(0,0)[lb ]    # 1#2#3#4#5 @font    ( 3855,4494)(0,-10 ) ( 777,912)(1722,1992 ) ( 1665.557,1881.936)(1722.000,1992.000)(1620.402,1921.446)(1666.686,1928.784)(1665.557,1881.936 ) ( 732,597)(372,237)(867,12)(867,507 ) ( 897.000,387.000)(867.000,507.000)(837.000,387.000)(867.000,423.000)(897.000,387.000 ) ( 3432,3612)(1992,4062)(867,3612 ) ( 967.275,3684.421)(867.000,3612.000)(989.559,3628.713)(944.992,3643.197)(967.275,3684.421 ) ( 867,3297)(1767,2262 ) ( 1665.620,2332.867)(1767.000,2262.000)(1710.897,2372.238)(1711.881,2325.387)(1665.620,2332.867 ) ( 1677,2127)(642,2127)(642,3207 ) ( 672.000,3087.000)(642.000,3207.000)(612.000,3087.000)(642.000,3123.000)(672.000,3087.000 ) ( 552,3612)(12,3972)(642,4467)(642,3792 ) ( 612.000,3912.000)(642.000,3792.000)(672.000,3912.000)(642.000,3876.000)(612.000,3912.000 ) ( 3432,3297)(2082,2262 ) ( 2158.980,2358.820)(2082.000,2262.000)(2195.486,2311.204)(2148.663,2313.108)(2158.980,2358.820 ) ( 2217,2127)(3567,2127)(3567,3207 ) ( 3597.000,3087.000)(3567.000,3207.000)(3537.000,3087.000)(3567.000,3123.000)(3597.000,3087.000 ) ( 1857,1947)(1857,1137)(1182,867 ) ( 1282.275,939.421)(1182.000,867.000)(1304.559,883.713)(1259.992,898.197)(1282.275,939.421 ) ( 1992,1947)(1992,1137)(3027,822 ) ( 2903.464,828.239)(3027.000,822.000)(2920.934,885.640)(2946.639,846.458)(2903.464,828.239 ) ( 1407,732)(2982,732 ) ( 2862.000,702.000)(2982.000,732.000)(2862.000,762.000)(2898.000,732.000)(2862.000,702.000 ) ( 1362,3432)(3072,3432 ) ( 2952.000,3402.000)(3072.000,3432.000)(2952.000,3462.000)(2988.000,3432.000)(2952.000,3402.000 ) ( 1767,2037)(0,0)[lb ] ( 417,3387)(0,0)[lb ] ( 417,687)(0,0)[lb ] ( 3117,3387)(0,0)[lb ] ( 3117,687)(0,0)[lb ] ( 777,4197)(0,0)[lb ] ( 2532,3972)(0,0)[lb ] ( 2577,2217)(0,0)[lb ] ( 867,2217)(0,0)[lb ] ( 1362,2847)(0,0)[lb ] ( 1767,3522)(0,0)[lb ] ( 642,1452)(0,0)[lb ] ( 1092,102)(0,0)[lb ] ( 1767,552)(0,0)[lb ] ( 2082,1182)(0,0)[lb ] ( 2307,2847)(0,0)[lb ] ( 1137,1182)(0,0)[lb ]    we may identify modal transition systems @xmath56 with labelled transition systems @xmath57 and refinement between such modal transition systems with bisimulation @xcite and will freely move between these two representations of labelled transition systems and bisimulation subsequently .
before we present the domain model for refinement of modal transition systems we use scott s interval domain @xcite as a motivating example that features most of the desirable properties of our domain model .
figure  [ fig : idom ] shows the interval domain and its ordering : @xmath58\leq [ r',s']$ ] iff ( @xmath59 and @xmath60 ) . in that case
we say that @xmath61 $ ] refines @xmath58 $ ] .    #
1#2#3#4#5 @font    ( 5175,4860)(0,-10 ) ( 3015,4545 ) ( 3015,4545 ) ( 540,4545)(5040,4545)(2790,270)(540,4545 ) ( 2565,3420)(2340,4545 ) ( 2565,3420)(3690,4545 ) ( 2790,2475)(1215,4545 ) ( 2790,2475)(4455,4545 ) ( 2790,2475)(2792,2477)(2795,2481 ) ( 2801,2488)(2809,2498)(2820,2512 ) ( 2833,2528)(2847,2546)(2862,2566 ) ( 2876,2588)(2890,2610)(2902,2633 ) ( 2913,2656)(2921,2681)(2928,2707 ) ( 2931,2734)(2930,2762)(2925,2790 ) ( 2915,2816)(2903,2839)(2889,2858 ) ( 2875,2872)(2862,2882)(2850,2888 ) ( 2838,2892)(2827,2894)(2816,2895 ) ( 2805,2896)(2793,2897)(2780,2900 ) ( 2765,2905)(2747,2913)(2727,2923 ) ( 2705,2937)(2680,2953)(2655,2970 ) ( 2628,2989)(2604,3005)(2585,3017 ) ( 2569,3024)(2557,3028)(2548,3029 ) ( 2541,3028)(2535,3026)(2529,3024 ) ( 2524,3024)(2517,3026)(2510,3031 ) ( 2501,3042)(2492,3057)(2482,3079 ) ( 2475,3105)(2472,3131)(2471,3156 ) ( 2472,3178)(2474,3197)(2477,3213 ) ( 2481,3226)(2485,3236)(2489,3244 ) ( 2494,3251)(2498,3259)(2504,3268 ) ( 2509,3278)(2516,3292)(2523,3310 ) ( 2532,3331)(2542,3358)(2553,3388 ) ( 2565,3420)(2579,3456)(2593,3487 ) ( 2605,3512)(2616,3531)(2625,3544 ) ( 2634,3553)(2641,3558)(2648,3562 ) ( 2654,3566)(2661,3572)(2667,3580 ) ( 2675,3592)(2682,3609)(2689,3632 ) ( 2696,3659)(2700,3690)(2701,3724 ) ( 2699,3753)(2695,3774)(2690,3789 ) ( 2685,3798)(2680,3803)(2674,3806 ) ( 2668,3809)(2661,3814)(2653,3823 ) ( 2645,3837)(2634,3857)(2623,3884 ) ( 2610,3915)(2597,3946)(2586,3974 ) ( 2575,3996)(2567,4013)(2559,4026 ) ( 2552,4035)(2546,4043)(2540,4050 ) ( 2535,4058)(2530,4069)(2525,4082 ) ( 2521,4100)(2519,4120)(2520,4140 ) ( 2524,4155)(2530,4167)(2536,4176 ) ( 2542,4181)(2547,4184)(2551,4186 ) ( 2554,4186)(2558,4185)(2561,4184 ) ( 2566,4183)(2573,4182)(2582,4182 ) ( 2594,4183)(2611,4183)(2631,4184 ) ( 2655,4185)(2681,4184)(2706,4182 ) ( 2728,4179)(2746,4175)(2761,4171 ) ( 2774,4166)(2784,4160)(2794,4155 ) ( 2803,4150)(2813,4145)(2825,4140 ) ( 2840,4137)(2858,4135)(2879,4134 ) ( 2902,4136)(2925,4140)(2946,4147 ) ( 2963,4154)(2975,4162)(2984,4168 ) ( 2989,4174)(2992,4178)(2993,4182 ) ( 2993,4185)(2992,4189)(2992,4193 ) ( 2993,4200)(2995,4208)(2998,4220 ) ( 3003,4235)(3009,4254)(3015,4275 ) ( 3020,4301)(3024,4327)(3026,4351 ) ( 3027,4374)(3026,4395)(3025,4416 ) ( 3023,4435)(3021,4453)(3019,4469 ) ( 3018,4482)(3016,4492)(3015,4497)(3015,4500 ) ( 0,4545)(0,0)[lb ] ( 5175,4545)(0,0)[lb ] ( 2700,0)(0,0)[lb ] ( 990,4680)(0,0)[lb ] ( 2745,4635)(0,0)[lb ] ( 2070,4635)(0,0)[lb ] ( 3465,4635)(0,0)[lb ] ( 4320,4635)(0,0)[lb ] ( 2565,3195)(0,0)[lb ] ( 2700,2295)(0,0)[lb ] ( 3240,630)(0,0)[lb ] ( 3600,1215)(0,0)[lb ]    the interval domain nicely illustrates some of the properties we expect our domain model @xmath0 to have .    1 .
* refinement is complete for implementations : * real numbers @xmath62 $ ] represented as intervals @xmath63 $ ] are the `` implementations '' of intervals , so @xmath58 $ ] has all @xmath63 $ ] with @xmath64 $ ] as implementations .
one can easily see that @xmath58 $ ] is refined by @xmath61 $ ] iff all implementations of @xmath61 $ ] are also implementations of @xmath58 $ ] .
* universality : * the interval domain @xmath65 is universal for worst / best - case abstractions of subsets of @xmath66 $ ] .
if we abstract @xmath67 $ ] by the interval @xmath68\in{{\mathbb i}}$ ] , any element of @xmath65 is the abstraction of at least one such @xmath69 .
in fact , there is a galois connection @xmath70})}^{\rm op}\to { { \mathbb i}}$ ] and @xmath71})}^{\rm op}$ ] where @xmath72 $ ] is the monotone abstraction function , @xmath73 ) = [ r , s]$ ] is the monotone `` concretization '' function , and @xmath74 and @xmath75})}^{\rm op}}$ ] .
* full abstraction : * the order on @xmath65 coincides with the refinement relation as the latter means reverse containment of implementations by item  ( 1 ) above . 4 .
* classical space as maximal - points space : * the set @xmath66 $ ] equipped with the compact euclidean topology is isomorphic as a topological space to the set of maximal elements of @xmath65 in the topology induced by the scott- or lawson - topology of @xmath65 .
* denseness of computable structures : * intervals with rational endpoints approximate intervals to any degree of precision .
* consistency measure : * the map @xmath76 defined by @xmath77,[r',s ' ] ) = [ \max(r , r'),\min(s , s')]$ ] , where @xmath78 $ ] is understood to be @xmath79 if @xmath80 , tells us whether its inputs are consistent with each other by checking whether its output is different from @xmath79 .
non - overlapping intervals can not possibly approximate the same real number .
the domain model @xmath0 for refinement of modal transition systems @xcite has similar properties which we discuss briefly here prior to their technical development in this paper .
the completeness proof for implementations for refinement of modal transition systems does not depend on the compactness of @xmath81 , is non - trivial , and presented elsewhere @xcite .
universality amounts to showing that every modal transition system has a refinement - equivalent embedding in the domain @xmath0 .
full abstraction means that the order on @xmath0 equals the greatest refinement relation on @xmath0 interpreted as a modal transition system .
the maximal - points space @xmath81 of @xmath0 gives us a precise model of labelled transition systems and their notion of `` nearness . ''
this space turns out to be the quotient of labelled transition systems with respect to bisimulation such that the familiar metric based on tests expressed in hennessy - milner logic @xcite induces the topology on that space .
finite - state labelled transition systems are shown to be dense in this space .
finally , the compactness of this space is proved and a monotone consistency measure    @xmath82    between two modal transition systems is then derived thereof .
said compactness then renders a galois connection between compact sets of implementations and scott - closed sets of modal transition systems as shown in theorem  [ theorem : gc ] below .
apart from these similarities with @xmath65 , a key difference is that @xmath0 is algebraic and that the maximal - points space is therefore zero - dimensional .
the reader familiar with domain theory @xcite may safely skip the next definition .    1 .   * a _ topological space _ @xmath83 consists of a set @xmath69 and a family @xmath84 of subsets of @xmath69 such that @xmath85 and @xmath69 are in @xmath84 , and @xmath84 is closed under finite intersections and arbitrary unions . * elements @xmath86 are _
_ , complements @xmath87 with @xmath88 are _ @xmath84-closed _ , and sets that are @xmath84-open and @xmath84-closed are _
@xmath84-clopen_. 2 .   * a subset @xmath89 of a partial order @xmath90
is _ directed _ iff ( for all @xmath91 there is some @xmath92 with @xmath93 ) . * a partial order @xmath90 is a _
iff all its directed subsets @xmath89 have a least upper bound @xmath94 .
* we write @xmath95 for the set of _ upper bounds _ of @xmath89 . *
we denote by @xmath96 the set of _ minimal upper bounds _ of @xmath89 . *
an element @xmath97 is _ compact _ in a dcpo @xmath98 iff ( for all directed sets
@xmath89 of @xmath98 with @xmath99 there is some @xmath100 with @xmath101 ) .
we write @xmath102 for the set of compact elements of @xmath98 . *
a dcpo @xmath98 is _ algebraic _ iff for all @xmath103 the set @xmath104 is directed with least upper bound @xmath105 .
* for a finite subset @xmath106 of @xmath98 define , for all @xmath107 + @xmath108 * a _ bifinite domain _ , also known as an _
sfp_-domain , is an algebraic dcpo @xmath98 such that for every finite subset @xmath109 the set @xmath110 is finite , contained in @xmath102 , and @xmath111 where for any @xmath112 we write + @xmath113 * we call @xmath69 _ upper _ iff @xmath114 ; _ lower _ iff @xmath115 .
3 .   for a bifinite domain @xmath98
, we define * the _ scott - topology _ @xmath116 to consist of all subsets @xmath117 of @xmath98 satisfying @xmath118 * the _ lawson - topology _ @xmath119 to consist of all subsets @xmath120 of @xmath98
such that @xmath121 implies the existence of some @xmath122 with @xmath123 ; and * the _ @xmath116-compact saturated _ subsets of @xmath98 to be the @xmath119-closed upper subsets of @xmath98 .
the definitions of item  ( 3 ) above are really characterizations  @xcite .
we use the _ initial _
solution @xmath0 of a domain equation , presented in @xcite and denoted by @xmath124 in loc .
, as the domain whose set of maximal points we prove to be the stone space of pointed labelled transition systems modulo bisimulation .
the items  ( 2 ) and  ( 3 ) of definition  [ def : mtsd ] below are definition  8 and  9 of @xcite , respectively .
[ def : mtsd ]    1 .
the _ mixed powerdomain _
@xmath125}$ ] @xcite of a bifinite domain @xmath98 has as elements all pairs @xmath126 where @xmath127 is @xmath116-closed and @xmath117 is @xmath116-compact saturated such that @xmath127 and @xmath117 satisfy the mix condition + @xmath128 + the order on @xmath125}$ ] is defined by + @xmath129 2
.   since @xmath125}$ ] is a bifinite domain whenever @xmath98 is bifinite and since the functors @xmath130 and @xmath131 are locally continuous @xcite , we can solve the domain equation + @xmath132}\ ] ] + over bifinite domains where @xmath133 denotes the product functor over all events in @xmath3 , and write @xmath0 for the _ initial solution _ of that equation .
3 .   the domain @xmath0 may be _ interpreted as a pointed mixed transition system _ + @xmath134 + where the recursion @xmath135 of the equation  ( [ equ : recursion ] ) for @xmath0 specifies that all elements @xmath136 in the set @xmath137 ( @xmath138 ) are exactly the @xmath139-successors ( @xmath140-successors ) of @xmath105 for @xmath141 in @xmath124 ( respectively ) .
thus , the @xmath127 and @xmath117 in  ( [ equ : mix ] ) model @xmath139- and @xmath140-transitions within @xmath124 , respectively .
the order - theoretic mix condition  ( [ equ : mix ] ) has an equivalent version for mixed transition systems .    a mixed transition system @xmath33 satisfies the _ mix condition ( mc ) _ iff ( for all @xmath36 there is some @xmath142 such that @xmath143 ) .    as shown in proposition  3 in @xcite ,  ( [ equ : mix ] )
ensures that @xmath124 satisfies the mix condition  ( mc ) since the order on @xmath0 is a refinement within @xmath0 : for all @xmath144 there is some @xmath145 such that @xmath146 .
[ example : mix ] figure  [ fig : mixed ] demonstrates that mixed transition systems @xmath147 ) that satisfy the mix condition ( mc ) are refinement - equivalent to modal transition systems @xmath148 . therefore
, such mixed transition systems are merely modal transition systems in disguise @xcite .
# 1#2#3#4#5 @font    ( 5488,2457)(0,-10 ) ( 1362,180 ) ( 462,1530 ) ( 2262,1530 ) ( 4512,180 ) ( 5412,1508 ) ( 3612,1530 ) ( 1317,225)(507,1440 ) ( 598.526,1356.795)(507.000,1440.000)(548.603,1323.513)(553.595,1370.108)(598.526,1356.795 ) ( 1473,287)(2238,1367 ) ( 2193.119,1251.737)(2238.000,1367.000)(2144.157,1286.418)(2189.447,1298.454)(2193.119,1251.737 ) ( 1362,360)(2127,1440 ) ( 2082.119,1324.737)(2127.000,1440.000)(2033.157,1359.418)(2078.447,1371.454)(2082.119,1324.737 ) ( 417,1575)(12,1980)(462,2430)(462,1755 ) ( 432.000,1875.000)(462.000,1755.000)(492.000,1875.000)(462.000,1839.000)(432.000,1875.000 ) ( 2172,1530)(597,1530 ) ( 717.000,1560.000)(597.000,1530.000)(717.000,1500.000)(681.000,1530.000)(717.000,1560.000 ) ( 4546,278)(5311,1358 ) ( 5266.119,1242.737)(5311.000,1358.000)(5217.157,1277.418)(5262.447,1289.454)(5266.119,1242.737 ) ( 5277,1530)(3702,1530 ) ( 3822.000,1560.000)(3702.000,1530.000)(3822.000,1500.000)(3786.000,1530.000)(3822.000,1560.000 ) ( 3522,1530)(3117,1935)(3567,2385)(3567,1710 ) ( 3537.000,1830.000)(3567.000,1710.000)(3597.000,1830.000)(3567.000,1794.000)(3537.000,1830.000 ) ( 192,1305)(0,0)[lb ] ( 2307,1305)(0,0)[lb ] ( 1182,1620)(0,0)[lb ] ( 552,2025)(0,0)[lb ] ( 1857,585)(0,0)[lb ] ( 1092,0)(0,0)[lb ] ( 687,630)(0,0)[lb ] ( 1452,900)(0,0)[lb ] ( 4152,1575)(0,0)[lb ] ( 4872,630)(0,0)[lb ] ( 3612,1980)(0,0)[lb ] ( 3297,1350)(0,0)[lb ] ( 4242,45)(0,0)[lb ] ( 5367,1260)(0,0)[lb ]    by proposition  1 in @xcite and as seen in the previous example , the mix condition  ( mc ) guarantees that the _ mixed _ transition system @xmath149 is refinement - equivalent to the _ modal _ transition system @xmath150 .
therefore all reasoning that is invariant under refinement equivalence , as is the case in this paper , may be done with the latter modal transition system and we abuse notation to refer to that modal transition system as @xmath124 as well .
the domain model @xmath0 is _ universal _ : there is an embedding @xmath151 from the class of image - finite pointed mixed transition system satisfying the mix - condition  ( mc ) to elements of @xmath0 such that @xmath31 and @xmath152 are refinement - equivalent ( theorem  6.1 in @xcite ) .
the domain model @xmath0 is _ fully abstract _ : for all @xmath153 , we have @xmath154 iff @xmath155 ( theorem  5 in @xcite ) . for sake of completeness
, we sketch the construction of this embedding and needed aspects of the full abstraction proof in the next section .
we show that the maximal elements of @xmath0 are precisely the representations of pointed labelled transition systems modulo bisimulation ; and that this quotient is a stone space and therefore determined by a complete ultra metric .
we define the required notions from topology .
[ def : ultra ]    1 .
a topological space @xmath83 is 1 .
_ compact _ iff for all @xmath156 with @xmath157 there is a finite subset @xmath158 with @xmath159 ; 2 .
_ hausdorff _ iff for all @xmath160 in @xmath69 there are @xmath161 with @xmath162 , @xmath163 and @xmath164 ; 3 .   _ zero - dimensional
_ iff every @xmath84-open set is the union of @xmath84-clopens ; and 4 .   a _ stone space _ iff it is zero - dimensional , compact , and hausdorff .
2 .   a subset @xmath165 of @xmath83 is _
@xmath84-compact _ iff the topological space @xmath166 is compact .
a subset @xmath89 of @xmath69 is _ dense _ in @xmath83 iff @xmath167 is non - empty for all non - empty @xmath168 .
[ item : fourd ] an _ ultra - metric _ on @xmath69 is a function @xmath169 $ ] such that for all @xmath170 1 .   @xmath171 iff @xmath172 ; 2 .
@xmath173 ; and 3 .
5 .   an ultra - metric @xmath169 $ ] _ determines a topology @xmath175 _ on @xmath69 whose elements are all those @xmath176 that are unions of sets of the form @xmath177 for @xmath178 and rational @xmath179 .
a topological space @xmath83 is _ ultra - metrizable _ iff there is an ultra - metric @xmath169 $ ] such that @xmath180 .
we denote by @xmath181 the set of _ maximal elements _ of @xmath0 .
the set + @xmath182 + has a _ maximal - points space topology _
@xcite + @xmath183 8 .   for @xmath184
, we write + @xmath185    since @xmath0 is a bifinite domain , the lawson condition  @xcite holds for @xmath0 , namely that the topology @xmath186 is also induced by the @xmath187-topology :    @xmath188    we remark that not all bifinite domains @xmath98 enjoy the property that @xmath189 is compact in the topology induced by @xmath116 or @xmath119 .
we first record that @xmath190 is hausdorff and zero - dimensional . proposition  [ prop : zero ] below holds for any algebraic domain satisfying the lawson condition  @xcite .
we state and prove that proposition for @xmath0 for sake of completeness .    [
prop : zero ] the topological space @xmath191 is zero - dimensional and hausdorff .    * every @xmath192 is the union of @xmath193-opens @xmath194 , @xmath195 , as @xmath0 is algebraic . but
each @xmath194 is @xmath187-clopen as @xmath196 and @xmath194 is @xmath187-closed . from the lawson condition for @xmath0 ,  ( [ equ : lawsoncondition ] )
, we infer that @xmath197 is @xmath190-clopen and so @xmath186 is zero - dimensional as every @xmath198 is the union of such sets . * to show that @xmath186 is hausdorff , let @xmath199 .
since @xmath0 is a partial order we may assume @xmath80 without loss of generality . since @xmath0 is algebraic , @xmath80 implies @xmath200 and @xmath201 for some @xmath195 .
but @xmath197 is @xmath186-open and contains @xmath202 whereas @xmath203 is in @xmath204 which is @xmath190-open since @xmath197 is also @xmath190-closed .
we use tools from temporal logic to develop a sufficient criterion for membership in @xmath205 .
[ def : weak ]    1 .
the set of formulas of _ hennessy - milner logic _
@xcite is generated by the grammar + @xmath206 + where @xmath141 ranges over the finite set of events @xmath3 .
2 .   let @xmath207 be a pointed modal transition system .
larsen s semantics , denoted by @xmath208 in @xcite for hennessy - milner logic in negation normal form , is depicted in figure  [ fig : hml ] .
3 .   we write @xmath209}}$ ] for @xmath210 and @xmath211 for @xmath212 subsequently for all @xmath27 and all @xmath213 and @xmath214 of hennessy - milner logic .
@xmath215    for each @xmath28 we have    @xmath216}}\phi & \mbox{iff } & \mbox{for all $ ( i,\alpha , i')\in{{r } ^{\it { \it \neg m}}}$ , $ ( n , i'){{\models } ^{\it { m}}}\phi$}\\ ( n , i){{\models } ^{\it { m}}}\phi\lor\psi & \mbox{iff } & \mbox{$((n , i){{\models } ^{\it { m}}}\phi$ or $ ( n , i){{\models } ^{\it { m}}}\psi)$\ , .}\end{array}\ ] ]    please note that @xmath217}}\phi$ ] universally quantifies over transitions in the _ dual _ mode @xmath218 .
[ example : two ] consider the modal transition system @xmath50 in figure  [ fig : ref ]
.    1 .   [ item : one ] we have @xmath219 because of the @xmath18-transition @xmath220 . by the semantics of negation , this implies @xmath221 .
we also infer @xmath222 as there is no state @xmath45 with @xmath223 . by the semantics of disjunction
, these two judgments render @xmath224 .
this judgment says that we ca nt determine that @xmath225 is asserted in state @xmath16 in @xmath50 .
as that formula is a tautology over labelled transition systems we see that judgments @xmath226 under - approximate validity judgments `` all refinements of @xmath227 satisfy @xmath213 . '' as we show below , it turns out that the ability to capture these validity judgments for certain tautologies over labelled transition systems via @xmath12 is what characterizes modal transition systems that are refinement - equivalent to labelled transition systems .
[ item : two ] we have @xmath228}}{{[{\rm talks}]}}({{\langle { \rm drinks}\rangle } } { { \it t\!t}}\lor\neg{{\langle { \rm drinks}\rangle } } { { \it t\!t}})$ ] as there is an @xmath18-path @xmath229 for the word @xmath230 and @xmath231 by item  ( 1 ) .
therefore , the check @xmath232}}{{[{\rm talks}]}}({{\langle { \rm drinks}\rangle } } { { \it t\!t}}\lor\neg{{\langle { \rm drinks}\rangle } } { { \it t\!t}})$ ] is unable to validate a tautology over labelled transition systems at state waits in @xmath50 .
we sketch the definition of the embedding @xmath233 for an image - finite modal transition system @xmath31 such that @xmath31 and @xmath152 are refinement - equivalent @xcite .
this construction follows ideas from algebraic semantics  la nivat - courcelle - guessarian @xcite or  la goguen - thatcher - wagner - wright @xcite in that we unfold pointed modal transition systems as finite trees for a fixed depth , adding a may - stub to all leaves of that tree for which there are still outgoing transitions in the pointed modal transition system .
this unfolding is presented here via a simple process algebra .    1 .
the grammar for the _ process algebra @xmath234 _ is + @xmath235 + where @xmath141 ranges over the finite set of events @xmath3 and no @xmath236 in @xmath237 is allowed to be @xmath238 or @xmath239 .
2 .   for each @xmath240 let @xmath241 be as in figure  [ fig : pad ] .
3 .   for all
@xmath240 , the structural operational semantics in figure  [ fig : sos ] defines a pointed modal transition system @xmath242 _ { } } } , p)$ ] .
l @xmath243 +   + @xmath244 +   + @xmath245 +   + @xmath246 +   + @xmath247 +   + @xmath248 +   + @xmath249 +   +    let @xmath240 be @xmath250 .
then @xmath242_{}}},p)$ ] is refinement - equivalent to the image - finite pointed modal transition system in figure  [ fig : app ] .
we record that the denotational semantics of @xmath234 in @xmath0 matches the structural operational semantics .
this proof is straightforward and amounts to showing that the saturations with @xmath251 and @xmath252 in @xmath0 do not break refinement equivalence as they always occur in the right direction .
[ lemma : match ] for all @xmath240 , the modal transition system @xmath242_{}}},p)$ ] is refinement - equivalent to the mixed transition system @xmath253 .    to define the embedding @xmath254 for an image - finite pointed modal transition system @xmath31 consider @xmath255 , unwind @xmath5 from @xmath30 as a tree @xmath256 $ ] such that all , and only , paths of length @xmath257 of @xmath5 are present .
if a leaf of that tree has some @xmath18-successor in @xmath5 , create @xmath18-loops on that leaf for _ all _ events in @xmath3 ( a _ may - stub _ ) ; otherwise , leave it as is ( deadlock ) . by construction , this image - finite pointed modal transition system @xmath258,i)$ ] is the operational meaning @xmath259 _ { } } } , p_m)$ ] of a term @xmath260 so @xmath261 and lemma  [ lemma : match ] imply that @xmath262 .
thus @xmath263 is directed and we can set    @xmath264    and note , shown in @xcite for bifinite domains without reference to a process algebra , that    @xmath265    we may thus represent all @xmath195 in the form @xmath266 for some @xmath240 subsequently .    ll & @xmath267 +   + @xmath268 & @xmath269 +   + @xmath270 & @xmath271 +   +    figure  [ fig : app ] illustrates the construction of a finite approximation and depicts @xmath272,{\rm tomdrinks})$ ] for the pointed modal transition system @xmath273 of figure  [ fig : reftwo ] .    # 1#2#3#4#5 @font    ( 3900,2634)(0,-10 ) ( 2037,225)(2037,1215 ) ( 2067.000,1095.000)(2037.000,1215.000)(2007.000,1095.000)(2037.000,1131.000)(2067.000,1095.000 ) ( 1722,225)(912,1215 ) ( 1011.207,1141.122)(912.000,1215.000)(964.770,1103.128)(965.192,1149.988)(1011.207,1141.122 ) ( 597,1575)(12,2070)(687,2340)(687,1755 ) ( 657.000,1875.000)(687.000,1755.000)(717.000,1875.000)(687.000,1839.000)(657.000,1875.000 ) ( 1992,1575)(1407,2070)(2082,2340)(2082,1755 ) ( 2052.000,1875.000)(2082.000,1755.000)(2112.000,1875.000)(2082.000,1839.000)(2052.000,1875.000 ) ( 2307,225)(3432,1215 ) ( 3361.733,1113.203)(3432.000,1215.000)(3322.096,1158.246)(3368.940,1159.507)(3361.733,1113.203 ) ( 1812,0)(0,0)[lb ] ( 462,1350)(0,0)[lb ] ( 1812,1350)(0,0)[lb ] ( 3162,1350)(0,0)[lb ] ( 822,495)(0,0)[lb ] ( 2307,720)(0,0)[lb ] ( 1407,990)(0,0)[lb ] ( 12,2475)(0,0)[lb ] ( 1632,2475)(0,0)[lb ]    we define the characteristic formulas for terms @xmath236 of the process algebra @xmath234 , which will also be the characteristic formulas of the compact elements @xmath266 of @xmath0 .    for each @xmath240
, we define the formula @xmath274 of hennessy - milner logic in figure  [ fig : phip ] .
l @xmath275 +   + @xmath276 +   + @xmath277}}\phi _ p\land\bigwedge _ { \beta\not=\alpha } \neg{{\langle { \beta}\rangle } } { { \it t\!t}}$ ] +   + @xmath278}}\phi _ p\land \bigwedge _ { \beta\not=\alpha } \neg{{\langle { \beta}\rangle } } { { \it t\!t}}$ ] +   + @xmath279 +   + @xmath280 } } ( \bigvee _ { v\in \{\bot,{{\it t\!t}}\ } } \ { \phi _ { r'}\mid p+q\longrightarrow ^\alpha_v r'\})$ ]    these formulas characterize their terms , for one can interchange refinement checks @xmath281 with model checks @xmath282 for all @xmath283 .
[ lemma : psip ] for all @xmath283 we have    @xmath284    we prove this by structural induction on @xmath240 .
* we have @xmath285 iff ( there are no @xmath140-transitions out of @xmath105 ) iff @xmath286 .
* we have @xmath287 for all @xmath283 , but also @xmath288 for all @xmath283 . * using induction on @xmath236 , we have @xmath289 iff ( there is a @xmath139-transition @xmath290 in @xmath0 with @xmath291 ; all @xmath140-transitions @xmath292 in @xmath0 satisfy @xmath293 ; and there are no @xmath140-transitions out of @xmath105 in @xmath0 for other events ) .
this exactly captures @xmath294 .
* by induction on @xmath236 , we have @xmath295 iff ( there are no @xmath140-transitions out of @xmath105 for events other than @xmath141 , and all @xmath140-transitions @xmath290 satisfy @xmath291 ) . but this captures @xmath296 . *
let @xmath297 .
then @xmath298 and induction express that all @xmath139-transitions out of @xmath299 to some @xmath300 can be answered by corresponding @xmath301 with @xmath302 ; whereas @xmath303 } } \bigl ( \bigvee \ { \psi _ { r'}\mid\exists v\in \{\bot,{{\it t\!t}}\}\colon p+q\longrightarrow ^\alpha_v r'\}\bigr ) $ ] states that all @xmath304 can be answered in @xmath305 by corresponding @xmath140-transitions to some @xmath300 such that @xmath306 by induction .
so @xmath307 .
this characterization is the key to proving that @xmath0 is fully abstract and that refinement is characterized by the semantics for hennessy - milner logic .
[ cor : hjs04 ]    1 .
the order on @xmath0 is the greatest refinement relation within @xmath124 .
2 .   for all pointed modal transition systems @xmath31 and @xmath51
the following are equivalent : 1 .
@xmath48 2 .   for all @xmath213 of hennessy - milner logic
, @xmath308 implies @xmath309 3 .   for all @xmath213 of hennessy - milner logic , @xmath310 implies @xmath311 .    1 .
that the order of @xmath0 is a refinement follows directly from the definition of @xmath124 . for the converse ,
we show `` @xmath312 implies that @xmath313 does not refine @xmath314 : '' first note that @xmath315 order - generates @xmath0 so @xmath312 implies @xmath316 and @xmath317 for some @xmath195 .
then there is @xmath240 with @xmath318 so that , by lemma  [ lemma : psip ] , for all @xmath319 : @xmath320 iff @xmath321 .
thus , @xmath322 and @xmath323 imply that @xmath324 does not refine @xmath105 in @xmath124 .
2 .   since @xmath325 and @xmath326 are dual with respect to negation , ( b ) and ( c ) are equivalent .
the proof that ( a ) implies ( b ) is a straightforward structural induction on @xmath213 @xcite . that ( b ) implies ( a ) follows from item  ( 1 ) , lemma  [ lemma : psip ] , and the fact that @xmath0 is algebraic
.    we demonstrate that embeddings of pointed image - finite labelled transition systems are dense in @xmath327 , which we subsequently show to be the quotient space of all pointed labelled transition systems with respect to bisimulation .
the denseness argument rests on the fact that embeddings of implementations are maximal elements of @xmath0 .
[ lemma : aremax ] let @xmath283 be such that , for all @xmath213 of hennessy - milner logic , @xmath328 implies @xmath329
. then @xmath330 .
consider such a @xmath105 and let @xmath154 in @xmath0 .
since @xmath331 is a partial order and since @xmath0 is algebraic it suffices to show that @xmath332 .
so let @xmath333 with @xmath334 . for @xmath335 of  ( [ equ : phip ] ) , @xmath334 implies @xmath336 which implies @xmath337 by corollary  [ cor : hjs04 ] as @xmath0 is fully abstract . but @xmath154 means @xmath338 as @xmath0 is fully abstract , and so @xmath339 by corollary  [ cor : hjs04 ] as @xmath337 . by assumption on @xmath105 , this renders @xmath322 and so @xmath340 by  ( [ equ : phip ] ) .    [
prop : dense ] the set of all embeddings of pointed image - finite labelled transition systems is dense in @xmath341 .    as any pointed
image - finite labelled transition system @xmath342 is refinement - equivalent to @xmath343 @xcite , the embedding @xmath344 is in @xmath345 since it satisfies the assumptions of lemma  [ lemma : aremax ] .
let @xmath198 be non - empty , so @xmath346 for some @xmath192 and there is some @xmath347 with @xmath348 since @xmath349 is non - empty and @xmath0 is algebraic .
let @xmath350 be obtained by replacing all @xmath79 in @xmath236 with @xmath239 and , for all @xmath351 , all prefixes @xmath352 with @xmath353 .
then @xmath354 _ { } } } , q)$ ] refines @xmath242 _ { } } } , p)$ ] .
since @xmath354_{}}},q)$ ] is a pointed _ labelled _ transition system and @xmath355 _ { } } } , r)$ ] is refinement - equivalent to @xmath356 for all @xmath357 by lemma  [ lemma : match ] , we conclude @xmath358 by lemma  [ lemma : aremax ] and @xmath359 is the embedding of a pointed image - finite labelled transition system .
we show that @xmath191 is compact by proving , indirectly , that @xmath360 is @xmath187-closed . using results from @xcite one
could show that @xmath360 is @xmath187-closed by finding a subset @xmath361 of @xmath315 that is a finitely branching tree and co - final in @xmath315 .
given a candidate of such a @xmath361 , the property that is difficult to ascertain is that any two elements of @xmath361 that have an upper bound in @xmath315 are comparable . for example , consider the compact elements @xmath362 and @xmath363 , both of which have the compact element @xmath364 as an upper bound yet neither of them refines the other .    faced with these difficulties , we therefore take a different route and realize @xmath360 as the set of those elements @xmath105 of @xmath0 that pass a set of judgments @xmath365 where @xmath366 are formulas of hennessy - milner logic .    1 .
let @xmath367 , @xmath27 , and @xmath240 .
then we define the hennessy - milner logic formula + @xmath368}}{{[{\delta _ 2}]}}\dots { { [ { \delta _ n}]}}({{\langle { \alpha}\rangle } } \phi
_ p\lor \neg { { \langle { \alpha}\rangle } } \phi _ p)\ ] ] + with @xmath274 as in figure  [ fig : phip ] .
2 .   let @xmath369 be the set of all hennessy - milner logic formulas @xmath366 where @xmath370 , @xmath27 , and @xmath240 .
3 .   for @xmath213 of hennessy - milner logic and all @xmath371 we define + @xmath372^{{\it m } } } } = \ { d\in { { \mathbb d}}\mid ( { { \mathcal { d}}},d){{\models } ^{\it { m}}}\phi \}\ , .\ ] ] 4 .
let @xmath373^{{\it a}}}}$ ] .    for each formula
@xmath213 in @xmath369 , the test @xmath374 checks whether there is a certain @xmath140-reachable state from @xmath105 with a certain outgoing may - transition that can not be matched with a corresponding outgoing must - transition .
accordingly , @xmath375 consists of those elements whose reachable states always find such a match .
intuitively , those should be the elements that represent labelled transition systems .    the formulas in items  ( [ item : one ] ) and  ( [ item : two ] ) of example  [ example : two ] are in @xmath369 as @xmath376 is @xmath377 , @xmath378 , and @xmath379 .    rather than proving directly that @xmath360 is @xmath187-closed
, we first establish that @xmath375 is @xmath187-closed and then prove @xmath380 .
whence maximal elements in @xmath0 are exactly those elements whose reachable may - transitions have matching must - transitions . as @xmath375 is the intersection of sets of the form @xmath381^{{\it a}}}}$ ] , we can show that the former is @xmath187-closed by proving that all latter sets are @xmath187-closed .
we do this by structural induction on @xmath213 which requires a stronger induction hypothesis .
[ lemma : denoteclosed ] for each @xmath213 of hennessy - milner logic , the sets @xmath381^{{\it a}}}}$ ] and @xmath381^{{\it c}}}}$ ] are @xmath187-clopen . in particular , @xmath375 is @xmath187-closed .
we proceed with the first claim by structural induction on @xmath213 .
this is evident for the clauses @xmath376 , negation , and conjunction since @xmath382^{{\it m } } } } = { { \mathbb d}}$ ] is @xmath187-clopen and clopens are closed under set complement ( @xmath383^{{\it a } } } } = { { \mathbb d}}\setminus { { [ \!\mid { \phi}\mid \!]^{{\it c}}}}$ ] and @xmath383^{{\it c } } } } = { { \mathbb d}}\setminus { { [ \!\mid { \phi}\mid \!]^{{\it a}}}}$ ] ) and finite intersections .
we still require proofs for @xmath384 , where for each @xmath28 we have    @xmath385^{{\it m } } } } = \{d\in { { \mathbb d}}\mid { { d } ^{\it { m}}}_\alpha \cap { { [ \!\mid { \phi}\mid \!]^{{\it m}}}}\not={\{\}}\}\ , .\ ] ]    * let @xmath386 . by theorem  4.2 in  @xcite , @xmath387^{{\it a}}}}$ ] is @xmath193-open for all @xmath214 of hennessy - milner logic , so @xmath388^{{\it a}}}}\in{{\sigma _ { { { \mathbb d}}}}}{\subseteq}{{\lambda _ { { { \mathbb d}}}}}$ ] and it suffices to show that @xmath388^{{\it a}}}}$ ] is @xmath187-closed , i.e.  @xmath193-compact as an upper set .
by induction , @xmath381^{{\it a}}}}$ ] is @xmath187-clopen ; it is also @xmath193-open so @xmath381^{{\it a } } } } = { { \uparrow \!\ ! _ { } \!{f_\phi}}}$ ] for a finite subset @xmath389 as @xmath0 is algebraic . by the definition of @xmath388^{{\it a}}}}$ ]
, we have @xmath390^{{\it a}}}}$ ] iff @xmath391 iff @xmath392 ( as @xmath393 is a lower set ) . for each @xmath394
define @xmath395 by @xmath396 for all @xmath397 ; and @xmath398 .
then @xmath399 is finite and @xmath400 . since @xmath401 for all @xmath402
, we get @xmath403^{{\it a}}}}$ ] as the latter set is upper .
note that for each @xmath394 we have @xmath404 in @xmath0 iff @xmath405 .
therefore , @xmath390^{{\it a}}}}$ ] implies @xmath406 .
thus , @xmath388^{{\it a}}}}$ ] equals @xmath407 for the finite subset @xmath165 of @xmath315 .
* let @xmath408 . from theorem  4.2 in
@xcite we already know that @xmath388^{{\it c}}}}$ ] is @xmath193-closed and therefore @xmath187-closed .
thus , it suffices to show that @xmath388^{{\it c}}}}$ ] is @xmath187-open . by induction , @xmath381^{{\it c}}}}$ ] is @xmath187-open and therefore @xmath409^{{\it c } } } } =      { { [ \!\mid { \neg\phi}\mid \!]^{{\it a}}}}$ ] is @xmath187-closed ( and @xmath193-open ) , i.e.  @xmath193-compact upper . since @xmath0 is algebraic , @xmath383^{{\it a } } } } = { { \uparrow \!\ !
_ { } \!{f_{\neg\phi}}}}$ ] for a finite subset @xmath410 of @xmath315 .
thus , @xmath381^{{\it c } } } } = { { \mathbb d}}\setminus { { \uparrow \!\ ! _ { } \!{f_{\neg\phi}}}}$ ] . inspecting the definition of @xmath388^{{\it c}}}}$ ] , we infer @xmath390^{{\it c}}}}$ ] iff there is some @xmath411 such that @xmath412
. now let @xmath413^{{\it c}}}}$ ] .
we claim that there are compact elements @xmath414 and @xmath415 with @xmath416^{{\it c}}}}$ ] , which concludes the proof since @xmath417 is @xmath187-open .
choose any @xmath418 .
as for @xmath419 , set @xmath420 for all @xmath397 ; and @xmath421 ; in particular , @xmath422 . note that @xmath423 in @xmath0 iff @xmath424 iff ( for some @xmath425 , @xmath426 )
. therefore , @xmath427^{{\it c}}}}$ ] .
so @xmath375 is @xmath187-closed as the intersection of @xmath187-closed sets .    in @xcite
open sets are thought of as observable properties , so the denotations of hennessy - milner logic formulas in @xmath0 ( and in @xmath428 ) are closed under negation as observations . if we extend these denotations to the modal mu - calculus @xcite , we expect observable properties to correspond to sets in the borel algebra generated by @xmath193 .    using the denseness of embeddings of image - finite labelled transition systems in @xmath428
, we can prove the inclusion @xmath429 .
[ lemma : minc ] the set @xmath360 is contained in @xmath430 .
let @xmath89 be the set of all embeddings @xmath344 of pointed image - finite labelled transition systems @xmath342 .
then @xmath431 follows as    * @xmath432 is refinement - equivalent to @xmath342 , * @xmath433 is valid over labelled transition systems for all @xmath213 of hennessy - milner logic , * @xmath434}}\phi$ ] is valid over labelled transition systems whenever @xmath213 is , and * @xmath325 is the standard semantics of hennessy - milner logic over labelled transition systems .    by proposition  [ prop : dense ] , @xmath89 is a dense subset of @xmath341 and so its superset @xmath435 is also dense in @xmath341 and is @xmath436-closed by the lawson condition for @xmath0 since @xmath437 is @xmath187-closed by lemma  [ lemma : denoteclosed ] .
but the only dense @xmath186-closed subset of @xmath438 is @xmath428 itself and so @xmath439 follows which implies @xmath440 .
for a proof of the reverse inclusion @xmath441 we need to clarify the structure of elements in @xmath375 .
[ lemma : aboutc ] let @xmath442 .
then :    1 .
all @xmath443 that are reachable from @xmath105 in the labelled transition system @xmath444 are in @xmath375 as well .
2 .   for all
@xmath27 we have @xmath445 .
3 .   for all
@xmath213 of hennessy - milner logic , @xmath446 implies @xmath329 .    1 .
let @xmath136 be reachable from @xmath105 in @xmath447 and let @xmath448 be the word obtained by travelling from @xmath105 to @xmath136 on such a path .
given @xmath449 , the concatenation @xmath450 is in @xmath451 and so @xmath452 .
thus the path for @xmath453 above and @xmath454 ensure @xmath455 and so @xmath456 .
2 .   let @xmath27 .
since @xmath457 , it suffices to show @xmath458 .
proof by contradiction : let @xmath459 .
then @xmath460 and @xmath461 imply @xmath462 and so @xmath463 . as @xmath0 is algebraic and @xmath464
, there is some @xmath465 with @xmath466 and @xmath467 and so @xmath468 as @xmath137 is a lower set . but @xmath454 implies @xmath469 , as @xmath470 is @xmath471 , and so @xmath472 implies @xmath473 by the definition of @xmath388^{{\it m}}}}$ ] in  ( [ equ : diauniv ] ) , contradicting @xmath474 .
we use structural induction on @xmath213 .
the cases for @xmath376 , negation , and conjunction are straightforward .
let @xmath475 , so @xmath476 for some @xmath477 .
by item  ( 2 ) , there is some @xmath478 with @xmath479 .
but then @xmath476 and @xmath479 imply @xmath480 by corollary  [ cor : hjs04 ] .
since @xmath481 is reachable from @xmath105 in @xmath447 it is in @xmath375 by item  ( 1 ) .
thus , we can apply induction on @xmath482 and get @xmath483 .
since @xmath484 , this renders @xmath485 .
we have now all the machinery at our disposal for stating and proving our main results in the next two theorems .    [
theorem : one ] the set @xmath360 equals @xmath375 . in particular , @xmath205 is @xmath187-closed and @xmath191 is a stone space in which the set of embeddings of pointed image - finite labelled transition systems is dense .    from item
( 3 ) of lemma  [ lemma : aboutc ] and lemma  [ lemma : aremax ] we infer @xmath486 .
lemma  [ lemma : minc ] then renders @xmath380 . by lemma  [ lemma : denoteclosed
] , this means that @xmath360 is @xmath187-closed . by propositions  [ prop : zero ] and  [ prop : dense ] , it suffices to show that @xmath487 is compact .
let @xmath488 for @xmath489 . by the definition of @xmath436 ,
each @xmath490 is of the form @xmath491 for some @xmath492 . since @xmath0 is a bifinite domain , @xmath493 is compact @xcite . since @xmath360 is @xmath187-closed it is @xmath187-compact as a @xmath187-closed subset of the compact space @xmath493 . from @xmath494 and @xmath196
we infer that @xmath495 .
the @xmath187-compactness of @xmath81 therefore implies the existence of a finite set @xmath158 with @xmath496 .
but then @xmath497 follows .
theorem  [ theorem : one ] is of interest in its own right since @xmath189 is not @xmath119-closed for bifinite domains @xmath98 in general .
but we also have to demonstrate that @xmath428 is the desired quotient space of labelled transition systems modulo bisimulation .
given a topological space @xmath83 let @xmath498}$ ] be the _ poset of all @xmath84-compact subsets of @xmath69 _ , ordered by reverse inclusion : @xmath499 iff @xmath500 .    [
theorem : two ]    1 .
the embedding @xmath151 for pointed image - finite modal transition systems given in @xcite extends to pointed modal transition systems such that labelled transition systems are embedded into @xmath81 .
conversely , for any @xmath501 the pointed mixed transition system @xmath314 is refinement - equivalent to a labelled transition system .
( it does nt `` type check '' to ask whether @xmath502 is _ bisimilar _ to a labelled transition system ; but @xmath503 and @xmath504 are merely saturation artifacts of the model . )
we have the isomorphism + @xmath505}\ ] ] + of sets where @xmath506 models the @xmath141-successors of @xmath203 as the @xmath186-compact set @xmath507 , for each @xmath27 .    1 .
whenever a state @xmath45 has infinitely many states @xmath508 as @xmath141-successors for @xmath18 , choose a finite subset @xmath106 of @xmath509 , retain transitions @xmath510 and their must / may status for all @xmath511 , discard all @xmath510 with @xmath512 , and create a _ may - stub _ @xmath513 ( @xmath514 ) and a may - transition @xmath515 . doing this for all events while , at the same time , unfolding @xmath31 as a tree ensures that all approximations are image - finite with limit @xmath254 such that @xmath516 is refinement - equivalent to @xmath31 .
in particular , @xmath517 by lemma  [ lemma : aremax ] whenever @xmath31 is a labelled transition system .
2 .   let @xmath330 and @xmath27 .
the set @xmath518 is in @xmath430 , which equals @xmath360 , and @xmath445 by lemma  [ lemma : aboutc ] and theorem  [ theorem : one ] . combining this with  ( [ equ : mix ] ) , we infer @xmath519 .
but since @xmath375 is closed under states reachable in @xmath444 , we may assume this representation for all elements @xmath324 reachable from @xmath105 in @xmath444 .
therefore , @xmath502 is refinement - equivalent to the modal transition system with no may - transitions that replaces @xmath520 with @xmath521 for all @xmath27 and all @xmath324 reachable from @xmath105 in @xmath444 .
the isomorphism follows from the equation for @xmath0 and lemmas  34.5 and  25 of @xcite ; the latter is stated for @xmath522-domains @xmath98 , which are bifinite , but its proof only requires that @xmath189 is @xmath119-closed .
an immediate consequence of these two main theorems is that sets of implementations of modal transition systems are compact in the quotient space modulo bisimulation .
[ cor : cl ] for each pointed modal transition system @xmath523 , its set of implementations is compact in the quotient space of labelled transition systems modulo bisimulation .
the set of implementations of @xmath523 in @xmath428 is @xmath524 which is @xmath187-closed as the intersection of two @xmath187-closed sets and so it is @xmath190-compact .
we now discuss some of the consequences of the compactness of @xmath190 : a compactness theorem for hennessy - milner logic on compact sets of implementations , an abstract interpretation of compact sets of implementations as scott - closed sets of modal transition systems , and a robust consistency measure for modal transition systems .
compactness of @xmath525 , stated in terms of hennessy - milner logic , is familiar from first - order logic but here secured without appeal to a complete proof system .
such semantic techniques for proving compactness are not new , we mention model - theoretic techniques based on ultra - filters .
a compactness theorem for hennessy - milner logic alone already follows from its standard encoding in first - order logic .
however , we prove a compactness result that goes beyond hennessy - milner logic as it applies to compact sets of labelled transition systems , in particular to the set of common implementations of finitely - many pointed modal transition systems . for a single such system , @xmath526 , we then regain the familiar compactness theorem for hennessy - milner logic . our result is stronger than this familiar theorem as the sets of implementations of pointed modal transition systems are not expressible through hennessy - milner logic . in theorem  [
theorem : mc](2 ) below we see that these sets are expressible in hennessy - milner logic extended with greatest fixed points for finite - state modal transition systems .
[ coro : one ]    1 .
let @xmath527 be a set of formulas of hennessy - milner logic and @xmath165 a @xmath190-compact set such that for all finite subsets @xmath528 of @xmath527 there is some @xmath529 that satisfies @xmath530 .
then there is some @xmath531 that satisfies all formulas of @xmath527 .
2 .   in particular , let @xmath527 be a set of formulas of hennessy - milner logic and @xmath532 a finite set of pointed modal transition systems such that for all finite subsets @xmath528 of @xmath527 there is a pointed labelled transition system that refines all @xmath533 and satisfies @xmath530 .
then there is a pointed labelled transition system that refines all @xmath533 and satisfies all formulas of @xmath527 .    by corollary  [ cor : cl ]
it suffices to prove item  ( 1 ) . by duality of consistency ( i.e.  satisfiability ) and validity
, it suffices to prove the dual statement of item  ( 1 ) : assume that every @xmath534 satisfies as least one @xmath535 and show that there is a finite set @xmath536 such that @xmath537 is valid over the set @xmath165 . by this assumption , we have    @xmath538    where @xmath539^{{\it a}}}}\cap \max ( { { \mathbb d}})\mid \phi\in \gamma\}$ ] is a subset of @xmath190 as all @xmath381^{{\it a}}}}$ ] are in @xmath193 by theorem  4.2 in  @xcite . as @xmath165 is @xmath190-compact , there is a finite @xmath158 with @xmath540 , i.e.  @xmath541^{{\it a } } } } = { { [ \!\mid { \bigvee \delta}\mid \!]^{{\it a}}}}$ ] for a finite set @xmath536 .
thus all @xmath534 satisfy @xmath542 .    figure  [ fig : cr ] depicts schematically the set of common implementations of two pointed modal transition systems @xmath314 and @xmath543 , the intersection of the implementations of @xmath105 and @xmath324 .
this is a compact subset of @xmath428 and so we get a compactness theorem for hennessy - milner logic on that set .
cousot & cousot s abstract interpretation framework @xcite approximates concrete objects and their transformations by abstract objects and transformations such that reasoning on abstract objects is sound for their concretizations . in a simple
setting , one has given a set @xmath165 of concrete objects ( e.g.  computer programs ) and a partial order @xmath544 of abstract objects , a monotone abstraction function @xmath545 , and a monotone concretization function @xmath546 .
the value @xmath547 should represent the best approximation of @xmath548 within the partial order @xmath544 and @xmath549 should represent the set of those concrete objects that are abstracted by @xmath550 .
one can encode these intuitions by making @xmath141 and @xmath551 a galois connection @xcite , a notion we define below .
let @xmath165 be the set of natural numbers and @xmath552 where @xmath553 is the top element and @xmath349 and @xmath554 are incomparable .
define @xmath555 to be @xmath349 if all elements of @xmath69 are odd ; @xmath554 if all elements of @xmath69 are even ; and @xmath553 otherwise . then @xmath556 and @xmath557 etc .
define @xmath558 , @xmath559 , and @xmath560 .
then @xmath561 says that @xmath349 is the least element that soundly represents the set @xmath562 .
the equation @xmath563 shows that the abstract value of @xmath562 has a larger set of concrete objects .
we want to apply this framework in our setting . from the compactness of @xmath190 corollary  [ cor : cl ] infers that the set @xmath564 is @xmath190-compact for all pointed modal transition systems @xmath523 .
said @xmath190-compact set comprises all the implementations of @xmath31 .
conversely , a @xmath190-compact set @xmath165 of labelled transition system can be approximated by any pointed modal transition system @xmath523 satisfying @xmath565 . ideally , one wants an _ optimal _ such @xmath523 , one for which the difference @xmath566 is minimal .
of course , this optimality is ensured for any @xmath165 of the form @xmath564 .
the next example shows that there is no optimal @xmath523 in general .
consider two pointed modal transition trees @xmath567 and @xmath568 that have a common refinement but do not refine each other .
in general , there will be more than one minimal upper bound of the set @xmath569 in @xmath0 so there can not be a @xmath283 such that @xmath570 equals the @xmath190-compact set @xmath571 .
the fact that modal transition systems can not be such optimal abstractions of @xmath190-compact sets seems to be related to the incompleteness of modal transition systems for abstraction - based model checking @xcite since @xmath0 is not bounded complete .
but there is a galois connection between @xmath190-compact subsets of @xmath428 and @xmath193-closed subsets of @xmath0 . for a @xmath190-compact set
@xmath165 its set of concretizations is the scott - closed set of all @xmath523 for which @xmath565 .
conversely , a scott - closed subset @xmath127 of pointed modal transition systems is abstracted as the set of those pointed labelled transition systems that implement all elements of @xmath127 .    1 .
let @xmath572 } = \{l\mid l\ \mbox{${{\sigma _ { { { \mathbb d}}}}}$-closed}\}$ ] be the set of @xmath193-closed subsets of @xmath0 , ordered by set inclusion : @xmath127 is less than or equal to @xmath573 iff @xmath574 .
2 .   let @xmath575 and @xmath576 be complete lattices .
a _ galois connection _
@xcite is a pair of monotone maps @xmath577 and @xmath578 such that for all @xmath579 we have @xmath580 and for all @xmath581 we have @xmath582 . in that case
, @xmath141 is the _ upper adjoint _ of @xmath551 .
[ theorem : gc ] the maps @xmath583}\to { { \mathcal l } [ { { { \mathbb d}}}]}$ ] and @xmath584}\to { { \mathcal c}[{{{\mathbb x}}},{\tau_{{\mathbb x}}}]}$ ] defined by    @xmath585    form a galois connection , where @xmath141 is the upper adjoint of @xmath551 .    * the map @xmath551 is well defined .
first @xmath154 implies @xmath586 and so @xmath587 is a lower set .
second let @xmath588 be directed in @xmath589 .
then @xmath590 and the latter equals @xmath591 , so @xmath587 is @xmath193-closed . *
the map @xmath141 is well defined .
for if @xmath127 is empty , then @xmath592 is @xmath190-compact ; and if @xmath127 is non - empty , @xmath593 is the intersection of @xmath187-closed elements and so @xmath187-closed whence @xmath190-compact . *
the map @xmath551 is monotone .
let @xmath499 , i.e.@xmath500
. then @xmath594 means @xmath595 and so @xmath596 follows .
therefore @xmath597 and so @xmath598 . *
the map @xmath141 is monotone .
let @xmath574 .
then @xmath599 and so @xmath600 .
* to see @xmath601}}$ ] let @xmath602}$ ] .
then @xmath603 clearly contains @xmath127 . * to see @xmath604}}$ ] let @xmath605}$ ] .
then @xmath606 obviously contains @xmath165 .
theorem  [ theorem : gc ] remains to be valid if we reverse the orders on the domains @xmath607}$ ] and @xmath572}$ ] and swap the names @xmath141 and @xmath608 throughout the theorem and its proof . in that case , a @xmath609-compact set @xmath165 is abstracted by a set @xmath127 of pointed modal transition systems and any such @xmath127 has a set of pointed labelled transition systems as concretizations .
this view is perhaps more natural .
we explicitly state the metrics @xmath610 for pointed modal transition systems and @xmath611 for pointed labelled transition systems .
the latter is then used to define a consistency measure on modal transition systems as an alternative to the metric @xmath610 .
fix an enumeration @xmath612 of @xmath234 and set    @xmath613    then the topology determined by @xmath614 and @xmath615 is @xmath187 and @xmath186 , respectively . for practical purposes we wish to enumerate @xmath240 in increasing modal depth of @xmath274 in  ( [ equ : phip ] ) , corresponding to the iterative unfolding of the functional for bisimulation @xcite . in that case
, @xmath611 is essentially the metric in @xcite .
these metrics are standard and well understood but result in consistency measures if lifted to compact sets of implementations .
we define the _ consistency measure _ @xmath616\colon { { \mathbb d}}\times{{\mathbb d}}\to{{\mathbb i}}$ ] by    @xmath617    and use this as an alternative to the metric @xmath610 for comparing the pointed modal transition systems @xmath314 and @xmath543 .
note that @xmath618 and @xmath619 are optimistic and pessimistic measures ( respectively ) from the point of view of an implementor .
figure  [ fig : cr ] shows a scenario where two pointed modal transition systems @xmath314 and @xmath543 have a common refinement , and so @xmath620 .    #
1#2#3#4#5 @font    ( 6222,3783)(0,-10 ) ( 3240,3240 ) ( 3240,3240 ) ( 1620,3240 ) ( 1620,3240 ) ( 5040,3240 ) ( 5040,3240 ) ( 810,3240)(6210,3240)(3510,90)(810,3240 ) ( 1575,3240)(2610,2115)(3780,3240 ) ( 2565,3240)(4500,2475)(5040,3240 ) ( 1575,3465)(3735,3465 ) ( 3735,3465)(3735,3375 ) ( 1575,3465)(1575,3375 ) ( 4500,2475)(4501,2477)(4503,2481 ) ( 4507,2489)(4513,2501)(4521,2515 ) ( 4530,2533)(4540,2553)(4551,2575 ) ( 4562,2597)(4572,2621)(4583,2644 ) ( 4594,2668)(4603,2692)(4613,2717 ) ( 4621,2742)(4629,2766)(4635,2790 ) ( 4638,2807)(4641,2822)(4642,2835 ) ( 4642,2844)(4642,2851)(4641,2857 ) ( 4640,2860)(4639,2861)(4638,2862 ) ( 4637,2862)(4635,2861)(4633,2860 ) ( 4631,2860)(4629,2859)(4627,2859 ) ( 4624,2860)(4620,2861)(4616,2864 ) ( 4611,2867)(4605,2871)(4598,2876 ) ( 4590,2880)(4571,2887)(4555,2891 ) ( 4544,2892)(4536,2892)(4530,2891 ) ( 4524,2890)(4515,2888)(4501,2886 ) ( 4481,2884)(4455,2880)(4429,2875 ) ( 4409,2869)(4396,2864)(4389,2859 ) ( 4384,2854)(4379,2849)(4372,2844 ) ( 4360,2840)(4342,2837)(4320,2835 ) ( 4305,2836)(4292,2837)(4282,2839 ) ( 4275,2840)(4270,2841)(4266,2842 ) ( 4264,2843)(4261,2843)(4259,2845 ) ( 4255,2848)(4250,2852)(4244,2859 ) ( 4237,2868)(4230,2880)(4223,2899 ) ( 4221,2916)(4223,2929)(4228,2939 ) ( 4234,2948)(4240,2956)(4244,2966 ) ( 4245,2979)(4241,2996)(4230,3015 ) ( 4218,3029)(4206,3039)(4196,3045 ) ( 4189,3049)(4185,3051)(4181,3053 ) ( 4177,3053)(4171,3054)(4161,3055 ) ( 4145,3057)(4123,3059)(4095,3060 ) ( 4069,3059)(4046,3057)(4026,3054 ) ( 4011,3051)(4001,3048)(3993,3045 ) ( 3986,3041)(3980,3038)(3972,3034 ) ( 3960,3031)(3945,3027)(3924,3023 ) ( 3899,3019)(3870,3015)(3838,3012 ) ( 3813,3009)(3796,3006)(3786,3003 ) ( 3782,3000)(3780,2996)(3778,2993 ) ( 3774,2992)(3764,2992)(3747,2995 ) ( 3722,3003)(3690,3015)(3665,3027 ) ( 3642,3041)(3622,3054)(3607,3066 ) ( 3595,3077)(3586,3087)(3579,3096 ) ( 3574,3105)(3568,3114)(3562,3123 ) ( 3553,3133)(3542,3144)(3527,3156 ) ( 3509,3169)(3488,3183)(3465,3195 ) ( 3441,3206)(3419,3213)(3402,3217 ) ( 3387,3218)(3375,3218)(3364,3215 ) ( 3355,3212)(3348,3208)(3341,3204 ) ( 3336,3200)(3333,3198)(3331,3196)(3330,3195 ) ( 2610,2115)(2608,2117)(2604,2121 ) ( 2598,2127)(2589,2137)(2578,2149 ) ( 2566,2164)(2554,2180)(2542,2197 ) ( 2530,2215)(2521,2233)(2514,2253 ) ( 2509,2273)(2508,2295)(2512,2317 ) ( 2520,2340)(2534,2361)(2550,2380 ) ( 2567,2393)(2584,2403)(2600,2410 ) ( 2616,2413)(2630,2414)(2644,2415 ) ( 2658,2415)(2673,2417)(2689,2419 ) ( 2706,2424)(2726,2433)(2747,2444 ) ( 2769,2459)(2790,2475)(2806,2490 ) ( 2819,2503)(2829,2514)(2837,2523 ) ( 2843,2529)(2847,2533)(2850,2536 ) ( 2852,2538)(2854,2539)(2855,2540 ) ( 2855,2542)(2856,2544)(2856,2549 ) ( 2855,2556)(2853,2566)(2849,2578 ) ( 2843,2593)(2835,2610)(2822,2630 ) ( 2807,2648)(2791,2664)(2775,2677 ) ( 2760,2687)(2746,2695)(2732,2702 ) ( 2719,2707)(2705,2713)(2692,2719 ) ( 2678,2727)(2663,2736)(2649,2747 ) ( 2634,2761)(2621,2775)(2610,2790 ) ( 2603,2809)(2608,2820)(2622,2823 ) ( 2641,2821)(2663,2816)(2684,2811 ) ( 2702,2809)(2714,2811)(2714,2820 ) ( 2700,2835)(2685,2845)(2667,2856 ) ( 2648,2865)(2627,2874)(2607,2881 ) ( 2586,2888)(2566,2893)(2547,2898 ) ( 2527,2903)(2508,2907)(2489,2912 ) ( 2470,2917)(2452,2924)(2434,2931 ) ( 2417,2940)(2402,2949)(2391,2960 ) ( 2385,2970)(2386,2980)(2394,2989 ) ( 2407,2994)(2423,2998)(2439,2999 ) ( 2457,2999)(2475,2998)(2494,2996 ) ( 2513,2995)(2532,2993)(2552,2993 ) ( 2573,2994)(2594,2996)(2616,3001 ) ( 2636,3007)(2655,3015)(2669,3024 ) ( 2678,3032)(2681,3038)(2678,3043 ) ( 2670,3047)(2660,3050)(2647,3051 ) ( 2633,3052)(2619,3054)(2607,3056 ) ( 2598,3059)(2594,3064)(2596,3071 ) ( 2606,3080)(2626,3092)(2655,3105 ) ( 2681,3115)(2711,3126)(2742,3136 ) ( 2774,3145)(2807,3154)(2840,3163 ) ( 2874,3171)(2908,3179)(2942,3187 ) ( 2976,3195)(3009,3202)(3042,3209 ) ( 3073,3215)(3102,3221)(3127,3227 ) ( 3149,3231)(3167,3234)(3179,3237 ) ( 3188,3239)(3193,3240)(3195,3240 ) ( 855,1170)(0,0)[lb ] ( 3735,0)(0,0)[lb ] ( 4365,2250)(0,0)[lb ] ( 0,810)(0,0)[lb ] ( 2520,1890)(0,0)[lb ] ( 3285,3060)(0,0)[lb ] ( 1350,3015)(0,0)[lb ] ( 1710,3600)(0,0)[lb ] ( 4635,3060)(0,0)[lb ] ( 4230,585)(0,0)[lb ]    since @xmath621 is @xmath186-compact for all @xmath622 by corollary  [ cor : cl ] , @xmath623 and @xmath624 are the metric analogue of symmetric @xmath625 and @xmath626 lifts of relations from elements to subsets , here of @xmath627 to @xmath186-compact subsets , respectively . the standard metric @xmath628 between compact subsets @xmath570 and @xmath629 , the hausdorff distance , is the symmetric @xmath630-lift of @xmath611 to @xmath186-compact subsets and so    @xmath631    such consistency measures are of particular interest if @xmath105 and @xmath324 represent different viewpoints @xcite of the same system such that the degree of consistency between these descriptions needs to be explored .
we prove that @xmath618 is a robust measure in that its kernel consists of those pairs of pointed modal transition systems that have a common refinement .
[ theorem : mc ]    1 .   for all @xmath153
, we have @xmath620 iff @xmath314 and @xmath313 have a common refinement .
2 .   deciding whether two finite - state modal transition systems have a common refinement is reducible to checking the satisfiability of a modal mu - calculus formula with greatest fixed points only .    1
.   we use theorems  [ theorem : one ] and  [ theorem : two ] repeatedly .
if @xmath314 and @xmath313 have a common refinement , there is some @xmath632 and so @xmath633 as @xmath634 .
conversely , let @xmath620 . then for each @xmath635 there are @xmath636 and @xmath637 with @xmath638 .
since @xmath341 is compact , there is a convergent subsequence @xmath639 of @xmath640 with limit @xmath641 and so @xmath642 as the latter is @xmath186-closed . since @xmath643 for each @xmath644
, this implies @xmath645 and so @xmath641 is in all @xmath186-closed sets that contain @xmath646 .
therefore , @xmath641 is in @xmath629 and so @xmath647 is a common refinement of @xmath314 and @xmath313 .
if @xmath31 and @xmath51 are finite - state , we show that there are formulas @xmath648 and @xmath649 of the modal mu - calculus with greatest fixed points only such that the modal mu - calculus formula @xmath650 is satisfiable over labelled transition systems iff @xmath31 and @xmath51 have a common refinement .
larsen & thomsen implicitly define these formulas in the system of recursive equations  ( 3 ) of @xcite where , for each state @xmath45 in @xmath651 , + @xmath652 } } ( \bigvee _ { ( s,\alpha , s')\in{{r } ^{\it { c } } } } x_{(m , s')}))\ ] ] + as a greatest fixed point .
if @xmath45 has finitely many reachable states in @xmath5 , then @xmath653 is expressible in the modal mu - calculus , using a `` calling context '' on the set of states @xmath44 that are @xmath18-reachable from @xmath45 and static scoping of the greatest fixed - point operators @xmath654 .
now for all pointed labelled transition systems @xmath342 we have @xmath655 iff @xmath656 where we can use the proof of  ( 3 ) in @xcite which works in our setting as conjunctions and disjunctions need not be finite .
let @xmath5 be the modal transition system from figure  [ fig : ref ] .
we write @xmath657 as a formula of the modal mu - calculus with greatest fixed points only .
let    @xmath658 } } z_{\rm dr } \land { { [ { \rm talks } ] } } x^{\rm dr}_{(m,{\rm ta})}\land { { [ { \rm orders } ] } } x^{\rm dr}_{(m,{\rm wa})}\\ x^{\rm dr}_{(m,{\rm ta } ) } & = & \nu z_{\rm ta}. { { [ { \rm drinks } ] } } z_{\rm dr } \land { { [ { \rm orders } ] } } x^{\rm dr\ , ta}_{(m,{\rm wa})}\nonumber\\ x^{\rm dr}_{(m,{\rm wa } ) } & = & \nu z_{\rm wa}. { { \langle { \rm newpint}\rangle } } z_{\rm dr } \land { { \langle { \rm newpint}\rangle } } x^{\rm dr}_{(m,{\rm ta})}\land { { [ { \rm newpint}]}}(z_{\rm dr}\lor x^{\rm dr\ , wa}_{(m,{\rm ta})})\nonumber\\ x^{\rm dr\ , wa}_{(m,{\rm ta } ) } & = & \nu z_{\rm ta}. { { [ { \rm drinks } ] } } z_{\rm dr } \land { { [ { \rm orders } ] } } z_{\rm wa}\nonumber\\ x^{\rm dr\ , ta}_{(m,{\rm wa } ) } & = & \nu z_{\rm wa}. { { \langle { \rm newpint}\rangle } } z_{\rm dr } \land { { \langle { \rm newpint}\rangle } } z_{\rm ta}\land { { [ { \rm newpint}]}}(z_{\rm dr}\lor z_{\rm ta})\nonumber\end{aligned}\ ] ]    where the superscripts in @xmath653 record the `` calling context '' of the recursions .
so @xmath623 measures the _ degree of inconsistency _ of @xmath502 and @xmath313 , a lower bound on the difference between their implementations , @xmath624 is an upper bound on such a difference , and none of them is a metric : from item  ( [ item : fourd ] ) of definition  [ def : ultra ] , @xmath618 satisfies only  ( b ) and @xmath619 satisfies only  ( b ) and  ( c ) .
the reducibility of common refinement checks to satisfiability checks in the modal mu - calculus yields exptime as a weak upper bound on its complexity .
since the formulas are defined in terms of greatest fixed points only , one can indeed show a stronger result : the decision problem of common refinements is in ptime @xcite .
our results also apply to 3-valued model checking frameworks in which system observables are state propositions or a combination of state propositions and events .
this is so since godefroid & jagadeesan s translation between modal transition systems ( events only ) , partial kripke structures @xcite ( state propositions only ) , and kripke modal transition systems @xcite ( events and state propositions ) and their translations of the respective temporal logic formulas is shown to preserve and reflect refinement and the meaning of model checks @xcite .
bakker & zucker use domain equations and metric completions for a metric and denotational treatment of concurrency in @xcite .
lawson proposes the notion of a maximal - point space to represent classical topological spaces as maximal points of a domain in the topology induced by the domain s lawson- and scott - topology @xcite .
abramsky @xcite provides a fully abstract domain of synchronization trees for _ partial _ bisimulation between labelled transition systems that have a divergence predicate .
the domain equation of loc .
cit .  uses a sum construction on the convex powerdomain .
maximal points are not part of that paper s agenda and are therefore not discussed therein .
labelled transition systems with a divergence predicate and partial bisimulation are recognized as certain modal transition systems and their refinement in @xcite .
mislove et al .
present a fully abstract domain model , which combines the probabilistic power domain with a convex variant of the plotkin powerdomain , for finite - state processes with non - deterministic and probabilistic choice @xcite .
alessi et al .
@xcite introduce a category of @xmath659-domains with a compositional maximal - points space functor to stone spaces .
they show that all bifinite domains @xmath98 for which @xmath189 is a stone space are scott - continuous retracts of @xmath659-domains .
in particular , @xmath0 is such a retract by theorem  [ theorem : one ] .
we suspect that @xmath0 is not an @xmath659-domain since @xmath660}$ ] is not an @xmath522-domain for the @xmath522-domain @xmath661 @xcite , although @xmath660}$ ] is the second iteration of the domain equation  ( [ equ : recursion ] ) for @xmath0 when @xmath662 .
the paper @xcite presents the domain @xmath0 and its modal transition system @xmath124 , both denoted as @xmath124 in loc.cit . , and proves full abstraction and a characterization of @xmath0 s compact elements in terms of formulas of hennessy - milner logic .
in @xcite it is shown that the co - inductive refinement of modal transition systems has an extensional description : a pointed modal transition system @xmath31 refines a pointed modal transition system @xmath51 if , and only if , the set of implementations of @xmath31 is a subset of the implementations of @xmath51 .
dams & namjoshi @xcite show that finite - state modal transition systems are incomplete as abstractions of infinite - state modal transition systems for modal mu - calculus checking .
they propose focused transition systems as a generalization of modal transition systems , show completeness for this class of models , and define a game semantics for refinement of focused transition systems and a game semantics for model checks of alternating tree automata on focused transition systems .
it is straightforward to write down a domain equation for focused transition systems but a programme of maximal - points spaces wo nt directly render pointed kripke structures since , as noted in @xcite , focused transition systems can have maximal refinements that have inconsistent constraints on propositions at states .    in @xcite consistency , satisfiability , and validity problems
are studied for collectively model checking a set of views endowed with labelled transitions , hybrid constraints on states , and atomic propositions . a ptime algorithm for deciding whether a set of views has a common refinement ( consistency )
it is proved that deciding whether a common refinement satisfies a formula of the hybrid mu - calculus @xcite ( satisfiability ) , and its dual ( validity ) , are exptime - complete .
two generically generated `` summary '' views are defined that constitute informative and consistent common refinements and abstractions of a set of views ( respectively ) .
di  pierro et al .
@xcite develop a quantitative notion of process equivalence as the basis for an approximative version of non - interference and precise quantifications of information leakage .
they present two semantics - based analyzes for approximative non - interference where one soundly abstracts the other .
desharnais et al .
@xcite show that each continuous - state labelled markov process has a sequence of finite acyclic labelled markov processes as abstractions which is precise for a probabilistic modal logic ; an equivalence between the category of markov processes and simulation morphisms and a recursively defined domain , viewed as a category , is given .
desharnais et al .
@xcite define a pseudo metric between labelled concurrent markov chains where zero distance means weak bisimilarity .
the metric is characterized in a real - valued modal logic and shown to allow for compositional quantitative reasoning .
we presented the fully abstract and universal domain model @xmath0 for pointed modal transition systems and refinement of @xcite . using techniques from concurrency theory and topology
, we demonstrated that @xmath0 is the right fully abstract and universal model for labelled transition systems and bisimulation since the quotient space of all pointed labelled transition systems with respect to bisimulation , @xmath191 , is obtained as the maximal - points space of @xmath0 .
we furthermore revealed the fine - structure of @xmath428 , notably we proved that its topology @xmath186 inherited from the scott- and lawson - topology of @xmath0 is compact , zero - dimensional , and hausdorff ( a stone space ) .
in particular , @xmath186 is determined by a computationally meaningful , complete ultra - metric @xmath615 for which image - finite labelled transition systems approximate labelled transition systems to any degree of precision .
modulo refinement , @xmath663 is image - finite for all @xmath195 , so this denseness also applies to modal transition systems for the lawson - topology and its metric @xmath610 .
thus our results unify denotational , operational , and metric semantics of labelled and modal transition systems .
we finally derived consequences of this compact representation : a compactness theorem for hennessy - milner logic on compact sets of implementations , an abstract interpretation of compact sets of implementations as scott - closed sets of modal transition systems , and a robust consistency measure for modal transition systems .
radha jagadeesan suggested working with the mixed powerdomain in @xcite .
glenn bruns , alessandra di  pierro , patrice godefroid , dimitar guelev , chris hankin , radha jagadeesan , achim jung , ralph kopperman , david schmidt , and herbert wiklicky are thanked for helpful comments and discussions .
this paper is an extended journal version of @xcite and reflects the thorough and thoughtful comments made by the anonymous referees of the lics 2004 conference and the journal logical methods in computer science .
f.  alessi , p.  baldan , and f.  honsell . partializing stone spaces using sfp domains . in m.
bidoit and m.  dauchet , editors , _ tapsoft97 conference proceedings _ , volume 1214 of _ lecture notes in computer science _ , pages 478489 , lille , france , 14 - 18 april 1997 .
springer verlag .
g.  bruns and p.
model checking partial state spaces with @xmath664-valued temporal logics . in _ proc .
of the 11th international conference on computer aided verification _ , volume 1633 of _ lecture notes in computer science _ , pages 274287 .
springer verlag , july 1999 .
g. bruns and p. godefroid .
generalized model checking : reasoning about partial state spaces . in _ proc .  of the 11th international conference on concurrency theory _ , volume 1877 of _ lecture notes in computer science _ , pages 168182 .
springer verlag , august 2000 .
p.  cousot and r.  cousot .
abstract interpretation : a unified lattice model for static analysis of programs . in _ proc .  of the 4th acm symposium on principles of programming languages _ ,
pages 238252 , los angeles , california .
acm press , 1977 .
d.  dams and k.  namjoshi . the existence of finite abstractions for branching time model checking . in _ proc .  of the nineteenth annual ieee symposium on logic in computer science _ , pages 335344 , 13 - 17 july , turku , finland .
ieee computer society press , 2004 .
j.  desharnais , v.  gupta , r.  jagadeesan , and p.  panangaden . approximating labeled markov processes . in _ proc .  of the 15th annual ieee symposium on logic in computer science _ ,
pages 95106 , santa barbara , california , 26 - 29 june 2000 .
ieee computer society press .
j.  desharnais , v.  gupta , r.  jagadeesan , and p.  panangaden . the metric analogue of weak bisimulation for probabilistic processes . in _ proc .  of the 17th annual ieee symposium on logic in computer science _
, pages 413422 , copenhagen , denmark , july 2002 .
ieee computer society .
godefroid , m.  huth , and r.  jagadeesan .
abstraction - based model checking using modal transition systems . in _ proc .  of the 12th international conference on theory and practice of concurrency
_ , volume 2154 of _ lecture notes in computer science _ , pages 426440 .
springer verlag , august 2001 .
p.  godefroid and r.  jagadeesan . automatic abstraction using generalized model checking . in e.
brinksma and k.  g. larsen , editors , _ proc .
of the 14th international conference on computer aided verification _ ,
volume 2404 of _ lecture notes in computer science _ , pages 137150 , copenhagen , denmark ,
july 2002 .
springer verlag .
p.  godefroid and r.  jagadeesan . on the expressiveness of 3-valued models . in l.
d. zuck , p.  c. attie , a.  cortesi , and s.  mukhopadhyay , editors , _ proc .  of the 4th international conference on verification , model checking and abstract interpretation _
, volume 2575 of _ lncs _ , pages 206222 , new york , january 2003 .
springer verlag .
m.  huth , r.  jagadeesan , and d.  a. schmidt .
modal transition systems : a foundation for three - valued program analysis . in d.  sands ,
editor , _ proc .  of esop2001
_ , pages 155169 .
springer verlag , april 2001 .
m. huth . beyond image - finiteness
: labelled transition systems as a stone space .
in : _ proc .  of the nineteenth annual ieee symposium on logic in computer science _ , pages  222231 , 13 - 17 july , turku , finland , ieee computer society press , 2004
.        k.  g. larsen .
modal specifications . in j.
sifakis , editor , _ automatic verification methods for finite state systems _ , number 407 in lecture notes in computer science , pages 232246 .
springer verlag , june 1214 1989 .
international workshop , grenoble , france .
u.  sattler and m.  vardi .
the hybrid @xmath667-calculus . in r.
gor ' e , a.  leitsch , and t.  nipkov _ proc .  of the first international joint conference on automated reasoning_. lecture notes in computer science  2083 , pages 7691 ,
siena , italy , 18 - 23 june , springer verlag , 2001 .
i.  sommerville , p.  sawyer , and s.  viller .
viewpoints for requirements elicitation : a practical approach . in _ proc .  of the 1998 international conference on requirements engineering _ , colorado springs , colorado , april 6 - 10 1998 .
ieee computer society press .