Hennessy-Milner Logic (HML)

• Hennessy-Milner Logic is a modal logic for labelled transition systems that uses diamond and box operators to express the existence and universality of transitions.
• It establishes that, for image-finite systems, theory equivalence coincides with bisimilarity, providing a robust framework for behavioral verification.
• Its formalization in Lean via CSLib integrates mechanized proofs with clear syntax and automation-friendly techniques for verifying core metatheorems.

Hennessy–Milner Logic (HML) is a modal logic for labelled transition systems (LTSs) whose basic purpose is to describe observable behaviour through action-indexed modalities. In the finitary setting, it combines Boolean structure with the diamond and box operators to express existence and universality of one-step transitions, and its central metatheorem states that, for image-finite systems, bisimilarity coincides with logical indistinguishability or theory equivalence. HML is treated both as a foundational logic for concurrency theory and as a formalized object of mechanized mathematics, notably in the Lean Computer Science Library (CSLib), while a substantial literature develops quantitative, nominal, intuitionistic, true-concurrent, and application-specific generalizations (Montesi et al., 17 Feb 2026).

1. Behavioural setting: labelled transition systems

An LTS is a triple $(S,\mathrm{Act},\to)$, where $S$ is the set of states, $\mathrm{Act}$ is the set of labels, and $\to \subseteq S \times \mathrm{Act} \times S$ is the transition relation. One writes $s \xrightarrow{a} t$ for $(s,a,t)\in \to$. In CSLib this structure is represented as LTS State Label with a transition predicate Tr : State → Label → State → Prop, together with the image set

$$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$

Image-finiteness means that for all states $s$ and labels $a$, the successor set $\{\,t \mid s \xrightarrow{a} t\,\}$ is finite; equivalently,

$S$0

In CSLib this is expressed by the typeclass assumption $S$1 (Montesi et al., 17 Feb 2026).

The basic semantic comparison induced by HML is theory equivalence. For a state $S$2, its HML theory is

$S$3

Two states are theory-equivalent when they satisfy the same formulas. This notion is central because the Hennessy–Milner theorem identifies the structural condition under which theory equivalence matches bisimilarity exactly. In formulations based on Kripke models or on single-action modal logic, the same principle appears as equality of modal theories, and the supplied material explicitly notes that the multi-action HML reading adapts componentwise from the single-relation setting (Takeda et al., 2 Jul 2026).

2. Language, satisfaction, and denotation

The canonical finitary HML grammar is

$S$4

The diamond modality $S$5 asserts that there exists an $S$6-transition to a $S$7-state, while the box modality $S$8 asserts that all $S$9-transitions lead to $\mathrm{Act}$0-states. Some presentations include atomic propositions explicitly, while others focus on the pure process fragment in which the modal vocabulary alone is used for behavioural equivalence (Montesi et al., 17 Feb 2026).

The satisfaction relation is standard:

$\mathrm{Act}$1

HML also admits a denotational semantics as a compositional map $\mathrm{Act}$2:

$\mathrm{Act}$3

This denotational view is not secondary: in CSLib, one of the core metatheorems states that inductive satisfaction coincides with membership in the denotation (Montesi et al., 17 Feb 2026).

The supplied material places HML close to normal modal logic $\mathrm{Act}$4, and it also states that extensions with recursion or fixpoints yield logics such as the modal $\mathrm{Act}$5-calculus. A separate development treats HML with greatest fixed points as the $\mathrm{Act}$6-fragment of the modal $\mathrm{Act}$7-calculus and shows its equivalence, as a specification formalism, with disjunctive modal transition systems (Beneš et al., 2013).

3. Bisimulation, theory equivalence, and the Hennessy–Milner theorem

A relation $\mathrm{Act}$8 is a bisimulation if, whenever $\mathrm{Act}$9, every transition of $\to \subseteq S \times \mathrm{Act} \times S$0 can be matched by a transition of $\to \subseteq S \times \mathrm{Act} \times S$1 with the same label to related successors, and symmetrically every transition of $\to \subseteq S \times \mathrm{Act} \times S$2 can be matched by one of $\to \subseteq S \times \mathrm{Act} \times S$3. Equivalently, $\to \subseteq S \times \mathrm{Act} \times S$4 is symmetric and satisfies the usual forth and back clauses. Bisimilarity, written $\to \subseteq S \times \mathrm{Act} \times S$5, is the union of all bisimulations, or equivalently the existence of some bisimulation relating $\to \subseteq S \times \mathrm{Act} \times S$6 and $\to \subseteq S \times \mathrm{Act} \times S$7 (Montesi et al., 17 Feb 2026).

The Hennessy–Milner theorem states that for image-finite LTSs,

$\to \subseteq S \times \mathrm{Act} \times S$8

equivalently $\to \subseteq S \times \mathrm{Act} \times S$9. In CSLib this is exposed as

$s \xrightarrow{a} t$0

under the typeclass assumption of image-finiteness (Montesi et al., 17 Feb 2026).

The proof architecture formalized in Lean has three parts. First, satisfaction and denotation are shown to coincide. Second, bisimulations are proved invariant for HML: if $s \xrightarrow{a} t$1 is a bisimulation and $s \xrightarrow{a} t$2, then every HML formula satisfied by $s \xrightarrow{a} t$3 is also satisfied by $s \xrightarrow{a} t$4, and symmetry gives the converse. Third, for image-finite LTSs, theory equivalence itself is shown to be a bisimulation. The key step is the standard distinguishing-formula construction: if $s \xrightarrow{a} t$5 and no $s \xrightarrow{a} t$6-successor of $s \xrightarrow{a} t$7 is theory-equivalent to $s \xrightarrow{a} t$8, then each $s \xrightarrow{a} t$9-successor $(s,a,t)\in \to$0 of $(s,a,t)\in \to$1 yields a distinguishing formula $(s,a,t)\in \to$2; image-finiteness makes the conjunction $(s,a,t)\in \to$3 finitary, and $(s,a,t)\in \to$4 contradicts theory equivalence (Montesi et al., 17 Feb 2026).

A common misunderstanding is that finitary HML characterizes bisimilarity on arbitrary transition systems. The supplied material instead states that without image-finiteness, theory equivalence may be strictly coarser than bisimilarity, because the characteristic-formula construction breaks down when infinitely many successors would have to be distinguished simultaneously; infinitary connectives or stronger logics such as fixpoints are then needed (Montesi et al., 17 Feb 2026). At the level of reverse mathematics, the theorem has also been calibrated precisely: over $(s,a,t)\in \to$5, the Hennessy–Milner theorem for image-finite models is equivalent to $(s,a,t)\in \to$6 (Takeda et al., 2 Jul 2026).

4. Formalization in CSLib and Lean

The CSLib development formalizes HML at library level in the namespace Cslib.Logic.HML. It is parametric over arbitrary state and label types, universe-polymorphic, and integrated with CSLib’s general LTS, IsBisimulation, and Bisimilarity APIs. The formalization includes syntax, the inductive satisfaction relation, denotational semantics, theory and theory equivalence, bisimulation invariance, and the Hennessy–Milner theorem for image-finite LTSs. Proofs rely heavily on Lean automation, notably the grind tactic, together with Mathlib’s set-theoretic and classical-logic infrastructure (Montesi et al., 17 Feb 2026).

CSLib component	Meaning
LTS State Label	Labelled transition systems
Proposition Label	HML syntax
Satisfies lts s φ	Satisfaction relation
φ.denotation lts	Denotational semantics
theory lts s	Set of formulas satisfied at s
TheoryEq lts	Equality of theories
Bisimilarity lts	Standard bisimilarity relation

A design choice of the library is that negation is not primitive. The inductive syntax uses only true, false, and, or, diamond, and box, and negation is defined structurally as a derived operation φ.neg, sending diamonds to boxes on negated subformulas and conjunctions to disjunctions of negated subformulas in the expected de Morgan style. The paper states that this makes the satisfaction relation a straightforward inductive predicate and keeps proofs simple and automation-friendly. Negation correctness is captured by the theorem

$(s,a,t)\in \to$7

which the development states is equivalent, using classical logic from Mathlib, to

$(s,a,t)\in \to$8

(Montesi et al., 17 Feb 2026).

The formalization also includes representative examples. One such LTS has states $(s,a,t)\in \to$9 and labels $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$0, with transitions $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$1, $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$2, and $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$3. The formula

$$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$4

holds at $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$5 because $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$6 has no $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$7-successors, but fails at $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$8 because $$\mathrm{image}(s,\mu)=\{\,s' \mid \mathrm{Tr}(s,\mu,s')\,\}.$$9 has a $s$0-self-loop. Hence $s$1 and $s$2 are not theory-equivalent and therefore not bisimilar. The code is public in the CSLib repository, and the paper reports checking with Lean 4.28.0-rc1 (Montesi et al., 17 Feb 2026).

5. Variants and domain-specific enrichments

Several extensions preserve the HML pattern while modifying either the transition structure, the admissible formulas, or the notion of behavioural comparison. One extension adds global-store predicates and update operators to process algebra with shared memory. In that setting, the logic contains a test operator $s$3 and a logical update operator $s$4; the combined logic characterizes stateless bisimilarity of image-finite process expressions, while the check-only fragment characterizes state-based bisimilarity of image-finite states. The same work provides a translation to a fragment of mCRL2 that preserves validity of the check fragment (Bouwman et al., 2020).

A different direction studies branching bisimulation. Positive HML with Until (PHMLU) restricts negation in order to characterize theory inclusion rather than just theory equality. In image-finite LTSs with reflexive $s$5, the paper proves a directed Hennessy–Milner theorem:

$s$6

where $s$7 is directed branching bisimulation. The same work proves that every HMLU formula is equivalent to a Boolean combination of positive formulas, so the positive fragment remains sufficient for the classical equality-of-theories result as well (Geuvers et al., 2022).

First-order enrichments appear in verification-oriented settings. For smart contracts, CHML extends HML with quantification over addresses, integers, procedures, and argument tuples, together with transaction-constrained modalities

$s$8

a past operator $s$9, and a reverted predicate. The logic is interpreted over a labelled transition system generated by a loop-free fragment of Solidity, then compiled into Lustre and checked with Kind 2 (Bartoletti et al., 15 Apr 2026).

Name-binding and infinitary structure motivate another family of generalizations. For nominal transition systems, HML is extended to actions that may bind names, with formulas built using finitely supported infinite conjunctions. That development proves adequacy and expressive completeness for bisimulation equivalence, and systematically treats early, late, open, and weak bisimulation variants; the main definitions and theorems are formalised in Nominal Isabelle (Parrow et al., 2019).

The Hennessy–Milner pattern also survives in fuzzy settings. For fuzzy multimodal logics over a complete linearly ordered Heyting algebra, HM-type theorems identify the greatest weak bisimulation for plus-formulae with forward bisimulation on image-finite models, the greatest weak bisimulation for minus-formulae with backward bisimulation on domain-finite models, and the greatest weak bisimulation for all modal formulae with regular bisimulation on degree-finite models (Stanković et al., 14 Feb 2025).

6. Extensions, abstractions, and foundational analyses

HML has repeatedly served as the interleaving baseline against which richer behavioural logics are calibrated. In a logic for true concurrency over prime event structures, standard HML is recovered as the fragment that uses only immediate single-event modalities and Boolean connectives; its induced equivalence is ordinary interleaving bisimilarity, strictly below step, pomset, history-preserving, and hereditary history-preserving bisimilarity (Baldan et al., 2011). A related development adds reverse modalities and event identifiers, yielding Event Identifier Logic, where sublogics characterize weak history-preserving, history-preserving, and hereditary history-preserving bisimulation over stable configuration structures (Phillips et al., 2011).

Generalized process models also motivate HML-like logics. For Generalized Synchronization Trees, GHML replaces action labels by equivalence classes of trajectory-labelled executions, and the paper proves that weak bisimulation for GSTs coincides with ordinary bisimulation on surrogate Kripke structures. This yields a GST analogue of image-finiteness and a corresponding Hennessy–Milner theorem for GHML (Ferlez et al., 2017).

Coalgebraic and quantitative work further broadens the landscape. One framework derives behavioural equivalences and metrics from logics by means of Galois connections between predicate lattices and behavioural objects, recovering classical bisimilarity as the qualitative HML case and extending the methodology to directed trace metrics and other behavioural pseudometrics (Beohar et al., 2022). A second quantitative coalgebraic development proves equality of logical and behavioural distances under closure and density assumptions, covering classical HML as the Boolean case and extending to continuous probabilistic transition systems and behavioural ultrametrics (Forster et al., 2022). A third coalgebraic line defines logic-induced $a$0-bisimulations from a one-step semantics and proves a Hennessy–Milner-type theorem under categorical hypotheses, with the classical HML/LTS setting recovered as an instance where $a$1-bisimulation coincides with standard bisimulation (Groot et al., 2020).

The supplied material also shows that HML-style metatheory interacts nontrivially with topology, intuitionism, and foundations. Topological compactness yields Hennessy–Milner classes for intuitionistic, dual-intuitionistic, and bi-intuitionistic logics and for their modal extensions, via image-compact and pre-image-compact relations (Groot et al., 2021). In a separate intuitionistic modal result, IK is shown to be exactly the IK-bisimulation-invariant fragment of intuitionistic first-order logic, with a Hennessy–Milner-style theorem proved using countable saturation and intuitionistic model theory (Groot et al., 30 Jun 2026). At the foundational level, the Hennessy–Milner theorem itself is shown to be equivalent to $a$2 over $a$3, whereas several forms of the van Benthem characterization theorem admit weaker proof-theoretic calibrations (Takeda et al., 2 Jul 2026).

This body of work suggests that HML functions not merely as a single modal formalism for LTSs, but as a reference point for a broad spectrum of behavioural specification theories. In the supplied material, it appears as a core finitary logic for labelled transition systems, a mechanized component of CSLib, a fragment recovered inside richer logics, a source of quantitative and coalgebraic abstractions, and a benchmark for foundational strength.