Hennessy–Milner Theorem

• Hennessy–Milner theorem is a modal characterization that shows bisimilarity and modal equivalence coincide in image-finite and modally saturated models.
• The theorem’s proof constructs candidate bisimulations from modal equivalence using finite-branching and saturation arguments to ensure the correspondence.
• Extensions and generalizations of the theorem impact areas such as second-order arithmetic, quantitative/logical metrics, and formal verification.

The Hennessy–Milner theorem is the modal characterization result stating that, under a finiteness hypothesis, behavioral equivalence and logical indistinguishability coincide: two states are bisimilar if and only if they satisfy the same modal formulas. In its familiar classical form, the theorem is stated for image-finite Kripke models or image-finite labelled transition systems; in a more general form, modal equivalence coincides with bisimilarity on modally saturated models. The theorem is foundational because it identifies an exact correspondence between coinductive behavioral reasoning and modal specification, and recent work has analyzed that correspondence in settings ranging from second-order arithmetic and theorem proving to branching, quantitative, fuzzy, intuitionistic, and non-distributive semantics (Montesi et al., 17 Feb 2026, Takeda et al., 2 Jul 2026).

1. Classical statement and semantic setting

In the propositional modal setting formalized in second-order arithmetic, a Kripke model is $M=(W,R,V)$, where $W\subseteq \mathbb N$ is a nonempty set of worlds, $R\subseteq W\times W$ is the accessibility relation, and $V:W\times \mathrm{Fml}\to 2$ is a full valuation satisfying the recursive modal truth clauses. For pointed models $(M,w)$ and $(M',w')$, modal equivalence is the relation

$(M,w)\leftrightsquigarrow (M',w')$

meaning that for all modal formulas $\varphi$,

$V(w,\varphi)=1 \iff V'(w',\varphi)=1.$

A bisimulation $Z\subseteq W\times W'$ is defined by atomic agreement together with the usual forth and back conditions, and $W\subseteq \mathbb N$0 means that some such $W\subseteq \mathbb N$1 contains $W\subseteq \mathbb N$2. The image-finite Hennessy–Milner theorem then states that for any two image-finite pointed models,

$W\subseteq \mathbb N$3

The same source also states the standard saturated-model variant: for modally saturated pointed models, modal equivalence and bisimilarity again coincide (Takeda et al., 2 Jul 2026).

In concurrency-theoretic form, the theorem is stated for labelled transition systems $W\subseteq \mathbb N$4, with $W\subseteq \mathbb N$5 when $W\subseteq \mathbb N$6. Hennessy–Milner Logic uses formulas generated from true, false, conjunction, disjunction, and the modalities $W\subseteq \mathbb N$7 and $W\subseteq \mathbb N$8. For a state $W\subseteq \mathbb N$9, its theory is

$R\subseteq W\times W$0

and theory equivalence is equality of these sets. The theorem is formalized as the extensional identity

$R\subseteq W\times W$1

for image-finite LTSs, where image-finiteness means that for every state $R\subseteq W\times W$2 and label $R\subseteq W\times W$3, the set $R\subseteq W\times W$4 is finite (Montesi et al., 17 Feb 2026).

2. Core notions and proof architecture

The easy direction is bisimulation invariance. In the Kripke presentation, if there is a bisimulation relating $R\subseteq W\times W$5 and $R\subseteq W\times W$6, then $R\subseteq W\times W$7; the proof is by induction on formula complexity using only $R\subseteq W\times W$8. In the LTS presentation, the corresponding lemma is that if $R\subseteq W\times W$9 is a bisimulation and $V:W\times \mathrm{Fml}\to 2$0, then every HML formula true at $V:W\times \mathrm{Fml}\to 2$1 is true at $V:W\times \mathrm{Fml}\to 2$2, with the diamond case handled by the forth clause and the box case by the back clause (Takeda et al., 2 Jul 2026, Montesi et al., 17 Feb 2026).

The converse direction is where image-finiteness enters decisively. In the Kripke proof, one defines the candidate bisimulation by modal equivalence itself,

$V:W\times \mathrm{Fml}\to 2$3

and then verifies the forth and back clauses. Suppose $V:W\times \mathrm{Fml}\to 2$4 and $V:W\times \mathrm{Fml}\to 2$5. If no successor of $V:W\times \mathrm{Fml}\to 2$6 is modally equivalent to $V:W\times \mathrm{Fml}\to 2$7, then, because $V:W\times \mathrm{Fml}\to 2$8 is image-finite, one can enumerate the finitely many successors $V:W\times \mathrm{Fml}\to 2$9 of $(M,w)$0, choose formulas $(M,w)$1 distinguishing $(M,w)$2 from each $(M,w)$3, and form the single formula

$(M,w)$4

which is true at $(M,w)$5 but false at $(M,w)$6, contradicting modal equivalence. The LTS proof uses the same finite-branching pattern: if $(M,w)$7 and no $(M,w)$8-successor of $(M,w)$9 is theory equivalent to $(M',w')$0, then one gathers finitely many distinguishing formulas $(M',w')$1 and uses

$(M',w')$2

to separate $(M',w')$3 from $(M',w')$4 (Takeda et al., 2 Jul 2026, Montesi et al., 17 Feb 2026).

The more general saturated-model form replaces finiteness by a compactness principle internal to modal theory. A model is modally saturated if whenever every finite subset of a set $(M',w')$5 of modal formulas is jointly possible at a successor, there is an actual successor satisfying all of $(M',w')$6. In the Kripke proof, if $(M',w')$7, one takes

$(M',w')$8

uses modal equivalence to show that every finite $(M',w')$9 is possible at $(M,w)\leftrightsquigarrow (M',w')$0, and then applies modal saturation to obtain a successor modally equivalent to $(M,w)\leftrightsquigarrow (M',w')$1. This yields the saturated-model theorem and explains why image-finite models are a special case: every image-finite model is modally saturated (Takeda et al., 2 Jul 2026).

A standard misconception is that image-finiteness is merely a technical convenience. The more precise point is that finitary modal languages can only form finite conjunctions and disjunctions. Without image-finiteness, ordinary HML may fail to distinguish non-bisimilar states because an infinitary conjunction would be required to package all local counterexamples into one formula (Montesi et al., 17 Feb 2026).

3. Formalization in second-order arithmetic and proof-theoretic strength

A recent reverse-mathematical analysis studies the theorem inside subsystems of second-order arithmetic. The base theory is $(M,w)\leftrightsquigarrow (M',w')$2, described there as Robinson arithmetic plus $(M,w)\leftrightsquigarrow (M',w')$3-induction and $(M,w)\leftrightsquigarrow (M',w')$4-comprehension, while $(M,w)\leftrightsquigarrow (M',w')$5 is $(M,w)\leftrightsquigarrow (M',w')$6 plus comprehension for all arithmetical formulas. Within this setting, formulas are coded as natural numbers and Kripke models are coded with domains $(M,w)\leftrightsquigarrow (M',w')$7. The central result is

$(M,w)\leftrightsquigarrow (M',w')$8

More precisely, over $(M,w)\leftrightsquigarrow (M',w')$9, the following are equivalent: $\varphi$0; the Hennessy–Milner theorem for modally saturated models; and the Hennessy–Milner theorem for image-finite models (Takeda et al., 2 Jul 2026).

The forward implication $\varphi$1 Hennessy–Milner uses arithmetical comprehension to form the set of modally equivalent pairs

$\varphi$2

since modal equivalence is expressible by a $\varphi$3 formula. Once $\varphi$4 exists as a set, the usual finite-branching or saturation argument shows that it is a bisimulation. The reverse implication is much subtler. Using the standard equivalence between $\varphi$5 and existence of the range of every injection $\varphi$6, the construction builds two image-finite Kripke models $\varphi$7 and $\varphi$8 such that the distinguished roots are modally equivalent, but any bisimulation between them encodes the range of $\varphi$9. Reading that range off from the bisimulation yields $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$0 (Takeda et al., 2 Jul 2026).

A technically distinctive point of this analysis is that bare $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$1 cannot in general extend an assignment on atomic formulas to a full valuation on all modal formulas. The reversal therefore constructs the needed valuation explicitly in stages rather than appealing to a general valuation-extension theorem. The same paper proves that such a general extension principle would already imply $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$2. This suggests a precise proof-theoretic moral: even for image-finite models, the existence of a bisimulation extracted from modal equivalence is not effectively available in the weak base theory (Takeda et al., 2 Jul 2026).

4. Structural variants and generalizations

The theorem has been generalized by changing either the logic, the semantic structures, or the behavioral relation. In several cases the classical slogan “modal equivalence $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$3 bisimilarity” survives only after the notions on both sides are adjusted.

Setting	Characterization	Source
Branching bisimulation with PHMLU	$V(w,\varphi)=1 \iff V'(w',\varphi)=1.$4, yielding the ordinary branching theorem as the symmetric case	(Geuvers et al., 2022)
Generalized Synchronization Trees	GHML equivalence coincides with weak GST bisimulation on image-finite GSTs	(Ferlez et al., 2017)
Intuitionistic modal logic $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$5	On modally saturated birelational models, $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$6	(Groot et al., 30 Jun 2026)
Fuzzy multimodal logics over Heyting algebras	Greatest weak bisimulation for plus/minus/all formulae coincides with greatest forward/backward/regular bisimulation under image-/domain-/degree-finiteness	(Stanković et al., 14 Feb 2025)
Non-distributive modal logic on polarity-based semantics	Modal equivalence corresponds to simulations both ways, not to a single symmetric bisimulation relation	(Ding et al., 2024)
ATL with imperfect information	A full Hennessy–Milner theorem holds for common-knowledge semantics using history-based alternating bisimulation	(Belardinelli et al., 2020)

These extensions are not uniform. In the branching setting, the central move is from equality of theories to inclusion of positive theories. Because full HML has unrestricted negation, $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$7 collapses to $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$8; the directed theorem therefore uses positive fragments such as PHML and PHMLU, together with directed bisimulation and directed apartness. The resulting theorem is one-sided: $V(w,\varphi)=1 \iff V'(w',\varphi)=1.$9 and the classical two-sided theorem is recovered by symmetrization (Geuvers et al., 2022).

Other generalizations alter the semantic substrate more radically. For Generalized Synchronization Trees, the theorem is transported through a surrogate Kripke structure: GHML on a GST corresponds to ordinary HML on the surrogate, and weak GST bisimulation corresponds to ordinary bisimulation of the surrogate roots. For intuitionistic modal logic $Z\subseteq W\times W'$0, the correct structure is birelational, with an order $Z\subseteq W\times W'$1 and a modal relation $Z\subseteq W\times W'$2; the paper defines IK-bisimulation so that the modal clause for $Z\subseteq W\times W'$3 reflects the composite relation $Z\subseteq W\times W'$4, and then proves a Hennessy–Milner-style theorem on modally saturated birelational models (Ferlez et al., 2017, Groot et al., 30 Jun 2026).

The non-distributive and fuzzy settings show that the theorem can survive even when symmetry must be weakened or graded. In polarity-based semantics for non-distributive modal logic, the appropriate behavioral notion is not a single symmetric bisimulation but two simulations, one in each direction; on image-finite models, modal equivalence coincides with this derived bisimilarity. In fuzzy multimodal logics over a complete linearly ordered Heyting algebra, modal equivalence becomes graded: $Z\subseteq W\times W'$5 and the theorem identifies this greatest weak bisimulation with forward, backward, or regular bisimulation depending on the fragment and finiteness assumption (Ding et al., 2024, Stanković et al., 14 Feb 2025).

5. Quantitative, algebraic, and specification-theoretic reformulations

A quantitative version replaces logical equivalence by equality of behavioral distance and logical distance. In a coalgebraic setting over a commutative unital quantale $Z\subseteq W\times W'$6, formulas take values in $Z\subseteq W\times W'$7, and one defines behavioral distance

$Z\subseteq W\times W'$8

and logical distance

$Z\subseteq W\times W'$9

Adequacy always gives $W\subseteq \mathbb N$00, and the main quantitative Hennessy–Milner theorem gives the converse under conditions formulated in terms of $W\subseteq \mathbb N$01-Kantorovich functors, closure operators, and density. This yields

$W\subseteq \mathbb N$02

for systems including weighted, metric, ultrametric, and probabilistic transition systems, and in particular covers continuous probabilistic transition systems with tight Borel measures (Forster et al., 2022).

A related abstract reformulation uses Galois connections between sets of predicates and behavioral objects such as equivalence relations, preorders, pseudo-metrics, or directed pseudo-metrics. If $W\subseteq \mathbb N$03 is the Galois connection, $W\subseteq \mathbb N$04 is the induced closure, and $W\subseteq \mathbb N$05 is a logic function satisfying the compatibility condition

$W\subseteq \mathbb N$06

then the induced behavior function $W\subseteq \mathbb N$07 satisfies

$W\subseteq \mathbb N$08

In this framework, Hennessy–Milner theorems become fixpoint identities covering bisimilarity, simulation preorder, trace equivalence, bisimulation metrics, directed simulation metrics, and directed trace metrics (Beohar et al., 2022).

Another line of work extends HML with greatest fixed points and changes the semantic target from state equivalence to specification equivalence. For Hennessy–Milner logic with greatest fixed points, the paper on specification theory proves that the $W\subseteq \mathbb N$09-calculus, finite nondeterministic acceptance automata, and finite disjunctive modal transition systems define exactly the same implementation classes. This is explicitly not the classical theorem “modal equivalence $W\subseteq \mathbb N$10 bisimilarity”; rather, it is a specification-theoretic analogue in which logical and behavioral specifications coincide in implementation semantics (Beneš et al., 2013).

A further generalization replaces one-step states by $W\subseteq \mathbb N$11-tuples. In $W\subseteq \mathbb N$12-quantifier logics, formulas are evaluated on $W\subseteq \mathbb N$13-pointed structures and quantifiers move between $W\subseteq \mathbb N$14-tuples via witness sets. The paper defines an associated bisimulation game and proves a finite-rank Ehrenfeucht–Fraïssé theorem together with a Hennessy–Milner theorem: on $W\subseteq \mathbb N$15-saturated structures,

$W\subseteq \mathbb N$16

This generalizes the saturated-model Hennessy–Milner pattern to a framework encompassing modal logic, monotone neighbourhood semantics, $W\subseteq \mathbb N$17, and $W\subseteq \mathbb N$18 (Härtter et al., 1 Feb 2026).

6. Formal verification, algorithmics, and practical use

The theorem has also become a formal and algorithmic object. In Lean’s CSLib, Hennessy–Milner Logic has been formalized with syntax, inductive satisfaction, denotational semantics, theory equivalence, and full metatheory. The final theorem is stated as equality of relations, $W\subseteq \mathbb N$24 and the development is parametric over arbitrary transition systems using CSLib’s generic LTS interface. This places the theorem into reusable library infrastructure rather than as a one-off case study (Montesi et al., 17 Feb 2026).

On the algorithmic side, the theorem’s existence claim has been turned into an optimization problem: given two non-bisimilar states in a finite LTS, compute a distinguishing HML formula. Computing a size-minimal distinguishing formula is NP-hard, and existence of a short distinguishing trace is NP-complete. By contrast, formulas of minimal observation depth, and even formulas with minimal observation depth together with recursively minimal negation depth, can be computed in polynomial time. The underlying finite-depth correspondence is the bounded version

$W\subseteq \mathbb N$19

which yields distinguishing formulas exactly when $W\subseteq \mathbb N$20-bisimilarity fails (Martens et al., 2023).

Practical applications often use HML ideas without invoking the theorem itself. In formal verification of smart contracts, KindHML builds a transaction-labelled transition system for Solidity-like contracts and introduces a first-order HML-based logic with structured modalities, quantification, a past operator $W\subseteq \mathbb N$21, and a predicate $W\subseteq \mathbb N$22. The work does not state the classical Hennessy–Milner theorem and does not develop a bisimulation characterization; nevertheless, it explicitly uses HML as the conceptual basis for reasoning about finite-depth transactional behavior over labelled transition systems (Bartoletti et al., 15 Apr 2026).

The theorem’s sensitivity to semantics is also visible in strategic logics. For ATL with imperfect information, a full Hennessy–Milner theorem is obtained only for the common-knowledge semantics, using a history-based alternating bisimulation and a four-player bisimulation game. The same paper shows that this is delicate in two senses: the theorem fails for the objective and subjective semantics, and deciding whether such a bisimulation exists between two finite imperfect-information concurrent game structures is undecidable (Belardinelli et al., 2020).

Taken together, these developments show that the Hennessy–Milner theorem is not a single isolated equivalence but a template. In its classical form, it identifies the exact match between modal theories and bisimulation on image-finite or saturated structures. In later work, the same template is preserved, weakened, graded, or redirected according to the ambient logic and semantics: by passing from equality to inclusion of theories, from Boolean truth to quantale-valued distance, from Kripke models to polarity frames or GSTs, from states to $W\subseteq \mathbb N$23-tuples, or from theorem statements to machine-checked libraries and witness-generation algorithms.