Expressiveness of Probabilistic Modal Logics, Revisited

Labelled Markov processes are probabilistic versions of labelled transition systems. In general, the state space of a labelled Markov process may be a continuum. Logical characterizations of probabilistic bisimulation and simulation were given by Desharnais et al. These results hold for systems deﬁned on analytic state spaces and assume that there are countably many labels in the case of bisimulation and ﬁnitely many labels in the case of simulation. In this paper, we ﬁrst revisit these results by giving simpler and more streamlined proofs. In particular, our proof for simulation has the same structure as the one for bisimulation, relying on a new result of a topological nature. This departs from the known proof for this result, which uses domain theory techniques and falls out of a theory of approximation of Labelled Markov processes. Both our proofs assume the presence of countably many labels. We investigate the necessity of this assumption, and show that the logical characterization of bisimulation may fail when there are uncountably many labels. However, with a stronger assumption on the transition functions (continuity instead of just measurability), we can regain the logical characterization result, for arbitrarily many labels. These new results arose from a new game-theoretic way of understanding probabilistic simulation and bisimulation.


Introduction
It is now 40 years since the logical characterization of bisimulation was established by van Benthem [14] and by Hennessy and Milner [10] for nondeterministic transition systems.It was shown that two states (or processes) are bisimilar if and only if they satisfied the same formulas of a modal logic that has come to be called Hennessy-Milner logic.The probabilistic version was studied by Larsen and Skou [12] who defined probabilistic bisimulation for discrete probabilistic transition systems and established a logical characterization theorem for discrete systems with a strong finite-branching assumption.
The analysis of bisimulation was extended to continuous state spaces by Blute et al. [4] and a logical characterization was shown by Desharnais et al. [6,7] who proved the result without using any negative constructs in the logic nor any kind of finite branching assumptions.Their proofs marked a XX:2 Expressiveness of probabilistic modal logics departure from the usual combinatorial arguments and used some non-trivial results from measure theory, specifically using remarkable properties of analytic spaces; see [13] for an expository account.
The fact that the logical characterization result can be established with a purely positive logic was a surprise at the time.It opened the door to the possibility that there could be a logical characterization of simulation; we define this precisely below but the idea should be intuitively clear.A clever example, due to Josée Desharnais [8], showed that this cannot be done with the same logic as the one used for bisimulation; one needs to have disjunction in the logic.A logical characterization of simulation was proved [8] for transition systems with finitely many labels.The main contribution of [8] was approximation theory which included a domain-theoretic treatment; the logical characterization result fell out of the domain theory results.Desharnais [5] in her thesis gave a proof not using domain theory in the discrete case.What remained unknown until now is a proof that works for countably many labels, continuous state spaces and, if possible, not using domain theory.We provide such a result, extending the characterization for simulation to countably many labels with a proof very much analogous to the one given for bisimulation.

Results
1. We give a characterization of bisimulation and simulation in terms of Spoiler/Duplicator games.This is elementary but interesting: it was the main driver of the intuitions that led to the proofs of the present paper though, in the end, one does not actually need the games to establish the results.2. The logical characterization of bisimulation has a proof which has a structure which can be boiled down to two main ingredients: Dynkin's π-λ theorem and the Unique Structure Theorem for analytic spaces.For simulation, it turns out that a completely analogous proof exists.It is enough to replace the two main ingredients by new positive versions: a positive analogue of the monotone class theorem and a positive UST, both of which we prove.This simplifies the previous domain-theoretic proof and clarifies the picture.The small price to pay is to move from analytic spaces to Polish ones; moving back to analytic is future work.

3.
Both proofs rely on the countability of the set of formulas.This is necessary, as an explicit counterexample shows.But if the transition structure is continuous, logical characterization results are regained for arbitrary sized sets of labels.As far as we know, this is the first result of this type for uncountable label spaces.Both logical characterization proofs, for bisimulation and simulation, have a similar structure and can even be said to follow the same top-level strategy as the original Hennessy-Milner proof.

Probabilistic systems and logics
We review some definitions and concepts from measure theory and topology.We assume that the reader is familiar with concepts like: σ-algebra, measurable functions, measures, topology and continuity.
Given a topological space X the σ-algebra induced by its open sets (or its closed sets) is called the Borel algebra; we will always work with Borel algebras of topological spaces.We call them Borel spaces.
A topological space is said to be separable if it has a countable dense subset.For metric spaces this is equivalent to having a countable base of open sets.A Polish space is the topological space underlying a complete separable metric space.Note that a space like (0, 1) which is not complete in its usual metric is nevertheless Polish, since it can be given a complete metric that produces the same topology.If X, Y are Polish spaces and f : X → Y is a continuous function then the image f (X) ⊂ Y is an analytic space.The class of analytic spaces is not altered if we allow f to be measurable instead of continuous or if we take the image of a Borel set instead of all of X. N. Fijalkow, B. Klin and P. Panangaden XX:3 Definition 1.A Markov kernel on a Borel space (X, Σ) is a function τ : X × Σ → [0, 1] such that for each fixed x ∈ X, the set function τ(x, •) is a sub-probability measure, and for each fixed C ∈ Σ the function τ(•, C) is a measurable function.
One interprets τ(x, C) as the probability of the process starting in state x making a transition into one of the states in C. Definition 2. A labelled Markov process (LMP) S with label set A is a structure (X, Σ, {τ a | a ∈ A}), where (X, Σ) is a Borel space and A key concept is bisimulation.The following definition is adapted from Larsen and Skou [12] to deal with measurability issues.Definition 3 (Bisimulation).Let S = (X, Σ, τ) be a labelled Markov process.An equivalence relation R on X is a bisimulation if whenever xRy, with x, y ∈ X, we have that for all a ∈ A and every R-closed measurable set C ∈ Σ, τ a (x, C) = τ a (y, C).We say that x and y are bisimilar, denoted x ≈ y, if there exists a bisimulation R such that xRy.
The modal logic L ∧ used in the logical characterization theorem of [7] is generated by the grammar: where p ranges over rational numbers between 0 and 1.A state x satisfies the modal formula a p φ if there exists a measurable subset C with every state in C satisfying φ and τ a (x, C) > p.It is easy to show that the sets defined by formulas [[φ]] := {x | x | = φ} are all measurable.We write x ≡ ∧ y to say that x and y satisfy the same formulas in L ∧ .The logical characterization theorem for probabilistic bisimulation is: 7]).For any labelled Markov process (X, Σ, τ) where (X, Σ) is analytic and A is countable, and for any x, y ∈ X, we have that x ≡ ∧ y if and only if x ≈ y.
For a preorder R on a set X, we say that C ⊆ X is R-closed if x ∈ C and xRy implies y ∈ C, for all x, y ∈ X. Definition 5 (Simulation).Let S = (X, Σ, τ) be a labelled Markov process.An preorder relation R on X is a simulation if whenever xRy, with x, y ∈ X, we have that for all a ∈ A and every R-closed measurable set C ∈ Σ, τ a (x, C) ≤ τ a (y, C).We say that x is simulated by y, denoted x y, if there exists a simulation R such that xRy.
The logic L ∨ ∧ extends L ∧ with disjunction: We write x ≤ ∨ ∧ y to say that every formula in L ∨ ∧ satisfied by x is also satisfied by y.
The previous logical characterization theorem for probabilistic simulation is: 8]).For any labelled Markov process (X, Σ, τ) where (X, Σ) is analytic and A is finite, and for any x, y ∈ X, we have that x ≤ ∨ ∧ y if and only if x y.
Existing proofs of Theorems 4 and 6 span several pages each, and are markedly dissimilar.In particular, the latter relies on the machinery of domain theory.One of our main contributions is to provide new, short proofs of both results.

Probabilistic (bi)simulation games
The classical notion of bisimulation and simulation for nondeterministic processes has a simple and elegant characterization in terms of games.These games, played between two players named Spoiler (who tries to prove that some two states in a process are not bisimilar) and Duplicator (who claims the opposite), provide convenient intuitions about the essence of bisimilarity.
To the best of our knowledge, probabilistic bisimulation and simulations have not been characterized by games before.In this section we fill this gap; as we shall see, the relevant games have a pleasantly simple structure, even in the setting of continuous space processes.
We begin with the case of bisimulation game.As in the classical case, we consider a spoiler/duplicator game with two players.Duplicator's plays are pairs of states that she claims are bisimilar.Spoiler tries to show that a given pair of states proffered by Duplicator are not bisimilar.Let S = (X, Σ, τ) be a labelled Markov process, and x, y ∈ X.The bisimulation game starting from the position (x, y) alternates between moves of the following kinds: Spoiler chooses a ∈ A and C ∈ Σ such that τ a (x, C) τ a (y, C), Duplicator answers by choosing x ∈ C and y C and the game continues from (x , y ).A player who cannot make a move at any point loses.Duplicator wins if the game goes on forever.
Note that the only way for Spoiler to win is to choose C = X at some point; otherwise Duplicator can always choose some x and y as prescribed.(The only other situation where Duplicator cannot proceed would be C = ∅, but that is not a legal move for Spoiler since always τ a (x, ∅) = τ a (y, ∅) = 0.) On the other hand, Duplicator can win either by forcing an infinite play or by reaching a position (x, y) where τ a (x, C) = τ a (y, C) for every C ∈ Σ.
The intuition behind the game should be clear.Spoiler tries to prove that states x and y are not bisimilar by showing a label a and a set C, purportedly closed under bisimilarity, such that the probabilities of a-labelled transitions to C are different for x and y.This difference of probabilities is checked but not disputed by Duplicator, who instead claims that C, in fact, is not closed under bisimilarity.She does that by choosing x ∈ C and y C and claiming that these two are bisimilar; the game then proceeds in the same fashion.
Before we formally prove the correctness of this game, let us spend a moment to consider what makes a game-theoretic characterization "elegant".In our opinion, the classical bisimulation game for nondeterministic processes is elegant because it allows one to characterize a global property of behaviours (bisimilarity) in terms of a game whose rules only depend on local considerations.Indeed, whether a move in the game is legal or not does not depend on bisimilarity or other long-range properties, but merely on local observations about transition capabilities that cannot be disputed by either player.
We argue that this criterion of elegance is satisfied by our probabilistic game.One can imagine the players engaging in a brief experiment with the given Markov process after each move by Spoiler, to determine that the two transition probabilities involved are indeed different.By performing random a-transitions from x and y sufficiently many times, Spoiler can demonstrate to Duplicator, with an arbitrarily high confidence level, that the probabilities of getting to C are different and so that the move to C is legal for Spoiler.It is important to note, comparing the game to the definition of probabilistic bisimulation itself, that the legality of a Spoiler's move does not depend on the set C being actually closed under bisimilarity; a game with such a condition would not be "elegant".
The question of how many random transitions are enough to convince Duplicator that a Spoiler's move is legal, and hence how much time it takes for Spoiler to win the game if x and y are not bisimilar, suggests a potentially interesting connection of the bisimulation game to the quantitative framework of metrics on labelled Markov processes [9].We leave this for future work.
Back to formal development.Since all infinite plays are won by the same player (Duplicator), standard game-theoretic arguments prove that: Fact 7. The bisimulation game is determined, i.e., from every position (x, y) either Spoiler has a winning strategy or Duplicator does.
From this we infer: Theorem 8.The states x and y are bisimilar if and only if Duplicator has a winning strategy from (x, y).
Proof.For the left-to-right implication, for bisimilar x and y, we construct a winning strategy from (x, y) for Duplicator.In this strategy, for any move a and C by Spoiler, Duplicator chooses some arbitrary x ∈ C and y C such that x and y are bisimilar.This is always possible: since Spoiler's move was legal, and it originated from a pair of bisimilar states, C cannot be closed under bisimilarity.This strategy is winning for Duplicator since it allows her response to any move by Spoiler, and Duplicator wins all infinite plays.
For the right-to-left implication, we shall show that the set R of all pairs (x, y) whence Duplicator has a winning strategy, is a bisimulation.To this end, first we need to show that R is an equivalence relation.Reflexivity is immediate, since from a position (x, x) Spoiler has no legal moves.For symmetry, given a winning strategy from (x, y) Duplicator builds a strategy from (y, x) trivially: she simply replies to any first move by Spoiler as if she would reply to a move from (x, y), and then she follows the given strategy.For transitivity, assume winning strategies for Duplicator from (x, y) and (y, z).A winning strategy for (x, z) works as follows: for a legal move a and C from Spoiler, it must be that τ a (x, C) τ a (y, C) or τ a (y, C) τ a (z, C).Depending on which of these inequalities holds, reply according to the strategy from (x, y) or from (y, z), and then follow that winning strategy.Now assume towards contradiction that R is not a bisimulation.This means that for some x, y such that xRy, there exists a letter a in A and an R-closed subset C of X such that τ a (x, C) τ a (y, C).Consider a and C as a Spoiler's move from (x, y).No matter what Duplicator chooses as x ∈ C and y C, since C is R-closed we have that not (x Ry ) and, by Fact 7, Spoiler has a winning strategy from (x , y ).This forms a winning strategy for Spoiler from (x, y), contradicting the assumption that xRy.
Simulation game is defined in a very similar fashion, alternating the following moves: Spoiler chooses a ∈ A and C ∈ Σ such that τ a (x, C) > τ a (y, C), Duplicator answers by choosing x ∈ C and y C and the game continues from (x , y ).Again, a player who cannot make a move at any point loses, and Duplicator wins all infinite plays.
The intuition behind the game is as before, except now Spoiler maintains that his chosen sets C are -closed, and Duplicator contradicts that by choosing x ∈ C and y C and maintaining that x y .All other considerations remain virtually the same, up to and including: Theorem 9. x y if and only if Duplicator has a winning strategy from (x, y).
Example 10.We illustrate the simulation game on an example (see Fig. 1).In this Markov process there is only one label.From the state q, the process loops forever.On the other hand, from the state p 1 , one can reach the deadlock state p 4 through the path to p 2 and p 3 .
We examine the simulation game and how Spoiler can successfully prove to Duplicator that the state p 1 does not simulate q.We start the simulation game from (q, p 1 ).A possible first move is 2 , but it allows Duplicator to play (q, p 1 ), back to the original position.A smarter move is C = {q, p 1 }, to which Duplicator has several possible answers, all losing.For instance, if Duplicator plays (q, p 4 ), Spoiler wins immediately by choosing C = X.Duplicator may survive more steps by playing (q, p 2 ), then (q, p 3 ), before the fatal (q, p 4 ). 1 Figure 1 It takes four steps for Spoiler to convince Duplicator that the state p 1 does not simulate q.

Logical characterization of bisimulation, revisited
In this section, we give a short proof for the logical characterization of bisimulation, which relies on two ingredients: the π-λ theorem and the Unique Structure Theorem.

The π-λ Theorem and the Unique Structure Theorem
A π-system is a family of subsets of a set X closed under finite intersections.A λ-system is a family that contains X and is closed under complement and countable disjoint unions.A σ-algebra is a family closed under complement, countable unions and countable intersections.For a family E, let σ(E) denote the least σ-algebra that contains E.
Below, ≡ E is the relation of equivalence up to E, i.e., x ≡ E y if and only if, for every Y ∈ E, x ∈ Y iff y ∈ Y.
Theorem 12 (Unique Structure Theorem, [1]).In any analytic space (X, Σ), for every countable family E ⊆ Σ such that X ∈ E, every measurable, ≡ E -closed subset of X is an element of σ(E).
Proof.Take some x, y ∈ X and assume that there exists some a ∈ A such that τ a (x, C) τ a (y, C) for some ≡ ∧ -closed set C ∈ Σ.We need to prove that x ∧ y.
If δ(X) = γ(X) then pick any It is easy to see that Π is a π-system and Λ is a λ-system (in particular, Λ is closed under complement since δ(X) = γ(X)).Clearly, ≡ Π = ≡ ∧ .Moreover, since there are only countably many formulas, Π is countable and, by Theorem This easily implies Theorem 4, repeated here: Corollary 14.For any labelled Markov process (X, Σ, τ) where (X, Σ) is analytic and A is countable, and for any x, y ∈ X, we have that x ≡ ∧ y if and only if x ≈ y.
Proof.The right-to-left implication is an easy induction on the structure of formulas.The left-to-right implication is immediate by Theorem 13.

Logical characterization of simulation, revisited
Our proof of the logical characterization of simulation is completely analogous to the one for bisimulation.It is enough to replace the two main ingredients (Theorems 11 and 12) by new ones.

The Positive Monotone Class Theorem and the Positive Unique Structure Theorem
A lattice of sets is a family of subsets of a set X closed under finite unions and intersections. 1 A monotone class is a family closed under unions of increasing chains and under intersections of decreasing chains.A σ-lattice of sets is a family of sets closed under countable unions and countable intersections.For a family E, let L(E) denote the least σ-lattice of sets that contains E.
Theorem 15 (Positive Monotone Class Theorem).For any lattice of sets E and any monotone class M on the same set X, if This result is similar and easier to prove than Theorem 11, and it should be treated as folklore.Below, E is the preorder determined by E, i.e., x E y if and only if, for every Y ∈ E, x ∈ Y implies y ∈ Y.
Theorem 16 (Positive Unique Structure Theorem).In any Polish space (X, Σ), for every countable family E ⊆ Σ, every nonempty, different from X, measurable and E -closed subset of X is an element of L(E).
This result strengthens Theorem 12, albeit on the restricted domain of Polish spaces.(Extending it to analytic spaces is future work.)Its proof is also more involved, using ideas similar to the proof of Lusin's Separation Theorem for analytic sets (see [11]).The proof was pointed out to us by Roman Pol.

The logical characterization
Theorem 17.For any labelled Markov process (X, Σ, τ) where (X, Σ) is Polish and A is countable, ≤ ∨ ∧ is a simulation.
Proof.Take some x, y ∈ X and assume that there exists some a ∈ A such that τ a (x, C) > τ a (y, C) for some ≤ ∨ ∧ -closed set C ∈ Σ.We need to prove that x ∨ ∧ y.
It is easy to see that E is a lattice of sets and (by continuity of measure) M is a monotone class.
Clearly, E = ≤ ∨ ∧ .Moreover, since there are only countably many formulas, E is countable hence, by Theorem 16, C ∈ L(E).Since by assumption C M, we have L(E) M, hence (by Theorem 15) E M. In other words, there exists a formula φ such that δ( ).We readily obtain x | = a p φ and y | = a p φ, hence x ∨ ∧ y as requested.
Compared to Theorem 6, the following easy consequence is restricted to Polish spaces but generalized to countable sets of labels.
Corollary 18.For any labelled Markov process (X, Σ, τ) where (X, Σ) is Polish and A is countable, and for any x, y ∈ X, we have that x ≤ ∨ ∧ y if and only if x y.
Proof.The right-to-left implication is an easy induction on the structure of formulas.The left-to-right implication is immediate by Theorem 17.

The case of uncountably many labels
Our proofs of the logical characterizations for simulation and bisimulation rely on the assumption that the set of formulas (and, equivalently, the set of transition labels) is countable.In this section we investigate the necessity of this assumption.We first observe that indeed if there are uncountably many labels, then the logical characterization fails in general.However, we show that if the transition structure is continuous, then the logical characterization holds again, without any assumption on the set of labels.

A counterexample
In the classical logical characterization of (bi)similarity for nondeterministic labelled transition systems [10], one can restrict to a logic with finite conjunction and disjunction only if the systems in question satisfy a finite branching property called image finiteness: each state can have only finitely many successors for any given transition label.Since [6,7] it has been known that this restriction does not apply to probabilistic systems, where a finitary logic is enough to characterize bisimilarity on systems with arbitrary (probabilistic) branching.
On the other hand, in the classical nondeterministic setting, once image finiteness is ensured, the size of the set of transition labels matters very little.Even if infinitely many, or even uncountably many labels are permitted, a finitary logic (with a correspondingly large set of modal operators) is enough to characterize (bi)similarity for nondeterministic transition systems labelled with them.
We now show that this is not the case for labelled Markov processes with continuous state spaces.Specifically, we show an example where the set of labels is uncountable and the logical characterization fails, even though the space of states is a particularly simple, compact Polish space.
The two states p and q do not simulate each other, but they satisfy the same formulas of L ∨ ∧ .
Consider a set of actions A = [0, 1].Define functions τ a : X × Σ → [0, 1] for each a ∈ A as follows: The following proposition easily implies that logical characterizations both for bisimulation and for simulation fail for this labelled Markov process.
Proposition 19.Neither p nor q simulates the other, but they satisfy the same formulas of L ∨ ∧ .
Proof.We prove that neither p nor q simulates the other.First, for any x, y in [0, 1], if x y then neither of these simulates the other.Indeed, from x, the action a = x leads to with probability 1 and leads nowhere from y.It follows that every subset of [0, 1] is -closed; in particular this applies to [0, 1  2 ] and [ 1  2 , 1].This implies that neither p nor q simulates the other, because τ a (p, [0, 1  2 ]) = 1 and τ a (q, [0, 1  2 ]) = 0, and vice-versa τ a (p, [ 1  2 , 1]) = 0 and τ a (q, [ 1 2 , 1]) = 1.To see that p and q satisfy the same formulas, we observe that for every finite subset B ⊆ A, p and q do simulate each other (indeed, they are even bisimilar) in the system restricted to labels from B. The claim easily follows from this, since every formula of L ∨ ∧ uses finitely many labels.
So for a finite B ⊆ A, define a relation R on X to be the least equivalence relation such that pRq and xRy for each x, y ∈ [0, 1] \ B. We claim that R is a bisimulation on the system restricted to labels with B. The only nontrivial case is the pair pRq: every R-closed set C ⊆ [0, 1] is either finite or co-finite, from which it easily follows that τ a (p, C) = τ a (q, C).
Intuitively, the core of the problem here is the highly non-continuous nature of transitions from [0, 1], allowing one to observe specific states from that uncountable space.Indeed, as we show in the following section, the problem disappears and the logical characterizations hold if we assume that the transition function τ a (•, C) is continuous for each a and C.

Logical characterizations for continuous transition functions
Given a labelled Markov process (X, Σ, τ) with labels from a set A, we denote by (X, Σ, τ |B ) the same system restricted to labels from B ⊆ A.
Theorem 20.For any labelled Markov process (X, Σ, τ) where (X, Σ) is Polish and such that for all a ∈ A, C ∈ Σ, the function τ a (•, C) is continuous, there exists a countable set B such that the bisimilarity relation ≈ on (X, Σ, τ |B ) coincides with that on (X, Σ, τ).
Proof.We will use the fact that, under the above assumptions, X 2 is also a Polish space for the product topology, hence it satisfies the hereditary Lindelöf property: any open cover of a subset of X 2 has a countable subcover.
By definition, the bisimilarity relation ≈ on (X, Σ, τ) is the largest bisimulation.It is standard to define it as the greatest fixpoint of a certain operator on binary relations on X.For us it will be convenient to speak in terms of complements, and we consider the complement of ≈ as the least fixpoint of the operator: Thanks to Tarski's fixed point theorem, this is obtained by defining a sequence (W α ) α of subsets of X 2 indexed by ordinals α: for α + 1 a successor ordinal and β a limit ordinal, define: The complement of ≈ on (X, Σ, τ) is the union of all W α for all ordinals α.More specifically, (W α ) α form an increasing sequence that reaches a fixpoint at some ordinal γ not larger than the cardinality of P(X 2 ).Note that all W α are open sets in X 2 .This is proved by ordinal induction: for a successor ordinal, W α+1 is a union of sets of the form For each ordinal α we construct a countable subset B α ⊆ A such that W α calculated on (X, Σ, τ |B α ) coincides with W α calculated on (X, Σ, τ).
For sucessor ordinals, rewrite the definition of W α+1 as: This is a union of open sets.Since X 2 is hereditary Lindelöf, one can extract a countable subcover of this union, indexed by some set B ⊆ A. It is then enough to take B α+1 = B α ∪ B.
For limit ordinals, extract a countable subcover of the union W β = α<β W α and take B β to be the union of the B α 's defined for α's from that subcover.Now the countable set B γ , where γ is the ordinal for which W γ reaches the least fixpoint of Φ, satisfies the desired property.
The same result holds for simulation: Theorem 21.For any labelled Markov process (X, Σ, τ) where (X, Σ) is Polish and such that for all a ∈ A, C ∈ Σ, the function τ a (•, C) is continuous, there exists a countable set B such that the similarity preorder on (X, Σ, τ |B ) coincides with that on (X, Σ, τ).
Proof.Completely analogous to the proof of Theorem 20, but with the operator Φ(R) = (x, y) ∈ X 2 ∃a ∈ A, ∃C ∈ Σ (X 2 \ R)-closed, s.t.τ a (x, C) > τ a (y, C) instead.In particular the fact that each W α is open, still holds.
The following immediately follows from Theorems 20 and 21 in the light of Corollaries 14 and 18.
Corollary 22.For any labelled Markov process (X, Σ, τ) where (X, Σ) is Polish and such that for all a ∈ A, C ∈ Σ, the function τ a (•, C) is continuous, for any x, y ∈ X, x ≡ ∧ y if and only if x ≈ y, x ≤ ∨ ∧ y if and only if x y.

Conclusions
The results of this paper suggest that we have arrived at a deeper understanding of the interplay of modal logic and probabilistic transition structure.Variations of the logic can also be used for logical characterization of bisimulation, for example, with the modal construct and just disjunction instead of just conjunction, as studied in [2].The arguments are minor variations of the proofs given in Section 3sec:bisim.The earlier proof of logical characterization of simulation [8] emerged as a by-product of the theory of approximation; the proof of the present paper is direct.It is particularly pleasing that the two logical characterization proofs have the same general shape and also resemble the overall strategy of the Hennessy-Milner proof.The game characterization, though elementary, is both pleasing and intriguing.As suggested earlier, there might be interesting links to metrics and the number of moves it takes for Spoiler to win a game.The connection between metrics and bisimulation is well understood but it is possible that via the game one might gain a more quantitative understanding of the numerical significance of the metric.
for some a and C. Such a set is open, since it is the inverse image of the (open) inequality relation on [0, 1] along the continuous function τ a (•, C).