Modal Semirings Revisited Jules Desharnais1 and Georg Struth2 1 D´epartement d’informatique et de g´enie logiciel, Pavillon Adrien-Pouliot, 1065, avenue de la M´edecine, Universit´e Laval, Qu´ebec, QC, Canada G1V 0A6 [email protected] 2 Department of Computer Science University of Sheffield, S1 4DP, United Kingdom [email protected] Abstract. A new axiomatisation for domain and codomain on semirings and Kleene algebras is proposed. It is much simpler, more general and more flexible than a predecessor, and it is particularly suitable for pro- gram analysis and program construction via automated deduction. Dif- ferent algebras of domain elements for distributive lattices, (co-)Heyting algebras and Boolean algebras arise by adapting this axiomatisation. Modal operators over all these domain algebras are then easy to define. The calculus of the previous axiomatisation arises as a special case. An application in terms of a fully automated proof of a modal correspon- dence result for L¨ob’s formula is also presented. 1 Introduction Kleene algebras are foundational structures in computing with applications rang- ing from program semantics, construction and refinement to rewriting and con- currency control. Most current variants are close relatives of Kozen’s elegant axiomatisation [17, 18], and share some important features: They focus on the essential operations for modelling programs and similar discrete systems. They support abstract and concise reasoning about such systems within first-order equational calculi. They have rich model classes that include relations, languages, paths in graphs, program traces and predicate transformers. And they enable a new kind of automated program analysis and construction that is supported by automated theorem provers (ATP systems) [10, 11, 13, 25]. To connect the algebraic approach with traditional logics of programs such as dynamic, temporal or Hoare logics, modal operators have been added to semirings and Kleene algebras by axiomatising a concept of domain [8]. In this approach—henceforth referred to as the DMS approach—the domain function d maps elements of an idempotent semiring S, which can be assumed to model the actions of some system, to elements of a certain Boolean subalgebra B of S, which models the state space of the system. This two-sorted approach seems very natural since domain elements d(x) represent precisely those states at which the action x is enabled. The resulting modal semirings and modal Kleene algebras have widely been applied since [5, 7, 10, 22, 24]. But despite its evident merits, the DMS approach shows some deficiencies. First, the domain algebra B in the range of d cannot be freely chosen: the DMS axioms imply that B must be the maximal Boolean subalgebra embedded into S in a certain way [8]. So the axioms determine B rather inelegantly and indirectly. Second, experiments show that the performance of ATP systems sig- nificantly suffers from the intricacies of the two-sorted setting [10]: an annoying obstacle to verification tasks. But are these deficiencies unavoidable? This paper proposes a one-sorted approach to domain semirings and Kleene algebras with domain that solves the problems mentioned. More precisely, our main contributions are as follows. – We provide a new one-sorted equational axiomatisation of domain for ar- bitrary semirings. It induces distributive lattices as domain algebras and supports the definition of modal operators on these lattices. – We extend domain semirings by an antidomain function that induces a Boolean domain algebra. We then reduce this axiomatisation to three simple equations plus the semiring axioms. We also show that all DMS theorems can be recovered in this much simpler and more pristine setting. – The flexibility of the approach is further demonstrated by extending domain semirings to Heyting and co-Heyting algebras with modal operators. – Finally, the improved applicability of the approach follows from proof ex- periments that include an automated modal correspondence proof for L¨ob’s formula, which has an immediate impact for automated termination analysis. These results show that the new approach presents a significant improvement: It is much simpler, more general and more flexible that the DMS approach with- out sacrificing the underlying intuitions. Its most important benefit, however, is its superior suitability for ATP systems in the context of automated program analysis and program construction. ATP systems also played an important role in the development of this ap- proach, in particular for analysing dependencies, redundancies and reducibilities of axiom systems and for developing the basic calculi. This technology allowed us to greatly accelerate the otherwise tedious and time-consuming search for proofs and counterexamples and to focus entirely on the conceptual work. We used the following tools: – Waldmeister [3], which is currently the most powerful system for unit equa- tional logic and which outputs equational proofs; – Prover9 [2], which is currently the most powerful ATP for full first-order reasoning with Kleene algebras [13] (but does not produce readable proofs); – Mace4 [2], which generates finite (counter)models from first-order axioms. All calculational proofs and counterexample searches in this paper have been fully automated with these tools, using a PC under Linux with an Intel Pentium 1.73GHz processor with 6.5 MB memory. The input templates in the appendices should put any reader in the position to easily reproduce them. Unfortunately, however, the granularity of Waldmeister proofs is too fine for publication. We therefore present comprehensive proofs of our main theorems in the paper. 2 The remainder of this text is organised as follows. Section 2 to Section 5 introduce domain semirings which induce distributive lattices as domain alge- bras and develop their basic calculus. Section 6 provides conditions that relate the domain algebras with Boolean algebras. Section 7 sets up the link between domain semirings, Kleene algebras with domain and distributive lattices with operators. Section 8 to Section 10 introduce antidomain operations that turn domain algebras into Boolean algebras. In Section 11, the domain algebras of domain semirings are extended to (co-)Heyting algebras. Section 12 presents an application of the new axiomatisation in automated termination analysis. Sec- tion 13 presents a conclusion. Additional material is collected in five appendices. 2 Domain Semirings Semirings are essentially rings without subtraction. Formally, a semiring is a structure (S, +, ·, 0, 1) such that (S, +, 0) is a commutative monoid, (S, ·, 1) is a monoid, multiplication distributes over addition from the left and right and 0 is a left and right zero of multiplication. As usual in algebra, variants without 0 and 1 can easily be defined, but they are less interesting for our purpose. The explicit semiring axioms (as ATP input) can be found in Appendix B and Appendix C. As usual in algebra, we stipulate that multiplication binds more strongly than addition and omit the multiplication symbol. A standard semiring duality is opposition. It is obtained by swapping the or- der of multiplication (or by reading expressions from right to left). The opposite So of a semiring S is again a semiring and Soo = S. A semiring S is idempotent if 1 + 1 = 1 or, equivalently, if x + x = x holds for all x ∈ S. For idempotent semirings, the relation ≤ defined, for all x, y ∈ S, by x ≤ y ⇔ x + y = x is a partial order; (S, ≤) is a semilattice with addition corresponding to join and with least element 0. Addition and multiplication are isotone with respect to that order. It is well known that idempotent semirings have many computational mean- ingful models. We will refer to two standard models to motivate our approach: – Relation semirings are idempotent semirings formed by binary relations un- der union, relational product, the empty relation and the unit relation. – Trace semirings are idempotent semirings formed by sets of traces of a pro- gram or transition system under union, trace products, the empty set of traces and the set of states from which traces are built. As usual, traces are words over a state alphabet and an action alphabet in which the first an the last letter are state symbols and in which state and action symbols alternate. Language and path semirings arise as special cases of trace semirings. We axiomatise a domain function on arbitrary semirings. It can be motivated in several ways. First, trace and relation semirings can be taken as starting points and some natural properties of domain can be selected. Alternatively, the DMS axioms (cf. Appendix A) can be translated into the one-sorted setting. In addition, the notion axiomatised can be tested on the algebra of domain elements 3 that is induced. We first present the axioms and then motivate them from all these points of view. A domain semiring is a semiring S extended by the domain operation d : S → S which, for all x, y ∈ S, satisfies the following axioms: x + d(x)x = d(x)x, (D1) d(xy)=d(xd(y)), (D2) d(x)+1=1, (D3) d(0) = 0, (D4) d(x + y)=d(x)+d(y). (D5) The following fact can easily be shown by an ATP system, and we present the proof generated by Waldmeister as an example in Appendix D. Proposition 2.1. Domain semirings are idempotent. Hence every domain semiring can be ordered. Let us discuss the particular choice of axioms. The axioms (D1) and (D2) correspond to the DMS axioms (20) and (22) in Appendix A. The axioms (D3), (D4) and (D5) follow from the DMS axioms, but, as we will see below, not from (D1) and (D2). DMS axiom (21) is particular to the two-sorted setting and cannot directly be expressed here. This will further be discussed below. By Proposition 2.1, axiom (D1) can be rewritten as x ≤ d(x)x. We say more generally that an element y of an idempotent semiring is a left preserver of an element x if x ≤ yx.Sod(x) is a left preserver of x and we call this axiom the preservation axiom.