Modal Algebra of Multirelations

We formalise the modal operators from the concurrent dynamic logics of Peleg, Nerode and Wijesekera in a multirelational algebraic language based on relation algebra and power allegories, using relational approximation operators on multirelations developed in a companion article. We relate Nerode and Wijesekera's box operator with a relational approximation operator for multirelations and two related operators that approximate multirelations by different kinds of deterministic multirelations. We provide an algebraic soundness proof of Goldblatt's axioms for concurrent dynamic logic as an application.


Introduction
This is the third article in a trilogy on the inner structure of multirelations [FGS23b], the determinisation of such relations [FGS23a] and their algebras of modal operators.
Multirelations are relations of type X ↔ PY , which model alternating nondeterminism.Here we contribute to a line of work on modal algebras of multirelations [FS15,FS16] related to Peleg's concurrent dynamic logic [Pel87] and algebraic languages for these [FKST17].These languages are extensions of relation algebra [Sch11] and boolean power allegories [F Š90] with specific operations for multirelations.
Our main motivation has been the algebraic formalisation of Nerode and Wijesekera's modal box operator [NW90] for concurrent dynamic logic.In dynamic logics, relational modal box operators A key observation is that Goldblatt's α : (X ↔ PY ) → (X ↔ Y ) can be expressed using fundamental concepts of power allegories.For any multirelation R : X → PY , α(R) = R∋, the relational composition of R with the converse of the element-(multi)relation ∈ : Y ↔ PY .Likewise we can define a new De Morgan dual diamond operator − α = − r • α.Yet the combination of [−] α with Peleg's multirelational diamond − * , which is used in Wijesekera and Nerode's as well as in Goldblatt's concurrent dynamic logics, and the study of the relationships between the different modal operators requires further multirelational operations, including Peleg's composition of multirelations.Due to the complexity of their interactions we consider them in concrete extensions and enrichments of the category Rel in this work, but with a view towards future axiomatic approaches, and therefore by and large through algebraic proofs.
Modal operators on relations or multirelations usually map relations X ↔ Y or multirelations X ↔ PY to functions or "predicate transformers" PY → PX.Modal diamonds then arise as relational or multirelational preimage operations and modal boxes as their De Morgan duals.Transformers PX → PY are obtained by opposition.Algebraically, these preimages can be expressed using relational and multirelational domain operations together with relational or Peleg composition.Alternatively, via the isomorphism between relations X ↔ Y and functions X → PY , predicate transformers PX → PY can be obtained as Kleisli extensions of Kleisli arrows in the powerset monad on Set.Similarly, we can map multirelations X ↔ PY to "relational predicate transformers" PX ↔ PY using a Kleisli lifting for multirelations introduced in [FKST17], while relations X ↔ Y are sent to such transformers by the relational image functor of power allegories.Predicate transformers PY ↔ PX can again be obtained via relational converse.The graph functor translates these transformers from Set to Rel.
While these constructions of modalities depend only on concepts of power allegories and on Peleg composition, the relationships between the different modal operators require closure and duality properties of the inner structure of multirelations and notions of inner determinism and inner functionality (or univalence), which have been studied in the first two parts of this trilogy [FGS23b,FGS23a].Here we harvest the concepts and results sown in the previous parts to obtain the results outlined above.As an application, we prove soundness of a variant of Goldblatt's axiomatisation of concurrent dynamic logic.
As in [FGS23b,FGS23a], we have used the Isabelle/HOL proof assistant to formalise and check many results in this article, see [GS23], without aiming at a complete formalisation.Our article is therefore self-contained without the Isabelle libraries.

Relations and Multirelations
We start with recalling the basics of binary relations and multirelations, following [FGS23b,FGS23a]; see also the references therein.Our multirelational language is closely related to allegorical and relation-algebraic approaches [SS89, Sch11, F Š90, BdM97, FKST17].We also use many properties from [FGS23b,FGS23a].We list all relational and multirelational concepts with respect to a small basis in Appendix A, which extends similar lists in the two predecessor articles.

Binary relations
Following [FGS23b,FGS23a], we work in enrichments of the category Rel.We write X ↔ Y for the homset Rel(X, Y ), Id X for the identity relation on X, ∅ X,Y for the least and U X,Y for the greatest element in X ↔ Y , −R for the complement of R and S − R for the relative complement S ∩ −R, RS for the relational composition of relations R, S of suitable type, R/S and R\S for the left and right residuals of R and S, and R for the converse of R. We frequently need the modular law RS ∩ T ⊆ (R ∩ T S )S and the properties T \S = (S /T ) , T /S = −(−T S ) and T \S = −(T (−S)) of residuals.
We also need the following concepts: the symmetric quotient T ÷ S : X ↔ Y , defined as T ÷ S = (T \S) ∩ (T /S ), tests, which are relations R ⊆ Id , and whose relational composition is intersection, and the domain map Domain elements and tests form the same full subalgebra of Rel(X, X) for any X, a complete atomic boolean algebra.The boolean complement of a test P is ¬P = Id − P .
Deterministic relations play an important role in our work.The relation R : and deterministic, or a function, if it is total and univalent.Functions as deterministic relations in Rel are of course graphs of functions in Set.We need the relational law Our proofs about modal operators are strongly based on concepts from power allegories, and in particular monadic concepts in relational form [F Š90, BdM97].We summarise these concepts in the following; see [FGS23a] for details.The standard isomorphism between relations in X ↔ Y and nondeterministic functions in X → PY in Set can be expressed in Rel by taking graphs.The power transpose The relational image functor P : codes the relational image, given by the covariant powerset functor in Set, again as a graph.It is deterministic by definition.The unit and multiplication of the monad of the powerset functor in Set are recovered in Rel as η X : X ↔ PX and µ X : Apart from tests we need the power test P * : PX ↔ PX of any test P ⊆ Id X , which is defined as P * = (∈ X \P ∈ X ) ∩ Id PX [FKST17].Equivalently, it can be expressed as P * = (∈ X \P U X,PX ) ∩ Id PX = {(A, A) | ∀a ∈ A. (a, a) ∈ P }, and it holds that P * ⊆ Id PX = (Id X ) * .
Finally, we need the subset relation

Multirelations
A multirelation is an arrow X ↔ PY in Rel and therefore a doubly-nondeterministic function X → P 2 Y in Set.We write M (X, Y ) for the homset X ↔ PY .Multirelations allow two levels of nondeterminism and two level of choices: an outer or angelic level given two elements (a, B) and (a, C) of a multirelation, and an inner or demonic level given by the elements b ∈ B for any (a, B).
The Peleg composition [Pel87] * : (X ↔ PY ) × (Y ↔ PZ) → (X ↔ PZ) can be defined in two steps from the Kleisli lifting (−) P : (X ↔ PY ) → (PX ↔ PY ) and the Peleg lifting (−) * : (X ↔ PY ) → (PX ↔ PY ) of multirelations [FKST17]: where, for R, S : The Kleisli lifting is the multirelational analogue of the Kleisli lifting or Kleisli extension in the Kleisli category of the powerset monad; see [FGS23a] for more details.It can also be seen as the relational image of the relational approximation of a given multirelation using the map α.By definition, Kleisli liftings of multirelations are functions in Rel.Peleg and Kleisli liftings coincide on deterministic multirelations: R * = R P if R is deterministic [FKST17].
The units of Peleg composition are given by the multirelations η X ; because of this, we henceforth also write 1 X for them.It is important to note that Peleg composition is not associativeonly (R * S) * T ⊆ R * (S * T ) holds -so that multirelations do not form a category under Peleg composition.Yet it becomes associative if the third factor is univalent [FKST17].
Peleg composition also preserves arbitrary unions in its first argument.It therefore has a right adjoint [FGS23b] R where residual notation has been overloaded.Multirelational modal operators require multirelational tests.These are subsets of 1 X for any X, which are related to relational tests by the isomorphism (−)1 X from relational tests to multirelational ones and its inverse (−)1 X , which specialise Λ and α.The boolean complement of a multirelational test P is ¬P = 1 − P , overloading notation for the complement of relational tests.
The Peleg lifting of a multirelational test (a, {a}) ∈ P }, the power test of the isomorphic test below Id X .This justifies overloading the power test and Peleg lifting operation.
Remark 2.2.To simplify notation, we often identify relational and multirelational tests with sets.A power test for P is then just the powerset of P : P * = PP .In particular we may assume that dom(R) = {a | ∃b.R a,b } for all R : X ↔ PY .We write, for instance, A ⊆ P instead of Id A ⊆ P and A ∩ P = ∅ instead of Id A ∩ P = ∅.We write ¬ for set complement.
We finish this section with a brief discussion of concepts related to the inner structure of multirelations, which have been studied in detail in [FGS23b], based on previous work in [ Rew03,FS15,FS16].We will henceforth speak of inner and outer concepts for a clear distinction.
For R, S : X ↔ PY , we define the inner union The inner union is associative and commutative, but need not be idempotent.
Inner deterministic multirelations are once again important.The multirelation R : that is, B is either a singleton or empty for each (a, B) ∈ R, and inner deterministic if it is inner total and inner univalent, in which case B ⊆ Y is a singleton set whenever R a,B for some a ∈ X.We write ν(R) for the inner total part of R: Finally, we need the following closures and preorders on the inner structure.For R : The up-closure and down-closure are related by inner duality.

Deterministic Multirelations
In this section, we discuss more advanced properties of deterministic multirelations that are important for reasoning with modal operators.
Recall that a quantaloid is a category in which every homset forms a complete lattice and where arrow composition preserves arbitrary sups in both arguments.
The main result in [FGS23a] on inner and outer deterministic multirelations is as follows.
For us, it is particularly important to note that Λ is the isomorphism from the quantaloid Rel to the quantaloid of outer deterministic multirelations that sends relational composition to Peleg composition, each Id X to 1 X and unions to inner unions, which are idempotent on deterministic multirelations [FGS23b, Lemma 3.6].Its inverse is α.Similarly, η = (−)1 is the isomorphism from Rel to the quantaloid of inner deterministic multirelations and α is its inverse.The following consequence of this fact is important for concurrent dynamic logic.
, and equality holds if R and S are inner or outer deterministic.
Note also that the preorders ⊑ ↓ and ⊑ ↑ are partial orders on inner and outer deterministic multirelations.They coincide on outer deterministic multirelations, and ⊑ ↓ and ⊒ ↑ coincide with ⊆ on inner deterministic multirelations [FGS23b, Proposition 5.8].
In [FGS23a], we have also introduced determinisation maps for multirelations.Let R : X ↔ PY be a multirelation.The outer determinisation operation δ o = Λ • α sends R to the outer deterministic multirelation isomorphic to relation α(R).The inner determinisation operation δ i = η • α sends R to the inner deterministic multirelation isomorphic to α(R).They satisfy We end this section with a collection of properties that are helpful in proofs in the remaining sections.
Lemma 3.5.Let R : X → Y , S : Y ↔ Z and let f : X → PY be outer deterministic.Then

Properties of Tests and Domain
Before turning to modal operators, we collect properties of tests and domain.Recall from Section 2 that we usually identify tests with sets and do not consider multirelational tests as subsets of 1 explicitly.More specifically, Peleg compositions P * R and R * P of multirelational tests P and multirelations R can always be replaced by relational compositions α(P )R and RP * , respectively, where α(P ) = P 1 is the isomorphic relational test and P * the isomorphic power test of P .

Modal Operators
We now turn to modal box and diamond operators for multirelations, but first recall the standard relational modalities.

Relational modal operators
The backward relational diamond operator −| : (X ↔ Y ) → (PX → PY ) can be obtained directly from the relational image operation: R|P = cod (P R) for all R : X ↔ Y and P ⊆ X.
The graph functor G : Set → Rel translates this diagram to Rel.The relational image operator P and the Kleisli lifting (−) P in Rel now play the role of −| and (−) K in Set.The Kleisli extension (−) K is actually an isomorphism between Set P and the category of backward diamond operators (with inverse given by postcomposition with the unit of the powerset monad).It preserves the entire quantaloid structure in Set P that comes from Rel.The standard definition of the Kleisli lifting translates to multirelations: R P = P(R)µ [FGS23a].Therefore, and of course owing to the composition of isomorphisms along the other outer faces of our diagram, we obtain a corresponding isomorphism between categories of outer deterministic multirelations and their Kleisli liftings on the right of this diagram.All arrows in the diagram are therefore isomorphisms between categories.
In the following, we focus on the forward operators |− and |−] and use the more conventional notation − r and [−] r .Hence, for R : X ↔ Y and P ⊆ Y , On the right of the diagram above it is routine to check that the graphs of R r Q and [R] r P are given by We henceforth write R G r = P(R ) and [R] G r = Λ(∋/R), where the superscript G indicates that these operators are graphs of R r and [R] r .The fact that [R] G r is an allegorical box operator in Rel is already known [BdM97].

Multirelational modal operators
Two extensions of relational modalities to multirelational ones have been proposed.The first replaces relational composition by Peleg composition in relational image operations and their De Morgan duals.It has been advocated by Peleg in concurrent dynamic logic [Pel87] and studied further in [FS15,FS16].The second has been proposed implicitly by Nerode and Wijesekera [NW90] and studied further in [Gol92].In the language of power allegories, it uses α to approximate multirelations by relations in relational boxes and diamonds.In the remainder of this section we formalise and relate these approaches.We also study the second approach in Rel.
First we recall the multirelational modal operators − * , [−] * : (X ↔ PY ) → (PY → PX) used in concurrent dynamic logic.These are defined, for all R : X ↔ PY and P ⊆ Y , as As already mentioned, these are essentially relational modalities with relational composition replaced by Peleg composition.Indeed, , and, unfolding definitions, Following Wijesekera and Nerode, we have already pointed out in the introduction that the semantics of [−] * is thus quite different from that of its relational counterpart, and it fails to capture standard program correctness specifications that are usually associated with modal boxes.Nerode and Wijesekera have therefore argued for an alternative multirelational box, to which we add a De Morgan dual diamond operator − α : (X ↔ PY ) → (PY → PX).In the language of power allegories and for R : X ↔ PY and P ⊆ Y , the two operators are which confirms in particular that [R] α P is consistent with Nerode and Wijesekera's definition.These two operations satisfy again  Moreover Its proof is immediate from the standard fact that relational diamonds preserve ⊆ in both arguments, while relational boxes reverse this order in their first argument (and preserve it in their second one), and relational representations of multirelational modal operators.

Properties of multirelational modal operators
Lemma 5.2 also indicates situations where multirelational modalities coincide.
The proofs use properties of Lemma 5.2 together with fixpoint properties of inner and outer deterministic multirelations and properties of δ o and δ i from [FGS23b].
Remark 5.5.The multirelational boxes and diamonds specialise to relational ones.Let R : Here is another definition of [−] α .

Proof. [R]
Our final definition of [−] α requires a technical lemma.
Proof.Using P and Q as relational or multirelational tests depending on the context, The penultimate step uses a standard property of dom of relations.
Proof.For the first identity we use Lemma 5.7 and the Galois connection for residuation, The proof of the second identity is similar.
Remark 5.9.The above instances imply that

Multirelational modal operators as relations
We now return to the right-hand triangle in the diagram from the beginning of this section.First we consider graphs of the relational modal operators [−] r and − r .As already mentioned, they are given by [−] G r = Λ(∋/(−)) and − G r = P((−) ), respectively.More concretely, rewriting the definitions at the beginning of this section shows that, for R : Backward modalities R and [R ] correspond in an analogous way to P(R) and Λ(∋/R ).The extension to the multirelational modalities − G α and [−] G α is then straightforward by inserting α's: for R : , and therefore This explains in particular the role of the Kleisli lifting (−) P = P • α as a backward diamond operator (X ↔ PY ) → (PX ↔ PY ) relative to its standard counterpart (−) K : (X → PY ) → (PX → PY ) in our diagram more formally.
For any relation X ↔ Y or multirelation X ↔ PY we can use these correspondences for translating properties from the maps PX → PY to their graphs PX ↔ PY , at least in tabular allegories.
Alternatively we can also reason about the latter in point-free style in the extended language of power allegories used in previous sections.We also recall a lemma from [FGS23a], to which we add a third property.The second identity is trivial, but it shows the correspondence with the first one.
Next we check the standard relationships between boxes and diamonds.In (1) below we prove the De Morgan duality between boxes and diamonds.In ( 2) and (3) we translate the standard conjugations and Galois connections for relational boxes and diamonds: Proof.

Goldblatt's Axioms for Concurrent Dynamic Logic
The box and diamond axioms of Peleg's concurrent dynamic logic have already been derived in the multirelational semantics [FS15].In particular, the Kleene star R * has been defined as the least fixpoint of λX. 1 ∪ R • X and studied in this setting.It exists because this function is orderpreserving on the complete lattice (M (X, X), ⊆).While the general algebra of multirelations does not satisfy the usual star axioms of Kleene algebra (owing for instance to the absence of associativity of Peleg composition), the modal star axioms of concurrent dynamic algebra can nevertheless be derived.Relative to these results it remains to derive Goldblatt's box axioms, which consider [−] α in combination with − * , and disregard [−] * .To simplify notation, we write − for − * and [−] for [−] α in the following.
Proof.Axioms (G10)-(G13) and (G15) belong to Peleg's concurrent dynamic logic.Algebraic variants have already been derived [FS15].The remaining axioms, except (G3), have been validated with Isabelle.As a counterexample to (G3), consider the relation Goldblatt's original axioms are therefore unsound with respect to the intended multirelational semantics.The failure of (G3) may seem surprising: after all, (R * S) * P = R * (S * P ) holds for all composable multirelations R and S and multirelational tests P Goldblatt proves that his extension of propositional dynamic logic, which is a variant of Peleg's concurrent dynamic logic [Pel87] with the Nerode-Wijesekera box operator, is finitely axiomatisable and has the finite model property, which implies decidability.Whether these results still hold for the sound axiomatisation using the formula in Lemma 6.2 remains to be seen.For − α and [−] α , by contrast, these relationships fail due to the approximative nature of α, as shown in Proposition 6.1 and Lemma 6.2.In the outer and inner deterministic case, we get similar results, owing to the isomorphisms with Rel.

Conclusion
In this trilogy of articles, we have studied the inner structure of multirelations and the categories of outer and inner deterministic and univalent multirelations.In the current article, the last in this trilogy, we have used this development to formalise Nerode and Wijesekera's alternative box operator for concurrent dynamic logic in an extension of power allegories, added a new De Morgan dual diamond and related these two operators with Peleg's modalities for multirelations and with relational modalities.As an application, we have derived an algebraic variant of Goldblatt's axioms for concurrent dynamic logic and shown that Nerode and Wijesekera's box does not yield an action on sets, which is atypical for modal operators.
While we use a multirelational language of concrete relations and multirelations in this work, an axiomatic extension of the abstract allegorical approach, which equips boolean power allegories with multirelational operations, is the most natural continuation of this work.The characterisation of intuitionistic modal algebras based on locally complete allegories is another interesting question.Beyond the forward modal operators considered so far, backward modalities could be defined using our structural approach, and their application in the semantics and verification of programs or specifications with alternating nondeterminism should be explored.The preorders ⊑ ↓ , ⊑ ↑ and ⊑ of multirelations seem related to the testing preorders for probabilistic processes studied by Deng et al. [DvGHM08], so it might be interesting to see how the modalities studied in concurrent dynamic logics relate to the Hennessy-Milner modalities in their approach.
[S] r Q = {a ∈ X | ∀b ∈ Y. S a,b ⇒ b ∈ Q}, for the relation S : X ↔ Y and the set Q ⊆ Y , typically express correctness specifications of relational programs: [S] r Q determines the set of states from which every terminating execution of program S must be in the set Q. Yet Peleg's multirelational box operator [R] * Q = {a | ∀B.R a,B ⇒ B ∩ Q = ∅} fails to capture the correctness of the multirelational program R : X ↔ PY in the presence of nonterminating elements of the form (a, ∅) [NW90].Nerode and Wijesekera therefore propose an alternative multirelational box[R] α Q = {a | ∀B.R a,B ⇒ B ⊆ Q}; Goldblatt has subsequently reduced it to a relational box, [R] α Q = [α(R)] r Q, approximating the multirelation R : X ↔ PY by the relation α(R) : X ↔ Y, R → {(a, b) | b ∈ {B | (a, B) ∈ R}},in which the alternating structure of R has been atomised.But how can [−] α and α(−) be formalised in an algebraic multirelational language?Which operations and constructs are needed for expressing it and for studying its relationship to [−] * ?
Forward and backward box operators |−] : (X ↔ Y ) → (PY → PX) and [−| : (X ↔ Y ) → (PY → PX) can be obtained from |− and −| by De Morgan duality |R] = ¬ • |R • ¬ and [R| = ¬ • R| • ¬.They are again related by opposition |R] = [R |.Using nondeterministic functions -arrows of the Kleisli category Set P of the powerset monad in Set -instead, −| = (−) K , the Kleisli extension of such arrows.The left triangle in the diagram below thus commutes, where F : Rel → Set P and R : Set P → Rel indicate the isomorphism between the two categories.

For
backward box and diamond operators we simply write R r and [R ] r .It follows that R r P = {b | ∃a ∈ P. R a,b } and [R ] r P = {b | ∀a ∈ P. R a,b }.This describes once again the left of the above diagram.
α and further equalities.All of the arguments R, δ o (R), δ i (R), R↓ and ν(R) contain essentially the same information (as regards box) just arranged differently with different degrees of redundancy.The different options have different properties: for example, δ o (−)↓ and ↓ are closure operators with respect to ⊆; ν is an interior operator with respect to ⊆; δ o /δ i are closure/interior operators with respect to ⊑ ↓ ; other options give extrema with respect to certain (pre)orders.
These use the subset relation Ω = ∈\∈ = −(−∋∈) and the complement relation C = ∈ ÷ −∈ = Λ(−∋) rather strongly.They also use properties such as −∈C = ∈ and ∈C = −∈, C = C , C 2 = Id and in particular that R(−S) = −(RS) if and only if relation R is outer deterministic apart from other standard properties of the relational calculus.

Remark 6. 3 .
The above counterexample also shows that [−] α , and consequently − α , do not generally yield actions of multirelations on powersets with respect to * , which is atypical for modal operators.For relational modalities,[RS] r = [R] r • [S]r and RS r = R r • S r ; in fact, [−] r and − r are inclusion functors Rel → Set.Similarly, for multirelational modalities, R * S * = R * • S * and [R * S] * = [R] * • [S] * [Pel87], so that [−] r and − r are inclusion maps from the algebra of multirelations (which is not a category) into Set.
where ∈ Y : Y ↔ PY is the membership relation on Y .Conversely, relational postcomposition with its converse, the has-element relation ∋ Y : PY ↔ Y , maps relations in X ↔ PY to relations in X ↔ Y .We henceforth write α = (−)∋.This function satisfies α