Theta as a Horn Solver

Theta is a verification framework that has participated in the CHC-COMP competition since 2023. While its core approach -- based on transforming constrained Horn clauses (CHCs) into control-flow automata (CFAs) for analysis -- has remained mostly unchanged, Theta’s verification techniques, design trade-offs, and limitations have remained mostly unexplored in the context of CHCs. This paper fills that gap: we provide a detailed description of the algorithms employed by Theta, highlighting the unique features that distinguish it from other CHC solvers. We also analyze the strengths and weaknesses of the tool in the context of CHC-COMP benchmarks. Notably, in the 2025 edition of the competition, Theta’s performance was impacted by a configuration issue, leading to suboptimal results. To provide a clearer picture of Theta’s actual capabilities, we re-execute the tool on the competition benchmarks under corrected settings and report on the resulting performance.

Transcript

1. Theta as a Horn Solver HCVS 2025 Levente Bajczi, Milán Mondok, Vince Molnár Supported by the 2024-2.1.1-EKOP-2024-00003 University Research Scholarship Programme under project numbers EKOP-24-3-BME-{78,213}, and the Doctoral Excellence Fellowship Programme under project number 400434/2023; with the support provided by the Ministry of Culture and Innovation of Hungary from the NRDI Fund.
2. HCVS 2025 • Generic, modular and configurable model checking framework developed at Budapest University of Technology • Originally ARG-based CEGAR • Recently further algorithms: – BMC, K-IND, IMC, Saturation, IC3/PDR • Wide array of supported input languages – C, Statecharts, PLC, Petri-nets, AIGER HW models, CHC • First participated in CHC-COMP in 2023 Theta github.com/ftsrg/theta 2
3. HCVS 2025 • Goal: prove certain properties of software, e.g. error reachability ✓ mathematical proof × refutation • One approach: Software Model Checking ... ... ... ... A(X) ← C(X) ∧ ... ∧ x > 0 B(X) ← D(X) ∧ ... ∧ x < 5 ... ← B(X) ∧ ... ∧ x ≠ 6 satisfiable unsatisfiable program code formal representation logic formulas CHC 3
4. • Advantages: – various – powerful Our goal: efficiently solve CHCs by 1. transforming them to a formal software representation 2. applying powerful model-checking techniques HCVS 2025 Our Approach ... ... ... ... A(X) ← C(X) ∧ ... ∧ x > 0 B(X) ← D(X) ∧ ... ∧ x < 5 ... ← B(X) ∧ ... ∧ x ≠ 6 CHC ✓ × model-checking techniques 4
5. HCVS 2025 Overview of the Approach A(X) ← C(X) ∧ ... ∧ x > 0 B(X) ← D(X) ∧ ... ∧ x < 5 ... ← B(X) ∧ ... ∧ x ≠ 6 ... ... ... ... Model-checking error unreachable + witness error reachable + example satisfiable + model unsatisfiable + refutation Software Verification Satisfiability CHC to CFA transformation Proof transformation CHC: CFA: (Control Flow Automaton) 5
6. CHC CFA CEGAR BMC K-IND IMC Abstract HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT STS Reverse 6
7. HCVS 2025 • Linear CHCs: at most 1 uninterpreted function in body • CHC types: – fact: no uninterpreted function in body F(x) ← x = 0 – query: no uninterpreted function in head ← F(x) ∧ x > 0 – deduction: uninterpreted function in both F(y) ← F(x) ∧ x ≤ 1 ∧ y = x + 1 Constrained Horn Clauses H(X) ← B(X) ∧ 𝜑(X) uninterpreted functions interpreted formulae 7
8. HCVS 2025 Control Flow Automaton • graph-like representation of programs • statement can be: – assignment – guard – procedure call 0: x = 0 1: while (x < 5) { 2: x = x + 1 } 3: assert(x <= 5) Program locations statements CFA nodes edges 0 1 2 [x < 5] x = 0 x = x + 1 3 [!(x < 5)] Err Fin [x <= 5] [!(x <= 5)] 8
9. HCVS 2025 • Forward/bottom-up approach – unique to Theta, presented at HCVS’23 – repeated application of applicable CHCs to check if is deducible • Backward/top-down approach – used by Ultimate Unihorn1 – CHC to Boogie code transformation – maps uninterpreted functions to procedures – recursively checks if body of CHC can be deduced, starting from CHC to CFA transformation options in Theta 1 https://github.com/ultimate-pa/ultimate ← ... ... ← ← ... ... ← 9
10. CHC CFA CEGAR BMC K-IND IMC Abstract HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT STS Reverse 10
11. HCVS 2025 • Abstract state space – Overapproximates the reachable state space – Safe if no error found – Precision: Degree of overapproximation • Abstract counterexample – Feasible in abstract state space – Feasible in concrete state space? – Unsafe if yes – Refine if no (abstraction too coarse) • Refinement – Removes unreachable parts from abstract state space CounterExample-Guided Abstraction Refinement (CEGAR) Concrete state space Over- approximate Abstract state space Abstract counterexample Feasibility checking Refinement Prec. 11
12. CHC CFA CEGAR BMC K-IND IMC Abstract HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT Reverse STS 12
13. HCVS 2025 CFA to STS Transformation I: l=0 T: (l=0 ∧ x′=0 ∧ l′=1) ∨ (l=1 ∧ x<5 ∧ x’=x ∧ l′=2) ∨ (l=2 ∧ x′=x+1 ∧ l′=1) ∨ (l=1 ∧ !(x<5) ∧ x’=x ∧ l′=3) ∨ (l=3 ∧ x’=x ∧ l′=Err) P: !(l=Err) 0 1 2 [x < 5] x = 0 x = x + 1 3 [!(x < 5)] Err [!(x <= 5)] CFA STS : Symbolic Transition System Currently limited to the FW transformation (single-procedure CFA) 13
14. CHC CFA CEGAR BMC K-IND IMC HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT STS Abstract Reverse 14
15. HCVS 2025 • Reversal: Can we reach the initial state from the error states with reversed steps? STS to STS Transformations I: x = 0 ∧ y < 100 T: x’ = x + 1 ∧ y’ = y P: x < 50 STS I rev : ¬P T rev : x = x’ + 1 ∧ y = y’ P rev : ¬I Reversed STS Swap v with v’ 15
16. HCVS 2025 • Reversal • Abstraction: Implicit predicate abstraction encoded into the model – Wrap the analysis in a CEGAR loop STS to STS Transformations I: x = 0 ∧ y < 100 T: x’ = x + 1 ∧ y’ = y P: x < 50 STS Precision + { (x < 2) } I abs : I ∧ (p 1 ⟺ (x < 2)) T abs : T ∧ (p 1 ⟺ (x < 2)) ∧ (p’ 1 ⟺ (x’ < 2)) P abs : ¬(¬P ∧ (p 1 ⟺ (x < 2))) Activation literals to track predicates Abstract STS 16
17. CHC CFA CEGAR BMC K-IND IMC HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT STS Abstract Reverse 17
18. HCVS 2025 • Bounded model checking (BMC) + K-induction (KIND) + Interpolation-based model checking (IMC) • Property-directed reachability (IC3/PDR) – Not used for CHC yet • (Generalized) saturation (GSAT) – Substitution diagrams: Top-down emulation of decision-diagram structure from SMT formulas STS Verification Algorithms 18
19. Substitution diagram f f t (a ∨ ¬b) ∧ (x = 2) true ¬b ∧ (x = 2) (x = 2) 2 a b x HCVS 2025 9 Lazy evaluation: presence of edges and children evaluated only when queried! substitute a with false Node: SMT formula substitute a with true Equivalent nodes are merged syntactically or with an SMT-solver
20. CHC CFA CEGAR BMC K-IND IMC Abstract HCVS 2025 Z3 native SMT-LIB2 JavaSMT GSAT STS Reverse 20
21. HCVS 2025 • Used by all algorithms • Satisfiability (+ Model generation, UNSAT cores, Interpolation) • Unified access through a common interface – Native Z3 (best performance, strong interpolation) – SMT-LIB2: cvc5, MathSat, Princess, SMTInterpol, Bitwuzla, Boolector, … – JavaSMT: common Java API over several 3rd party solvers SMT Solver Backends 21
22. HCVS 2025 • Some of our algorithms provide an overabstraction of the reachable state space – CEGAR: returns the ARG (abstract reachability graph) – GSAT: returns the precise reachable state space as an MDD – IMC: provides an inductive invariant formula CHC Model Generation Correctness witness: overapproximation of reachable states Error is not reachable 22
23. HCVS 2025 CHC Model Generation loc = F → x = y + 2 ∧ y = z + 1 correctness witness formula for F F(x) UF with parameter x ∀x: F(x) ∃y,z: x = y + 2 ∧ y = z + 1 universally quantified UF parameters existentially quantified other variables 23
24. HCVS 2025 Sequential portfolio, change to next config on timeout or exception CHC-COMP’25 portfolio BMC Z3, 450s K-IND Z3, 20s EXPL Z3, 650s BMC cvc5, 550s IMC Z3, 10s BOOL Z3, 15s CART Z3, 15s K-IND cvc5, 70s CART cvc5, 550s GSAT rest 24
25. HCVS 2025 • We fixed several bugs in Theta since – Variable name collisions, loop unrolling • If the competition was rerun, some rankings would change: CHC-COMP’25 results We are currently the best tool for sat linear array problems 25
26. HCVS 2025 Category Eldarica Golem ThetaCHC LIA 378 709 0 LIA-Lin 623 675 565 LIA-Arrays 1000 - 0 LIA-Lin-Arrays 52 - 55 LRA-Lin 0 73 11 BV 17 - 22 CHC-COMP’25 model generation results We currently do not support non-linear CHC model generation, but have an implementation mind 26
27. HCVS 2025 Summary github.com/ftsrg/theta Model checker solving CHC through transformations to CFA ThetaCHC • Forward/backward CHC to CFA transformations • Diverse algorithm backends with chainable model transformations • CHC model generation from correctness witnesses • Sequential algorithm portfolio for CHC-COMP’25 27
28. HCVS 2025 • Unique to Theta Forward CHC to CFA Transformation CHC uninterpreted functions parameters CHCs satisfiability CFA nodes variables edges reachability M. Somorjai et al.: Bottoms Up for CHCs: Novel Transformation of Linear Constrained Horn Clauses to Software Verification In: HCVS 2023. 28
29. HCVS 2025 Example F(y) ← F(x) ∧ x ≤ 1 ∧ y = x + 1 F(x) ← x = 0 ← F(x) ∧ x > 0 F var f; S E f = 0; [f ≤ 1] f = f + 1; [f > 0] 29
30. HCVS 2025 • Unihorn’s approach adapted to CFA Backward CHC to CFA Transformation CHC uninterpreted functions parameters CHCs satisfiability CFA procedures procedure parameters edges return value 30
31. HCVS 2025 Example F(y) ← F(x) ∧ x ≤ 1 ∧ y = x + 1 F(x) ← x = 0 ← F(x) ∧ x > 0 Lm var x; Im E [x > 0] rF = F(x); [rF ] main F(f): Int → Bool LF var x; IF FF [rF ] f == x + 1 ∧ x ≤ 1 rF = F(x); [f == 0] rF = true; 31
32. Substitution diagram f f t (a ∨ ¬b) ∧ (x = 2) true ¬b ∧ (x = 2) (x = 2) 2 a b x HCVS 2025 9 Lazy evaluation: presence of edges and children evaluated only when queried! substitute a with false Node: SMT formula substitute a with true Equivalent nodes are merged syntactically or with an SMT-solver
33. x’ y’ x y Model checking with substitution diagrams I: (x = 0) ∧ (y = 1) T: (x’ = x + 1) ∧ (y’ = y) (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 Initial states Transition relation 10
34. x’ y’ x y Relational product: model step (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 x = 10
35. x’ y’ x y (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 true x = Relational product: model step 10
36. x’ y’ x y Relational product: model step (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 true x = Intersection of “source” edges 10
37. x’ y’ x y Relational product: model step (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 true (y = 1) 1 x = Intersection of “source” edges Extract “target” edges 10
38. x’ y’ x y Relational product: model step (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 true (y = 1) 1 x = 10 Intersection of “source” edges Extract “target” edges
39. x’ y’ x y Relational product: model step (x = 0) ∧ (y = 1) true (y = 1) 0 1 (x’ = x + 1) ∧ (y’ = y) true (y’ = y) 1 … … 0 1 2 1 2 3 0 1 2 2 0 1 HCVS 2025 (x = 1) ∧ (y = 1) true (y = 1) 1 1 x = The set of reachable states after one step of the model 10 Intersection of “source” edges Extract “target” edges
40. Fixed point calculation x x x x … HCVS 2025 Repeat until new states keep appearing Many possible algorithms: BFS, Saturation 11