Anthem 2.0: ASP Verification and Translation

• Anthem 2.0 is a verification-oriented system that translates ASP programs in mini-gringo into first-order logical formulas using methods like σ* to establish strong equivalence.
• It employs mixed translation variants (τ*, ν, and μ) and proof outlines to balance human readability with robust semantic verification.
• The tool integrates automated theorem proving via Vampire to confirm properties such as strong equivalence, external equivalence, and adherence to first-order specifications under defined conditions.

Anthem 2.0 is a verification-oriented reasoning system for Answer Set Programming (ASP) that translates programs written in an expressive fragment of Clingo’s input language into logical formulas and then uses first-order automated theorem proving to establish semantic properties of those programs. In the development documented by the original anthem prototype, the io-program verification line, the bachelor thesis on strong-equivalence checking, and the later system overview, the name denotes a consolidation and extension of earlier translation-based tools into a standalone tool and library supporting strong equivalence, weak or external equivalence, adherence to first-order specifications, and structural analyses such as tightness and regularity (Lifschitz et al., 2018, Fandinno et al., 2020, Heuer, 2023, Fandinno et al., 15 Jul 2025).

1. Historical development and problem setting

The original anthem was introduced as a translator for a substantial fragment of gringo’s input language. Its purpose was to convert a nonground gringo program into a first-order representation of its completion, simplify that representation, and thereby make the meaning of the program more transparent to human inspection. The prototype already positioned anthem as both a program-understanding tool and a possible front end for verification with external reasoning tools (Lifschitz et al., 2018).

A second step extended anthem from formula extraction toward verification of tight logic programs with input and output. In that setting, an io-program was treated as a quadruple $(\Pi, PH, In, Out)$ with placeholders, input predicates, output predicates, and private predicates, and verification was reduced to theorem proving about the program’s completion under assumptions on admissible inputs. This line established the completion-based verification workflow for tight programs and clarified the importance of tightness and the absence of private recursion for first-order reductions (Fandinno et al., 2020).

The bachelor thesis published in 2023 described what can reasonably be called “Anthem 2.0” in a narrower but foundational sense: a new version of anthem that removed the earlier restriction to positive programs for practical strong-equivalence checking and extended the input language to include pools. Its key contribution was a semantic bridge from the logic of here-and-there to classical logic, together with an implementation in anthem 0.3 (Heuer, 2023).

The 2025 system paper then presented Anthem 2.0 explicitly as a verification-oriented reasoning system for ASP. It described the tool as the consolidated successor to the original anthem for specification adherence of tight programs, a separate system for strong equivalence, and Anthem-P2P for external equivalence. In that form, Anthem 2.0 became a standalone tool and library for translating mini-gringo programs, analyzing properties such as tightness, and invoking first-order theorem provers to confirm strong equivalence, external equivalence, or adherence to a first-order specification (Fandinno et al., 15 Jul 2025).

2. Semantic foundations

A central problem addressed by Anthem 2.0 is strong equivalence. Two programs $\Pi_1$ and $\Pi_2$ are strongly equivalent iff for every program $\Pi$, the answer sets of $\Pi_1 \cup \Pi$ and $\Pi_2 \cup \Pi$ coincide. This is the replacement criterion needed when an optimized or refactored subprogram is supposed to preserve behavior in any surrounding program context (Heuer, 2023).

The semantic basis is the standard characterization of strong equivalence via the logic of here-and-there (HT). The thesis states the theorem that $\Pi_1$ and $\Pi_2$ are strongly equivalent iff their representations as propositional formulas are equivalent in HT. The obstacle for automation is that mainstream theorem provers do not reason natively in HT; they reason in classical logic (Heuer, 2023).

The thesis addressed that obstacle by introducing the transformation $\sigma^*$. For every atom $p \in P$, a fresh primed atom $\Pi_1$0 represents truth in the “there” world, and the inclusion condition $\Pi_1$1 is encoded by the prime axioms

$\Pi_1$2

The transformation is defined recursively by preserving atoms, $\Pi_1$3, and $\Pi_1$4; preserving $\Pi_1$5 and $\Pi_1$6 pointwise; translating negation by

$\Pi_1$7

and implication by

$\Pi_1$8

Together with the correspondence $\Pi_1$9, this yields the theorem that HT-equivalence of formulas can be expressed as classical equivalence of their $\Pi_2$0-translations under the prime axioms (Heuer, 2023).

The later system overview presents an analogous embedding, denoted $\Pi_2$1, for first-order theorem proving. For example, the rule

$\Pi_2$2

has the natural translation

$\Pi_2$3

and after applying $\Pi_2$4 one obtains

$\Pi_2$5

To relate the “here” and “there” predicates, one adds ordering sentences such as

$\Pi_2$6

This is the mechanism that lets a classical prover such as Vampire reason about HT-based proof obligations (Fandinno et al., 15 Jul 2025).

A second semantic pillar is completion. For tight programs, Clark completion classically characterizes stable models. The io-program verification paper proved the key equivalence theorem that for any tight io-program $\Pi_2$7 and any set $\Pi_2$8 of precomputed public atoms without placeholders,

$\Pi_2$9

This completion theorem is the basis for external equivalence and specification adherence (Fandinno et al., 2020).

3. Translation architecture and source language

The 2025 overview describes the supported source language as mini-gringo, a subset of the Abstract Gringo language and, more precisely, the fragment of Clingo’s input language “for which an appropriate translation to the syntax of first-order logic has been widely studied.” A mini-gringo program consists of basic rules, choice rules, and constraints of the forms

$\Pi$0

Here each $\Pi$1 is either an atom, possibly preceded by one or two negation-as-failure symbols, or a comparison. The fragment includes variables, arithmetic, comparisons, negation as failure including double negation, and simple choice rules, but excludes aggregates (Fandinno et al., 15 Jul 2025).

The target language is many-sorted and syntactically first-order. The 2025 paper describes three sorts of variables: a general sort whose universe contains integers, symbolic constants, and the special symbols #inf and #sup; a subsort of integers; and a subsort of symbolic constants. This sorted target language is used internally for transformations and can be exported to TPTP (Fandinno et al., 15 Jul 2025).

Anthem 2.0 implements several translation variants. The classical robust translation is $\Pi$2, inherited from earlier work. The paper emphasizes that $\Pi$3 can handle difficult cases such as partial arithmetic functions, but often produces formulas that are difficult for humans to read. For rules satisfying a syntactic regularity condition, Anthem 2.0 also implements a more natural translation $\Pi$4, and the mixed translation $\Pi$5 applies $\Pi$6 to regular rules and $\Pi$7 to nonregular ones. This mixed strategy is a central design choice: readable formulas whenever possible, fallback to semantically robust formulas when needed (Fandinno et al., 15 Jul 2025).

The thesis extended $\Pi$8 in a different direction, especially for pools and tuples. It added recursive clauses for $\Pi$9 so that program terms could include tuples $\Pi_1 \cup \Pi$0 and pools $\Pi_1 \cup \Pi$1, and it extended $\Pi_1 \cup \Pi$2 and $\Pi_1 \cup \Pi$3 accordingly. With those extensions, $\Pi_1 \cup \Pi$4 could express the strong equivalence of programs containing negation, simple choices, and pools in classical logic when combined with $\Pi_1 \cup \Pi$5 (Heuer, 2023).

The earlier prototype literature remains visible in Anthem 2.0’s concern for readability. The original anthem already performed simplifications, replaced hidden auxiliary predicates by their completed definitions when possible, and exposed integer typing information through notations such as

$\Pi_1 \cup \Pi$6

which abbreviates

$\Pi_1 \cup \Pi$7

That emphasis on human-readable logical form persists in the distinction among $\Pi_1 \cup \Pi$8, $\Pi_1 \cup \Pi$9, and $\Pi_2 \cup \Pi$0 (Lifschitz et al., 2018).

4. Verification modes

Anthem 2.0 organizes verification around several semantically distinct tasks. The later system overview states that it can verify strong equivalence, weak/external equivalence, and adherence to first-order specifications, and can also analyze structural properties such as tightness and regularity (Fandinno et al., 15 Jul 2025).

Verification mode	Logical basis	Current conditions
Strong equivalence	HT representations compared via $\Pi_2 \cup \Pi$1 or $\Pi_2 \cup \Pi$2	The paper states that strong equivalence does not suffer the tightness/private-recursion limitation
External equivalence	Completion of translated programs under a user guide	Current automatic procedure requires programs to be tight and to lack private recursion
Specification adherence	Special case of external equivalence against a first-order specification	Same restriction as external equivalence

For strong equivalence, the goal is to establish that the HT encodings of two programs are equivalent. In the 2025 paper, if $\Pi_2 \cup \Pi$3 and $\Pi_2 \cup \Pi$4 are the programs, the proof target is to derive

$\Pi_2 \cup \Pi$5

or, with mixed translation,

$\Pi_2 \cup \Pi$6

from the ordering sentences. The paper’s worked example reduces a transitivity-preserving refactoring to four implication subproblems, each discharged by Vampire if possible (Fandinno et al., 15 Jul 2025).

The 2023 thesis gives the corresponding semantic result in terms of $\Pi_2 \cup \Pi$7. Its main theorem states that

$\Pi_2 \cup \Pi$8

iff

$\Pi_2 \cup \Pi$9

in every classical interpretation over $\Pi_1$0 satisfying the prime axioms $\Pi_1$1. This is the formal justification for checking strong equivalence by ordinary classical theorem proving after translation (Heuer, 2023).

External equivalence is weaker and explicitly interface-sensitive. It is defined relative to a user guide that specifies what counts as input, which predicates are public output, and what assumptions hold on admissible inputs. This allows two programs with different private predicates to be compared by their observable behavior rather than by exact identity of stable models. The 2025 paper notes that if programs take no inputs and have no auxiliary predicates, external equivalence is simply equality of stable models (Fandinno et al., 15 Jul 2025).

Specification adherence is presented as a special case of external equivalence. Instead of comparing one logic program to another, Anthem compares a program to a first-order specification written directly in the tool’s control language. This formulation inherits the completion-based semantics developed earlier for io-programs, where program correctness can be stated as validity of

$\Pi_1$2

on standard interpretations, with $\Pi_1$3 the assumptions and $\Pi_1$4 the specification (Fandinno et al., 2020).

5. Implementation and theorem-prover interaction

The thesis gives a concrete implementation workflow for the strong-equivalence extension. The system parses the input ASP program or programs using the clingo API, transforms the ASP abstract syntax tree into a first-order abstract syntax tree via the extended $\Pi_1$5 translation, and maintains a semantics flag initially set to classical logic. If a rule contains negation or a choice, the flag is set to “logic of here-and-there”; if the final flag indicates HT semantics, anthem applies $\Pi_1$6, creates primed atoms, adds the prime axioms $\Pi_1$7, and outputs the resulting classical first-order formulas either in human-readable form or in TPTP TFF (Heuer, 2023).

The 2025 system overview describes a broader transformation pipeline: mini-gringo program(s) $\Pi_1$8 target-language formulas $\Pi_1$9 optional HT embedding $\Pi_2$0 and/or completion $\Pi_2$1 TPTP tasks $\Pi_2$2 Vampire $\Pi_2$3 interpretation of theorem-prover results. The backend ATP is currently Vampire, and Anthem generates TPTP problems together with standard arithmetic axioms for standard interpretations (Fandinno et al., 15 Jul 2025).

The tool also exposes a control language for assumptions, specifications, and proof support. One of the main practical additions in the 2025 paper is the use of proof outlines, where formulas are annotated as $\Pi_2$7 and the role can be definition, lemma, or inductive-lemma. Definitions introduce fresh predicates as abbreviations; lemmas are proved sequentially using prior results; inductive lemmas are expanded into base and step obligations, and if both are proved, the general lemma is added as an available axiom (Fandinno et al., 15 Jul 2025).

The original anthem prototype had already emphasized simplification and predicate hiding as part of the user-facing workflow. Hidden auxiliary predicates could be eliminated by substituting their completed definitions, subject to cycle checks, and the resulting formulas were pretty-printed to standard output. Anthem 2.0 preserves that concern for inspectable intermediate logic rather than treating translation as a purely internal preprocessing step (Lifschitz et al., 2018).

6. Capabilities, empirical behavior, and limitations

The 2023 thesis is explicit about the new strong-equivalence capabilities obtained from $\Pi_2$4 and the extended $\Pi_2$5. It states that anthem can express the strong equivalence of logic programs containing negation, simple choices, and pools. It also reports several translation examples, including pooled facts such as colour(r;g;b). and programs combining a simple choice with negation, where the output includes prime axioms and $\Pi_2$6-transformed formulas suitable for classical theorem provers (Heuer, 2023).

The 2025 overview characterizes the supported language somewhat differently, through mini-gringo: arithmetic operations and simple choice rules are supported, but aggregates are not. The paper is also direct about current limitations: the system supports only mini-gringo rather than full Clingo; the fully automatic procedure for external equivalence requires tightness and the absence of private recursion; there is no effective automatic procedure for checking local tightness; difficult examples may require proof outlines; the backend is currently only Vampire; and the system has a specific current definition of integer division that the authors plan to revise (Fandinno et al., 15 Jul 2025).

Earlier work explains why these restrictions matter. Tightness is the condition under which completion is sound and complete for the stable-model semantics of the translated io-program, and the no-private-recursion condition is what enables the second-order completion to be rewritten into a universal form amenable to first-order theorem proving. These are not merely implementation choices; they arise from the logic of the completion-based reduction itself (Fandinno et al., 2020).

The thesis includes an empirical comparison of generated proof obligations on cvc4, princess, vampire, and zipperposition for positive programs, programs with pools, programs with negation, and programs with simple choice rules. Its reported conclusion is that cvc4 and vampire are the most suitable back-end provers for anthem-generated problems: Vampire solves the largest number of examples, whereas cvc4 is often fastest when it succeeds (Heuer, 2023). The later system paper, by contrast, standardizes on Vampire and interprets results through SZS-style theorem-proving statuses, emphasizing that verification failure need not mean that the property is false; it may instead indicate that the theorem prover did not find a proof in time (Fandinno et al., 15 Jul 2025).

Planned and ongoing extensions are substantial. The 2023 thesis identifies unsupported features such as extended or general choices, aggregates, disjunctions in rule heads, classical negation, and conditionals in rule bodies (Heuer, 2023). The 2025 paper adds future work on improved formula simplification, proof outlines for strong equivalence tasks, alternative ATP backends, integration of natural translation into external equivalence verification, bypassing tightness restrictions with ordered completion and/or tightening, extending the language with conditional literals, supporting counting and unrestricted aggregates, revising integer division, and ultimately supporting the complete Clingo language (Fandinno et al., 15 Jul 2025).