Catalia: CHC Solver for ADTs

• Catalia is a CHC solver for ADTs that leverages catamorphism-based abstraction to convert recursive data into integer arithmetic.
• It automatically synthesizes folds through a counterexample-guided abstraction-refinement loop to capture inductive invariants.
• Catalia outperforms state-of-the-art solvers on satisfiable benchmarks and powered ChocoCatalia to win the ADT-LIA category in CHC-COMP 2025.

Catalia is a CHC solver for satisfiability checking of Constrained Horn Clauses over Algebraic Data Types, designed for cases in which models require inductively defined functions or predicates such as “sum of a list” or “addition on Peano naturals.” Its central mechanism is a catamorphism-based abstraction that maps ADT values into integer domains, automatically synthesizes folds on demand, and reduces CHCs over ADTs to CHCs purely over integer arithmetic, which off-the-shelf solvers can handle efficiently. The solver was introduced in “Automated Catamorphism Synthesis for Solving Constrained Horn Clauses over Algebraic Data Types” and was reported to outperform state-of-the-art solvers on satisfiable CHCs over ADTs in the CHC-COMP 2024 benchmark; it also served as the core of ChocoCatalia, which won the ADT-LIA category of CHC-COMP 2025 (Katsura et al., 28 Jul 2025).

1. Problem setting and motivation

Catalia addresses a specific limitation of existing CHC-based automated verification for ADTs. Classical CHC solvers can find purely arithmetic invariants, for example proving that for a predicate Plus(m,n,r) one has m+n=r, but they struggle when the same property must be expressed over ADT encodings of numbers or lists. The stated reason is that the corresponding models live in the world of recursive data rather than in a purely arithmetic domain (Katsura et al., 28 Jul 2025).

The solver is intended to bridge this gap between Horn-clause engines such as Spacer and Eldarica and verification problems whose models require inductively defined functions over ADTs. The paper identifies “sum of a list” and “addition on Peano naturals” as prototypical examples. This suggests that Catalia is aimed not merely at improving search heuristics, but at changing the representational basis of the model discovery problem by introducing synthesized folds as latent summaries of recursive structure.

A key contribution is the formalization of a catamorphism-based abstraction of Horn clauses. Whenever a clause mentions an ADT term t, Catalia replaces t by a tuple of integers cata(t) produced by a fold and adds a predicate P_adm to ensure that these integers lie in the fold’s image. The resulting system is then passed to an integer-only back-end solver. If the abstraction is precise enough and the integer CHCs are satisfiable, the solution can be lifted back to a model of the original ADT problem. If not, Catalia refines the fold through a counterexample-guided process (Katsura et al., 28 Jul 2025).

2. Catamorphisms as the abstraction mechanism

Catalia is built around catamorphisms, presented as generalized fold functions from ADT domains into integer tuples. Let

$\tau = (\delta,\{C_1,\dots,C_k\})$

be an ADT with constructors

$$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$

A catamorphism cata: U_δ → ℤ^N of approximation degree $N$ is defined by structural recursion: $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$8 where each structure map

$$combine_i : \mathbb{Z}^{m_i} \times (\mathbb{Z}^N)^{n_i} \to \mathbb{Z}^N$$

is an $N$-vector-valued function, often affine (Katsura et al., 28 Jul 2025).

For lists, with

$\delta = ilist,\quad C_0 = nil,\quad C_1 = cons,$

the paper gives a 1-degree template fold $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$9 By instantiating the parameters $(a,b,c,d)$, one obtains concrete folds such as length or sum. In Catalia, such templates are not fixed once and for all; they are synthesized on demand when the current abstraction is too coarse.

The abstraction of CHCs proceeds by replacing ADT terms with their catamorphism images. For a clause over ADTs and integers of the form $N$0 Catalia constructs a pure-integer CHC $N$1 in which each ADT term t is replaced by the integer tuple cata(t), and each universally quantified ADT variable is guarded by a fresh P_adm(x') requiring membership in the image of cata. The definition of P_adm is itself abstracted from ADT-unfolding clauses: $N$2 The paper states a soundness result, Theorem 4.3: any model of the abstracted integer CHCs lifts to a model of the original ADT CHCs by composing each predicate interpretation with cata (Katsura et al., 28 Jul 2025).

3. Abstraction, refinement, and synthesis loop

Catalia operates through a CEGAR-style loop with three phases: abstraction and integer solving, counterexample extraction, and template-based refinement. The purpose of the loop is to recover a fold that is strong enough to express the required inductive invariant while remaining amenable to integer reasoning (Katsura et al., 28 Jul 2025).

In the first phase, Catalia takes the current fold cata, abstracts the ADT-CHCs into integer-only CHCs, and invokes a back-end CHC solver such as Spacer, Eldarica, or Hoice. If the back-end returns SAT, Catalia lifts the model and terminates with “satisfiable.” This part of the design reflects the solver’s main strategy: reduce recursive-data reasoning to arithmetic reasoning whenever a suitable fold has been found.

If the integer CHCs are UNSAT, Catalia extracts an (hyper)resolution proof from Spacer and maps each step back to the original ADT clauses, ignoring P_adm, to produce a counterexample constraint $\theta$ over ADTs. The solver then checks whether $\theta$ is satisfiable in ADT theory. If it is satisfiable, the original CHCs are truly UNSAT and Catalia returns “unsatisfiable.” If not, the abstraction was spurious and must be strengthened (Katsura et al., 28 Jul 2025).

Refinement is template-based. Catalia maintains a set $S$ of obligations

$$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$0

and chooses a template catamorphism cataTMP(a₁,…,a_k), initially with parameter ranges [-1,1] and later expanded. It then solves for parameters such that all obligations in $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$1 hold under the abstraction by cataTMP. The resulting search problem is described as an

$$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$2

formula with recursive definitions (Katsura et al., 28 Jul 2025).

The synthesis uses a CEGIS-style inner loop. Catalia tests the validity of $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$3 under the current parameter candidate by asking an SMT solver to find a small counterexample value $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$4. If none is found within a short timeout, the current cata(a) is accepted. Otherwise, the solver refines the integer constraints on the parameters by plugging $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$5 into the abstracted $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$6, solves the resulting quantifier-free non-linear integer constraints with Z3, and repeats. If the current template cannot satisfy the accumulated obligations, Catalia advances to a richer template with bigger coefficient ranges or higher approximation degree (Katsura et al., 28 Jul 2025).

This design supports the paper’s intended interpretation of refinement: when a fold is “too coarse,” its abstraction yields a spurious UNSAT proof; refinement then discovers an enriched fold that regains satisfiability. A plausible implication is that Catalia’s distinctive strength lies in learning representational structure rather than only strengthening arithmetic interpolants or search bounds.

4. System architecture and implementation

Catalia’s implementation combines preprocessing, a central CEGAR loop, multiple back-end solvers, fixed sequences of templates, proof-based counterexample reconstruction, and SMT-based parameter search. The architecture is organized around a Horn-clause AST and a mapping from ADT variables to fresh integer-tuple variables, together with a parameter-constraint store for each template (Katsura et al., 28 Jul 2025).

The preprocessing phase translates ADT testers and selectors into constructor-only form. The core loop, identified in the paper as Fig. 1, implements the abstraction, solving, proof analysis, and refinement phases. For integer CHC solving, Catalia uses a portfolio consisting of Spacer from Z3, Eldarica, and Hoice. Z3 alone is used for the small non-linear integer solves that arise during parameter synthesis (Katsura et al., 28 Jul 2025).

Template management is fixed in advance. The paper describes sequences of linear templates with parameter ranges [−1,1], [−2,2], [−4,4], and so on, together with increasing approximation degrees. Counterexample generation reconstructs a candidate ADT constraint $$C_i : (\mathbb{Z}^{m_i} \times \delta^{n_i}) \to \delta.$$7 by parsing Z3 or Spacer unsat proofs and collecting resolution steps. Testing and CEGIS rely on lightweight random or model-guided testing in Z3 with a 1 s timeout, followed by accumulation of parameter constraints and a final non-linear-integer SMT call (Katsura et al., 28 Jul 2025).

Several heuristics are also explicitly stated: timeouts on recursive validity checks, caching of parameter constraints so that repeated counterexamples force fresh refinement, and incremental strengthening of templates. These choices indicate that the practical solver departs from a purely proof-theoretic presentation and incorporates engineering decisions intended to make the synthesis loop terminate effectively on benchmark problems.

5. Empirical performance and competition results

The evaluation reported for Catalia uses the 300 ADT-LIA benchmarks of CHC-COMP 2024, with a 300 s timeout on Intel Xeon, 64 GB, and compares Catalia against Spacer, RInGen, and Eldarica. The paper states that Catalia solved more satisfiable instances than any other solver in this benchmark suite, while Spacer and Eldarica retained a slight edge on unsatisfiable problems (Katsura et al., 28 Jul 2025).

Category	Catalia	RInGen	Spacer	Eldarica
SAT	67	54	48	50
UNSAT	80	46	86	87
TOTAL	147	100	134	137
Unique—SAT	18	14	3	1
Unique—UNSAT	2	3	4	1

The paper further notes that cactus plots confirm Catalia’s lead on satisfiable instances, attributing this to its ability to distill the right inductive invariant as a fold. For unsatisfiable instances, the comparative advantage shifts toward Spacer and Eldarica. This division is consistent with Catalia’s overall design emphasis: it is optimized for discovering expressive catamorphisms that support model construction, rather than primarily for refutational strength (Katsura et al., 28 Jul 2025).

Catalia was also embedded into a larger tool, ChocoCatalia, together with complementary techniques, and this composite system won the ADT-LIA category of CHC-COMP 2025. Within the scope of the provided data, this establishes Catalia as not only a standalone solver but also a reusable verification component in a broader competition-grade architecture.

6. Scope, limitations, and technical significance

The reported limitations are explicit. First, template expressiveness is currently restricted to linear affine folds and therefore cannot capture properties such as “last element” or more complex tree shapes. Second, refutational power is weaker than its strength on satisfiable instances, and more precise abstraction-refinement for unsatisfiable ADT CHCs remains open. Third, the theoretical fairness assumptions required for back-end solvers to enumerate all resolution proofs do not strictly hold in practice, so termination is not guaranteed on some pathological inputs. Fourth, scalability of CEGIS may be constrained by repeated SMT calls and testing overhead (Katsura et al., 28 Jul 2025).

These limitations clarify the solver’s technical niche. Catalia is not a general replacement for all ADT-aware CHC engines; it is a specialized framework for cases where the missing ingredient is an inductively defined summary function that can be represented as a catamorphism into integers. The paper’s results suggest that this niche is substantial enough to change benchmark outcomes, especially on satisfiable ADT-LIA problems.

From a verification-theoretic perspective, Catalia’s significance lies in the integration of three ideas: abstraction by folds, proof-guided counterexample extraction, and automated synthesis of catamorphisms via template search. The soundness theorem ensures that successful integer abstractions lift back to the original ADT setting, while the refinement loop provides a mechanism for repairing abstractions that are too weak. A plausible implication is that Catalia exemplifies a broader methodology in which recursive data verification is mediated by automatically learned algebraic summaries rather than by fixed hand-engineered abstractions.

7. Relation to adjacent solver paradigms

Catalia is positioned relative to existing CHC solvers rather than isolated from them. The paper explicitly mentions Spacer and Eldarica as examples of Horn-clause engines that existing approaches seek to complement, and Catalia directly uses Spacer, Eldarica, and Hoice as back-end integer-only solvers after abstraction (Katsura et al., 28 Jul 2025).

This relationship is technically important. Catalia does not replace back-end CHC reasoning over linear integer arithmetic; instead, it transforms the input so that mature arithmetic engines can become effective on problems originally formulated over ADTs. In that sense, Catalia is a solver architecture for representational reduction: ADT terms are mapped to integer tuples, admissibility is enforced by P_adm, and model search is delegated to established arithmetic infrastructure.

The contrast with standard CHC workflows is most evident in how invariants are represented. Traditional engines are strongest when invariants are already naturally arithmetic. Catalia intervenes precisely when the desired invariant is implicit in recursive structure and must first be exposed as a fold. This suggests that Catalia should be understood as an overview-augmented front end for CHC solving over ADTs, with success depending on whether the target property can be captured by some template catamorphism within its refinement space (Katsura et al., 28 Jul 2025).