src/HOL/SMT2.thy
author blanchet
Thu Mar 13 13:18:13 2014 +0100 (2014-03-13)
changeset 56078 624faeda77b5
child 56083 b5d1d9c60341
permissions -rw-r--r--
moved 'SMT2' (SMT-LIB-2-based SMT module) into Isabelle
blanchet@56078
     1
(*  Title:      HOL/SMT2.thy
blanchet@56078
     2
    Author:     Sascha Boehme, TU Muenchen
blanchet@56078
     3
*)
blanchet@56078
     4
blanchet@56078
     5
header {* Bindings to Satisfiability Modulo Theories (SMT) solvers based on SMT-LIB 2 *}
blanchet@56078
     6
blanchet@56078
     7
theory SMT2
blanchet@56078
     8
imports Record
blanchet@56078
     9
keywords "smt2_status" :: diag
blanchet@56078
    10
begin
blanchet@56078
    11
blanchet@56078
    12
ML_file "Tools/SMT2/smt2_utils.ML"
blanchet@56078
    13
ML_file "Tools/SMT2/smt2_failure.ML"
blanchet@56078
    14
ML_file "Tools/SMT2/smt2_config.ML"
blanchet@56078
    15
blanchet@56078
    16
blanchet@56078
    17
subsection {* Triggers for quantifier instantiation *}
blanchet@56078
    18
blanchet@56078
    19
text {*
blanchet@56078
    20
Some SMT solvers support patterns as a quantifier instantiation
blanchet@56078
    21
heuristics.  Patterns may either be positive terms (tagged by "pat")
blanchet@56078
    22
triggering quantifier instantiations -- when the solver finds a
blanchet@56078
    23
term matching a positive pattern, it instantiates the corresponding
blanchet@56078
    24
quantifier accordingly -- or negative terms (tagged by "nopat")
blanchet@56078
    25
inhibiting quantifier instantiations.  A list of patterns
blanchet@56078
    26
of the same kind is called a multipattern, and all patterns in a
blanchet@56078
    27
multipattern are considered conjunctively for quantifier instantiation.
blanchet@56078
    28
A list of multipatterns is called a trigger, and their multipatterns
blanchet@56078
    29
act disjunctively during quantifier instantiation.  Each multipattern
blanchet@56078
    30
should mention at least all quantified variables of the preceding
blanchet@56078
    31
quantifier block.
blanchet@56078
    32
*}
blanchet@56078
    33
blanchet@56078
    34
typedecl pattern
blanchet@56078
    35
blanchet@56078
    36
consts
blanchet@56078
    37
  pat :: "'a \<Rightarrow> pattern"
blanchet@56078
    38
  nopat :: "'a \<Rightarrow> pattern"
blanchet@56078
    39
blanchet@56078
    40
definition trigger :: "pattern list list \<Rightarrow> bool \<Rightarrow> bool" where "trigger _ P = P"
blanchet@56078
    41
blanchet@56078
    42
blanchet@56078
    43
subsection {* Quantifier weights *}
blanchet@56078
    44
blanchet@56078
    45
text {*
blanchet@56078
    46
Weight annotations to quantifiers influence the priority of quantifier
blanchet@56078
    47
instantiations.  They should be handled with care for solvers, which support
blanchet@56078
    48
them, because incorrect choices of weights might render a problem unsolvable.
blanchet@56078
    49
*}
blanchet@56078
    50
blanchet@56078
    51
definition weight :: "int \<Rightarrow> bool \<Rightarrow> bool" where "weight _ P = P"
blanchet@56078
    52
blanchet@56078
    53
text {*
blanchet@56078
    54
Weights must be non-negative.  The value @{text 0} is equivalent to providing
blanchet@56078
    55
no weight at all.
blanchet@56078
    56
blanchet@56078
    57
Weights should only be used at quantifiers and only inside triggers (if the
blanchet@56078
    58
quantifier has triggers).  Valid usages of weights are as follows:
blanchet@56078
    59
blanchet@56078
    60
\begin{itemize}
blanchet@56078
    61
\item
blanchet@56078
    62
@{term "\<forall>x. trigger [[pat (P x)]] (weight 2 (P x))"}
blanchet@56078
    63
\item
blanchet@56078
    64
@{term "\<forall>x. weight 3 (P x)"}
blanchet@56078
    65
\end{itemize}
blanchet@56078
    66
*}
blanchet@56078
    67
blanchet@56078
    68
blanchet@56078
    69
subsection {* Higher-order encoding *}
blanchet@56078
    70
blanchet@56078
    71
text {*
blanchet@56078
    72
Application is made explicit for constants occurring with varying
blanchet@56078
    73
numbers of arguments.  This is achieved by the introduction of the
blanchet@56078
    74
following constant.
blanchet@56078
    75
*}
blanchet@56078
    76
blanchet@56078
    77
definition fun_app :: "'a \<Rightarrow> 'a" where "fun_app f = f"
blanchet@56078
    78
blanchet@56078
    79
text {*
blanchet@56078
    80
Some solvers support a theory of arrays which can be used to encode
blanchet@56078
    81
higher-order functions.  The following set of lemmas specifies the
blanchet@56078
    82
properties of such (extensional) arrays.
blanchet@56078
    83
*}
blanchet@56078
    84
blanchet@56078
    85
lemmas array_rules = ext fun_upd_apply fun_upd_same fun_upd_other  fun_upd_upd fun_app_def
blanchet@56078
    86
blanchet@56078
    87
blanchet@56078
    88
subsection {* Integer division and modulo for Z3 *}
blanchet@56078
    89
blanchet@56078
    90
definition z3div :: "int \<Rightarrow> int \<Rightarrow> int" where
blanchet@56078
    91
  "z3div k l = (if 0 \<le> l then k div l else -(k div (-l)))"
blanchet@56078
    92
blanchet@56078
    93
definition z3mod :: "int \<Rightarrow> int \<Rightarrow> int" where
blanchet@56078
    94
  "z3mod k l = (if 0 \<le> l then k mod l else k mod (-l))"
blanchet@56078
    95
blanchet@56078
    96
blanchet@56078
    97
subsection {* Setup *}
blanchet@56078
    98
blanchet@56078
    99
ML_file "Tools/SMT2/smt2_builtin.ML"
blanchet@56078
   100
ML_file "Tools/SMT2/smt2_datatypes.ML"
blanchet@56078
   101
ML_file "Tools/SMT2/smt2_normalize.ML"
blanchet@56078
   102
ML_file "Tools/SMT2/smt2_translate.ML"
blanchet@56078
   103
ML_file "Tools/SMT2/smt2_solver.ML"
blanchet@56078
   104
ML_file "Tools/SMT2/smtlib2.ML"
blanchet@56078
   105
ML_file "Tools/SMT2/smtlib2_interface.ML"
blanchet@56078
   106
ML_file "Tools/SMT2/z3_new_interface.ML"
blanchet@56078
   107
ML_file "Tools/SMT2/z3_new_proof.ML"
blanchet@56078
   108
ML_file "Tools/SMT2/z3_new_proof_tools.ML"
blanchet@56078
   109
ML_file "Tools/SMT2/z3_new_proof_literals.ML"
blanchet@56078
   110
ML_file "Tools/SMT2/z3_new_proof_rules.ML"
blanchet@56078
   111
ML_file "Tools/SMT2/z3_new_proof_methods.ML"
blanchet@56078
   112
ML_file "Tools/SMT2/z3_new_proof_replay.ML"
blanchet@56078
   113
ML_file "Tools/SMT2/z3_new_isar.ML"
blanchet@56078
   114
ML_file "Tools/SMT2/smt2_setup_solvers.ML"
blanchet@56078
   115
blanchet@56078
   116
method_setup smt2 = {*
blanchet@56078
   117
  Scan.optional Attrib.thms [] >>
blanchet@56078
   118
    (fn thms => fn ctxt =>
blanchet@56078
   119
      METHOD (fn facts => HEADGOAL (SMT2_Solver.smt2_tac ctxt (thms @ facts))))
blanchet@56078
   120
*} "apply an SMT solver to the current goal (based on SMT-LIB 2)"
blanchet@56078
   121
blanchet@56078
   122
blanchet@56078
   123
subsection {* Configuration *}
blanchet@56078
   124
blanchet@56078
   125
text {*
blanchet@56078
   126
The current configuration can be printed by the command
blanchet@56078
   127
@{text smt2_status}, which shows the values of most options.
blanchet@56078
   128
*}
blanchet@56078
   129
blanchet@56078
   130
blanchet@56078
   131
blanchet@56078
   132
subsection {* General configuration options *}
blanchet@56078
   133
blanchet@56078
   134
text {*
blanchet@56078
   135
The option @{text smt2_solver} can be used to change the target SMT
blanchet@56078
   136
solver.  The possible values can be obtained from the @{text smt2_status}
blanchet@56078
   137
command.
blanchet@56078
   138
blanchet@56078
   139
Due to licensing restrictions, Yices and Z3 are not installed/enabled
blanchet@56078
   140
by default.  Z3 is free for non-commercial applications and can be enabled
blanchet@56078
   141
by setting Isabelle system option @{text z3_non_commercial} to @{text yes}.
blanchet@56078
   142
*}
blanchet@56078
   143
blanchet@56078
   144
declare [[ smt2_solver = z3_new ]]
blanchet@56078
   145
blanchet@56078
   146
text {*
blanchet@56078
   147
Since SMT solvers are potentially non-terminating, there is a timeout
blanchet@56078
   148
(given in seconds) to restrict their runtime.  A value greater than
blanchet@56078
   149
120 (seconds) is in most cases not advisable.
blanchet@56078
   150
*}
blanchet@56078
   151
blanchet@56078
   152
declare [[ smt2_timeout = 20 ]]
blanchet@56078
   153
blanchet@56078
   154
text {*
blanchet@56078
   155
SMT solvers apply randomized heuristics.  In case a problem is not
blanchet@56078
   156
solvable by an SMT solver, changing the following option might help.
blanchet@56078
   157
*}
blanchet@56078
   158
blanchet@56078
   159
declare [[ smt2_random_seed = 1 ]]
blanchet@56078
   160
blanchet@56078
   161
text {*
blanchet@56078
   162
In general, the binding to SMT solvers runs as an oracle, i.e, the SMT
blanchet@56078
   163
solvers are fully trusted without additional checks.  The following
blanchet@56078
   164
option can cause the SMT solver to run in proof-producing mode, giving
blanchet@56078
   165
a checkable certificate.  This is currently only implemented for Z3.
blanchet@56078
   166
*}
blanchet@56078
   167
blanchet@56078
   168
declare [[ smt2_oracle = false ]]
blanchet@56078
   169
blanchet@56078
   170
text {*
blanchet@56078
   171
Each SMT solver provides several commandline options to tweak its
blanchet@56078
   172
behaviour.  They can be passed to the solver by setting the following
blanchet@56078
   173
options.
blanchet@56078
   174
*}
blanchet@56078
   175
blanchet@56078
   176
(* declare [[ cvc3_options = "" ]] TODO *)
blanchet@56078
   177
(* declare [[ yices_options = "" ]] TODO *)
blanchet@56078
   178
(* declare [[ z3_options = "" ]] TODO *)
blanchet@56078
   179
blanchet@56078
   180
text {*
blanchet@56078
   181
The SMT method provides an inference mechanism to detect simple triggers
blanchet@56078
   182
in quantified formulas, which might increase the number of problems
blanchet@56078
   183
solvable by SMT solvers (note: triggers guide quantifier instantiations
blanchet@56078
   184
in the SMT solver).  To turn it on, set the following option.
blanchet@56078
   185
*}
blanchet@56078
   186
blanchet@56078
   187
declare [[ smt2_infer_triggers = false ]]
blanchet@56078
   188
blanchet@56078
   189
text {*
blanchet@56078
   190
Enable the following option to use built-in support for div/mod, datatypes,
blanchet@56078
   191
and records in Z3.  Currently, this is implemented only in oracle mode.
blanchet@56078
   192
*}
blanchet@56078
   193
blanchet@56078
   194
declare [[ z3_new_extensions = false ]]
blanchet@56078
   195
blanchet@56078
   196
text {*
blanchet@56078
   197
The SMT method monomorphizes the given facts, that is, it tries to
blanchet@56078
   198
instantiate all schematic type variables with fixed types occurring
blanchet@56078
   199
in the problem.  This is a (possibly nonterminating) fixed-point
blanchet@56078
   200
construction whose cycles are limited by the following option.
blanchet@56078
   201
*}
blanchet@56078
   202
blanchet@56078
   203
declare [[ monomorph_max_rounds = 5 ]]
blanchet@56078
   204
blanchet@56078
   205
text {*
blanchet@56078
   206
In addition, the number of generated monomorphic instances is limited
blanchet@56078
   207
by the following option.
blanchet@56078
   208
*}
blanchet@56078
   209
blanchet@56078
   210
declare [[ monomorph_max_new_instances = 500 ]]
blanchet@56078
   211
blanchet@56078
   212
blanchet@56078
   213
blanchet@56078
   214
subsection {* Certificates *}
blanchet@56078
   215
blanchet@56078
   216
text {*
blanchet@56078
   217
By setting the option @{text smt2_certificates} to the name of a file,
blanchet@56078
   218
all following applications of an SMT solver a cached in that file.
blanchet@56078
   219
Any further application of the same SMT solver (using the very same
blanchet@56078
   220
configuration) re-uses the cached certificate instead of invoking the
blanchet@56078
   221
solver.  An empty string disables caching certificates.
blanchet@56078
   222
blanchet@56078
   223
The filename should be given as an explicit path.  It is good
blanchet@56078
   224
practice to use the name of the current theory (with ending
blanchet@56078
   225
@{text ".certs"} instead of @{text ".thy"}) as the certificates file.
blanchet@56078
   226
Certificate files should be used at most once in a certain theory context,
blanchet@56078
   227
to avoid race conditions with other concurrent accesses.
blanchet@56078
   228
*}
blanchet@56078
   229
blanchet@56078
   230
declare [[ smt2_certificates = "" ]]
blanchet@56078
   231
blanchet@56078
   232
text {*
blanchet@56078
   233
The option @{text smt2_read_only_certificates} controls whether only
blanchet@56078
   234
stored certificates are should be used or invocation of an SMT solver
blanchet@56078
   235
is allowed.  When set to @{text true}, no SMT solver will ever be
blanchet@56078
   236
invoked and only the existing certificates found in the configured
blanchet@56078
   237
cache are used;  when set to @{text false} and there is no cached
blanchet@56078
   238
certificate for some proposition, then the configured SMT solver is
blanchet@56078
   239
invoked.
blanchet@56078
   240
*}
blanchet@56078
   241
blanchet@56078
   242
declare [[ smt2_read_only_certificates = false ]]
blanchet@56078
   243
blanchet@56078
   244
blanchet@56078
   245
blanchet@56078
   246
subsection {* Tracing *}
blanchet@56078
   247
blanchet@56078
   248
text {*
blanchet@56078
   249
The SMT method, when applied, traces important information.  To
blanchet@56078
   250
make it entirely silent, set the following option to @{text false}.
blanchet@56078
   251
*}
blanchet@56078
   252
blanchet@56078
   253
declare [[ smt2_verbose = true ]]
blanchet@56078
   254
blanchet@56078
   255
text {*
blanchet@56078
   256
For tracing the generated problem file given to the SMT solver as
blanchet@56078
   257
well as the returned result of the solver, the option
blanchet@56078
   258
@{text smt2_trace} should be set to @{text true}.
blanchet@56078
   259
*}
blanchet@56078
   260
blanchet@56078
   261
declare [[ smt2_trace = false ]]
blanchet@56078
   262
blanchet@56078
   263
text {*
blanchet@56078
   264
From the set of assumptions given to the SMT solver, those assumptions
blanchet@56078
   265
used in the proof are traced when the following option is set to
blanchet@56078
   266
@{term true}.  This only works for Z3 when it runs in non-oracle mode
blanchet@56078
   267
(see options @{text smt2_solver} and @{text smt2_oracle} above).
blanchet@56078
   268
*}
blanchet@56078
   269
blanchet@56078
   270
declare [[ smt2_trace_used_facts = false ]]
blanchet@56078
   271
blanchet@56078
   272
blanchet@56078
   273
subsection {* Schematic rules for Z3 proof reconstruction *}
blanchet@56078
   274
blanchet@56078
   275
text {*
blanchet@56078
   276
Several prof rules of Z3 are not very well documented.  There are two
blanchet@56078
   277
lemma groups which can turn failing Z3 proof reconstruction attempts
blanchet@56078
   278
into succeeding ones: the facts in @{text z3_rule} are tried prior to
blanchet@56078
   279
any implemented reconstruction procedure for all uncertain Z3 proof
blanchet@56078
   280
rules;  the facts in @{text z3_simp} are only fed to invocations of
blanchet@56078
   281
the simplifier when reconstructing theory-specific proof steps.
blanchet@56078
   282
*}
blanchet@56078
   283
blanchet@56078
   284
lemmas [z3_new_rule] =
blanchet@56078
   285
  refl eq_commute conj_commute disj_commute simp_thms nnf_simps
blanchet@56078
   286
  ring_distribs field_simps times_divide_eq_right times_divide_eq_left
blanchet@56078
   287
  if_True if_False not_not
blanchet@56078
   288
blanchet@56078
   289
lemma [z3_new_rule]:
blanchet@56078
   290
  "(P \<and> Q) = (\<not>(\<not>P \<or> \<not>Q))"
blanchet@56078
   291
  "(P \<and> Q) = (\<not>(\<not>Q \<or> \<not>P))"
blanchet@56078
   292
  "(\<not>P \<and> Q) = (\<not>(P \<or> \<not>Q))"
blanchet@56078
   293
  "(\<not>P \<and> Q) = (\<not>(\<not>Q \<or> P))"
blanchet@56078
   294
  "(P \<and> \<not>Q) = (\<not>(\<not>P \<or> Q))"
blanchet@56078
   295
  "(P \<and> \<not>Q) = (\<not>(Q \<or> \<not>P))"
blanchet@56078
   296
  "(\<not>P \<and> \<not>Q) = (\<not>(P \<or> Q))"
blanchet@56078
   297
  "(\<not>P \<and> \<not>Q) = (\<not>(Q \<or> P))"
blanchet@56078
   298
  by auto
blanchet@56078
   299
blanchet@56078
   300
lemma [z3_new_rule]:
blanchet@56078
   301
  "(P \<longrightarrow> Q) = (Q \<or> \<not>P)"
blanchet@56078
   302
  "(\<not>P \<longrightarrow> Q) = (P \<or> Q)"
blanchet@56078
   303
  "(\<not>P \<longrightarrow> Q) = (Q \<or> P)"
blanchet@56078
   304
  "(True \<longrightarrow> P) = P"
blanchet@56078
   305
  "(P \<longrightarrow> True) = True"
blanchet@56078
   306
  "(False \<longrightarrow> P) = True"
blanchet@56078
   307
  "(P \<longrightarrow> P) = True"
blanchet@56078
   308
  by auto
blanchet@56078
   309
blanchet@56078
   310
lemma [z3_new_rule]:
blanchet@56078
   311
  "((P = Q) \<longrightarrow> R) = (R | (Q = (\<not>P)))"
blanchet@56078
   312
  by auto
blanchet@56078
   313
blanchet@56078
   314
lemma [z3_new_rule]:
blanchet@56078
   315
  "(\<not>True) = False"
blanchet@56078
   316
  "(\<not>False) = True"
blanchet@56078
   317
  "(x = x) = True"
blanchet@56078
   318
  "(P = True) = P"
blanchet@56078
   319
  "(True = P) = P"
blanchet@56078
   320
  "(P = False) = (\<not>P)"
blanchet@56078
   321
  "(False = P) = (\<not>P)"
blanchet@56078
   322
  "((\<not>P) = P) = False"
blanchet@56078
   323
  "(P = (\<not>P)) = False"
blanchet@56078
   324
  "((\<not>P) = (\<not>Q)) = (P = Q)"
blanchet@56078
   325
  "\<not>(P = (\<not>Q)) = (P = Q)"
blanchet@56078
   326
  "\<not>((\<not>P) = Q) = (P = Q)"
blanchet@56078
   327
  "(P \<noteq> Q) = (Q = (\<not>P))"
blanchet@56078
   328
  "(P = Q) = ((\<not>P \<or> Q) \<and> (P \<or> \<not>Q))"
blanchet@56078
   329
  "(P \<noteq> Q) = ((\<not>P \<or> \<not>Q) \<and> (P \<or> Q))"
blanchet@56078
   330
  by auto
blanchet@56078
   331
blanchet@56078
   332
lemma [z3_new_rule]:
blanchet@56078
   333
  "(if P then P else \<not>P) = True"
blanchet@56078
   334
  "(if \<not>P then \<not>P else P) = True"
blanchet@56078
   335
  "(if P then True else False) = P"
blanchet@56078
   336
  "(if P then False else True) = (\<not>P)"
blanchet@56078
   337
  "(if P then Q else True) = ((\<not>P) \<or> Q)"
blanchet@56078
   338
  "(if P then Q else True) = (Q \<or> (\<not>P))"
blanchet@56078
   339
  "(if P then Q else \<not>Q) = (P = Q)"
blanchet@56078
   340
  "(if P then Q else \<not>Q) = (Q = P)"
blanchet@56078
   341
  "(if P then \<not>Q else Q) = (P = (\<not>Q))"
blanchet@56078
   342
  "(if P then \<not>Q else Q) = ((\<not>Q) = P)"
blanchet@56078
   343
  "(if \<not>P then x else y) = (if P then y else x)"
blanchet@56078
   344
  "(if P then (if Q then x else y) else x) = (if P \<and> (\<not>Q) then y else x)"
blanchet@56078
   345
  "(if P then (if Q then x else y) else x) = (if (\<not>Q) \<and> P then y else x)"
blanchet@56078
   346
  "(if P then (if Q then x else y) else y) = (if P \<and> Q then x else y)"
blanchet@56078
   347
  "(if P then (if Q then x else y) else y) = (if Q \<and> P then x else y)"
blanchet@56078
   348
  "(if P then x else if P then y else z) = (if P then x else z)"
blanchet@56078
   349
  "(if P then x else if Q then x else y) = (if P \<or> Q then x else y)"
blanchet@56078
   350
  "(if P then x else if Q then x else y) = (if Q \<or> P then x else y)"
blanchet@56078
   351
  "(if P then x = y else x = z) = (x = (if P then y else z))"
blanchet@56078
   352
  "(if P then x = y else y = z) = (y = (if P then x else z))"
blanchet@56078
   353
  "(if P then x = y else z = y) = (y = (if P then x else z))"
blanchet@56078
   354
  by auto
blanchet@56078
   355
blanchet@56078
   356
lemma [z3_new_rule]:
blanchet@56078
   357
  "0 + (x::int) = x"
blanchet@56078
   358
  "x + 0 = x"
blanchet@56078
   359
  "x + x = 2 * x"
blanchet@56078
   360
  "0 * x = 0"
blanchet@56078
   361
  "1 * x = x"
blanchet@56078
   362
  "x + y = y + x"
blanchet@56078
   363
  by auto
blanchet@56078
   364
blanchet@56078
   365
lemma [z3_new_rule]:  (* for def-axiom *)
blanchet@56078
   366
  "P = Q \<or> P \<or> Q"
blanchet@56078
   367
  "P = Q \<or> \<not>P \<or> \<not>Q"
blanchet@56078
   368
  "(\<not>P) = Q \<or> \<not>P \<or> Q"
blanchet@56078
   369
  "(\<not>P) = Q \<or> P \<or> \<not>Q"
blanchet@56078
   370
  "P = (\<not>Q) \<or> \<not>P \<or> Q"
blanchet@56078
   371
  "P = (\<not>Q) \<or> P \<or> \<not>Q"
blanchet@56078
   372
  "P \<noteq> Q \<or> P \<or> \<not>Q"
blanchet@56078
   373
  "P \<noteq> Q \<or> \<not>P \<or> Q"
blanchet@56078
   374
  "P \<noteq> (\<not>Q) \<or> P \<or> Q"
blanchet@56078
   375
  "(\<not>P) \<noteq> Q \<or> P \<or> Q"
blanchet@56078
   376
  "P \<or> Q \<or> P \<noteq> (\<not>Q)"
blanchet@56078
   377
  "P \<or> Q \<or> (\<not>P) \<noteq> Q"
blanchet@56078
   378
  "P \<or> \<not>Q \<or> P \<noteq> Q"
blanchet@56078
   379
  "\<not>P \<or> Q \<or> P \<noteq> Q"
blanchet@56078
   380
  "P \<or> y = (if P then x else y)"
blanchet@56078
   381
  "P \<or> (if P then x else y) = y"
blanchet@56078
   382
  "\<not>P \<or> x = (if P then x else y)"
blanchet@56078
   383
  "\<not>P \<or>  (if P then x else y) = x"
blanchet@56078
   384
  "P \<or> R \<or> \<not>(if P then Q else R)"
blanchet@56078
   385
  "\<not>P \<or> Q \<or> \<not>(if P then Q else R)"
blanchet@56078
   386
  "\<not>(if P then Q else R) \<or> \<not>P \<or> Q"
blanchet@56078
   387
  "\<not>(if P then Q else R) \<or> P \<or> R"
blanchet@56078
   388
  "(if P then Q else R) \<or> \<not>P \<or> \<not>Q"
blanchet@56078
   389
  "(if P then Q else R) \<or> P \<or> \<not>R"
blanchet@56078
   390
  "(if P then \<not>Q else R) \<or> \<not>P \<or> Q"
blanchet@56078
   391
  "(if P then Q else \<not>R) \<or> P \<or> R"
blanchet@56078
   392
  by auto
blanchet@56078
   393
blanchet@56078
   394
hide_type (open) pattern
blanchet@56078
   395
hide_const fun_app z3div z3mod
blanchet@56078
   396
hide_const (open) trigger pat nopat weight
blanchet@56078
   397
blanchet@56078
   398
end