(*  Title:      HOL/Tools/refute.ML

    ID:         $Id$

    Author:     Tjark Weber

    Copyright   2003-2005

Finite model generation for HOL formulas, using a SAT solver.

*)

(* ------------------------------------------------------------------------- *)

(* Declares the 'REFUTE' signature as well as a structure 'Refute'.          *)

(* Documentation is available in the Isabelle/Isar theory 'HOL/Refute.thy'.  *)

(* ------------------------------------------------------------------------- *)

signature REFUTE =

sig

	exception REFUTE of string * string

(* ------------------------------------------------------------------------- *)

(* Model/interpretation related code (translation HOL -> propositional logic *)

(* ------------------------------------------------------------------------- *)

	type params

	type interpretation

	type model

	type arguments

	exception MAXVARS_EXCEEDED

	val add_interpreter : string -> (theory -> model -> arguments -> Term.term -> (interpretation * model * arguments) option) -> theory -> theory

	val add_printer     : string -> (theory -> model -> Term.term -> interpretation -> (int -> bool) -> Term.term option) -> theory -> theory

	val interpret : theory -> model -> arguments -> Term.term -> (interpretation * model * arguments)

	val print       : theory -> model -> Term.term -> interpretation -> (int -> bool) -> Term.term

	val print_model : theory -> model -> (int -> bool) -> string

(* ------------------------------------------------------------------------- *)

(* Interface                                                                 *)

(* ------------------------------------------------------------------------- *)

	val set_default_param  : (string * string) -> theory -> theory

	val get_default_param  : theory -> string -> string option

	val get_default_params : theory -> (string * string) list

	val actual_params      : theory -> (string * string) list -> params

	val find_model : theory -> params -> Term.term -> bool -> unit

	val satisfy_term   : theory -> (string * string) list -> Term.term -> unit  (* tries to find a model for a formula *)

	val refute_term    : theory -> (string * string) list -> Term.term -> unit  (* tries to find a model that refutes a formula *)

	val refute_subgoal : theory -> (string * string) list -> Thm.thm -> int -> unit

	val setup : theory -> theory

end;

structure Refute : REFUTE =

struct

	open PropLogic;

	(* We use 'REFUTE' only for internal error conditions that should    *)

	(* never occur in the first place (i.e. errors caused by bugs in our *)

	(* code).  Otherwise (e.g. to indicate invalid input data) we use    *)

	(* 'error'.                                                          *)

	exception REFUTE of string * string;  (* ("in function", "cause") *)

	(* should be raised by an interpreter when more variables would be *)

	(* required than allowed by 'maxvars'                              *)

	exception MAXVARS_EXCEEDED;

(* ------------------------------------------------------------------------- *)

(* TREES                                                                     *)

(* ------------------------------------------------------------------------- *)

(* ------------------------------------------------------------------------- *)

(* tree: implements an arbitrarily (but finitely) branching tree as a list   *)

(*       of (lists of ...) elements                                          *)

(* ------------------------------------------------------------------------- *)

	datatype 'a tree =

		  Leaf of 'a

		| Node of ('a tree) list;

	(* ('a -> 'b) -> 'a tree -> 'b tree *)

	fun tree_map f tr =

		case tr of

		  Leaf x  => Leaf (f x)

		| Node xs => Node (map (tree_map f) xs);

	(* ('a * 'b -> 'a) -> 'a * ('b tree) -> 'a *)

	fun tree_foldl f =

	let

		fun itl (e, Leaf x)  = f(e,x)

		  | itl (e, Node xs) = Library.foldl (tree_foldl f) (e,xs)

	in

		itl

	end;

	(* 'a tree * 'b tree -> ('a * 'b) tree *)

	fun tree_pair (t1, t2) =

		case t1 of

		  Leaf x =>

			(case t2 of

				  Leaf y => Leaf (x,y)

				| Node _ => raise REFUTE ("tree_pair", "trees are of different height (second tree is higher)"))

		| Node xs =>

			(case t2 of

				  (* '~~' will raise an exception if the number of branches in   *)

				  (* both trees is different at the current node                 *)

				  Node ys => Node (map tree_pair (xs ~~ ys))

				| Leaf _  => raise REFUTE ("tree_pair", "trees are of different height (first tree is higher)"));

(* ------------------------------------------------------------------------- *)

(* params: parameters that control the translation into a propositional      *)

(*         formula/model generation                                          *)

(*                                                                           *)

(* The following parameters are supported (and required (!), except for      *)

(* "sizes"):                                                                 *)

(*                                                                           *)

(* Name          Type    Description                                         *)

(*                                                                           *)

(* "sizes"       (string * int) list                                         *)

(*                       Size of ground types (e.g. 'a=2), or depth of IDTs. *)

(* "minsize"     int     If >0, minimal size of each ground type/IDT depth.  *)

(* "maxsize"     int     If >0, maximal size of each ground type/IDT depth.  *)

(* "maxvars"     int     If >0, use at most 'maxvars' Boolean variables      *)

(*                       when transforming the term into a propositional     *)

(*                       formula.                                            *)

(* "maxtime"     int     If >0, terminate after at most 'maxtime' seconds.   *)

(* "satsolver"   string  SAT solver to be used.                              *)

(* ------------------------------------------------------------------------- *)

	type params =

		{

			sizes    : (string * int) list,

			minsize  : int,

			maxsize  : int,

			maxvars  : int,

			maxtime  : int,

			satsolver: string

		};

(* ------------------------------------------------------------------------- *)

(* interpretation: a term's interpretation is given by a variable of type    *)

(*                 'interpretation'                                          *)

(* ------------------------------------------------------------------------- *)

	type interpretation =

		prop_formula list tree;

(* ------------------------------------------------------------------------- *)

(* model: a model specifies the size of types and the interpretation of      *)

(*        terms                                                              *)

(* ------------------------------------------------------------------------- *)

	type model =

		(Term.typ * int) list * (Term.term * interpretation) list;

(* ------------------------------------------------------------------------- *)

(* arguments: additional arguments required during interpretation of terms   *)

(* ------------------------------------------------------------------------- *)

	type arguments =

		{

			maxvars   : int,   (* just passed unchanged from 'params' *)

			def_eq    : bool,  (* whether to use 'make_equality' or 'make_def_equality' *)

			(* the following may change during the translation *)

			next_idx  : int,

			bounds    : interpretation list,

			wellformed: prop_formula

		};

	structure RefuteDataArgs =

	struct

		val name = "HOL/refute";

		type T =

			{interpreters: (string * (theory -> model -> arguments -> Term.term -> (interpretation * model * arguments) option)) list,

			 printers: (string * (theory -> model -> Term.term -> interpretation -> (int -> bool) -> Term.term option)) list,

			 parameters: string Symtab.table};

		val empty = {interpreters = [], printers = [], parameters = Symtab.empty};

		val copy = I;

		val extend = I;

		fun merge _

			({interpreters = in1, printers = pr1, parameters = pa1},

			 {interpreters = in2, printers = pr2, parameters = pa2}) =

			{interpreters = rev (merge_alists (rev in1) (rev in2)),

			 printers = rev (merge_alists (rev pr1) (rev pr2)),

			 parameters = Symtab.merge (op=) (pa1, pa2)};

		fun print sg {interpreters, printers, parameters} =

			Pretty.writeln (Pretty.chunks

				[Pretty.strs ("default parameters:" :: List.concat (map (fn (name, value) => [name, "=", value]) (Symtab.dest parameters))),

				 Pretty.strs ("interpreters:" :: map fst interpreters),

				 Pretty.strs ("printers:" :: map fst printers)]);

	end;

	structure RefuteData = TheoryDataFun(RefuteDataArgs);

(* ------------------------------------------------------------------------- *)

(* interpret: interprets the term 't' using a suitable interpreter; returns  *)

(*            the interpretation and a (possibly extended) model that keeps  *)

(*            track of the interpretation of subterms                        *)

(* ------------------------------------------------------------------------- *)

	(* theory -> model -> arguments -> Term.term -> (interpretation * model * arguments) *)

	fun interpret thy model args t =

		(case get_first (fn (_, f) => f thy model args t) (#interpreters (RefuteData.get thy)) of

		  NONE   => raise REFUTE ("interpret", "no interpreter for term " ^ quote (Sign.string_of_term (sign_of thy) t))

		| SOME x => x);

(* ------------------------------------------------------------------------- *)

(* print: converts the constant denoted by the term 't' into a term using a  *)

(*        suitable printer                                                   *)

(* ------------------------------------------------------------------------- *)

	(* theory -> model -> Term.term -> interpretation -> (int -> bool) -> Term.term *)

	fun print thy model t intr assignment =

		(case get_first (fn (_, f) => f thy model t intr assignment) (#printers (RefuteData.get thy)) of

		  NONE   => raise REFUTE ("print", "no printer for term " ^ quote (Sign.string_of_term (sign_of thy) t))

		| SOME x => x);

(* ------------------------------------------------------------------------- *)

(* print_model: turns the model into a string, using a fixed interpretation  *)

(*              (given by an assignment for Boolean variables) and suitable  *)

(*              printers                                                     *)

(* ------------------------------------------------------------------------- *)

	(* theory -> model -> (int -> bool) -> string *)

	fun print_model thy model assignment =

	let

		val (typs, terms) = model

		val typs_msg =

			if null typs then

				"empty universe (no type variables in term)\n"

			else

				"Size of types: " ^ commas (map (fn (T, i) => Sign.string_of_typ (sign_of thy) T ^ ": " ^ string_of_int i) typs) ^ "\n"

		val show_consts_msg =

			if not (!show_consts) andalso Library.exists (is_Const o fst) terms then

				"set \"show_consts\" to show the interpretation of constants\n"

			else

				""

		val terms_msg =

			if null terms then

				"empty interpretation (no free variables in term)\n"

			else

				space_implode "\n" (List.mapPartial (fn (t, intr) =>

					(* print constants only if 'show_consts' is true *)

					if (!show_consts) orelse not (is_Const t) then

						SOME (Sign.string_of_term (sign_of thy) t ^ ": " ^ Sign.string_of_term (sign_of thy) (print thy model t intr assignment))

					else

						NONE) terms) ^ "\n"

	in

		typs_msg ^ show_consts_msg ^ terms_msg

	end;

(* ------------------------------------------------------------------------- *)

(* PARAMETER MANAGEMENT                                                      *)

(* ------------------------------------------------------------------------- *)

	(* string -> (theory -> model -> arguments -> Term.term -> (interpretation * model * arguments) option) -> theory -> theory *)

	fun add_interpreter name f thy =

	let

		val {interpreters, printers, parameters} = RefuteData.get thy

	in

		case AList.lookup (op =) interpreters name of

		  NONE   => RefuteData.put {interpreters = (name, f) :: interpreters, printers = printers, parameters = parameters} thy

		| SOME _ => error ("Interpreter " ^ name ^ " already declared")

	end;

	(* string -> (theory -> model -> Term.term -> interpretation -> (int -> bool) -> Term.term option) -> theory -> theory *)

	fun add_printer name f thy =

	let

		val {interpreters, printers, parameters} = RefuteData.get thy

	in

		case AList.lookup (op =) printers name of

		  NONE   => RefuteData.put {interpreters = interpreters, printers = (name, f) :: printers, parameters = parameters} thy

		| SOME _ => error ("Printer " ^ name ^ " already declared")

	end;

(* ------------------------------------------------------------------------- *)

(* set_default_param: stores the '(name, value)' pair in RefuteData's        *)

(*                    parameter table                                        *)

(* ------------------------------------------------------------------------- *)

	(* (string * string) -> theory -> theory *)

	fun set_default_param (name, value) thy =

	let

		val {interpreters, printers, parameters} = RefuteData.get thy

	in

		case Symtab.lookup parameters name of

		  NONE   => RefuteData.put

			{interpreters = interpreters, printers = printers, parameters = Symtab.extend (parameters, [(name, value)])} thy

		| SOME _ => RefuteData.put

			{interpreters = interpreters, printers = printers, parameters = Symtab.update (name, value) parameters} thy

	end;

(* ------------------------------------------------------------------------- *)

(* get_default_param: retrieves the value associated with 'name' from        *)

(*                    RefuteData's parameter table                           *)

(* ------------------------------------------------------------------------- *)

	(* theory -> string -> string option *)

	val get_default_param = Symtab.lookup o #parameters o RefuteData.get;

(* ------------------------------------------------------------------------- *)

(* get_default_params: returns a list of all '(name, value)' pairs that are  *)

(*                     stored in RefuteData's parameter table                *)

(* ------------------------------------------------------------------------- *)

	(* theory -> (string * string) list *)

	val get_default_params = Symtab.dest o #parameters o RefuteData.get;

(* ------------------------------------------------------------------------- *)

(* actual_params: takes a (possibly empty) list 'params' of parameters that  *)

(*      override the default parameters currently specified in 'thy', and    *)

(*      returns a record that can be passed to 'find_model'.                 *)

(* ------------------------------------------------------------------------- *)

	(* theory -> (string * string) list -> params *)

	fun actual_params thy override =

	let

		(* (string * string) list * string -> int *)

		fun read_int (parms, name) =

			case AList.lookup (op =) parms name of

			  SOME s => (case Int.fromString s of

				  SOME i => i

				| NONE   => error ("parameter " ^ quote name ^ " (value is " ^ quote s ^ ") must be an integer value"))

			| NONE   => error ("parameter " ^ quote name ^ " must be assigned a value")

		(* (string * string) list * string -> string *)

		fun read_string (parms, name) =

			case AList.lookup (op =) parms name of

			  SOME s => s

			| NONE   => error ("parameter " ^ quote name ^ " must be assigned a value")

		(* (string * string) list *)

		val allparams = override @ (get_default_params thy)  (* 'override' first, defaults last *)

		(* int *)

		val minsize   = read_int (allparams, "minsize")

		val maxsize   = read_int (allparams, "maxsize")

		val maxvars   = read_int (allparams, "maxvars")

      val maxtime   = read_int (allparams, "maxtime")

		(* string *)

		val satsolver = read_string (allparams, "satsolver")

		(* all remaining parameters of the form "string=int" are collected in  *)

		(* 'sizes'                                                             *)

		(* TODO: it is currently not possible to specify a size for a type     *)

		(*       whose name is one of the other parameters (e.g. 'maxvars')    *)

		(* (string * int) list *)

		val sizes     = List.mapPartial

			(fn (name,value) => (case Int.fromString value of SOME i => SOME (name, i) | NONE => NONE))

			(List.filter (fn (name,_) => name<>"minsize" andalso name<>"maxsize" andalso name<>"maxvars" andalso name<>"maxtime" andalso name<>"satsolver")

				allparams)

	in

		{sizes=sizes, minsize=minsize, maxsize=maxsize, maxvars=maxvars, maxtime=maxtime, satsolver=satsolver}

	end;

(* ------------------------------------------------------------------------- *)

(* TRANSLATION HOL -> PROPOSITIONAL LOGIC, BOOLEAN ASSIGNMENT -> MODEL       *)

(* ------------------------------------------------------------------------- *)

(* ------------------------------------------------------------------------- *)

(* typ_of_dtyp: converts a data type ('DatatypeAux.dtyp') into a type        *)

(*              ('Term.typ'), given type parameters for the data type's type *)

(*              arguments                                                    *)

(* ------------------------------------------------------------------------- *)

	(* DatatypeAux.descr -> (DatatypeAux.dtyp * Term.typ) list -> DatatypeAux.dtyp -> Term.typ *)

	fun typ_of_dtyp descr typ_assoc (DatatypeAux.DtTFree a) =

		(* replace a 'DtTFree' variable by the associated type *)

		(the o AList.lookup (op =) typ_assoc) (DatatypeAux.DtTFree a)

	  | typ_of_dtyp descr typ_assoc (DatatypeAux.DtType (s, ds)) =

		Type (s, map (typ_of_dtyp descr typ_assoc) ds)

	  | typ_of_dtyp descr typ_assoc (DatatypeAux.DtRec i) =

		let

			val (s, ds, _) = (the o AList.lookup (op =) descr) i

		in

			Type (s, map (typ_of_dtyp descr typ_assoc) ds)

		end;

(* ------------------------------------------------------------------------- *)

(* collect_axioms: collects (monomorphic, universally quantified versions    *)

(*                 of) all HOL axioms that are relevant w.r.t 't'            *)

(* ------------------------------------------------------------------------- *)

	(* Note: to make the collection of axioms more easily extensible, this    *)

	(*       function could be based on user-supplied "axiom collectors",     *)

	(*       similar to 'interpret'/interpreters or 'print'/printers          *)

	(* theory -> Term.term -> Term.term list *)

	(* Which axioms are "relevant" for a particular term/type goes hand in    *)

	(* hand with the interpretation of that term/type by its interpreter (see *)

	(* way below): if the interpretation respects an axiom anyway, the axiom  *)

	(* does not need to be added as a constraint here.                        *)

	(* When an axiom is added as relevant, further axioms may need to be      *)

	(* added as well (e.g. when a constant is defined in terms of other       *)

	(* constants).  To avoid infinite recursion (which should not happen for  *)

	(* constants anyway, but it could happen for "typedef"-related axioms,    *)

	(* since they contain the type again), we use an accumulator 'axs' and    *)

	(* add a relevant axiom only if it is not in 'axs' yet.                   *)

	fun collect_axioms thy t =

	let

		val _ = immediate_output "Adding axioms..."

		(* (string * Term.term) list *)

		val axioms = Theory.all_axioms_of thy;

		(* string list *)

		val rec_names = Symtab.foldl (fn (acc, (_, info)) =>

			#rec_names info @ acc) ([], DatatypePackage.get_datatypes thy)

		(* string list *)

		val const_of_class_names = map Logic.const_of_class (Sign.classes (sign_of thy))

		(* given a constant 's' of type 'T', which is a subterm of 't', where  *)

		(* 't' has a (possibly) more general type, the schematic type          *)

		(* variables in 't' are instantiated to match the type 'T' (may raise  *)

		(* Type.TYPE_MATCH)                                                    *)

		(* (string * Term.typ) * Term.term -> Term.term *)

		fun specialize_type ((s, T), t) =

		let

			fun find_typeSubs (Const (s', T')) =

				(if s=s' then

					SOME (Sign.typ_match thy (T', T) Vartab.empty) handle Type.TYPE_MATCH => NONE

				else

					NONE)

			  | find_typeSubs (Free _)           = NONE

			  | find_typeSubs (Var _)            = NONE

			  | find_typeSubs (Bound _)          = NONE

			  | find_typeSubs (Abs (_, _, body)) = find_typeSubs body

			  | find_typeSubs (t1 $ t2)          = (case find_typeSubs t1 of SOME x => SOME x | NONE => find_typeSubs t2)

			val typeSubs = (case find_typeSubs t of

				  SOME x => x

				| NONE   => raise Type.TYPE_MATCH (* no match found - perhaps due to sort constraints *))

		in

			map_term_types

				(map_type_tvar

					(fn v =>

						case Type.lookup (typeSubs, v) of

						  NONE =>

							(* schematic type variable not instantiated *)

							raise REFUTE ("collect_axioms", "term " ^ Sign.string_of_term (sign_of thy) t ^ " still has a polymorphic type (after instantiating type of " ^ quote s ^ ")")

						| SOME typ =>

							typ))

					t

		end

		(* applies a type substitution 'typeSubs' for all type variables in a  *)

		(* term 't'                                                            *)

		(* (Term.sort * Term.typ) Term.Vartab.table -> Term.term -> Term.term *)

		fun monomorphic_term typeSubs t =

			map_term_types (map_type_tvar

				(fn v =>

					case Type.lookup (typeSubs, v) of

					  NONE =>

						(* schematic type variable not instantiated *)

						error ""

					| SOME typ =>

						typ)) t

		(* Term.term list * Term.typ -> Term.term list *)

		fun collect_sort_axioms (axs, T) =

			let

				(* collect the axioms for a single 'class' (but not for its superclasses) *)

				(* Term.term list * string -> Term.term list *)

				fun collect_class_axioms (axs, class) =

					let

						(* obtain the axioms generated by the "axclass" command *)

						(* (string * Term.term) list *)

						val class_axioms             = List.filter (fn (s, _) => String.isPrefix (Logic.const_of_class class ^ ".axioms_") s) axioms

						(* replace the one schematic type variable in each axiom by the actual type 'T' *)

						(* (string * Term.term) list *)

						val monomorphic_class_axioms = map (fn (axname, ax) =>

							let

								val (idx, S) = (case term_tvars ax of

									  [is] => is

									| _    => raise REFUTE ("collect_axioms", "class axiom " ^ axname ^ " (" ^ Sign.string_of_term (sign_of thy) ax ^ ") does not contain exactly one type variable"))

							in

								(axname, monomorphic_term (Vartab.make [(idx, (S, T))]) ax)

							end) class_axioms

						(* Term.term list * (string * Term.term) list -> Term.term list *)

						fun collect_axiom (axs, (axname, ax)) =

							if mem_term (ax, axs) then

								axs

							else (

								immediate_output (" " ^ axname);

								collect_term_axioms (ax :: axs, ax)

							)

					in

						Library.foldl collect_axiom (axs, monomorphic_class_axioms)

					end

				(* string list *)

				val sort = (case T of

					  TFree (_, sort) => sort

					| TVar (_, sort)  => sort

					| _               => raise REFUTE ("collect_axioms", "type " ^ Sign.string_of_typ (sign_of thy) T ^ " is not a variable"))

				(* obtain all superclasses of classes in 'sort' *)

				(* string list *)

				val superclasses = distinct (op =) (sort @ maps (Sign.super_classes thy) sort)

			in

				Library.foldl collect_class_axioms (axs, superclasses)

			end

		(* Term.term list * Term.typ -> Term.term list *)

		and collect_type_axioms (axs, T) =

			case T of

			(* simple types *)

			  Type ("prop", [])      => axs

			| Type ("fun", [T1, T2]) => collect_type_axioms (collect_type_axioms (axs, T1), T2)

			| Type ("set", [T1])     => collect_type_axioms (axs, T1)

			| Type ("itself", [T1])  => collect_type_axioms (axs, T1)  (* axiomatic type classes *)

			| Type (s, Ts)           =>

				let

					(* look up the definition of a type, as created by "typedef" *)

					(* (string * Term.term) list -> (string * Term.term) option *)

					fun get_typedefn [] =

						NONE

					  | get_typedefn ((axname,ax)::axms) =

						(let

							(* Term.term -> Term.typ option *)

							fun type_of_type_definition (Const (s', T')) =

								if s'="Typedef.type_definition" then

									SOME T'

								else

									NONE

							  | type_of_type_definition (Free _)           = NONE

							  | type_of_type_definition (Var _)            = NONE

							  | type_of_type_definition (Bound _)          = NONE

							  | type_of_type_definition (Abs (_, _, body)) = type_of_type_definition body

							  | type_of_type_definition (t1 $ t2)          = (case type_of_type_definition t1 of SOME x => SOME x | NONE => type_of_type_definition t2)

						in

							case type_of_type_definition ax of

							  SOME T' =>

								let

									val T''      = (domain_type o domain_type) T'

									val typeSubs = Sign.typ_match thy (T'', T) Vartab.empty

								in

									SOME (axname, monomorphic_term typeSubs ax)

								end

							| NONE =>

								get_typedefn axms

						end

						handle ERROR _         => get_typedefn axms

						     | MATCH           => get_typedefn axms

						     | Type.TYPE_MATCH => get_typedefn axms)

				in

					case DatatypePackage.get_datatype thy s of

					  SOME info =>  (* inductive datatype *)

							(* only collect relevant type axioms for the argument types *)

							Library.foldl collect_type_axioms (axs, Ts)

					| NONE =>

						(case get_typedefn axioms of

						  SOME (axname, ax) => 

							if mem_term (ax, axs) then

								(* only collect relevant type axioms for the argument types *)

								Library.foldl collect_type_axioms (axs, Ts)

							else

								(immediate_output (" " ^ axname);

								collect_term_axioms (ax :: axs, ax))

						| NONE =>

							(* unspecified type, perhaps introduced with 'typedecl' *)

							(* at least collect relevant type axioms for the argument types *)

							Library.foldl collect_type_axioms (axs, Ts))

				end

			| TFree _                => collect_sort_axioms (axs, T)  (* axiomatic type classes *)

			| TVar _                 => collect_sort_axioms (axs, T)  (* axiomatic type classes *)

		(* Term.term list * Term.term -> Term.term list *)

		and collect_term_axioms (axs, t) =

			case t of

			(* Pure *)

			  Const ("all", _)                => axs

			| Const ("==", _)                 => axs

			| Const ("==>", _)                => axs

			| Const ("TYPE", T)               => collect_type_axioms (axs, T)  (* axiomatic type classes *)

			(* HOL *)

			| Const ("Trueprop", _)           => axs

			| Const ("Not", _)                => axs

			| Const ("True", _)               => axs  (* redundant, since 'True' is also an IDT constructor *)

			| Const ("False", _)              => axs  (* redundant, since 'False' is also an IDT constructor *)

			| Const ("arbitrary", T)          => collect_type_axioms (axs, T)

			| Const ("The", T)                =>

				let

					val ax = specialize_type (("The", T), (the o AList.lookup (op =) axioms) "HOL.the_eq_trivial")

				in

					if mem_term (ax, axs) then

						collect_type_axioms (axs, T)

					else

						(immediate_output " HOL.the_eq_trivial";

						collect_term_axioms (ax :: axs, ax))

				end

			| Const ("Hilbert_Choice.Eps", T) =>

				let

					val ax = specialize_type (("Hilbert_Choice.Eps", T),

                      (the o AList.lookup (op =) axioms) "Hilbert_Choice.someI")

				in

					if mem_term (ax, axs) then

						collect_type_axioms (axs, T)

					else

						(immediate_output " Hilbert_Choice.someI";

						collect_term_axioms (ax :: axs, ax))

				end

			| Const ("All", _) $ t1           => collect_term_axioms (axs, t1)

			| Const ("Ex", _) $ t1            => collect_term_axioms (axs, t1)

			| Const ("op =", T)               => collect_type_axioms (axs, T)

			| Const ("op &", _)               => axs

			| Const ("op |", _)               => axs

			| Const ("op -->", _)             => axs

			(* sets *)

			| Const ("Collect", T)            => collect_type_axioms (axs, T)

			| Const ("op :", T)               => collect_type_axioms (axs, T)

			(* other optimizations *)

			| Const ("Finite_Set.card", T)    => collect_type_axioms (axs, T)

			| Const ("Finite_Set.Finites", T) => collect_type_axioms (axs, T)

			| Const ("Orderings.less", T as Type ("fun", [Type ("nat", []), Type ("fun", [Type ("nat", []), Type ("bool", [])])])) => collect_type_axioms (axs, T)

			| Const ("HOL.plus", T as Type ("fun", [Type ("nat", []), Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => collect_type_axioms (axs, T)

			| Const ("HOL.minus", T as Type ("fun", [Type ("nat", []), Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => collect_type_axioms (axs, T)

			| Const ("HOL.times", T as Type ("fun", [Type ("nat", []), Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => collect_type_axioms (axs, T)

			| Const ("List.op @", T)          => collect_type_axioms (axs, T)

			| Const ("Lfp.lfp", T)            => collect_type_axioms (axs, T)

			| Const ("Gfp.gfp", T)            => collect_type_axioms (axs, T)

			(* simply-typed lambda calculus *)

			| Const (s, T)                    =>

				let

					(* look up the definition of a constant, as created by "constdefs" *)

					(* string -> Term.typ -> (string * Term.term) list -> (string * Term.term) option *)

					fun get_defn [] =

						NONE

					  | get_defn ((axname, ax)::axms) =

						(let

							val (lhs, _) = Logic.dest_equals ax  (* equations only *)

							val c        = head_of lhs

							val (s', T') = dest_Const c

						in

							if s=s' then

								let

									val typeSubs = Sign.typ_match thy (T', T) Vartab.empty

								in

									SOME (axname, monomorphic_term typeSubs ax)

								end

							else

								get_defn axms

						end

						handle ERROR _         => get_defn axms

						     | TERM _          => get_defn axms

						     | Type.TYPE_MATCH => get_defn axms)

					(* axiomatic type classes *)

					(* unit -> bool *)

					fun is_const_of_class () =

						(* I'm not quite sure if checking the name 's' is sufficient, *)

						(* or if we should also check the type 'T'                    *)

						s mem const_of_class_names

					(* inductive data types *)

					(* unit -> bool *)

					fun is_IDT_constructor () =

						(case body_type T of

						  Type (s', _) =>

							(case DatatypePackage.get_datatype_constrs thy s' of

							  SOME constrs =>

								Library.exists (fn (cname, cty) =>

								cname = s andalso Sign.typ_instance thy (T, cty))

									constrs

							| NONE =>

								false)

						| _  =>

							false)

					(* unit -> bool *)

					fun is_IDT_recursor () =

						(* I'm not quite sure if checking the name 's' is sufficient, *)

						(* or if we should also check the type 'T'                    *)

						s mem rec_names

				in

					if is_const_of_class () then

						(* axiomatic type classes: add "OFCLASS(?'a::c, c_class)" and *)

						(* the introduction rule "class.intro" as axioms              *)

						let

							val class   = Logic.class_of_const s

							val inclass = Logic.mk_inclass (TVar (("'a", 0), [class]), class)

							(* Term.term option *)

							val ofclass_ax = (SOME (specialize_type ((s, T), inclass)) handle Type.TYPE_MATCH => NONE)

							val intro_ax   = (Option.map (fn t => specialize_type ((s, T), t))

								(AList.lookup (op =) axioms (class ^ ".intro")) handle Type.TYPE_MATCH => NONE)

							val axs'       = (case ofclass_ax of NONE => axs | SOME ax => if mem_term (ax, axs) then

									(* collect relevant type axioms *)

									collect_type_axioms (axs, T)

								else

									(immediate_output (" " ^ Sign.string_of_term (sign_of thy) ax);

									collect_term_axioms (ax :: axs, ax)))

							val axs''      = (case intro_ax of NONE => axs' | SOME ax => if mem_term (ax, axs') then

									(* collect relevant type axioms *)

									collect_type_axioms (axs', T)

								else

									(immediate_output (" " ^ s ^ ".intro");

									collect_term_axioms (ax :: axs', ax)))

						in

							axs''

						end

					else if is_IDT_constructor () then

						(* only collect relevant type axioms *)

						collect_type_axioms (axs, T)

					else if is_IDT_recursor () then

						(* only collect relevant type axioms *)

						collect_type_axioms (axs, T)

					else (

						case get_defn axioms of

						  SOME (axname, ax) => 

							if mem_term (ax, axs) then

								(* collect relevant type axioms *)

								collect_type_axioms (axs, T)

							else

								(immediate_output (" " ^ axname);

								collect_term_axioms (ax :: axs, ax))

						| NONE =>

							(* collect relevant type axioms *)

							collect_type_axioms (axs, T)

					)

				end

			| Free (_, T)                     => collect_type_axioms (axs, T)

			| Var (_, T)                      => collect_type_axioms (axs, T)

			| Bound i                         => axs

			| Abs (_, T, body)                => collect_term_axioms (collect_type_axioms (axs, T), body)

			| t1 $ t2                         => collect_term_axioms (collect_term_axioms (axs, t1), t2)

		(* universal closure over schematic variables *)

		(* Term.term -> Term.term *)

		fun close_form t =

		let

			(* (Term.indexname * Term.typ) list *)

			val vars = sort_wrt (fst o fst) (map dest_Var (term_vars t))

		in

			Library.foldl

				(fn (t', ((x, i), T)) => (Term.all T) $ Abs (x, T, abstract_over (Var((x, i), T), t')))

				(t, vars)

		end

		(* Term.term list *)

		val result = map close_form (collect_term_axioms ([], t))

		val _ = writeln " ...done."

	in

		result

	end;

(* ------------------------------------------------------------------------- *)

(* ground_types: collects all ground types in a term (including argument     *)

(*               types of other types), suppressing duplicates.  Does not    *)

(*               return function types, set types, non-recursive IDTs, or    *)

(*               'propT'.  For IDTs, also the argument types of constructors *)

(*               are considered.                                             *)

(* ------------------------------------------------------------------------- *)

	(* theory -> Term.term -> Term.typ list *)

	fun ground_types thy t =

	let

		(* Term.typ * Term.typ list -> Term.typ list *)

		fun collect_types (T, acc) =

			if T mem acc then

				acc  (* prevent infinite recursion (for IDTs) *)

			else

				(case T of

				  Type ("fun", [T1, T2]) => collect_types (T1, collect_types (T2, acc))

				| Type ("prop", [])      => acc

				| Type ("set", [T1])     => collect_types (T1, acc)

				| Type (s, Ts)           =>

					(case DatatypePackage.get_datatype thy s of

					  SOME info =>  (* inductive datatype *)

						let

							val index               = #index info

							val descr               = #descr info

							val (_, dtyps, constrs) = (the o AList.lookup (op =) descr) index

							val typ_assoc           = dtyps ~~ Ts

							(* sanity check: every element in 'dtyps' must be a 'DtTFree' *)

							val _ = (if Library.exists (fn d =>

									case d of DatatypeAux.DtTFree _ => false | _ => true) dtyps

								then

									raise REFUTE ("ground_types", "datatype argument (for type " ^ Sign.string_of_typ (sign_of thy) (Type (s, Ts)) ^ ") is not a variable")

								else

									())

							(* if the current type is a recursive IDT (i.e. a depth is required), add it to 'acc' *)

							val acc' = (if Library.exists (fn (_, ds) => Library.exists DatatypeAux.is_rec_type ds) constrs then

									T ins acc

								else

									acc)

							(* collect argument types *)

							val acc_args = foldr collect_types acc' Ts

							(* collect constructor types *)

							val acc_constrs = foldr collect_types acc_args (List.concat (map (fn (_, ds) => map (typ_of_dtyp descr typ_assoc) ds) constrs))

						in

							acc_constrs

						end

					| NONE =>  (* not an inductive datatype, e.g. defined via "typedef" or "typedecl" *)

						T ins (foldr collect_types acc Ts))

				| TFree _                => T ins acc

				| TVar _                 => T ins acc)

	in

		it_term_types collect_types (t, [])

	end;

(* ------------------------------------------------------------------------- *)

(* string_of_typ: (rather naive) conversion from types to strings, used to   *)

(*                look up the size of a type in 'sizes'.  Parameterized      *)

(*                types with different parameters (e.g. "'a list" vs. "bool  *)

(*                list") are identified.                                     *)

(* ------------------------------------------------------------------------- *)

	(* Term.typ -> string *)

	fun string_of_typ (Type (s, _))     = s

	  | string_of_typ (TFree (s, _))    = s

	  | string_of_typ (TVar ((s,_), _)) = s;

(* ------------------------------------------------------------------------- *)

(* first_universe: returns the "first" (i.e. smallest) universe by assigning *)

(*                 'minsize' to every type for which no size is specified in *)

(*                 'sizes'                                                   *)

(* ------------------------------------------------------------------------- *)

	(* Term.typ list -> (string * int) list -> int -> (Term.typ * int) list *)

	fun first_universe xs sizes minsize =

	let

		fun size_of_typ T =

			case AList.lookup (op =) sizes (string_of_typ T) of

			  SOME n => n

			| NONE   => minsize

	in

		map (fn T => (T, size_of_typ T)) xs

	end;

(* ------------------------------------------------------------------------- *)

(* next_universe: enumerates all universes (i.e. assignments of sizes to     *)

(*                types), where the minimal size of a type is given by       *)

(*                'minsize', the maximal size is given by 'maxsize', and a   *)

(*                type may have a fixed size given in 'sizes'                *)

(* ------------------------------------------------------------------------- *)

	(* (Term.typ * int) list -> (string * int) list -> int -> int -> (Term.typ * int) list option *)

	fun next_universe xs sizes minsize maxsize =

	let

		(* creates the "first" list of length 'len', where the sum of all list *)

		(* elements is 'sum', and the length of the list is 'len'              *)

		(* int -> int -> int -> int list option *)

		fun make_first _ 0 sum =

			if sum=0 then

				SOME []

			else

				NONE

		  | make_first max len sum =

			if sum<=max orelse max<0 then

				Option.map (fn xs' => sum :: xs') (make_first max (len-1) 0)

			else

				Option.map (fn xs' => max :: xs') (make_first max (len-1) (sum-max))

		(* enumerates all int lists with a fixed length, where 0<=x<='max' for *)

		(* all list elements x (unless 'max'<0)                                *)

		(* int -> int -> int -> int list -> int list option *)

		fun next max len sum [] =

			NONE

		  | next max len sum [x] =

			(* we've reached the last list element, so there's no shift possible *)

			make_first max (len+1) (sum+x+1)  (* increment 'sum' by 1 *)

		  | next max len sum (x1::x2::xs) =

			if x1>0 andalso (x2<max orelse max<0) then

				(* we can shift *)

				SOME (valOf (make_first max (len+1) (sum+x1-1)) @ (x2+1) :: xs)

			else

				(* continue search *)

				next max (len+1) (sum+x1) (x2::xs)

		(* only consider those types for which the size is not fixed *)

		val mutables = List.filter (not o (AList.defined (op =) sizes) o string_of_typ o fst) xs

		(* subtract 'minsize' from every size (will be added again at the end) *)

		val diffs = map (fn (_, n) => n-minsize) mutables

	in

		case next (maxsize-minsize) 0 0 diffs of

		  SOME diffs' =>

			(* merge with those types for which the size is fixed *)

			SOME (snd (foldl_map (fn (ds, (T, _)) =>

				case AList.lookup (op =) sizes (string_of_typ T) of

				  SOME n => (ds, (T, n))                    (* return the fixed size *)

				| NONE   => (tl ds, (T, minsize + hd ds)))  (* consume the head of 'ds', add 'minsize' *)

				(diffs', xs)))

		| NONE =>

			NONE

	end;

(* ------------------------------------------------------------------------- *)

(* toTrue: converts the interpretation of a Boolean value to a propositional *)

(*         formula that is true iff the interpretation denotes "true"        *)

(* ------------------------------------------------------------------------- *)

	(* interpretation -> prop_formula *)

	fun toTrue (Leaf [fm, _]) = fm

	  | toTrue _              = raise REFUTE ("toTrue", "interpretation does not denote a Boolean value");

(* ------------------------------------------------------------------------- *)

(* toFalse: converts the interpretation of a Boolean value to a              *)

(*          propositional formula that is true iff the interpretation        *)

(*          denotes "false"                                                  *)

(* ------------------------------------------------------------------------- *)

	(* interpretation -> prop_formula *)

	fun toFalse (Leaf [_, fm]) = fm

	  | toFalse _              = raise REFUTE ("toFalse", "interpretation does not denote a Boolean value");

(* ------------------------------------------------------------------------- *)

(* find_model: repeatedly calls 'interpret' with appropriate parameters,     *)

(*             applies a SAT solver, and (in case a model is found) displays *)

(*             the model to the user by calling 'print_model'                *)

(* thy       : the current theory                                            *)

(* {...}     : parameters that control the translation/model generation      *)

(* t         : term to be translated into a propositional formula            *)

(* negate    : if true, find a model that makes 't' false (rather than true) *)

(* ------------------------------------------------------------------------- *)

	(* theory -> params -> Term.term -> bool -> unit *)

	fun find_model thy {sizes, minsize, maxsize, maxvars, maxtime, satsolver} t negate =

	let

		(* unit -> unit *)

		fun wrapper () =

		let

			(* Term.term list *)

			val axioms = collect_axioms thy t

			(* Term.typ list *)

			val types  = Library.foldl (fn (acc, t') => acc union (ground_types thy t')) ([], t :: axioms)

			val _      = writeln ("Ground types: "

				^ (if null types then "none."

				   else commas (map (Sign.string_of_typ (sign_of thy)) types)))

			(* we can only consider fragments of recursive IDTs, so we issue a  *)

			(* warning if the formula contains a recursive IDT                  *)

			(* TODO: no warning needed for /positive/ occurrences of IDTs       *)

			val _ = if Library.exists (fn

				  Type (s, _) =>

					(case DatatypePackage.get_datatype thy s of

					  SOME info =>  (* inductive datatype *)

						let

							val index           = #index info

							val descr           = #descr info

							val (_, _, constrs) = (the o AList.lookup (op =) descr) index

						in

							(* recursive datatype? *)

							Library.exists (fn (_, ds) => Library.exists DatatypeAux.is_rec_type ds) constrs

						end

					| NONE => false)

				| _ => false) types then

					warning "Term contains a recursive datatype; countermodel(s) may be spurious!"

				else

					()

			(* (Term.typ * int) list -> unit *)

			fun find_model_loop universe =

			let

				val init_model             = (universe, [])

				val init_args              = {maxvars = maxvars, def_eq = false, next_idx = 1, bounds = [], wellformed = True}

				val _                      = immediate_output ("Translating term (sizes: " ^ commas (map (fn (_, n) => string_of_int n) universe) ^ ") ...")

				(* translate 't' and all axioms *)

				val ((model, args), intrs) = foldl_map (fn ((m, a), t') =>

					let

						val (i, m', a') = interpret thy m a t'

					in

						(* set 'def_eq' to 'true' *)

						((m', {maxvars = #maxvars a', def_eq = true, next_idx = #next_idx a', bounds = #bounds a', wellformed = #wellformed a'}), i)

					end) ((init_model, init_args), t :: axioms)

				(* make 't' either true or false, and make all axioms true, and *)

				(* add the well-formedness side condition                       *)

				val fm_t  = (if negate then toFalse else toTrue) (hd intrs)

				val fm_ax = PropLogic.all (map toTrue (tl intrs))

				val fm    = PropLogic.all [#wellformed args, fm_ax, fm_t]

			in

				immediate_output " invoking SAT solver...";

				(case SatSolver.invoke_solver satsolver fm of

				  SatSolver.SATISFIABLE assignment =>

					(writeln " model found!";

					writeln ("*** Model found: ***\n" ^ print_model thy model (fn i => case assignment i of SOME b => b | NONE => true)))

				| SatSolver.UNSATISFIABLE _ =>

					(immediate_output " no model exists.\n";

					case next_universe universe sizes minsize maxsize of

					  SOME universe' => find_model_loop universe'

					| NONE           => writeln "Search terminated, no larger universe within the given limits.")

				| SatSolver.UNKNOWN =>

					(immediate_output " no model found.\n";

					case next_universe universe sizes minsize maxsize of

					  SOME universe' => find_model_loop universe'

					| NONE           => writeln "Search terminated, no larger universe within the given limits.")

				) handle SatSolver.NOT_CONFIGURED =>

					error ("SAT solver " ^ quote satsolver ^ " is not configured.")