src/HOL/Tools/refute.ML

removed assert/deny (avoid clash with Alice keywords and confusion due to strict evaluation);

(*  Title:      HOL/Tools/refute.ML
    ID:         $Id$
    Author:     Tjark Weber
    Copyright   2003-2007

Finite model generation for HOL formulas, using a SAT solver.
*)

(* ------------------------------------------------------------------------- *)
(* Declares the 'REFUTE' signature as well as a structure 'Refute'.          *)
(* Documentation is available in the Isabelle/Isar theory 'HOL/Refute.thy'.  *)
(* ------------------------------------------------------------------------- *)

signature REFUTE =
sig

  exception REFUTE of string * string

(* ------------------------------------------------------------------------- *)
(* Model/interpretation related code (translation HOL -> propositional logic *)
(* ------------------------------------------------------------------------- *)

  type params
  type interpretation
  type model
  type arguments

  exception MAXVARS_EXCEEDED

  val add_interpreter : string -> (theory -> model -> arguments -> Term.term ->
    (interpretation * model * arguments) option) -> theory -> theory
  val add_printer     : string -> (theory -> model -> Term.term ->
    interpretation -> (int -> bool) -> Term.term option) -> theory -> theory

  val interpret : theory -> model -> arguments -> Term.term ->
    (interpretation * model * arguments)

  val print       : theory -> model -> Term.term -> interpretation ->
    (int -> bool) -> Term.term
  val print_model : theory -> model -> (int -> bool) -> string

(* ------------------------------------------------------------------------- *)
(* Interface                                                                 *)
(* ------------------------------------------------------------------------- *)

  val set_default_param  : (string * string) -> theory -> theory
  val get_default_param  : theory -> string -> string option
  val get_default_params : theory -> (string * string) list
  val actual_params      : theory -> (string * string) list -> params

  val find_model : theory -> params -> Term.term -> bool -> unit

  (* tries to find a model for a formula: *)
  val satisfy_term   : theory -> (string * string) list -> Term.term -> unit
  (* tries to find a model that refutes a formula: *)
  val refute_term    : theory -> (string * string) list -> Term.term -> unit
  val refute_subgoal :
    theory -> (string * string) list -> Thm.thm -> int -> unit

  val setup : theory -> theory

end;  (* signature REFUTE *)

structure Refute : REFUTE =
struct

  open PropLogic;

  (* We use 'REFUTE' only for internal error conditions that should    *)
  (* never occur in the first place (i.e. errors caused by bugs in our *)
  (* code).  Otherwise (e.g. to indicate invalid input data) we use    *)
  (* 'error'.                                                          *)
  exception REFUTE of string * string;  (* ("in function", "cause") *)

  (* should be raised by an interpreter when more variables would be *)
  (* required than allowed by 'maxvars'                              *)
  exception MAXVARS_EXCEEDED;

(* ------------------------------------------------------------------------- *)
(* TREES                                                                     *)
(* ------------------------------------------------------------------------- *)

(* ------------------------------------------------------------------------- *)
(* tree: implements an arbitrarily (but finitely) branching tree as a list   *)
(*       of (lists of ...) elements                                          *)
(* ------------------------------------------------------------------------- *)

  datatype 'a tree =
      Leaf of 'a
    | Node of ('a tree) list;

  (* ('a -> 'b) -> 'a tree -> 'b tree *)

  fun tree_map f tr =
    case tr of
      Leaf x  => Leaf (f x)
    | Node xs => Node (map (tree_map f) xs);

  (* ('a * 'b -> 'a) -> 'a * ('b tree) -> 'a *)

  fun tree_foldl f =
  let
    fun itl (e, Leaf x)  = f(e,x)
      | itl (e, Node xs) = Library.foldl (tree_foldl f) (e,xs)
  in
    itl
  end;

  (* 'a tree * 'b tree -> ('a * 'b) tree *)

  fun tree_pair (t1, t2) =
    case t1 of
      Leaf x =>
      (case t2 of
          Leaf y => Leaf (x,y)
        | Node _ => raise REFUTE ("tree_pair",
            "trees are of different height (second tree is higher)"))
    | Node xs =>
      (case t2 of
          (* '~~' will raise an exception if the number of branches in   *)
          (* both trees is different at the current node                 *)
          Node ys => Node (map tree_pair (xs ~~ ys))
        | Leaf _  => raise REFUTE ("tree_pair",
            "trees are of different height (first tree is higher)"));

(* ------------------------------------------------------------------------- *)
(* params: parameters that control the translation into a propositional      *)
(*         formula/model generation                                          *)
(*                                                                           *)
(* The following parameters are supported (and required (!), except for      *)
(* "sizes"):                                                                 *)
(*                                                                           *)
(* Name          Type    Description                                         *)
(*                                                                           *)
(* "sizes"       (string * int) list                                         *)
(*                       Size of ground types (e.g. 'a=2), or depth of IDTs. *)
(* "minsize"     int     If >0, minimal size of each ground type/IDT depth.  *)
(* "maxsize"     int     If >0, maximal size of each ground type/IDT depth.  *)
(* "maxvars"     int     If >0, use at most 'maxvars' Boolean variables      *)
(*                       when transforming the term into a propositional     *)
(*                       formula.                                            *)
(* "maxtime"     int     If >0, terminate after at most 'maxtime' seconds.   *)
(* "satsolver"   string  SAT solver to be used.                              *)
(* ------------------------------------------------------------------------- *)

  type params =
    {
      sizes    : (string * int) list,
      minsize  : int,
      maxsize  : int,
      maxvars  : int,
      maxtime  : int,
      satsolver: string
    };

(* ------------------------------------------------------------------------- *)
(* interpretation: a term's interpretation is given by a variable of type    *)
(*                 'interpretation'                                          *)
(* ------------------------------------------------------------------------- *)

  type interpretation =
    prop_formula list tree;

(* ------------------------------------------------------------------------- *)
(* model: a model specifies the size of types and the interpretation of      *)
(*        terms                                                              *)
(* ------------------------------------------------------------------------- *)

  type model =
    (Term.typ * int) list * (Term.term * interpretation) list;

(* ------------------------------------------------------------------------- *)
(* arguments: additional arguments required during interpretation of terms   *)
(* ------------------------------------------------------------------------- *)

  type arguments =
    {
      (* just passed unchanged from 'params': *)
      maxvars   : int,
      (* whether to use 'make_equality' or 'make_def_equality': *)
      def_eq    : bool,
      (* the following may change during the translation: *)
      next_idx  : int,
      bounds    : interpretation list,
      wellformed: prop_formula
    };


  structure RefuteDataArgs =
  struct
    val name = "HOL/refute";
    type T =
      {interpreters: (string * (theory -> model -> arguments -> Term.term ->
        (interpretation * model * arguments) option)) list,
       printers: (string * (theory -> model -> Term.term -> interpretation ->
        (int -> bool) -> Term.term option)) list,
       parameters: string Symtab.table};
    val empty = {interpreters = [], printers = [], parameters = Symtab.empty};
    val copy = I;
    val extend = I;
    fun merge _
      ({interpreters = in1, printers = pr1, parameters = pa1},
       {interpreters = in2, printers = pr2, parameters = pa2}) =
      {interpreters = AList.merge (op =) (K true) (in1, in2),
       printers = AList.merge (op =) (K true) (pr1, pr2),
       parameters = Symtab.merge (op=) (pa1, pa2)};
    fun print sg {interpreters, printers, parameters} =
      Pretty.writeln (Pretty.chunks
        [Pretty.strs ("default parameters:" :: List.concat (map
          (fn (name, value) => [name, "=", value]) (Symtab.dest parameters))),
         Pretty.strs ("interpreters:" :: map fst interpreters),
         Pretty.strs ("printers:" :: map fst printers)]);
  end;

  structure RefuteData = TheoryDataFun(RefuteDataArgs);


(* ------------------------------------------------------------------------- *)
(* interpret: interprets the term 't' using a suitable interpreter; returns  *)
(*            the interpretation and a (possibly extended) model that keeps  *)
(*            track of the interpretation of subterms                        *)
(* ------------------------------------------------------------------------- *)

  (* theory -> model -> arguments -> Term.term ->
    (interpretation * model * arguments) *)

  fun interpret thy model args t =
    case get_first (fn (_, f) => f thy model args t)
      (#interpreters (RefuteData.get thy)) of
      NONE   => raise REFUTE ("interpret",
        "no interpreter for term " ^ quote (Sign.string_of_term thy t))
    | SOME x => x;

(* ------------------------------------------------------------------------- *)
(* print: converts the constant denoted by the term 't' into a term using a  *)
(*        suitable printer                                                   *)
(* ------------------------------------------------------------------------- *)

  (* theory -> model -> Term.term -> interpretation -> (int -> bool) ->
    Term.term *)

  fun print thy model t intr assignment =
    case get_first (fn (_, f) => f thy model t intr assignment)
      (#printers (RefuteData.get thy)) of
      NONE   => raise REFUTE ("print",
        "no printer for term " ^ quote (Sign.string_of_term thy t))
    | SOME x => x;

(* ------------------------------------------------------------------------- *)
(* print_model: turns the model into a string, using a fixed interpretation  *)
(*              (given by an assignment for Boolean variables) and suitable  *)
(*              printers                                                     *)
(* ------------------------------------------------------------------------- *)

  (* theory -> model -> (int -> bool) -> string *)

  fun print_model thy model assignment =
  let
    val (typs, terms) = model
    val typs_msg =
      if null typs then
        "empty universe (no type variables in term)\n"
      else
        "Size of types: " ^ commas (map (fn (T, i) =>
          Sign.string_of_typ thy T ^ ": " ^ string_of_int i) typs) ^ "\n"
    val show_consts_msg =
      if not (!show_consts) andalso Library.exists (is_Const o fst) terms then
        "set \"show_consts\" to show the interpretation of constants\n"
      else
        ""
    val terms_msg =
      if null terms then
        "empty interpretation (no free variables in term)\n"
      else
        space_implode "\n" (List.mapPartial (fn (t, intr) =>
          (* print constants only if 'show_consts' is true *)
          if (!show_consts) orelse not (is_Const t) then
            SOME (Sign.string_of_term thy t ^ ": " ^
              Sign.string_of_term thy (print thy model t intr assignment))
          else
            NONE) terms) ^ "\n"
  in
    typs_msg ^ show_consts_msg ^ terms_msg
  end;


(* ------------------------------------------------------------------------- *)
(* PARAMETER MANAGEMENT                                                      *)
(* ------------------------------------------------------------------------- *)

  (* string -> (theory -> model -> arguments -> Term.term ->
    (interpretation * model * arguments) option) -> theory -> theory *)

  fun add_interpreter name f thy =
  let
    val {interpreters, printers, parameters} = RefuteData.get thy
  in
    case AList.lookup (op =) interpreters name of
      NONE   => RefuteData.put {interpreters = (name, f) :: interpreters,
      printers = printers, parameters = parameters} thy
    | SOME _ => error ("Interpreter " ^ name ^ " already declared")
  end;

  (* string -> (theory -> model -> Term.term -> interpretation ->
    (int -> bool) -> Term.term option) -> theory -> theory *)

  fun add_printer name f thy =
  let
    val {interpreters, printers, parameters} = RefuteData.get thy
  in
    case AList.lookup (op =) printers name of
      NONE   => RefuteData.put {interpreters = interpreters,
      printers = (name, f) :: printers, parameters = parameters} thy
    | SOME _ => error ("Printer " ^ name ^ " already declared")
  end;

(* ------------------------------------------------------------------------- *)
(* set_default_param: stores the '(name, value)' pair in RefuteData's        *)
(*                    parameter table                                        *)
(* ------------------------------------------------------------------------- *)

  (* (string * string) -> theory -> theory *)

  fun set_default_param (name, value) thy =
  let
    val {interpreters, printers, parameters} = RefuteData.get thy
  in
    RefuteData.put (case Symtab.lookup parameters name of
      NONE   =>
      {interpreters = interpreters, printers = printers,
        parameters = Symtab.extend (parameters, [(name, value)])}
    | SOME _ =>
      {interpreters = interpreters, printers = printers,
        parameters = Symtab.update (name, value) parameters}) thy
  end;

(* ------------------------------------------------------------------------- *)
(* get_default_param: retrieves the value associated with 'name' from        *)
(*                    RefuteData's parameter table                           *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string -> string option *)

  val get_default_param = Symtab.lookup o #parameters o RefuteData.get;

(* ------------------------------------------------------------------------- *)
(* get_default_params: returns a list of all '(name, value)' pairs that are  *)
(*                     stored in RefuteData's parameter table                *)
(* ------------------------------------------------------------------------- *)

  (* theory -> (string * string) list *)

  val get_default_params = Symtab.dest o #parameters o RefuteData.get;

(* ------------------------------------------------------------------------- *)
(* actual_params: takes a (possibly empty) list 'params' of parameters that  *)
(*      override the default parameters currently specified in 'thy', and    *)
(*      returns a record that can be passed to 'find_model'.                 *)
(* ------------------------------------------------------------------------- *)

  (* theory -> (string * string) list -> params *)

  fun actual_params thy override =
  let
    (* (string * string) list * string -> int *)
    fun read_int (parms, name) =
      case AList.lookup (op =) parms name of
        SOME s => (case Int.fromString s of
          SOME i => i
        | NONE   => error ("parameter " ^ quote name ^
          " (value is " ^ quote s ^ ") must be an integer value"))
      | NONE   => error ("parameter " ^ quote name ^
          " must be assigned a value")
    (* (string * string) list * string -> string *)
    fun read_string (parms, name) =
      case AList.lookup (op =) parms name of
        SOME s => s
      | NONE   => error ("parameter " ^ quote name ^
        " must be assigned a value")
    (* 'override' first, defaults last: *)
    (* (string * string) list *)
    val allparams = override @ (get_default_params thy)
    (* int *)
    val minsize   = read_int (allparams, "minsize")
    val maxsize   = read_int (allparams, "maxsize")
    val maxvars   = read_int (allparams, "maxvars")
    val maxtime   = read_int (allparams, "maxtime")
    (* string *)
    val satsolver = read_string (allparams, "satsolver")
    (* all remaining parameters of the form "string=int" are collected in *)
    (* 'sizes'                                                            *)
    (* TODO: it is currently not possible to specify a size for a type    *)
    (*       whose name is one of the other parameters (e.g. 'maxvars')   *)
    (* (string * int) list *)
    val sizes     = List.mapPartial
      (fn (name, value) => Option.map (pair name) (Int.fromString value))
      (List.filter (fn (name, _) => name<>"minsize" andalso name<>"maxsize"
        andalso name<>"maxvars" andalso name<>"maxtime"
        andalso name<>"satsolver") allparams)
  in
    {sizes=sizes, minsize=minsize, maxsize=maxsize, maxvars=maxvars,
      maxtime=maxtime, satsolver=satsolver}
  end;


(* ------------------------------------------------------------------------- *)
(* TRANSLATION HOL -> PROPOSITIONAL LOGIC, BOOLEAN ASSIGNMENT -> MODEL       *)
(* ------------------------------------------------------------------------- *)

  (* (''a * 'b) list -> ''a -> 'b *)

  fun lookup xs key =
    Option.valOf (AList.lookup (op =) xs key);

(* ------------------------------------------------------------------------- *)
(* typ_of_dtyp: converts a data type ('DatatypeAux.dtyp') into a type        *)
(*              ('Term.typ'), given type parameters for the data type's type *)
(*              arguments                                                    *)
(* ------------------------------------------------------------------------- *)

  (* DatatypeAux.descr -> (DatatypeAux.dtyp * Term.typ) list ->
    DatatypeAux.dtyp -> Term.typ *)

  fun typ_of_dtyp descr typ_assoc (DatatypeAux.DtTFree a) =
    (* replace a 'DtTFree' variable by the associated type *)
    lookup typ_assoc (DatatypeAux.DtTFree a)
    | typ_of_dtyp descr typ_assoc (DatatypeAux.DtType (s, ds)) =
    Type (s, map (typ_of_dtyp descr typ_assoc) ds)
    | typ_of_dtyp descr typ_assoc (DatatypeAux.DtRec i) =
    let
      val (s, ds, _) = lookup descr i
    in
      Type (s, map (typ_of_dtyp descr typ_assoc) ds)
    end;

(* ------------------------------------------------------------------------- *)
(* close_form: universal closure over schematic variables in 't'             *)
(* ------------------------------------------------------------------------- *)

  (* Term.term -> Term.term *)

  fun close_form t =
  let
    (* (Term.indexname * Term.typ) list *)
    val vars = sort_wrt (fst o fst) (map dest_Var (term_vars t))
  in
    Library.foldl (fn (t', ((x, i), T)) =>
      (Term.all T) $ Abs (x, T, abstract_over (Var ((x, i), T), t')))
      (t, vars)
  end;

(* ------------------------------------------------------------------------- *)
(* monomorphic_term: applies a type substitution 'typeSubs' for all type     *)
(*                   variables in a term 't'                                 *)
(* ------------------------------------------------------------------------- *)

  (* Type.tyenv -> Term.term -> Term.term *)

  fun monomorphic_term typeSubs t =
    map_types (map_type_tvar
      (fn v =>
        case Type.lookup (typeSubs, v) of
          NONE =>
          (* schematic type variable not instantiated *)
          raise REFUTE ("monomorphic_term",
            "no substitution for type variable " ^ fst (fst v) ^
            " in term " ^ Display.raw_string_of_term t)
        | SOME typ =>
          typ)) t;

(* ------------------------------------------------------------------------- *)
(* specialize_type: given a constant 's' of type 'T', which is a subterm of  *)
(*                  't', where 't' has a (possibly) more general type, the   *)
(*                  schematic type variables in 't' are instantiated to      *)
(*                  match the type 'T' (may raise Type.TYPE_MATCH)           *)
(* ------------------------------------------------------------------------- *)

  (* theory -> (string * Term.typ) -> Term.term -> Term.term *)

  fun specialize_type thy (s, T) t =
  let
    fun find_typeSubs (Const (s', T')) =
      if s=s' then
        SOME (Sign.typ_match thy (T', T) Vartab.empty)
          handle Type.TYPE_MATCH => NONE
      else
        NONE
      | find_typeSubs (Free _)           = NONE
      | find_typeSubs (Var _)            = NONE
      | find_typeSubs (Bound _)          = NONE
      | find_typeSubs (Abs (_, _, body)) = find_typeSubs body
      | find_typeSubs (t1 $ t2)          =
      (case find_typeSubs t1 of SOME x => SOME x
                              | NONE   => find_typeSubs t2)
  in
    case find_typeSubs t of
      SOME typeSubs =>
      monomorphic_term typeSubs t
    | NONE =>
      (* no match found - perhaps due to sort constraints *)
      raise Type.TYPE_MATCH
  end;

(* ------------------------------------------------------------------------- *)
(* is_const_of_class: returns 'true' iff 'Const (s, T)' is a constant that   *)
(*                    denotes membership to an axiomatic type class          *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string * Term.typ -> bool *)

  fun is_const_of_class thy (s, T) =
  let
    val class_const_names = map Logic.const_of_class (Sign.all_classes thy)
  in
    (* I'm not quite sure if checking the name 's' is sufficient, *)
    (* or if we should also check the type 'T'.                   *)
    s mem_string class_const_names
  end;

(* ------------------------------------------------------------------------- *)
(* is_IDT_constructor: returns 'true' iff 'Const (s, T)' is the constructor  *)
(*                     of an inductive datatype in 'thy'                     *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string * Term.typ -> bool *)

  fun is_IDT_constructor thy (s, T) =
    (case body_type T of
      Type (s', _) =>
      (case DatatypePackage.get_datatype_constrs thy s' of
        SOME constrs =>
        List.exists (fn (cname, cty) =>
          cname = s andalso Sign.typ_instance thy (T, cty)) constrs
      | NONE =>
        false)
    | _  =>
      false);

(* ------------------------------------------------------------------------- *)
(* is_IDT_recursor: returns 'true' iff 'Const (s, T)' is the recursion       *)
(*                  operator of an inductive datatype in 'thy'               *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string * Term.typ -> bool *)

  fun is_IDT_recursor thy (s, T) =
  let
    val rec_names = Symtab.fold (append o #rec_names o snd)
      (DatatypePackage.get_datatypes thy) []
  in
    (* I'm not quite sure if checking the name 's' is sufficient, *)
    (* or if we should also check the type 'T'.                   *)
    s mem_string rec_names
  end;

(* ------------------------------------------------------------------------- *)
(* get_def: looks up the definition of a constant, as created by "constdefs" *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string * Term.typ -> (string * Term.term) option *)

  fun get_def thy (s, T) =
  let
    (* maps  f ?t1 ... ?tn == rhs  to  %t1...tn. rhs *)
    fun norm_rhs eqn =
    let
      fun lambda (v as Var ((x, _), T)) t = Abs (x, T, abstract_over (v, t))
        | lambda v t                      = raise TERM ("lambda", [v, t])
      val (lhs, rhs) = Logic.dest_equals eqn
      val (_, args)  = Term.strip_comb lhs
    in
      fold lambda (rev args) rhs
    end
    (* (string * Term.term) list -> (string * Term.term) option *)
    fun get_def_ax [] = NONE
      | get_def_ax ((axname, ax) :: axioms) =
      (let
        val (lhs, _) = Logic.dest_equals ax  (* equations only *)
        val c        = Term.head_of lhs
        val (s', T') = Term.dest_Const c
      in
        if s=s' then
          let
            val typeSubs = Sign.typ_match thy (T', T) Vartab.empty
            val ax'      = monomorphic_term typeSubs ax
            val rhs      = norm_rhs ax'
          in
            SOME (axname, rhs)
          end
        else
          get_def_ax axioms
      end handle ERROR _         => get_def_ax axioms
               | TERM _          => get_def_ax axioms
               | Type.TYPE_MATCH => get_def_ax axioms)
  in
    get_def_ax (Theory.all_axioms_of thy)
  end;

(* ------------------------------------------------------------------------- *)
(* get_typedef: looks up the definition of a type, as created by "typedef"   *)
(* ------------------------------------------------------------------------- *)

  (* theory -> (string * Term.typ) -> (string * Term.term) option *)

  fun get_typedef thy T =
  let
    (* (string * Term.term) list -> (string * Term.term) option *)
    fun get_typedef_ax [] = NONE
      | get_typedef_ax ((axname, ax) :: axioms) =
      (let
        (* Term.term -> Term.typ option *)
        fun type_of_type_definition (Const (s', T')) =
          if s'="Typedef.type_definition" then
            SOME T'
          else
            NONE
          | type_of_type_definition (Free _)           = NONE
          | type_of_type_definition (Var _)            = NONE
          | type_of_type_definition (Bound _)          = NONE
          | type_of_type_definition (Abs (_, _, body)) =
          type_of_type_definition body
          | type_of_type_definition (t1 $ t2)          =
          (case type_of_type_definition t1 of
            SOME x => SOME x
          | NONE   => type_of_type_definition t2)
      in
        case type_of_type_definition ax of
          SOME T' =>
          let
            val T''      = (domain_type o domain_type) T'
            val typeSubs = Sign.typ_match thy (T'', T) Vartab.empty
          in
            SOME (axname, monomorphic_term typeSubs ax)
          end
        | NONE =>
          get_typedef_ax axioms
      end handle ERROR _         => get_typedef_ax axioms
               | MATCH           => get_typedef_ax axioms
               | Type.TYPE_MATCH => get_typedef_ax axioms)
  in
    get_typedef_ax (Theory.all_axioms_of thy)
  end;

(* ------------------------------------------------------------------------- *)
(* get_classdef: looks up the defining axiom for an axiomatic type class, as *)
(*               created by the "axclass" command                            *)
(* ------------------------------------------------------------------------- *)

  (* theory -> string -> (string * Term.term) option *)

  fun get_classdef thy class =
  let
    val axname = class ^ "_class_def"
  in
    Option.map (pair axname)
      (AList.lookup (op =) (Theory.all_axioms_of thy) axname)
  end;

(* ------------------------------------------------------------------------- *)
(* unfold_defs: unfolds all defined constants in a term 't', beta-eta        *)
(*              normalizes the result term; certain constants are not        *)
(*              unfolded (cf. 'collect_axioms' and the various interpreters  *)
(*              below): if the interpretation respects a definition anyway,  *)
(*              that definition does not need to be unfolded                 *)
(* ------------------------------------------------------------------------- *)

  (* theory -> Term.term -> Term.term *)

  (* Note: we could intertwine unfolding of constants and beta-(eta-)       *)
  (*       normalization; this would save some unfolding for terms where    *)
  (*       constants are eliminated by beta-reduction (e.g. 'K c1 c2').  On *)
  (*       the other hand, this would cause additional work for terms where *)
  (*       constants are duplicated by beta-reduction (e.g. 'S c1 c2 c3').  *)

  fun unfold_defs thy t =
  let
    (* Term.term -> Term.term *)
    fun unfold_loop t =
      case t of
      (* Pure *)
        Const ("all", _)                => t
      | Const ("==", _)                 => t
      | Const ("==>", _)                => t
      | Const ("TYPE", _)               => t  (* axiomatic type classes *)
      (* HOL *)
      | Const ("Trueprop", _)           => t
      | Const ("Not", _)                => t
      | (* redundant, since 'True' is also an IDT constructor *)
        Const ("True", _)               => t
      | (* redundant, since 'False' is also an IDT constructor *)
        Const ("False", _)              => t
      | Const ("arbitrary", _)          => t
      | Const ("The", _)                => t
      | Const ("Hilbert_Choice.Eps", _) => t
      | Const ("All", _)                => t
      | Const ("Ex", _)                 => t
      | Const ("op =", _)               => t
      | Const ("op &", _)               => t
      | Const ("op |", _)               => t
      | Const ("op -->", _)             => t
      (* sets *)
      | Const ("Collect", _)            => t
      | Const ("op :", _)               => t
      (* other optimizations *)
      | Const ("Finite_Set.card", _)    => t
      | Const ("Finite_Set.Finites", _) => t
      | Const ("Finite_Set.finite", _)  => t
      | Const ("Orderings.less", Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("bool", [])])])) => t
      | Const ("HOL.plus", Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => t
      | Const ("HOL.minus", Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => t
      | Const ("HOL.times", Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) => t
      | Const ("List.op @", _)          => t
      | Const ("Lfp.lfp", _)            => t
      | Const ("Gfp.gfp", _)            => t
      | Const ("fst", _)                => t
      | Const ("snd", _)                => t
      (* simply-typed lambda calculus *)
      | Const (s, T) =>
        (if is_IDT_constructor thy (s, T)
          orelse is_IDT_recursor thy (s, T) then
          t  (* do not unfold IDT constructors/recursors *)
        (* unfold the constant if there is a defining equation *)
        else case get_def thy (s, T) of
          SOME (axname, rhs) =>
          (* Note: if the term to be unfolded (i.e. 'Const (s, T)')  *)
          (* occurs on the right-hand side of the equation, i.e. in  *)
          (* 'rhs', we must not use this equation to unfold, because *)
          (* that would loop.  Here would be the right place to      *)
          (* check this.  However, getting this really right seems   *)
          (* difficult because the user may state arbitrary axioms,  *)
          (* which could interact with overloading to create loops.  *)
          ((*immediate_output (" unfolding: " ^ axname);*)unfold_loop rhs)
        | NONE => t)
      | Free _           => t
      | Var _            => t
      | Bound _          => t
      | Abs (s, T, body) => Abs (s, T, unfold_loop body)
      | t1 $ t2          => (unfold_loop t1) $ (unfold_loop t2)
    val result = Envir.beta_eta_contract (unfold_loop t)
  in
    result
  end;

(* ------------------------------------------------------------------------- *)
(* collect_axioms: collects (monomorphic, universally quantified, unfolded   *)
(*                 versions of) all HOL axioms that are relevant w.r.t 't'   *)
(* ------------------------------------------------------------------------- *)

  (* Note: to make the collection of axioms more easily extensible, this    *)
  (*       function could be based on user-supplied "axiom collectors",     *)
  (*       similar to 'interpret'/interpreters or 'print'/printers          *)

  (* Note: currently we use "inverse" functions to the definitional         *)
  (*       mechanisms provided by Isabelle/HOL, e.g. for "axclass",         *)
  (*       "typedef", "constdefs".  A more general approach could consider  *)
  (*       *every* axiom of the theory and collect it if it has a constant/ *)
  (*       type/typeclass in common with the term 't'.                      *)

  (* theory -> Term.term -> Term.term list *)

  (* Which axioms are "relevant" for a particular term/type goes hand in    *)
  (* hand with the interpretation of that term/type by its interpreter (see *)
  (* way below): if the interpretation respects an axiom anyway, the axiom  *)
  (* does not need to be added as a constraint here.                        *)

  (* To avoid collecting the same axiom multiple times, we use an           *)
  (* accumulator 'axs' which contains all axioms collected so far.          *)

  fun collect_axioms thy t =
  let
    val _ = immediate_output "Adding axioms..."
    (* (string * Term.term) list *)
    val axioms = Theory.all_axioms_of thy
    (* string * Term.term -> Term.term list -> Term.term list *)
    fun collect_this_axiom (axname, ax) axs =
    let
      val ax' = unfold_defs thy ax
    in
      if member (op aconv) axs ax' then
        axs
      else (
        immediate_output (" " ^ axname);
        collect_term_axioms (ax' :: axs, ax')
      )
    end
    (* Term.term list * Term.typ -> Term.term list *)
    and collect_sort_axioms (axs, T) =
    let
      (* string list *)
      val sort = (case T of
          TFree (_, sort) => sort
        | TVar (_, sort)  => sort
        | _               => raise REFUTE ("collect_axioms", "type " ^
          Sign.string_of_typ thy T ^ " is not a variable"))
      (* obtain axioms for all superclasses *)
      val superclasses = sort @ (maps (Sign.super_classes thy) sort)
      (* merely an optimization, because 'collect_this_axiom' disallows *)
      (* duplicate axioms anyway:                                       *)
      val superclasses = distinct (op =) superclasses
      val class_axioms = maps (fn class => map (fn ax =>
        ("<" ^ class ^ ">", Thm.prop_of ax))
        (#axioms (AxClass.get_definition thy class) handle ERROR _ => []))
        superclasses
      (* replace the (at most one) schematic type variable in each axiom *)
      (* by the actual type 'T'                                          *)
      val monomorphic_class_axioms = map (fn (axname, ax) =>
        (case Term.term_tvars ax of
          [] =>
          (axname, ax)
        | [(idx, S)] =>
          (axname, monomorphic_term (Vartab.make [(idx, (S, T))]) ax)
        | _ =>
          raise REFUTE ("collect_axioms", "class axiom " ^ axname ^ " (" ^
            Sign.string_of_term thy ax ^
            ") contains more than one type variable")))
        class_axioms
    in
      fold collect_this_axiom monomorphic_class_axioms axs
    end
    (* Term.term list * Term.typ -> Term.term list *)
    and collect_type_axioms (axs, T) =
      case T of
      (* simple types *)
        Type ("prop", [])      => axs
      | Type ("fun", [T1, T2]) => collect_type_axioms
        (collect_type_axioms (axs, T1), T2)
      | Type ("set", [T1])     => collect_type_axioms (axs, T1)
      (* axiomatic type classes *)
      | Type ("itself", [T1])  => collect_type_axioms (axs, T1)
      | Type (s, Ts)           =>
        (case DatatypePackage.get_datatype thy s of
          SOME info =>  (* inductive datatype *)
            (* only collect relevant type axioms for the argument types *)
            Library.foldl collect_type_axioms (axs, Ts)
        | NONE =>
          (case get_typedef thy T of
            SOME (axname, ax) =>
            collect_this_axiom (axname, ax) axs
          | NONE =>
            (* unspecified type, perhaps introduced with "typedecl" *)
            (* at least collect relevant type axioms for the argument types *)
            Library.foldl collect_type_axioms (axs, Ts)))
      (* axiomatic type classes *)
      | TFree _                => collect_sort_axioms (axs, T)
      (* axiomatic type classes *)
      | TVar _                 => collect_sort_axioms (axs, T)
    (* Term.term list * Term.term -> Term.term list *)
    and collect_term_axioms (axs, t) =
      case t of
      (* Pure *)
        Const ("all", _)                => axs
      | Const ("==", _)                 => axs
      | Const ("==>", _)                => axs
      (* axiomatic type classes *)
      | Const ("TYPE", T)               => collect_type_axioms (axs, T)
      (* HOL *)
      | Const ("Trueprop", _)           => axs
      | Const ("Not", _)                => axs
      (* redundant, since 'True' is also an IDT constructor *)
      | Const ("True", _)               => axs
      (* redundant, since 'False' is also an IDT constructor *)
      | Const ("False", _)              => axs
      | Const ("arbitrary", T)          => collect_type_axioms (axs, T)
      | Const ("The", T)                =>
        let
          val ax = specialize_type thy ("The", T)
            (lookup axioms "HOL.the_eq_trivial")
        in
          collect_this_axiom ("HOL.the_eq_trivial", ax) axs
        end
      | Const ("Hilbert_Choice.Eps", T) =>
        let
          val ax = specialize_type thy ("Hilbert_Choice.Eps", T)
            (lookup axioms "Hilbert_Choice.someI")
        in
          collect_this_axiom ("Hilbert_Choice.someI", ax) axs
        end
      | Const ("All", T)                => collect_type_axioms (axs, T)
      | Const ("Ex", T)                 => collect_type_axioms (axs, T)
      | Const ("op =", T)               => collect_type_axioms (axs, T)
      | Const ("op &", _)               => axs
      | Const ("op |", _)               => axs
      | Const ("op -->", _)             => axs
      (* sets *)
      | Const ("Collect", T)            => collect_type_axioms (axs, T)
      | Const ("op :", T)               => collect_type_axioms (axs, T)
      (* other optimizations *)
      | Const ("Finite_Set.card", T)    => collect_type_axioms (axs, T)
      | Const ("Finite_Set.Finites", T) => collect_type_axioms (axs, T)
      | Const ("Finite_Set.finite", T)  => collect_type_axioms (axs, T)
      | Const ("Orderings.less", T as Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("bool", [])])])) =>
          collect_type_axioms (axs, T)
      | Const ("HOL.plus", T as Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) =>
          collect_type_axioms (axs, T)
      | Const ("HOL.minus", T as Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) =>
          collect_type_axioms (axs, T)
      | Const ("HOL.times", T as Type ("fun", [Type ("nat", []),
        Type ("fun", [Type ("nat", []), Type ("nat", [])])])) =>
          collect_type_axioms (axs, T)
      | Const ("List.op @", T)          => collect_type_axioms (axs, T)
      | Const ("Lfp.lfp", T)            => collect_type_axioms (axs, T)
      | Const ("Gfp.gfp", T)            => collect_type_axioms (axs, T)
      | Const ("fst", T)                => collect_type_axioms (axs, T)
      | Const ("snd", T)                => collect_type_axioms (axs, T)
      (* simply-typed lambda calculus *)
      | Const (s, T)                    =>
          if is_const_of_class thy (s, T) then
            (* axiomatic type classes: add "OFCLASS(?'a::c, c_class)" *)
            (* and the class definition                               *)
            let
              val class   = Logic.class_of_const s
              val inclass = Logic.mk_inclass (TVar (("'a", 0), [class]), class)
              val ax_in   = SOME (specialize_type thy (s, T) inclass)
                (* type match may fail due to sort constraints *)
                handle Type.TYPE_MATCH => NONE
              val ax_1 = Option.map (fn ax => (Sign.string_of_term thy ax, ax))
                ax_in
              val ax_2 = Option.map (apsnd (specialize_type thy (s, T)))
                (get_classdef thy class)
            in
              collect_type_axioms (fold collect_this_axiom
                (map_filter I [ax_1, ax_2]) axs, T)
            end
          else if is_IDT_constructor thy (s, T)
            orelse is_IDT_recursor thy (s, T) then
            (* only collect relevant type axioms *)
            collect_type_axioms (axs, T)
          else
            (* other constants should have been unfolded, with some *)
            (* exceptions: e.g. Abs_xxx/Rep_xxx functions for       *)
            (* typedefs, or type-class related constants            *)
            (* only collect relevant type axioms *)
            collect_type_axioms (axs, T)
      | Free (_, T)      => collect_type_axioms (axs, T)
      | Var (_, T)       => collect_type_axioms (axs, T)
      | Bound i          => axs
      | Abs (_, T, body) => collect_term_axioms
        (collect_type_axioms (axs, T), body)
      | t1 $ t2          => collect_term_axioms
        (collect_term_axioms (axs, t1), t2)
    (* Term.term list *)
    val result = map close_form (collect_term_axioms ([], t))
    val _ = writeln " ...done."
  in
    result
  end;

(* ------------------------------------------------------------------------- *)
(* ground_types: collects all ground types in a term (including argument     *)
(*               types of other types), suppressing duplicates.  Does not    *)
(*               return function types, set types, non-recursive IDTs, or    *)
(*               'propT'.  For IDTs, also the argument types of constructors *)
(*               are considered.                                             *)
(* ------------------------------------------------------------------------- *)

  (* theory -> Term.term -> Term.typ list *)

  fun ground_types thy t =
  let
    (* Term.typ * Term.typ list -> Term.typ list *)
    fun collect_types (T, acc) =
      if T mem acc then
        acc  (* prevent infinite recursion (for IDTs) *)
      else
        (case T of
          Type ("fun", [T1, T2]) => collect_types (T1, collect_types (T2, acc))
        | Type ("prop", [])      => acc
        | Type ("set", [T1])     => collect_types (T1, acc)
        | Type (s, Ts)           =>
          (case DatatypePackage.get_datatype thy s of
            SOME info =>  (* inductive datatype *)
            let
              val index               = #index info
              val descr               = #descr info
              val (_, dtyps, constrs) = lookup descr index
              val typ_assoc           = dtyps ~~ Ts
              (* sanity check: every element in 'dtyps' must be a 'DtTFree' *)
              val _ = (if Library.exists (fn d =>
                  case d of DatatypeAux.DtTFree _ => false | _ => true) dtyps
                then
                  raise REFUTE ("ground_types", "datatype argument (for type "
                    ^ Sign.string_of_typ thy (Type (s, Ts))
                    ^ ") is not a variable")
                else
                  ())
              (* if the current type is a recursive IDT (i.e. a depth is *)
              (* required), add it to 'acc'                              *)
              val acc' = (if Library.exists (fn (_, ds) => Library.exists
                DatatypeAux.is_rec_type ds) constrs then
                  insert (op =) T acc
                else
                  acc)
              (* collect argument types *)
              val acc_args = foldr collect_types acc' Ts
              (* collect constructor types *)
              val acc_constrs = foldr collect_types acc_args (List.concat
                (map (fn (_, ds) => map (typ_of_dtyp descr typ_assoc) ds)
                  constrs))
            in
              acc_constrs
            end
          | NONE =>
            (* not an inductive datatype, e.g. defined via "typedef" or *)
            (* "typedecl"                                               *)
            insert (op =) T (foldr collect_types acc Ts))
        | TFree _                => insert (op =) T acc
        | TVar _                 => insert (op =) T acc)
  in
    it_term_types collect_types (t, [])
  end;

(* ------------------------------------------------------------------------- *)
(* string_of_typ: (rather naive) conversion from types to strings, used to   *)
(*                look up the size of a type in 'sizes'.  Parameterized      *)
(*                types with different parameters (e.g. "'a list" vs. "bool  *)
(*                list") are identified.                                     *)
(* ------------------------------------------------------------------------- *)

  (* Term.typ -> string *)

  fun string_of_typ (Type (s, _))     = s
    | string_of_typ (TFree (s, _))    = s
    | string_of_typ (TVar ((s,_), _)) = s;

(* ------------------------------------------------------------------------- *)
(* first_universe: returns the "first" (i.e. smallest) universe by assigning *)
(*                 'minsize' to every type for which no size is specified in *)
(*                 'sizes'                                                   *)
(* ------------------------------------------------------------------------- *)

  (* Term.typ list -> (string * int) list -> int -> (Term.typ * int) list *)

  fun first_universe xs sizes minsize =
  let
    fun size_of_typ T =
      case AList.lookup (op =) sizes (string_of_typ T) of
        SOME n => n
      | NONE   => minsize
  in
    map (fn T => (T, size_of_typ T)) xs
  end;

(* ------------------------------------------------------------------------- *)
(* next_universe: enumerates all universes (i.e. assignments of sizes to     *)
(*                types), where the minimal size of a type is given by       *)
(*                'minsize', the maximal size is given by 'maxsize', and a   *)
(*                type may have a fixed size given in 'sizes'                *)
(* ------------------------------------------------------------------------- *)

  (* (Term.typ * int) list -> (string * int) list -> int -> int ->
    (Term.typ * int) list option *)

  fun next_universe xs sizes minsize maxsize =
  let
    (* creates the "first" list of length 'len', where the sum of all list *)
    (* elements is 'sum', and the length of the list is 'len'              *)
    (* int -> int -> int -> int list option *)
    fun make_first _ 0 sum =
      if sum=0 then
        SOME []
      else
        NONE
      | make_first max len sum =
      if sum<=max orelse max<0 then
        Option.map (fn xs' => sum :: xs') (make_first max (len-1) 0)
      else
        Option.map (fn xs' => max :: xs') (make_first max (len-1) (sum-max))
    (* enumerates all int lists with a fixed length, where 0<=x<='max' for *)
    (* all list elements x (unless 'max'<0)                                *)
    (* int -> int -> int -> int list -> int list option *)
    fun next max len sum [] =
      NONE
      | next max len sum [x] =
      (* we've reached the last list element, so there's no shift possible *)
      make_first max (len+1) (sum+x+1)  (* increment 'sum' by 1 *)
      | next max len sum (x1::x2::xs) =
      if x1>0 andalso (x2<max orelse max<0) then
        (* we can shift *)
        SOME (valOf (make_first max (len+1) (sum+x1-1)) @ (x2+1) :: xs)
      else
        (* continue search *)
        next max (len+1) (sum+x1) (x2::xs)
    (* only consider those types for which the size is not fixed *)
    val mutables = List.filter
      (not o (AList.defined (op =) sizes) o string_of_typ o fst) xs
    (* subtract 'minsize' from every size (will be added again at the end) *)
    val diffs = map (fn (_, n) => n-minsize) mutables
  in
    case next (maxsize-minsize) 0 0 diffs of
      SOME diffs' =>
      (* merge with those types for which the size is fixed *)
      SOME (snd (foldl_map (fn (ds, (T, _)) =>
        case AList.lookup (op =) sizes (string_of_typ T) of
        (* return the fixed size *)
          SOME n => (ds, (T, n))
        (* consume the head of 'ds', add 'minsize' *)
        | NONE   => (tl ds, (T, minsize + hd ds)))
        (diffs', xs)))
    | NONE =>
      NONE
  end;

(* ------------------------------------------------------------------------- *)
(* toTrue: converts the interpretation of a Boolean value to a propositional *)
(*         formula that is true iff the interpretation denotes "true"        *)
(* ------------------------------------------------------------------------- *)

  (* interpretation -> prop_formula *)

  fun toTrue (Leaf [fm, _]) =
    fm
    | toTrue _              =
    raise REFUTE ("toTrue", "interpretation does not denote a Boolean value");

(* ------------------------------------------------------------------------- *)
(* toFalse: converts the interpretation of a Boolean value to a              *)
(*          propositional formula that is true iff the interpretation        *)
(*          denotes "false"                                                  *)
(* ------------------------------------------------------------------------- *)

  (* interpretation -> prop_formula *)

  fun toFalse (Leaf [_, fm]) =
    fm
    | toFalse _              =
    raise REFUTE ("toFalse", "interpretation does not denote a Boolean value");

(* ------------------------------------------------------------------------- *)
(* find_model: repeatedly calls 'interpret' with appropriate parameters,     *)
(*             applies a SAT solver, and (in case a model is found) displays *)
(*             the model to the user by calling 'print_model'                *)
(* thy       : the current theory                                            *)
(* {...}     : parameters that control the translation/model generation      *)
(* t         : term to be translated into a propositional formula            *)
(* negate    : if true, find a model that makes 't' false (rather than true) *)
(* ------------------------------------------------------------------------- *)

  (* theory -> params -> Term.term -> bool -> unit *)

  fun find_model thy {sizes, minsize, maxsize, maxvars, maxtime, satsolver} t
    negate =
  let
    (* unit -> unit *)
    fun wrapper () =
    let
      val u      = unfold_defs thy t
      val _      = writeln ("Unfolded term: " ^ Sign.string_of_term thy u)
      val axioms = collect_axioms thy u
      (* Term.typ list *)
      val types = Library.foldl (fn (acc, t') =>
        acc union (ground_types thy t')) ([], u :: axioms)
      val _     = writeln ("Ground types: "
        ^ (if null types then "none."
           else commas (map (Sign.string_of_typ thy) types)))
      (* we can only consider fragments of recursive IDTs, so we issue a  *)
      (* warning if the formula contains a recursive IDT                  *)
      (* TODO: no warning needed for /positive/ occurrences of IDTs       *)
      val _ = if Library.exists (fn
          Type (s, _) =>
          (case DatatypePackage.get_datatype thy s of
            SOME info =>  (* inductive datatype *)
            let
              val index           = #index info
              val descr           = #descr info
              val (_, _, constrs) = lookup descr index
            in
              (* recursive datatype? *)
              Library.exists (fn (_, ds) =>
                Library.exists DatatypeAux.is_rec_type ds) constrs
            end
          | NONE => false)
        | _ => false) types then
          warning ("Term contains a recursive datatype; "
            ^ "countermodel(s) may be spurious!")
        else
          ()
      (* (Term.typ * int) list -> unit *)
      fun find_model_loop universe =
      let
        val init_model = (universe, [])
        val init_args  = {maxvars = maxvars, def_eq = false, next_idx = 1,
          bounds = [], wellformed = True}
        val _          = immediate_output ("Translating term (sizes: "
          ^ commas (map (fn (_, n) => string_of_int n) universe) ^ ") ...")
        (* translate 'u' and all axioms *)
        val ((model, args), intrs) = foldl_map (fn ((m, a), t') =>
          let
            val (i, m', a') = interpret thy m a t'
          in
            (* set 'def_eq' to 'true' *)
            ((m', {maxvars = #maxvars a', def_eq = true,
              next_idx = #next_idx a', bounds = #bounds a',
              wellformed = #wellformed a'}), i)
          end) ((init_model, init_args), u :: axioms)
        (* make 'u' either true or false, and make all axioms true, and *)
        (* add the well-formedness side condition                       *)
        val fm_u  = (if negate then toFalse else toTrue) (hd intrs)
        val fm_ax = PropLogic.all (map toTrue (tl intrs))
        val fm    = PropLogic.all [#wellformed args, fm_ax, fm_u]
      in
        immediate_output " invoking SAT solver...";
        (case SatSolver.invoke_solver satsolver fm of
          SatSolver.SATISFIABLE assignment =>
          (writeln " model found!";
          writeln ("*** Model found: ***\n" ^ print_model thy model
            (fn i => case assignment i of SOME b => b | NONE => true)))
        | SatSolver.UNSATISFIABLE _ =>
          (immediate_output " no model exists.\n";
          case next_universe universe sizes minsize maxsize of
            SOME universe' => find_model_loop universe'
          | NONE           => writeln
            "Search terminated, no larger universe within the given limits.")
        | SatSolver.UNKNOWN =>
          (immediate_output " no model found.\n";
          case next_universe universe sizes minsize maxsize of
            SOME universe' => find_model_loop universe'