theorem
  'not' (x <=> y) = x 'xor' y;
