\documentstyle[makeidx]{article}
\makeindex
%\setlength{\oddsidemargin}{.5in}
%\setlength{\evensidemargin}{.5in}
%\setlength{\textwidth}{5.8in}
\begin{document}
%\setlength{\parindent}{0pt}
%\newcounter{bean}
%\begin{list}{\arabic{bean}.}{\usecounter{bean}\setlength{\leftmargin}{0pt}\setlength{\rightmargin}{0pt}\setlength{\listparindent}{20pt}\setlength{\parsep}{5pt}}
%\item[]

\begin{verbatim}#|

 Copyright (C) 1994 by Yuan Yu.  All Rights Reserved.

 This script is hereby placed in the public domain, and therefore unlimited
 editing and redistribution is permitted.

 NO WARRANTY

 Yuan Yu PROVIDES ABSOLUTELY NO WARRANTY.  THE EVENT SCRIPT IS PROVIDED "AS IS"
 WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT
 LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
 PARTICULAR PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
 SCRIPT IS WITH YOU.  SHOULD THE SCRIPT PROVE DEFECTIVE, YOU ASSUME THE COST OF
 ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

 IN NO EVENT WILL Yuan Yu BE LIABLE TO YOU FOR ANY DAMAGES, ANY LOST PROFITS,
 LOST MONIES, OR OTHER SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT
 OF THE USE OR INABILITY TO USE THIS SCRIPT (INCLUDING BUT NOT LIMITED TO LOSS
 OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY THIRD
 PARTIES), EVEN IF YOU HAVE ADVISED US OF THE POSSIBILITY OF SUCH DAMAGES, OR
 FOR ANY CLAIM BY ANY OTHER PARTY.

|#

; ---------------------------------------------------------------------------
; Date:      Jan, 1991
; Modified:  Sep 4, 1992.
; File:      mc20-2.events
; ---------------------------------------------------------------------------
;
;-------------------------------------------------------------------------
;                       PROVING PHASE
;
; we establish basic theory for program proving based upon our MC68020 
; specification.
;-------------------------------------------------------------------------
;
; load and compile the spec.
\end{verbatim}
\noindent{\sc Event}:   Start with the library {\tt{"mc20-1"}} using the compiled version.

\addvspace{18pt}

\noindent{\sc Event}:   For efficiency, compile those definitions not yet compiled.

\addvspace{18pt}

\begin{verbatim}; a segment of the memory is ROM, iff it is pc-readable(read-only).
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{rom-addrp}$\;\;$
{\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp} $=$ {\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}
\end{tabbing}

\begin{verbatim}; a segment of the memory is RAM, iff it is writable(random).
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{ram-addrp}$\;\;$
{\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp} $=$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp}
\end{tabbing}

\begin{verbatim}; x is an element of lst wrt numberp.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{n-member} \\  
\=\+{\rm{n-member}}\,({\it{x\/}}, {\it{lst\/}})\index{n-member} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\rm{car}}\,({\it{lst\/}}))) $\vee$ {\rm{n-member}}\,({\it{x\/}}, {\rm{cdr}}\,({\it{lst\/}}))\index{n-member}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; mod-eq returns t iff x and y are the "same" bit-vector.  It is often 
; used as an induction hint to many lemmas.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mod-eq} \\  
\=\+{\rm{mod-eq}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{mod-eq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }({\rm{bcar}}\,({\it{x\/}})\index{bcar} $=$ {\rm{bcar}}\,({\it{y\/}})\index{bcar}) $\wedge$ {\rm{mod-eq}}\,({\it{n\/}} $-\;1$, {\rm{bcdr}}\,({\it{x\/}})\index{bcdr}, {\rm{bcdr}}\,({\it{y\/}})\index{bcdr})\index{mod-eq}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; mod32-eq is equivalent to mod-eq with n = 32. But we define it as follows.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mod32-eq}$\;\;$
{\rm{mod32-eq}}\,({\it{x\/}}, {\it{y\/}})\index{mod32-eq} $=$ ({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head} $=$ {\rm{head}}\,({\it{y\/}}, {\tt{32}})\index{head})
\end{tabbing}

\begin{verbatim}; the equivalence is given by this lemma.
; (prove-lemma mod-eq-lemma (rewrite)
;      (equal (mod-eq 32 x y)
;             (mod32-eq x y)))

; the negation of a bit-vector.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{neg}$\;\;$
{\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg} $=$ {\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{sub}
\end{tabbing}

\begin{verbatim}; {x, x+1, ..., x+(m-1)} and {y} are disjoint.  We assume all the numbers are
; modulo 2^32.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{disjoint0} \\  
\=\+{\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}})\index{disjoint0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{m\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }\=\+($\neg$ {\rm{mod32-eq}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{m\/}} $-\;1$)\index{add}, {\it{y\/}})\index{mod32-eq}) \\ 
$\wedge$$\;\;\;\;${\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}} $-\;1$, {\it{y\/}})\index{disjoint0}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; {x, x+1, ..., x+(m-1)} and {y, y+1, ..., y+(n-1)} are disjoint.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{disjoint} \\  
\=\+{\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{y\/}}, {\it{n\/}} $-\;1$)\index{add})\index{disjoint0} $\wedge$ {\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}} $-\;1$)\index{disjoint}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};                 BIT VECTOR AS LIST OF BIT
; A lower level layer.  This is part of my old spec that specifies the 
; microprocessor at a relatively lower level. 
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{bit} \\  
\=\+{\rm{bit}}\,({\it{bv\/}})\index{bit} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\sc{b0}}\index{b0} \\ 
{\bf elseif }{\rm{b0p}}\,({\rm{car}}\,({\it{bv\/}}))\index{b0p}$\;\;${\bf then }{\sc{b0}}\index{b0} \\ 
{\bf else }{\sc{b1}}\index{b1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{vec} \\  
\=\+{\rm{vec}}\,({\it{bv\/}})\index{vec} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cdr}}\,({\it{bv\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{fix-bv} \\  
\=\+{\rm{fix-bv}}\,({\it{bv\/}})\index{fix-bv} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\rm{bit}}\,({\it{bv\/}})\index{bit}, {\rm{fix-bv}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec})\index{fix-bv})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-len} \\  
\=\+{\rm{bv-len}}\,({\it{bv\/}})\index{bv-len} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }$1\;+$ {\rm{bv-len}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec})\index{bv-len}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-not} \\  
\=\+{\rm{bv-not}}\,({\it{bv\/}})\index{bv-not} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\rm{b-not}}\,({\rm{bit}}\,({\it{bv\/}})\index{bit})\index{b-not}, {\rm{bv-not}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec})\index{bv-not})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-head} \\  
\=\+{\rm{bv-head}}\,({\it{bv\/}}, {\it{n\/}})\index{bv-head} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\rm{bit}}\,({\it{bv\/}})\index{bit}, {\rm{bv-head}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec}, {\it{n\/}} $-\;1$)\index{bv-head})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-tail} \\  
\=\+{\rm{bv-tail}}\,({\it{bv\/}}, {\it{n\/}})\index{bv-tail} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{fix-bv}}\,({\it{bv\/}})\index{fix-bv} \\ 
{\bf else }{\rm{bv-tail}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec}, {\it{n\/}} $-\;1$)\index{bv-tail}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-bitn} \\  
\=\+{\rm{bv-bitn}}\,({\it{bv\/}}, {\it{n\/}})\index{bv-bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{bit}}\,({\it{bv\/}})\index{bit} \\ 
{\bf else }{\rm{bv-bitn}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec}, {\it{n\/}} $-\;1$)\index{bv-bitn}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-mbit} \\  
\=\+{\rm{bv-mbit}}\,({\it{bv\/}})\index{bv-mbit} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\sc{b0}}\index{b0} \\ 
{\bf elseif }{\rm{vec}}\,({\it{bv\/}})\index{vec} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\rm{bit}}\,({\it{bv\/}})\index{bit} \\ 
{\bf else }{\rm{bv-mbit}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec})\index{bv-mbit}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-adder} \\  
\=\+{\rm{bv-adder}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,(\=\+{\rm{b-eor}}\,({\rm{b-eor}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\rm{bit}}\,({\it{y\/}})\index{bit})\index{b-eor}, {\it{c\/}})\index{b-eor}, \\ 
{\rm{bv-adder}}\,(\=\+{\rm{b-or}}\,(\=\+{\rm{b-and}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\rm{bit}}\,({\it{y\/}})\index{bit})\index{b-and}, \\ 
{\rm{b-or}}\,({\rm{b-and}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\it{c\/}})\index{b-and}, {\rm{b-and}}\,({\rm{bit}}\,({\it{y\/}})\index{bit}, {\it{c\/}})\index{b-and})\index{b-or})\-\index{b-or}, \\ 
{\rm{vec}}\,({\it{x\/}})\index{vec}, \\ 
{\rm{vec}}\,({\it{y\/}})\index{vec})\-\index{bv-adder})\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; conversion functions.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{bv-to-nat} \\  
\=\+{\rm{bv-to-nat}}\,({\it{bv\/}})\index{bv-to-nat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{bv\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{bit}}\,({\it{bv\/}})\index{bit} $+$ ({\tt{2}} $*$ {\rm{bv-to-nat}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec})\index{bv-to-nat})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-sized-to-nat} \\  
\=\+{\rm{bv-sized-to-nat}}\,({\it{bv\/}}, {\it{size\/}})\index{bv-sized-to-nat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{size\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{bit}}\,({\it{bv\/}})\index{bit} $+$ ({\tt{2}} $*$ {\rm{bv-sized-to-nat}}\,({\rm{vec}}\,({\it{bv\/}})\index{vec}, {\it{size\/}} $-\;1$)\index{bv-sized-to-nat})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{nat-to-bv} \\  
\=\+{\rm{nat-to-bv}}\,({\it{n\/}})\index{nat-to-bv} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\it{n\/}} ${}${\bf{mod}}${}$ {\tt{2}}, {\rm{nat-to-bv}}\,({\it{n\/}} $\div$ {\tt{2}})\index{nat-to-bv})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{nat-to-bv-sized} \\  
\=\+{\rm{nat-to-bv-sized}}\,({\it{n\/}}, {\it{size\/}})\index{nat-to-bv-sized} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{size\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\it{n\/}} ${}${\bf{mod}}${}$ {\tt{2}}, {\rm{nat-to-bv-sized}}\,({\it{n\/}} $\div$ {\tt{2}}, {\it{size\/}} $-\;1$)\index{nat-to-bv-sized})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};               LISTP 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-len-listp \\ \index{bv-len-listp}
({\rm{bv-len}}\,({\it{x\/}})\index{bv-len} $=$ {\tt{0}}) $=$ ({\it{x\/}} $\simeq\;${{\bf{nil}}}${}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-head-listp \\ \index{bv-head-listp}
{\rm{listp}}\,({\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head}) $=$ ({\it{n\/}} $\not\simeq {\tt{0}}$)
\end{tabbing}     

\begin{tabbing}{\sc Theorem}:  bv-adder-listp \\ \index{bv-adder-listp}
{\rm{listp}}\,({\rm{bv-adder}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder}) $=$ {\rm{listp}}\,({\it{x\/}})
\end{tabbing}

\begin{verbatim};               BV-LEN
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-head-len \\ \index{bv-head-len}
{\rm{bv-len}}\,({\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head})\index{bv-len} $=$ {\rm{fix}}\,({\it{n\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-bv-sized-len \\ \index{nat-to-bv-sized-len}
{\rm{bv-len}}\,({\rm{nat-to-bv-sized}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-bv-sized})\index{bv-len} $=$ {\rm{fix}}\,({\it{n\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-adder-len \\ \index{bv-adder-len}
{\rm{bv-len}}\,({\rm{bv-adder}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder})\index{bv-len} $=$ {\rm{bv-len}}\,({\it{x\/}})\index{bv-len}
\end{tabbing}

\begin{verbatim};                 CONVERSION THEOREMS
; nat-to-bv-sized only considers the first k binary digits of natural number n.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-bv-sized-la0 \\ \index{nat-to-bv-sized-la0}
{\rm{nat-to-bv-sized}}\,({\it{n\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{k\/}})\index{exp}, {\it{k\/}})\index{nat-to-bv-sized} $=$ {\rm{nat-to-bv-sized}}\,({\it{n\/}}, {\it{k\/}})\index{nat-to-bv-sized}
\end{tabbing}

\begin{verbatim}; rewrite nat-to-bv-sized into nat-to-bv.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-bv-sized-head \\ \index{nat-to-bv-sized-head}
{\rm{nat-to-bv-sized}}\,({\it{m\/}}, {\it{n\/}})\index{nat-to-bv-sized} $=$ {\rm{bv-head}}\,({\rm{nat-to-bv}}\,({\it{m\/}})\index{nat-to-bv}, {\it{n\/}})\index{bv-head}
\end{tabbing}

\begin{verbatim}; rewrite bv-sized-to-nat into bv-to-nat.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-sized-to-nat-head \\ \index{bv-sized-to-nat-head}
{\rm{bv-sized-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{bv-sized-to-nat} $=$ {\rm{bv-to-nat}}\,({\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head})\index{bv-to-nat}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-to-nat-to-bv \\ \index{bv-to-nat-to-bv}
{\rm{bv-head}}\,({\rm{nat-to-bv}}\,({\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat})\index{nat-to-bv}, {\it{n\/}})\index{bv-head} $=$ {\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-bv-to-nat \\ \index{nat-to-bv-to-nat}
{\rm{bv-to-nat}}\,({\rm{nat-to-bv}}\,({\it{n\/}})\index{nat-to-bv})\index{bv-to-nat} $=$ {\rm{fix}}\,({\it{n\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-head-nat \\ \index{bv-head-nat}
\=\+{\rm{bv-to-nat}}\,({\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head})\index{bv-to-nat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat} \\ 
{\bf else }{\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-to-nat-to-bv-sized \\ \index{bv-to-nat-to-bv-sized}
{\rm{nat-to-bv-sized}}\,({\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat}, {\it{n\/}})\index{nat-to-bv-sized} $=$ {\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-bv-sized-to-nat \\ \index{nat-to-bv-sized-to-nat}
\=\+{\rm{bv-to-nat}}\,({\rm{nat-to-bv-sized}}\,({\it{m\/}}, {\it{n\/}})\index{nat-to-bv-sized})\index{bv-to-nat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{m\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\rm{fix}}\,({\it{m\/}}) \\ 
{\bf else }{\it{m\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-sized-to-nat-to-bv-sized \\ \index{bv-sized-to-nat-to-bv-sized}
{\rm{nat-to-bv-sized}}\,({\rm{bv-sized-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{bv-sized-to-nat}, {\it{n\/}})\index{nat-to-bv-sized} $=$ {\rm{bv-head}}\,({\it{x\/}}, {\it{n\/}})\index{bv-head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-bv-sized-sized-to-nat \\ \index{nat-to-bv-sized-sized-to-nat}
\=\+{\rm{bv-sized-to-nat}}\,({\rm{nat-to-bv-sized}}\,({\it{m\/}}, {\it{n\/}})\index{nat-to-bv-sized}, {\it{n\/}})\index{bv-sized-to-nat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{m\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\rm{fix}}\,({\it{m\/}}) \\ 
{\bf else }{\it{m\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable bv-sized-to-nat-head.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nat-to-bv-sized-head.

\addvspace{18pt}

\begin{verbatim};            BV-BITN and BV-NOT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-bitn-not \\ \index{bv-bitn-not}
\=\+{\rm{bv-bitn}}\,({\rm{bv-not}}\,({\it{x\/}})\index{bv-not}, {\it{i\/}})\index{bv-bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\rm{bv-len}}\,({\it{x\/}})\index{bv-len}$\;\;${\bf then }{\rm{b-not}}\,({\rm{bv-bitn}}\,({\it{x\/}}, {\it{i\/}})\index{bv-bitn})\index{b-not} \\ 
{\bf else }{\sc{b0}}\index{b0}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-to-nat-rangep \\ \index{bv-to-nat-rangep}
{\rm{nat-rangep}}\,({\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat}, {\rm{bv-len}}\,({\it{x\/}})\index{bv-len})\index{nat-rangep}
\end{tabbing}

\begin{verbatim};            BV-ADDER
; a bridge function.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{bv-adder\&carry} \\  
\=\+{\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\rm{cons}}\,({\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit}, {\bf{nil}}) \\ 
{\bf else }{\rm{cons}}\,(\=\+{\rm{b-eor}}\,({\it{c\/}}, {\rm{b-eor}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\rm{bit}}\,({\it{y\/}})\index{bit})\index{b-eor})\index{b-eor}, \\ 
{\rm{bv-adder\&carry}}\,(\=\+{\rm{b-or}}\,(\=\+{\rm{b-and}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\rm{bit}}\,({\it{y\/}})\index{bit})\index{b-and}, \\ 
{\rm{b-or}}\,(\=\+{\rm{b-and}}\,({\rm{bit}}\,({\it{x\/}})\index{bit}, {\it{c\/}})\index{b-and}, \\ 
{\rm{b-and}}\,({\rm{bit}}\,({\it{y\/}})\index{bit}, {\it{c\/}})\index{b-and})\-\index{b-or})\-\index{b-or}, \\ 
{\rm{vec}}\,({\it{x\/}})\index{vec}, \\ 
{\rm{vec}}\,({\it{y\/}})\index{vec})\-\index{bv-adder\&carry})\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-adder\&carry-len \\ \index{bv-adder\&carry-len}
{\rm{bv-len}}\,({\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry})\index{bv-len} $=$ ($1\;+$ {\rm{bv-len}}\,({\it{x\/}})\index{bv-len})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  fix-bv-adder\&carry \\ \index{fix-bv-adder\&carry}
{\rm{fix-bv}}\,({\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry})\index{fix-bv} $=$ {\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry}
\end{tabbing}

\begin{verbatim}; the relation between bv-adder&carry and bv-adder.  We have successfully 
; constructed the bridge!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-adder-bridge \\ \index{bv-adder-bridge}
{\rm{bv-adder}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder} $=$ {\rm{bv-head}}\,({\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry}, {\rm{bv-len}}\,({\it{x\/}})\index{bv-len})\index{bv-head}
\end{tabbing}

\begin{verbatim};                  lifting lemmas
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bv-not-lognot \\ \index{bv-not-lognot}
{\rm{bv-to-nat}}\,({\rm{bv-not}}\,({\it{x\/}})\index{bv-not})\index{bv-to-nat} $=$ {\rm{lognot}}\,({\rm{bv-len}}\,({\it{x\/}})\index{bv-len}, {\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat})\index{lognot}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-bitn-bitn \\ \index{bv-bitn-bitn}
{\rm{bv-bitn}}\,({\it{x\/}}, {\it{n\/}})\index{bv-bitn} $=$ {\rm{bitn}}\,({\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat}, {\it{n\/}})\index{bitn}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-mbit-bitn \\ \index{bv-mbit-bitn}
\=\+{\rm{bv-mbit}}\,({\it{x\/}})\index{bv-mbit} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{bv-len}}\,({\it{x\/}})\index{bv-len} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{bitn}}\,({\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat}, {\rm{bv-len}}\,({\it{x\/}})\index{bv-len} $-\;1$)\index{bitn}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-adder\&carry-nat \\ \index{bv-adder\&carry-nat}
\=\+({\rm{bv-len}}\,({\it{x\/}})\index{bv-len} $=$ {\rm{bv-len}}\,({\it{y\/}})\index{bv-len}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bv-to-nat}}\,({\rm{bv-adder\&carry}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder\&carry})\index{bv-to-nat} \\ 
$=$$\;\;\;\;$({\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit} $+$ {\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat} $+$ {\rm{bv-to-nat}}\,({\it{y\/}})\index{bv-to-nat}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-adder-nat \\ \index{bv-adder-nat}
\=\+(({\rm{bv-len}}\,({\it{x\/}})\index{bv-len} $=$ {\rm{bv-len}}\,({\it{y\/}})\index{bv-len}) $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bv-to-nat}}\,({\rm{bv-adder}}\,({\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{bv-adder})\index{bv-to-nat} \\ 
$=$$\;\;\;\;${\rm{adder}}\,({\rm{bv-len}}\,({\it{x\/}})\index{bv-len}, {\it{c\/}}, {\rm{bv-to-nat}}\,({\it{x\/}})\index{bv-to-nat}, {\rm{bv-to-nat}}\,({\it{y\/}})\index{bv-to-nat})\index{adder})\-\-
\end{tabbing}

\begin{verbatim};                    EVENP
; add-evenp states that the sum of two even numbers is still even.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-evenp \\ \index{add-evenp}
({\rm{evenp}}\,({\it{x\/}})\index{evenp} $\wedge$ {\rm{evenp}}\,({\it{y\/}})\index{evenp}) $\rightarrow$ {\rm{evenp}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{evenp}
\end{tabbing}


\noindent{\sc Event}:   Disable evenp.

\addvspace{18pt}

\begin{verbatim};                     LOGNOT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lognot-0 \\ \index{lognot-0}
\=\+({\it{x\/}} $\not\in\;${\bf{N}}${}$) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{lognot}}\,({\it{x\/}}, {\it{y\/}})\index{lognot} $=$ {\rm{lognot}}\,({\tt{0}}, {\it{y\/}})\index{lognot}) $\wedge$ ({\rm{lognot}}\,({\it{y\/}}, {\it{x\/}})\index{lognot} $=$ {\rm{lognot}}\,({\it{y\/}}, {\tt{0}})\index{lognot}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lognot-nat-rangep \\ \index{lognot-nat-rangep}
{\rm{nat-rangep}}\,({\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lognot-lognot \\ \index{lognot-lognot}
{\rm{lognot}}\,({\it{n\/}}, {\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot})\index{lognot} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lognot-cancel \\ \index{lognot-cancel}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot} $=$ {\rm{lognot}}\,({\it{n\/}}, {\it{y\/}})\index{lognot}) $=$ ({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}})))\-
\end{tabbing}

\begin{verbatim}; the integer interpretation of lognot.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lognot-int \\ \index{lognot-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-int}}\,({\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{iplus}}\,({\tt{-1}}, {\rm{ineg}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{ineg})\index{iplus})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-lognot \\ \index{adder-lognot}
\=\+{\rm{bitp}}\,({\it{c\/}})\index{bitp} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{lognot}}\,({\it{n\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder})\index{lognot} \\ 
$=$$\;\;\;\;${\rm{adder}}\,({\it{n\/}}, {\rm{b-not}}\,({\it{c\/}})\index{b-not}, {\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot}, {\rm{lognot}}\,({\it{n\/}}, {\it{y\/}})\index{lognot})\index{adder})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable lognot.

\addvspace{18pt}

\begin{verbatim};               BASICS ABOUT HEAD & TAIL
\end{verbatim}\begin{tabbing}{\sc Theorem}:  head-0 \\ \index{head-0}
{\rm{head}}\,({\tt{0}}, {\it{n\/}})\index{head} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-0 \\ \index{tail-0}
{\rm{tail}}\,({\tt{0}}, {\it{n\/}})\index{tail} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-of-0 \\ \index{head-of-0}
{\rm{head}}\,({\it{x\/}}, {\tt{0}})\index{head} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-of-0 \\ \index{tail-of-0}
{\rm{tail}}\,({\it{x\/}}, {\tt{0}})\index{tail} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-lessp \\ \index{head-lessp}
{\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-lessp \\ \index{tail-lessp}
({\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail} $<$ {\it{y\/}}) $=$ ({\it{x\/}} $<$ ({\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $*$ {\it{y\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-leq \\ \index{head-leq}
{\it{x\/}} $\not<$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-leq \\ \index{tail-leq}
{\it{x\/}} $\not<$ {\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-equal-0 \\ \index{tail-equal-0}
({\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail} $=$ {\tt{0}}) $=$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-lemma \\ \index{head-lemma}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-lemma \\ \index{tail-lemma}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-0 \\ \index{replace-0}
\=\+({\rm{replace}}\,({\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{replace} $=$ {\rm{fix}}\,({\it{y\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{replace} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{replace} $=$ {\rm{fix}}\,({\it{x\/}})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  app-0 \\ \index{app-0}
\=\+({\rm{app}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{app} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}) \\ 
$\wedge$$\;\;\;\;$({\rm{app}}\,({\it{n\/}}, {\tt{0}}, {\it{y\/}})\index{app} $=$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})) \\ 
$\wedge$$\;\;\;\;$({\rm{app}}\,({\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{app} $=$ {\rm{fix}}\,({\it{y\/}}))\-
\end{tabbing}

\begin{verbatim};                THEOREMS ABOUT SHIFT AND ROTATE
; the key events are LSL-UINT, LSR-UINT, ASL-INT, and ASR-INT.
; ASL-INT and ASR-INT are pretty hard.  It took me a few days to get the
; proofs.  It would be a good challenge to other provers.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lsl-uint \\ \index{lsl-uint}
\=\+{\rm{uint-rangep}}\,({\it{x\/}}, {\it{n\/}} $-$ {\it{cnt\/}})\index{uint-rangep} \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{lsl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-uint \\ \index{lsr-uint}
{\rm{nat-to-uint}}\,({\rm{lsr}}\,({\it{x\/}}, {\it{cnt\/}})\index{lsr})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp})
\end{tabbing}

\begin{verbatim}; two lemmas for asl-int.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  remainder-diff-la \\ \index{remainder-diff-la}
\=\+((({\it{x\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}}) $\wedge$ ({\it{y\/}} $<$ {\it{z\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $-$ {\it{y\/}}) ${}${\bf{mod}}${}$ {\it{z\/}}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $\leq$ {\it{y\/}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf elseif }{\it{y\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\it{z\/}} $-$ {\it{y\/}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-int-crock1 \\ \index{asl-int-crock1}
\=\+({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, ({\it{n\/}} $-$ {\it{s\/}}) $-\;1$)\index{exp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{head}}\,({\it{x\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp}, {\it{n\/}})\index{head} $=$ ({\it{x\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-int-crock2 \\ \index{asl-int-crock2}
\=\+((({\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp} $*$ ({\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-$ {\it{x\/}})) $\leq$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{head}}\,({\it{x\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp}, {\it{n\/}})\index{head} \\ 
$=$$\;\;\;\;$({\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-$ ({\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp} $*$ ({\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-$ {\it{x\/}}))))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-int \\ \index{asl-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{int-rangep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}} $-$ {\it{s\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-int}}\,({\rm{asl}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}})\index{asl}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{s\/}})\index{exp})\index{itimes})\-
\end{tabbing}


\noindent{\sc Event}:   Disable asl-int-crock1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl-int-crock2.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  quotient-diff-la \\ \index{quotient-diff-la}
\=\+((({\it{x\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}}) $\wedge$ ({\it{y\/}} $<$ {\it{z\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $-$ {\it{y\/}}) $\div$ {\it{z\/}}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{x\/}} $\div$ {\it{z\/}} \\ 
{\bf else }({\it{x\/}} $\div$ {\it{z\/}}) $-\;1$$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-diff \\ \index{remainder-diff}
\=\+(({\it{x\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $-$ {\it{y\/}}) ${}${\bf{mod}}${}$ {\it{z\/}}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{x\/}} $\leq$ {\it{y\/}}) $\vee$ (({\it{y\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}})$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\it{z\/}} $-$ ({\it{y\/}} ${}${\bf{mod}}${}$ {\it{z\/}})$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-diff \\ \index{quotient-diff}
\=\+(({\it{x\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $-$ {\it{y\/}}) $\div$ {\it{z\/}}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{y\/}} ${}${\bf{mod}}${}$ {\it{z\/}}) $=$ {\tt{0}}$\;\;${\bf then }({\it{x\/}} $\div$ {\it{z\/}}) $-$ ({\it{y\/}} $\div$ {\it{z\/}}) \\ 
{\bf else }(({\it{x\/}} $\div$ {\it{z\/}}) $-$ ({\it{y\/}} $\div$ {\it{z\/}})) $-\;1$$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-exp-lessp \\ \index{quotient-exp-lessp}
\=\+({\it{cnt\/}} $\leq$ {\it{n\/}}) \\ 
$\rightarrow$$\;\;\;\;$((({\it{x\/}} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-$ {\it{cnt\/}})\index{exp}) $=$ ({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-times-exp-1s \\ \index{lessp-times-exp-1s}
\=\+(({\it{m\/}} $+$ {\it{n\/}}) $=$ {\rm{fix}}\,({\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $+$ ({\rm{exp}}\,({\tt{2}}, {\it{m\/}})\index{exp} $*$ ({\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-\;1$))) $<$ {\rm{exp}}\,({\tt{2}}, {\it{k\/}} $-\;1$)\index{exp}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, ({\it{m\/}} $+$ {\it{n\/}}) $-\;1$)\index{exp} \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-app-1s \\ \index{lessp-app-1s}
\=\+(({\it{m\/}} $+$ {\it{n\/}}) $=$ {\rm{fix}}\,({\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{app}}\,({\it{m\/}}, {\it{x\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-\;1$)\index{app} $<$ {\rm{exp}}\,({\tt{2}}, {\it{k\/}} $-\;1$)\index{exp}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head} $<$ {\rm{exp}}\,({\tt{2}}, ({\it{m\/}} $+$ {\it{n\/}}) $-\;1$)\index{exp} \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  times-sub1 \\ \index{times-sub1}
(({\it{y\/}} $-\;1$) $*$ {\it{x\/}}) $=$ (({\it{x\/}} $*$ {\it{y\/}}) $-$ {\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-app-1s \\ \index{difference-app-1s}
\=\+(({\it{m\/}} $+$ {\it{n\/}}) $=$ {\rm{fix}}\,({\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{exp}}\,({\tt{2}}, {\it{k\/}})\index{exp} $-$ {\rm{app}}\,({\it{m\/}}, {\it{x\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} $-\;1$)\index{app}) $=$ ({\rm{exp}}\,({\tt{2}}, {\it{m\/}})\index{exp} $-$ {\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}))\-
\end{tabbing}


\noindent{\sc Event}:   Disable times-sub1.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  asr-int-crock \\ \index{asr-int-crock}
\=\+(({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $\wedge$ ({\it{x\/}} $\not<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{cnt\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+({\rm{app}}\,({\it{n\/}} $-$ {\it{cnt\/}}, {\it{x\/}} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}, {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp} $-\;1$)\index{app} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) \\ 
$=$$\;\;\;\;${\bf{f}})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-int \\ \index{asr-int}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{asr}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}})\index{asr}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}) \\ 
{\bf then }\=\+{\bf if }{\rm{iremainder}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})\index{iremainder} $=$ {\tt{0}} \\ 
{\bf then }{\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})\index{iquotient} \\ 
{\bf else }{\rm{iplus}}\,({\tt{-1}}, {\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})\index{iquotient})\index{iplus}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})\index{iquotient}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable asr-int-crock.

\addvspace{18pt}

\noindent{\sc Event}:   Disable quotient-exp-lessp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable remainder-diff.

\addvspace{18pt}

\noindent{\sc Event}:   Disable quotient-diff.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  lsl-0 \\ \index{lsl-0}
{\rm{lsl}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{lsl} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-nat-rangep \\ \index{lsl-nat-rangep}
{\rm{nat-rangep}}\,({\rm{lsl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-lsl \\ \index{lsl-lsl}
{\rm{lsl}}\,({\it{n\/}}, {\rm{lsl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt1\/}})\index{lsl}, {\it{cnt2\/}})\index{lsl} $=$ {\rm{lsl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt1\/}} $+$ {\it{cnt2\/}})\index{lsl}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-0 \\ \index{lsr-0}
{\rm{lsr}}\,({\it{x\/}}, {\tt{0}})\index{lsr} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-nat-rangep \\ \index{lsr-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{nat-rangep}}\,({\rm{lsr}}\,({\it{x\/}}, {\it{cnt\/}})\index{lsr}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-lsr \\ \index{lsr-lsr}
{\rm{lsr}}\,({\rm{lsr}}\,({\it{x\/}}, {\it{cnt1\/}})\index{lsr}, {\it{cnt2\/}})\index{lsr} $=$ {\rm{lsr}}\,({\it{x\/}}, {\it{cnt1\/}} $+$ {\it{cnt2\/}})\index{lsr}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-0 \\ \index{asl-0}
{\rm{asl}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{asl} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-nat-rangep \\ \index{asl-nat-rangep}
{\rm{nat-rangep}}\,({\rm{asl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-asl \\ \index{asl-asl}
{\rm{asl}}\,({\it{n\/}}, {\rm{asl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt1\/}})\index{asl}, {\it{cnt2\/}})\index{asl} $=$ {\rm{asl}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt1\/}} $+$ {\it{cnt2\/}})\index{asl}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-0 \\ \index{asr-0}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{asr}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{asr} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-nat-rangep \\ \index{asr-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{nat-rangep}}\,({\rm{asr}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{verbatim}; unproved!  Not useful yet.
; (prove-lemma asr-asr (rewrite)
;     (implies (and (nat-rangep x n)
;                   (not (zerop n)))       
;              (equal (asr n (asr n x cnt1) cnt2)
;                     (asr n x (plus cnt1 cnt2)))))

; the integer interpretation of ext.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mbit-means-lessp \\ \index{mbit-means-lessp}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bitn}}\,({\it{x\/}}, {\it{n\/}} $-\;1$)\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  exp2-lessp \\ \index{exp2-lessp}
({\it{i\/}} $<$ {\it{j\/}}) $\rightarrow$ ({\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp} $<$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp})
\end{tabbing}
             
\begin{verbatim}; note that ext-lemma takes care of the other aspects about ext.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ext-int \\ \index{ext-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $<$ {\it{size\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-int}}\,({\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext}, {\it{size\/}})\index{nat-to-int} $=$ {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\-
\end{tabbing}


\noindent{\sc Event}:   Disable exp2-lessp.

\addvspace{18pt}

\begin{verbatim};                      INTEGERS!
; functions with a postfix `end' will eventually be disabled.  We use them
; to ``tell'' the prover that something unexpected happens.  They can 
; somehow force the prover to stop proving and print out some information.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{adder-int-end} \\  
\=\+{\rm{adder-int-end}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder-int-end} \\ 
$=$$\;\;\;\;${\rm{nat-to-int}}\,(\=\+\=\+({\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit} $+$ {\rm{int-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{int-to-nat} $+$ {\rm{int-to-nat}}\,({\it{y\/}}, {\it{n\/}})\index{int-to-nat}) \\ 
${}${\bf{mod}}${}$$\;\;\;\;${\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}\-, \\ 
{\it{n\/}})\-\index{nat-to-int}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-to-iplus \\ \index{plus-to-iplus}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{adder-int-end}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder-int-end} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit})\index{iplus})\index{iplus}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }{\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit})\index{iplus})\index{iplus} \\ 
{\bf elseif }{\rm{negativep}}\,({\it{x\/}}) \\ 
{\bf then }{\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{iplus}}\,({\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\index{iplus} \\ 
{\bf else }{\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{iplus}}\,({\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\index{iplus}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable plus-to-iplus.

\addvspace{18pt}     

\begin{tabbing}{\sc Theorem}:  iplus-with-carry-negativep \\ \index{iplus-with-carry-negativep}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{bitp}}\,({\it{z\/}})\index{bitp} $\wedge$ {\rm{negativep}}\,({\it{x\/}}) $\wedge$ {\rm{negativep}}\,({\it{y\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-with-carry-non-negativep \\ \index{iplus-with-carry-non-negativep}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{bitp}}\,({\it{z\/}})\index{bitp} \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\it{y\/}})))\- \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus}))\-
\end{tabbing}

\begin{verbatim}; two lemmas for addx-v.  They will be disabled right after we use them.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  addx-v-crock1 \\ \index{addx-v-crock1}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{bitp}}\,({\it{z\/}})\index{bitp} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep})\- \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{iplus}}\,({\it{z\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\index{iplus}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-v-crock2 \\ \index{addx-v-crock2}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{bitp}}\,({\it{z\/}})\index{bitp} \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep})\- \\ 
$\rightarrow$$\;\;\;\;${\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{iplus}}\,({\it{z\/}}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\index{iplus})\-
\end{tabbing}

\begin{verbatim}; two lemmas for BMI of add.  They will be disabled right after we 
; use them.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-bmi-crock1 \\ \index{add-bmi-crock1}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-bmi-crock2 \\ \index{add-bmi-crock2}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;${\rm{negativep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\-
\end{tabbing}

\begin{verbatim}; two lemmas for BMI of sub.  They will be disabled right after we 
; use them.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ilessp-crock1 \\ \index{ilessp-crock1}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{ilessp}}\,({\rm{iplus}}\,({\it{y\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, {\it{x\/}})\index{ilessp})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ilessp-crock2 \\ \index{ilessp-crock2}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;${\rm{ilessp}}\,({\rm{iplus}}\,({\it{y\/}}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, {\it{x\/}})\index{ilessp}\-
\end{tabbing}

\begin{verbatim}; the addition of two opposite sign integers will never overflow, provided
; the two integers are in "good" range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iplus-int-rangep1 \\ \index{iplus-int-rangep1}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{bitp}}\,({\it{z\/}})\index{bitp} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{negativep}}\,({\it{y\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-int-rangep2 \\ \index{iplus-int-rangep2}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{bitp}}\,({\it{z\/}})\index{bitp} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{negativep}}\,({\it{x\/}}) \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\it{y\/}})))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-int-rangep1 \\ \index{idifference-int-rangep1}
\=\+(\=\+{\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{ilessp}}\,({\it{x\/}}, {\it{y\/}})\index{ilessp}) \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\it{y\/}})))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{idifference}}\,({\it{y\/}}, {\it{x\/}})\index{idifference}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-int-rangep2 \\ \index{idifference-int-rangep2}
\=\+(\=\+{\rm{integerp}}\,({\it{x\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{integerp}}\,({\it{y\/}})\index{integerp} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{ilessp}}\,({\it{y\/}}, {\it{x\/}})\index{ilessp}) \\ 
$\wedge$$\;\;\;\;${\rm{negativep}}\,({\it{y\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{idifference}}\,({\it{y\/}}, {\it{x\/}})\index{idifference}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{verbatim}; two lemmas about uint-rangep and int-rangep. We introduce them before any
; lemmas about uint-rangep and int-rangep.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  uint-rangep-la \\ \index{uint-rangep-la}
({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $\rightarrow$ {\rm{uint-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{uint-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  int-rangep-la \\ \index{int-rangep-la}
(({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp})) $\rightarrow$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{verbatim};                NAT-TO-UINT & UINT-TO-NAT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-uint-to-nat \\ \index{nat-to-uint-to-nat}
{\rm{uint-to-nat}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint})\index{uint-to-nat} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  uint-to-nat-to-uint \\ \index{uint-to-nat-to-uint}
{\rm{nat-to-uint}}\,({\rm{uint-to-nat}}\,({\it{x\/}})\index{uint-to-nat})\index{nat-to-uint} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  uint-to-nat-rangep \\ \index{uint-to-nat-rangep}
({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{uint-to-nat}}\,({\it{x\/}})\index{uint-to-nat}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-uint-rangep \\ \index{nat-to-uint-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}, {\it{n\/}})\index{uint-rangep}
\end{tabbing}

\begin{verbatim};                NAT-TO-INT & INT-TO-NAT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-int-0 \\ \index{nat-to-int-0}
{\rm{nat-to-int}}\,({\tt{0}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  int-to-nat-0 \\ \index{int-to-nat-0}
{\rm{int-to-nat}}\,({\tt{0}}, {\it{n\/}})\index{int-to-nat} $=$ {\tt{0}}
\end{tabbing}

\begin{verbatim}; nat-to-int always returns an integer, provided the input is a "good"
; natural number.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-int-integerp \\ \index{nat-to-int-integerp}
{\rm{integerp}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{integerp} $=$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}              

\begin{verbatim}; nat-to-int always returns a "good" integer.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-int-rangep \\ \index{nat-to-int-rangep}
{\rm{int-rangep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{verbatim}; int-to-nat always returns a "good" natural number, provided the input
; is a "good" integer.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  int-to-nat-rangep \\ \index{int-to-nat-rangep}
({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{int-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{int-to-nat}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-to-int-to-nat \\ \index{nat-to-int-to-nat}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{int-to-nat}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}})\index{int-to-nat} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  int-to-nat-to-int \\ \index{int-to-nat-to-int}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-int}}\,({\rm{int-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{int-to-nat}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{fix-int}}\,({\it{x\/}})\index{fix-int})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  int-to-nat=0 \\ \index{int-to-nat=0}
\=\+({\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{integerp}}\,({\it{x\/}})\index{integerp}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{int-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{int-to-nat} $=$ {\tt{0}}) $=$ ({\it{x\/}} $=$ {\tt{0}}))\-
\end{tabbing}

\begin{verbatim}; /x/ = /y/ --> x = y.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-to-int= \\ \index{nat-to-int=}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}) $=$ ({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}})))\-
\end{tabbing}

\begin{verbatim}; nat-to-int and int-to-nat are disabled.
\end{verbatim}
\noindent{\sc Event}:   Disable nat-to-int.

\addvspace{18pt}

\noindent{\sc Event}:   Disable int-to-nat.

\addvspace{18pt}

\begin{verbatim}; theorems about int-rangep.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  abs-lessp-int-rangep \\ \index{abs-lessp-int-rangep}
({\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ ({\rm{abs}}\,({\it{y\/}})\index{abs} $<$ {\rm{abs}}\,({\it{x\/}})\index{abs})) $\rightarrow$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{verbatim}; 0 is always in "good" integer range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  int-rangep-of-0 \\ \index{int-rangep-of-0}
{\rm{int-rangep}}\,({\tt{0}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub1-int-rangep \\ \index{sub1-int-rangep}
{\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\rightarrow$ {\rm{int-rangep}}\,({\it{x\/}} $-\;1$, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-int-rangep \\ \index{difference-int-rangep}
{\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\rightarrow$ {\rm{int-rangep}}\,({\it{x\/}} $-$ {\it{y\/}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-int-rangep \\ \index{quotient-int-rangep}
{\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\rightarrow$ {\rm{int-rangep}}\,({\it{x\/}} $\div$ {\it{y\/}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-int-rangep \\ \index{remainder-int-rangep}
({\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ ({\it{y\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{int-rangep}}\,({\it{x\/}} ${}${\bf{mod}}${}$ {\it{y\/}}, {\it{n\/}})\index{int-rangep}
\end{tabbing}

\begin{verbatim}; iquotient is almost always in the integer range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iquotient-int-rangep \\ \index{iquotient-int-rangep}
\=\+{\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{int-rangep}}\,({\rm{iquotient}}\,({\it{x\/}}, {\it{y\/}})\index{iquotient}, {\it{n\/}})\index{int-rangep} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $=$ {\tt{-1}}$\;\;${\bf then }{\it{x\/}} $\not=$ ($-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; iremainder is almost always in the integer range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iremainder-int-rangep \\ \index{iremainder-int-rangep}
\=\+({\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ ({\it{y\/}} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{iremainder}}\,({\it{x\/}}, {\it{y\/}})\index{iremainder}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{verbatim}; lemmas about integerp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  integerp-fix-int \\ \index{integerp-fix-int}
{\rm{integerp}}\,({\it{x\/}})\index{integerp} $\rightarrow$ ({\rm{fix-int}}\,({\it{x\/}})\index{fix-int} $=$ {\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  fix-int-integerp \\ \index{fix-int-integerp}
{\rm{integerp}}\,({\rm{fix-int}}\,({\it{x\/}})\index{fix-int})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  minus-integerp \\ \index{minus-integerp}
{\rm{integerp}}\,($-$ {\it{x\/}})\index{integerp} $=$ ({\it{x\/}} $\not\simeq {\tt{0}}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  integerp-minus0 \\ \index{integerp-minus0}
{\rm{integerp}}\,({\it{x\/}})\index{integerp} $\rightarrow$ ({\it{x\/}} $\not=$ ($-$ {\tt{0}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  negativep-guts0 \\ \index{negativep-guts0}
({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{negativep}}\,({\it{x\/}})) $\rightarrow$ ({\rm{negative-guts}}\,({\it{x\/}}) $\not=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  numberp-integerp \\ \index{numberp-integerp}
({\it{x\/}} $\in\;${\bf{N}}${}$) $\rightarrow$ {\rm{integerp}}\,({\it{x\/}})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-integerp \\ \index{iplus-integerp}
{\rm{integerp}}\,({\rm{iplus}}\,({\it{x\/}}, {\it{y\/}})\index{iplus})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ineg-integerp \\ \index{ineg-integerp}
{\rm{integerp}}\,({\rm{ineg}}\,({\it{x\/}})\index{ineg})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-integerp \\ \index{idifference-integerp}
{\rm{integerp}}\,({\rm{idifference}}\,({\it{x\/}}, {\it{y\/}})\index{idifference})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-integerp \\ \index{itimes-integerp}
{\rm{integerp}}\,({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iremainder-integerp \\ \index{iremainder-integerp}
{\rm{integerp}}\,({\rm{iremainder}}\,({\it{x\/}}, {\it{y\/}})\index{iremainder})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iquotient-integerp \\ \index{iquotient-integerp}
{\rm{integerp}}\,({\rm{iquotient}}\,({\it{x\/}}, {\it{y\/}})\index{iquotient})\index{integerp}
\end{tabbing}

\begin{verbatim}; theorems about iplus, idifference, and ineg.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iplus-commutativity \\ \index{iplus-commutativity}
{\rm{iplus}}\,({\it{x\/}}, {\it{y\/}})\index{iplus} $=$ {\rm{iplus}}\,({\it{y\/}}, {\it{x\/}})\index{iplus}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-commutativity1 \\ \index{iplus-commutativity1}
{\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus} $=$ {\rm{iplus}}\,({\it{y\/}}, {\rm{iplus}}\,({\it{x\/}}, {\it{z\/}})\index{iplus})\index{iplus}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-associativity \\ \index{iplus-associativity}
{\rm{iplus}}\,({\rm{iplus}}\,({\it{x\/}}, {\it{y\/}})\index{iplus}, {\it{z\/}})\index{iplus} $=$ {\rm{iplus}}\,({\it{x\/}}, {\rm{iplus}}\,({\it{y\/}}, {\it{z\/}})\index{iplus})\index{iplus}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ineg-iplus \\ \index{ineg-iplus}
{\rm{ineg}}\,({\rm{iplus}}\,({\it{x\/}}, {\it{y\/}})\index{iplus})\index{ineg} $=$ {\rm{iplus}}\,({\rm{ineg}}\,({\it{x\/}})\index{ineg}, {\rm{ineg}}\,({\it{y\/}})\index{ineg})\index{iplus}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-0 \\ \index{iplus-0}
{\rm{izerop}}\,({\it{x\/}})\index{izerop} $\rightarrow$ (({\rm{iplus}}\,({\it{x\/}}, {\it{y\/}})\index{iplus} $=$ {\rm{fix-int}}\,({\it{y\/}})\index{fix-int}) $\wedge$ ({\rm{iplus}}\,({\it{y\/}}, {\it{x\/}})\index{iplus} $=$ {\rm{fix-int}}\,({\it{y\/}})\index{fix-int}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iplus-1--1 \\ \index{iplus-1--1}
{\rm{iplus}}\,({\tt{1}}, {\rm{iplus}}\,({\tt{-1}}, {\it{x\/}})\index{iplus})\index{iplus} $=$ {\rm{fix-int}}\,({\it{x\/}})\index{fix-int}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-x-x \\ \index{idifference-x-x}
{\rm{idifference}}\,({\it{x\/}}, {\it{x\/}})\index{idifference} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-negativep \\ \index{idifference-negativep}
{\rm{negativep}}\,({\rm{idifference}}\,({\it{x\/}}, {\it{y\/}})\index{idifference}) $=$ {\rm{ilessp}}\,({\it{x\/}}, {\it{y\/}})\index{ilessp}
\end{tabbing}

\begin{verbatim}; lemmas about ilessp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ilessp-reflex \\ \index{ilessp-reflex}
$\neg$ {\rm{ilessp}}\,({\it{x\/}}, {\it{x\/}})\index{ilessp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ilessp-entails-ileq \\ \index{ilessp-entails-ileq}
{\rm{ilessp}}\,({\it{x\/}}, {\it{y\/}})\index{ilessp} $\rightarrow$ ($\neg$ {\rm{ilessp}}\,({\it{y\/}}, {\it{x\/}})\index{ilessp})
\end{tabbing}

\begin{verbatim}; lemmas about itimes.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  itimes-0 \\ \index{itimes-0}
{\rm{itimes}}\,({\tt{0}}, {\it{x\/}})\index{itimes} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-equal-0 \\ \index{itimes-equal-0}
({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes} $=$ {\tt{0}}) $=$ ({\rm{izerop}}\,({\it{x\/}})\index{izerop} $\vee$ {\rm{izerop}}\,({\it{y\/}})\index{izerop})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-commutativity \\ \index{itimes-commutativity}
{\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes} $=$ {\rm{itimes}}\,({\it{y\/}}, {\it{x\/}})\index{itimes}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-associativity \\ \index{itimes-associativity}
{\rm{itimes}}\,({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes}, {\it{z\/}})\index{itimes} $=$ {\rm{itimes}}\,({\it{x\/}}, {\rm{itimes}}\,({\it{y\/}}, {\it{z\/}})\index{itimes})\index{itimes}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-equal-cancellation \\ \index{itimes-equal-cancellation}
\=\+($\neg$ {\rm{izerop}}\,({\it{x\/}})\index{izerop}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes} $=$ {\rm{itimes}}\,({\it{x\/}}, {\it{z\/}})\index{itimes}) $=$ ({\rm{fix-int}}\,({\it{y\/}})\index{fix-int} $=$ {\rm{fix-int}}\,({\it{z\/}})\index{fix-int}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  itimes-sign \\ \index{itimes-sign}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{negativep}}\,({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes}) \\ 
$=$$\;\;\;\;$(\=\+(({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{x\/}} $\not=$ {\tt{0}}) $\wedge$ {\rm{negativep}}\,({\it{y\/}})) \\ 
$\vee$$\;\;\;\;$({\rm{negativep}}\,({\it{x\/}}) $\wedge$ ({\it{y\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{y\/}} $\not=$ {\tt{0}})))\-)\-\-
\end{tabbing}

\begin{verbatim}; lemmas about iremainder and iquotient.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iremainder-wrt-1 \\ \index{iremainder-wrt-1}
{\rm{iremainder}}\,({\it{x\/}}, {\tt{1}})\index{iremainder} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iquotient-wrt-1 \\ \index{iquotient-wrt-1}
{\rm{iquotient}}\,({\it{x\/}}, {\tt{1}})\index{iquotient} $=$ {\rm{fix-int}}\,({\it{x\/}})\index{fix-int}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iremainder-wrt--1 \\ \index{iremainder-wrt--1}
{\rm{iremainder}}\,({\it{x\/}}, {\tt{-1}})\index{iremainder} $=$ {\tt{0}}
\end{tabbing}
                    
\begin{tabbing}{\sc Theorem}:  iquotient-wrt--1 \\ \index{iquotient-wrt--1}
{\rm{iquotient}}\,({\it{x\/}}, {\tt{-1}})\index{iquotient} $=$ {\rm{ineg}}\,({\it{x\/}})\index{ineg}
\end{tabbing}


\noindent{\sc Event}:   Disable iplus.

\addvspace{18pt}

\noindent{\sc Event}:   Disable itimes.

\addvspace{18pt}

\noindent{\sc Event}:   Disable iremainder.

\addvspace{18pt}

\noindent{\sc Event}:   Disable iquotient.

\addvspace{18pt}

\noindent{\sc Event}:   Disable integerp.

\addvspace{18pt}

\begin{verbatim}; unsigned interpretation of mulu.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  times-lessp\_1 \\ \index{times-lessp\_1}
(({\it{x\/}} $<$ {\it{x1\/}}) $\wedge$ ({\it{y\/}} $<$ {\it{y1\/}})) $\rightarrow$ (({\it{x\/}} $*$ {\it{y\/}}) $<$ ({\it{x1\/}} $*$ {\it{y1\/}}))
\end{tabbing}

\begin{verbatim}; three instances of mulu-nat.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mulu\_1632-nat \\ \index{mulu\_1632-nat}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{mulu}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{mulu})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3264-nat \\ \index{mulu\_3264-nat}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{mulu}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3232-nat \\ \index{mulu\_3232-nat}
\=\+{\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}, {\tt{32}})\index{uint-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{mulu}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}))\-\-
\end{tabbing}

\begin{verbatim}; signed interpretation of muls.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  exp2-lessp-crock \\ \index{exp2-lessp-crock}
\=\+(\=\+({\it{i\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $<$ {\it{i\/}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-)\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{exp}}\,({\tt{2}}, {\it{i\/}} $-\;1$)\index{exp} $<$ {\rm{exp}}\,({\tt{2}}, {\it{k\/}})\index{exp})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-int-crock \\ \index{head-int-crock}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{j\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{head}}\,({\rm{int-to-nat}}\,({\it{x\/}}, {\it{j\/}})\index{int-to-nat}, {\it{n\/}})\index{head} $=$ {\rm{int-to-nat}}\,({\it{x\/}}, {\it{n\/}})\index{int-to-nat})\-
\end{tabbing}


\noindent{\sc Event}:   Disable exp2-lessp-crock.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  times-lessp\_2 \\ \index{times-lessp\_2}
\=\+(({\it{x\/}} $\leq$ {\it{x1\/}}) $\wedge$ ({\it{y\/}} $\leq$ {\it{y1\/}}) $\wedge$ ({\it{x1\/}} $\not\simeq {\tt{0}}$) $\wedge$ ({\it{y1\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(({\it{x\/}} $*$ {\it{y\/}}) $<$ ({\tt{2}} $*$ {\it{x1\/}} $*$ {\it{y1\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  times-lessp\_3 \\ \index{times-lessp\_3}
\=\+(({\it{x\/}} $\leq$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{y\/}} $\leq$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$((({\it{x\/}} $*$ {\it{y\/}}) $<$ {\rm{exp}}\,({\tt{2}}, ({\it{n\/}} $+$ {\it{n\/}}) $-\;1$)\index{exp}) $=$ {\bf{t}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  times-lessp\_4 \\ \index{times-lessp\_4}
\=\+(({\it{x\/}} $\leq$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{y\/}} $\leq$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{exp}}\,({\tt{2}}, ({\it{n\/}} $+$ {\it{n\/}}) $-\;1$)\index{exp} $<$ ({\it{x\/}} $*$ {\it{y\/}})) $=$ {\bf{f}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls-crock \\ \index{muls-crock}
\=\+({\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{itimes}}\,({\it{x\/}}, {\it{y\/}})\index{itimes}, {\it{n\/}} $+$ {\it{n\/}})\index{int-rangep}\-
\end{tabbing}

\begin{verbatim}; three instances of muls-int.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  muls\_1632-int \\ \index{muls\_1632-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{muls}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{muls}, {\tt{32}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{16}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{16}})\index{nat-to-int})\index{itimes})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3264-int \\ \index{muls\_3264-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{muls}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls}, {\tt{64}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3232-int \\ \index{muls\_3232-int}
\=\+{\rm{int-rangep}}\,({\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes}, {\tt{32}})\index{int-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{muls}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls}, {\tt{32}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable times-lessp\_1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable times-lessp\_2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable times-lessp\_3.

\addvspace{18pt}

\noindent{\sc Event}:   Disable times-lessp\_4.

\addvspace{18pt}

\noindent{\sc Event}:   Disable muls-crock.

\addvspace{18pt}

\begin{verbatim}; signed interpretation of irem.  
; notice that we only consider the case that the divisor and the result 
; have the same boundary n.  Since it is enough to cover the situations 
; in the DIVS instructions.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  irem-int \\ \index{irem-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{irem}}\,({\it{n\/}}, {\it{x\/}}, {\it{n\/}}, {\it{y\/}}, {\it{j\/}})\index{irem}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{iremainder}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{iremainder})\-\-
\end{tabbing}

\begin{verbatim}; signed interpretation of iquot.
; notice that we only consider the case that the length of the result 
; is at most the length of the dividend.  Since it is enough to cover
; the situations in DIVS instruction.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iquot-int \\ \index{iquot-int}
\=\+({\rm{int-rangep}}\,({\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int})\index{iquotient}, {\it{n\/}})\index{int-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{j\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{iquot}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}}, {\it{y\/}}, {\it{j\/}})\index{iquot}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int})\index{iquotient})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable head-int-crock.

\addvspace{18pt}

\begin{verbatim}; unsigned interpratation of rem.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  rem-nat \\ \index{rem-nat}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{rem}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{rem})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} \\ 
{\bf else }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; unsigned interpretation of quot.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  quot-nat \\ \index{quot-nat}
\=\+{\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{quot}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{quot})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $\div$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}))\-
\end{tabbing}


\noindent{\sc Event}:   Disable int-rangep.

\addvspace{18pt}

\begin{verbatim}; the only correct execution of DIV is when NO overflow occurs.  We 
; need to pass the guard in the specification.  The following few
; lemmas are introduced for this purpose. 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  divu-overflow \\ \index{divu-overflow}
\=\+{\rm{divu-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{divu-v} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $\div$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}, {\it{n\/}})\index{uint-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divs-overflow \\ \index{divs-overflow}
\=\+{\rm{divs-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}}, {\it{y\/}}, {\it{j\/}})\index{divs-v} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int})\index{iquotient}, {\it{n\/}})\index{int-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-\-
\end{tabbing}
                    
\begin{tabbing}{\sc Theorem}:  divs\_3232-overflow \\ \index{divs\_3232-overflow}
\=\+{\rm{divs-v}}\,({\tt{32}}, {\it{x\/}}, {\tt{32}}, {\it{y\/}}, {\tt{32}})\index{divs-v} \\ 
$=$$\;\;\;\;$\=\+{\bf if }\=\+({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{-2147483648}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{-1}})\-$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable divu-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable divs-v.

\addvspace{18pt}

\begin{verbatim};          UNSIGNED INTERPRETATION OF ADDITION AND SUBTRACTION
;               
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-nat-la \\ \index{add-nat-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{x\/}} $+$ {\it{y\/}}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\it{x\/}} $+$ {\it{y\/}} \\ 
{\bf else }({\it{x\/}} $+$ {\it{y\/}}) $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-nat-la \\ \index{sub-nat-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $<$ {\it{x\/}}$\;\;${\bf then }({\it{y\/}} $+$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $-$ {\it{x\/}} \\ 
{\bf else }{\it{y\/}} $-$ {\it{x\/}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-nat-la \\ \index{adder-nat-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{c\/}} $+$ {\it{x\/}} $+$ {\it{y\/}}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\it{c\/}} $+$ {\it{x\/}} $+$ {\it{y\/}} \\ 
{\bf else }({\it{c\/}} $+$ {\it{x\/}} $+$ {\it{y\/}}) $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subtracter-nat-la \\ \index{subtracter-nat-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{subtracter}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{subtracter} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $<$ ({\it{c\/}} $+$ {\it{x\/}})$\;\;${\bf then }({\it{y\/}} $+$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $-$ ({\it{c\/}} $+$ {\it{x\/}}) \\ 
{\bf else }{\it{y\/}} $-$ ({\it{c\/}} $+$ {\it{x\/}})$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-numberp \\ \index{plus-numberp}
({\it{y\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ (({\it{x\/}} $+$ {\it{y\/}}) $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{verbatim}; unsigned interpretation of adder.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-uint \\ \index{adder-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} \\ 
{\bf then }{\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} \\ 
{\bf else }\=\+({\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) \\ 
$-$$\;\;\;\;${\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}\-$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; unsigned interpretation of subtracter.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  subtracter-uint \\ \index{subtracter-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{subtracter}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{subtracter})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $<$ ({\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}) \\ 
{\bf then }\=\+({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $+$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) \\ 
$-$$\;\;\;\;$({\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint})\- \\ 
{\bf else }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $-$ ({\it{c\/}} $+$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint})$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; unsigned interpretation of add.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-uint \\ \index{add-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp} \\ 
{\bf then }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} \\ 
{\bf else }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; unsigned interpretation of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-uint \\ \index{sub-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $<$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} \\ 
{\bf then }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $-$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} \\ 
{\bf else }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $-$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable plus-numberp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-nat-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-nat-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable adder-nat-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subtracter-nat-la.

\addvspace{18pt}

\begin{verbatim};                  THEOREMS OF ADDER
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-shift-carry \\ \index{adder-shift-carry}
{\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\it{y\/}}, {\it{z\/}})\index{adder})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\it{x\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{y\/}}, {\it{z\/}})\index{adder})\index{adder}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-commutativity \\ \index{adder-commutativity}
{\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{y\/}}, {\it{x\/}})\index{adder}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-associativity \\ \index{adder-associativity}
{\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder}, {\it{z\/}})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\it{y\/}}, {\it{z\/}})\index{adder})\index{adder}
\end{tabbing}

\begin{verbatim}; another commutativity theorem about adder.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-commutativity1 \\ \index{adder-commutativity1}
{\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\it{y\/}}, {\it{z\/}})\index{adder})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{y\/}}, {\rm{adder}}\,({\it{n\/}}, {\it{d\/}}, {\it{x\/}}, {\it{z\/}})\index{adder})\index{adder}
\end{tabbing}

\begin{verbatim};               THEOREMS ABOUT ADD AND SUB
;
; trivial!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-of-0 \\ \index{add-of-0}
{\rm{add}}\,({\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\tt{0}}
\end{tabbing}

\begin{verbatim}; x + 0 = x!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-0 \\ \index{add-0}
({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{add} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}) $\wedge$ ({\rm{add}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}})\index{add} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head})
\end{tabbing}
             
\begin{verbatim}; x - 0 = x!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-0 \\ \index{sub-0}
{\rm{sub}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}})\index{sub} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{verbatim}; x - x = 0!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-x-x \\ \index{sub-x-x}
{\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\it{x\/}})\index{sub} $=$ {\tt{0}}
\end{tabbing}

\begin{verbatim}; commutativity of addition : x + y = y + x.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-commutativity \\ \index{add-commutativity}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{add}
\end{tabbing}

\begin{verbatim}; associativity of addition: (x + y) + z = x + (y + z).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-associativity \\ \index{add-associativity}
{\rm{add}}\,({\it{n\/}}, {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{z\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{add})\index{add}
\end{tabbing}

\begin{verbatim}; another commutativity of addition: x + (y + z) = y + (x + z).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-commutativity1 \\ \index{add-commutativity1}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{add})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{z\/}})\index{add})\index{add}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-leq \\ \index{remainder-leq}
{\it{x\/}} $\not<$ ({\it{x\/}} ${}${\bf{mod}}${}$ {\it{y\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-leq \\ \index{add-leq}
({\it{x\/}} $+$ {\it{y\/}}) $\not<$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-leq-la \\ \index{sub-leq-la}
({\it{x\/}} $\leq$ {\it{y\/}}) $\rightarrow$ (({\it{y\/}} $-$ {\it{x\/}}) $\not<$ {\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub})
\end{tabbing}


\noindent{\sc Event}:   Disable remainder-leq.

\addvspace{18pt}

\begin{verbatim}; addition and subtraction are always in "good" range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-nat-rangep \\ \index{adder-nat-rangep}
{\rm{nat-rangep}}\,({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subtracter-nat-rangep \\ \index{subtracter-nat-rangep}
{\rm{nat-rangep}}\,({\rm{subtracter}}\,({\it{n\/}}, {\it{c\/}}, {\it{y\/}}, {\it{x\/}})\index{subtracter}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-nat-rangep \\ \index{add-nat-rangep}
{\rm{nat-rangep}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-nat-rangep \\ \index{sub-nat-rangep}
{\rm{nat-rangep}}\,({\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-head \\ \index{adder-head}
\=\+({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}, {\it{y\/}})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder}) \\ 
$\wedge$$\;\;\;\;$({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-head \\ \index{add-head}
({\rm{add}}\,({\it{n\/}}, {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}, {\it{y\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}) $\wedge$ ({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})
\end{tabbing}
             
\begin{verbatim}; x + y = x - z <==> y + z = 0.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-sub-cancel \\ \index{add-sub-cancel}
\=\+({\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{z\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}})\index{sub}) $=$ ({\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{add} $=$ {\tt{0}}))\-
\end{tabbing}

\begin{verbatim}; x - y = 0 <==> x = y.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-equal-0 \\ \index{sub-equal-0}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{sub}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub} $=$ {\tt{0}}) $=$ ({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}})))\-
\end{tabbing}

\begin{verbatim}; a bridge from add to adder.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-adder \\ \index{add-adder}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\rm{adder}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{adder}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-add1-sub1 \\ \index{plus-add1-sub1}
({\it{y\/}} $\not\simeq {\tt{0}}$) $\rightarrow$ (($1\;+$ ({\it{x\/}} $+$ ({\it{y\/}} $-\;1$))) $=$ ({\it{x\/}} $+$ {\it{y\/}}))
\end{tabbing}

\begin{verbatim}; a bridge from sub to adder.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-adder \\ \index{sub-adder}
{\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub} $=$ {\rm{adder}}\,({\it{n\/}}, {\tt{1}}, {\it{x\/}}, {\rm{lognot}}\,({\it{n\/}}, {\it{y\/}})\index{lognot})\index{adder}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-neg-adder \\ \index{add-neg-adder}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add} $=$ {\rm{adder}}\,({\it{n\/}}, {\tt{1}}, {\it{x\/}}, {\rm{lognot}}\,({\it{n\/}}, {\it{y\/}})\index{lognot})\index{adder}
\end{tabbing}

\begin{verbatim}; plus-add1-sub1 is a very ``dangerous'' event.  To use it,  you need
; to enable it first.
\end{verbatim}
\noindent{\sc Event}:   Disable plus-add1-sub1.

\addvspace{18pt}


\noindent{\sc Event}:   Disable add.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub.

\addvspace{18pt}

\begin{verbatim}; (x + y) -z = x + (y - z).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-sub \\ \index{add-sub}
{\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{sub} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{y\/}})\index{sub})\index{add}
\end{tabbing}

\begin{verbatim}; (x - y) + z = x + (z - y).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-add \\ \index{sub-add}
{\rm{add}}\,({\it{n\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub}, {\it{z\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{sub})\index{add}
\end{tabbing}

\begin{verbatim}; (x - y) - z = x - (y + z).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-sub \\ \index{sub-sub}
{\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub})\index{sub} $=$ {\rm{sub}}\,({\it{n\/}}, {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{add}, {\it{x\/}})\index{sub}
\end{tabbing}

\begin{verbatim}; x - (y - z) = x + (z - y).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-sub1 \\ \index{sub-sub1}
{\rm{sub}}\,({\it{n\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{y\/}})\index{sub}, {\it{x\/}})\index{sub} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{sub})\index{add}
\end{tabbing}
             
\begin{verbatim}; another commutativity of addition: x + (y - z) = y + (x - z).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-commutativity2 \\ \index{add-commutativity2}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{y\/}})\index{sub})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}})\index{sub})\index{add}
\end{tabbing}

\begin{verbatim}; x + y = x <==> y = 0.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-cancel0 \\ \index{add-cancel0}
({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\it{x\/}}) $=$ (({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head} $=$ {\tt{0}}))
\end{tabbing}

\begin{verbatim}; x - y = x <==> y = 0.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-cancel0 \\ \index{sub-cancel0}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub} $=$ {\it{x\/}}) $=$ (({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{y\/}} $\simeq {\tt{0}}$)))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  adder-cancel \\ \index{adder-cancel}
({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder} $=$ {\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{z\/}})\index{adder}) $=$ ({\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{z\/}}, {\it{n\/}})\index{head})
\end{tabbing}

\begin{verbatim}; x + y = x + z <==> y = z.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-cancel \\ \index{add-cancel}
({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{z\/}})\index{add}) $=$ ({\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{z\/}}, {\it{n\/}})\index{head})
\end{tabbing}

\begin{verbatim}; x - y = x - z <==> y = z.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-cancel \\ \index{sub-cancel}
\=\+({\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{z\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub} $=$ {\rm{sub}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}})\index{sub}) $=$ ({\rm{fix}}\,({\it{y\/}}) $=$ {\rm{fix}}\,({\it{z\/}})))\-
\end{tabbing}      


\noindent{\sc Event}:   Disable add-adder.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-adder.

\addvspace{18pt}

\begin{verbatim}; x + (y - y) = x!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  addy-y \\ \index{addy-y}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{y\/}})\index{sub})\index{add} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{verbatim}; y + (x - y) = x!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  addy-y1 \\ \index{addy-y1}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ ({\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub})\index{add} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{verbatim};           INTEGER INTERPRETATION OF ADDITION AND SUBTRACTION

; a bridge for adder-int.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-int-bridge \\ \index{adder-int-bridge}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{adder-int-end}}\,({\it{n\/}}, {\it{c\/}}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{adder-int-end})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable adder-int-end.

\addvspace{18pt}

\noindent{\sc Event}:   Disable adder.

\addvspace{18pt}

\begin{verbatim}; integer interpretation of adder.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  adder-int \\ \index{adder-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{adder}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{adder}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\index{iplus}, \\ 
{\it{n\/}})\-\index{int-rangep} \\ 
{\bf then }{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\index{iplus} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}) \\ 
{\bf then }{\rm{iplus}}\,(\=\+{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\it{c\/}}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\-\index{iplus} \\ 
{\bf else }{\rm{iplus}}\,(\=\+{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\it{c\/}}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus})\-\index{iplus}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; integer interpretation of subtracter.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  subtracter-int \\ \index{subtracter-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{subtracter}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{subtracter}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,(\=\+{\rm{idifference}}\,(\=\+{\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\-\index{idifference}, \\ 
{\it{n\/}})\-\index{int-rangep} \\ 
{\bf then }{\rm{idifference}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\index{idifference} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}) \\ 
{\bf then }{\rm{idifference}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\-\index{idifference} \\ 
{\bf else }{\rm{idifference}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\-\index{idifference}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable subtracter.

\addvspace{18pt}

\begin{verbatim}; integer interpretation of add.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-int \\ \index{add-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{iplus}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{iplus} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}) \\ 
{\bf then }{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\index{iplus} \\ 
{\bf else }{\rm{iplus}}\,(\=\+{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus})\-\index{iplus}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; integer interpretation of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-int \\ \index{sub-int}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add}, {\it{n\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{idifference}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{idifference}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }{\rm{idifference}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{idifference} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}) \\ 
{\bf then }{\rm{idifference}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, \\ 
{\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\-\index{idifference} \\ 
{\bf else }{\rm{idifference}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp})\index{iplus}, \\ 
{\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\-\index{idifference}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable add-neg-adder.

\addvspace{18pt}

\begin{verbatim};            THEOREMS ABOUT HEAD, TAIL, APP, AND REPLACE
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  head-head \\ \index{head-head}
\=\+{\rm{head}}\,({\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}, {\it{n\/}})\index{head} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\it{m\/}}$\;\;${\bf then }{\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} \\ 
{\bf else }{\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-tail \\ \index{tail-tail}
{\rm{tail}}\,({\rm{tail}}\,({\it{x\/}}, {\it{m\/}})\index{tail}, {\it{n\/}})\index{tail} $=$ {\rm{tail}}\,({\it{x\/}}, {\it{m\/}} $+$ {\it{n\/}})\index{tail}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-plus-cancel0 \\ \index{head-plus-cancel0}
({\rm{head}}\,({\it{i\/}} $+$ {\it{j\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{i\/}}, {\it{n\/}})\index{head}) $=$ ({\rm{head}}\,({\it{j\/}}, {\it{n\/}})\index{head} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-plus-cancel \\ \index{head-plus-cancel}
({\rm{head}}\,({\it{x\/}} $+$ {\it{y\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{x\/}} $+$ {\it{z\/}}, {\it{n\/}})\index{head}) $=$ ({\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{z\/}}, {\it{n\/}})\index{head})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-plus-head \\ \index{head-plus-head}
{\rm{head}}\,({\it{x\/}} $+$ {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{x\/}} $+$ {\it{y\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-plus-times-exp2-1 \\ \index{remainder-plus-times-exp2-1}
\=\+({\it{j\/}} $\leq$ {\it{i\/}}) \\ 
$\rightarrow$$\;\;\;\;$((({\it{x\/}} $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) $=$ ({\it{x\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder2-plus-times-exp2 \\ \index{remainder2-plus-times-exp2}
({\it{i\/}} $\not\simeq {\tt{0}}$) $\rightarrow$ ((({\it{x\/}} $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) ${}${\bf{mod}}${}$ {\tt{2}}) $=$ ({\it{x\/}} ${}${\bf{mod}}${}$ {\tt{2}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-plus-times-exp2-2 \\ \index{remainder-plus-times-exp2-2}
\=\+(({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp}) $\wedge$ ({\it{i\/}} $\leq$ {\it{j\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{j\/}}$\;\;${\bf then }{\it{x\/}} $+$ (({\it{y\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}} $-$ {\it{i\/}})\index{exp}) $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp}) \\ 
{\bf else }{\rm{fix}}\,({\it{x\/}})$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-plus-times-exp2-1 \\ \index{quotient-plus-times-exp2-1}
\=\+({\it{j\/}} $<$ {\it{i\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{x\/}} $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) \\ 
$=$$\;\;\;\;$(({\it{x\/}} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}} $-$ {\it{j\/}})\index{exp})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  exp2-leq \\ \index{exp2-leq}
({\it{i\/}} $\leq$ {\it{j\/}}) $\rightarrow$ ({\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp} $\not<$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-plus-times-exp2-2 \\ \index{quotient-plus-times-exp2-2}
\=\+(({\it{i\/}} $\leq$ {\it{j\/}}) $\wedge$ ({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) \\ 
$\rightarrow$$\;\;\;\;$((({\it{x\/}} $+$ ({\it{y\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})) $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) $=$ ({\it{y\/}} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}} $-$ {\it{i\/}})\index{exp}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  remainder-quotient-exp2 \\ \index{remainder-quotient-exp2}
\=\+(({\it{x\/}} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp}) $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{j\/}} $<$ {\it{i\/}}$\;\;${\bf then }({\it{x\/}} $\div$ {\rm{exp}}\,({\tt{2}}, {\it{j\/}})\index{exp}) ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}} $-$ {\it{j\/}})\index{exp} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable exp2-leq.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  head-replace \\ \index{head-replace}
\=\+{\rm{head}}\,({\rm{replace}}\,({\it{m\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{n\/}})\index{head} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{m\/}} $<$ {\it{n\/}}$\;\;${\bf then }{\rm{replace}}\,({\it{m\/}}, {\it{x\/}}, {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head})\index{replace} \\ 
{\bf else }{\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-head \\ \index{tail-head}
{\rm{tail}}\,({\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}, {\it{n\/}})\index{tail} $=$ {\rm{head}}\,({\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail}, {\it{m\/}} $-$ {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-app \\ \index{tail-app}
\=\+{\rm{tail}}\,({\rm{app}}\,({\it{i\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{j\/}})\index{tail} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{j\/}} $<$ {\it{i\/}}$\;\;${\bf then }{\rm{app}}\,({\it{i\/}} $-$ {\it{j\/}}, {\rm{tail}}\,({\it{x\/}}, {\it{j\/}})\index{tail}, {\it{y\/}})\index{app} \\ 
{\bf else }{\rm{tail}}\,({\it{y\/}}, {\it{j\/}} $-$ {\it{i\/}})\index{tail}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-replace \\ \index{tail-replace}
\=\+{\rm{tail}}\,({\rm{replace}}\,({\it{i\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{j\/}})\index{tail} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{j\/}} $<$ {\it{i\/}}$\;\;${\bf then }{\rm{replace}}\,({\it{i\/}} $-$ {\it{j\/}}, {\rm{tail}}\,({\it{x\/}}, {\it{j\/}})\index{tail}, {\rm{tail}}\,({\it{y\/}}, {\it{j\/}})\index{tail})\index{replace} \\ 
{\bf else }{\rm{tail}}\,({\it{y\/}}, {\it{j\/}})\index{tail}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-reflex \\ \index{replace-reflex}
{\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\it{x\/}})\index{replace} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-head \\ \index{replace-head}
({\it{n\/}} $\leq$ {\it{m\/}}) $\rightarrow$ ({\rm{replace}}\,({\it{n\/}}, {\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}, {\it{x\/}})\index{replace} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-associativity \\ \index{replace-associativity}
{\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\rm{replace}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{replace})\index{replace} $=$ {\rm{replace}}\,({\it{n\/}}, {\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{z\/}})\index{replace}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-leq1 \\ \index{replace-leq1}
({\it{j\/}} $\leq$ {\it{i\/}}) $\rightarrow$ ({\rm{replace}}\,({\it{i\/}}, {\it{x\/}}, {\rm{replace}}\,({\it{j\/}}, {\it{y\/}}, {\it{z\/}})\index{replace})\index{replace} $=$ {\rm{replace}}\,({\it{i\/}}, {\it{x\/}}, {\it{z\/}})\index{replace})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-leq \\ \index{replace-leq}
({\it{i\/}} $\leq$ {\it{j\/}}) $\rightarrow$ ({\rm{replace}}\,({\it{i\/}}, {\rm{replace}}\,({\it{j\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{z\/}})\index{replace} $=$ {\rm{replace}}\,({\it{i\/}}, {\it{x\/}}, {\it{z\/}})\index{replace})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-app \\ \index{head-app}
({\it{i\/}} $\leq$ {\it{j\/}}) $\rightarrow$ ({\rm{head}}\,({\rm{app}}\,({\it{j\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{i\/}})\index{head} $=$ {\rm{head}}\,({\it{x\/}}, {\it{i\/}})\index{head})
\end{tabbing}

\begin{verbatim}; a few basic lemmas about bcar and bcdr.  They are useful in induction
; proofs with bcar and bcdr disabled.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bcar-nonnumberp \\ \index{bcar-nonnumberp}
({\it{x\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{bcar}}\,({\it{x\/}})\index{bcar} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcdr-nonnumberp \\ \index{bcdr-nonnumberp}
({\it{x\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{bcdr}}\,({\it{x\/}})\index{bcdr} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcar-1 \\ \index{bcar-1}
({\rm{bcar}}\,({\tt{2}} $*$ {\it{x\/}})\index{bcar} $=$ {\tt{0}}) $\wedge$ ({\rm{bcar}}\,($1\;+$ ({\tt{2}} $*$ {\it{x\/}}))\index{bcar} $=$ {\tt{1}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcdr-1 \\ \index{bcdr-1}
({\rm{bcdr}}\,({\tt{2}} $*$ {\it{x\/}})\index{bcdr} $=$ {\rm{fix}}\,({\it{x\/}})) $\wedge$ ({\rm{bcdr}}\,($1\;+$ ({\tt{2}} $*$ {\it{x\/}}))\index{bcdr} $=$ {\rm{fix}}\,({\it{x\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcar-2 \\ \index{bcar-2}
{\rm{bcar}}\,({\it{x\/}} $+$ ({\tt{2}} $*$ {\it{y\/}}))\index{bcar} $=$ {\rm{bcar}}\,({\it{x\/}})\index{bcar}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcdr-2 \\ \index{bcdr-2}
{\rm{bcdr}}\,({\it{x\/}} $+$ ({\tt{2}} $*$ {\it{y\/}}))\index{bcdr} $=$ ({\rm{bcdr}}\,({\it{x\/}})\index{bcdr} $+$ {\it{y\/}})
\end{tabbing}

\begin{verbatim}; the first "bit" of head.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bcar-head \\ \index{bcar-head}
\=\+{\rm{bcar}}\,({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head})\index{bcar} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{bcar}}\,({\it{x\/}})\index{bcar}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; the first "bit" of app.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bcar-app \\ \index{bcar-app}
\=\+{\rm{bcar}}\,({\rm{app}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{app})\index{bcar} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{bcar}}\,({\it{y\/}})\index{bcar} \\ 
{\bf else }{\rm{bcar}}\,({\it{x\/}})\index{bcar}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; the first "bit" of replace.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bcar-replace \\ \index{bcar-replace}
\=\+{\rm{bcar}}\,({\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{replace})\index{bcar} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{bcar}}\,({\it{y\/}})\index{bcar} \\ 
{\bf else }{\rm{bcar}}\,({\it{x\/}})\index{bcar}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcar-lessp \\ \index{bcar-lessp}
{\rm{bcar}}\,({\it{x\/}})\index{bcar} $<$ {\tt{2}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bcdr-lessp \\ \index{bcdr-lessp}
({\rm{bcdr}}\,({\it{x\/}})\index{bcdr} $<$ {\it{y\/}}) $=$ ({\it{x\/}} $<$ ({\tt{2}} $*$ {\it{y\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  app-associativity \\ \index{app-associativity}
{\rm{app}}\,({\it{n1\/}}, {\it{x\/}}, {\rm{app}}\,({\it{n2\/}}, {\it{y\/}}, {\it{z\/}})\index{app})\index{app} $=$ {\rm{app}}\,({\it{n1\/}} $+$ {\it{n2\/}}, {\rm{app}}\,({\it{n1\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{z\/}})\index{app}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  app-head-tail \\ \index{app-head-tail}
{\rm{app}}\,({\it{n\/}}, {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}, {\rm{tail}}\,({\it{x\/}}, {\it{n\/}})\index{tail})\index{app} $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-app-head-tail \\ \index{head-app-head-tail}
{\rm{app}}\,({\it{m\/}}, {\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}, {\rm{head}}\,({\rm{tail}}\,({\it{x\/}}, {\it{m\/}})\index{tail}, {\it{n\/}})\index{head})\index{app} $=$ {\rm{head}}\,({\it{x\/}}, {\it{m\/}} $+$ {\it{n\/}})\index{head}
\end{tabbing}


\noindent{\sc Event}:   Disable head.

\addvspace{18pt}

\noindent{\sc Event}:   Disable tail.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bcar.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bcdr.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  app-nat-rangep \\ \index{app-nat-rangep}
({\it{m\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\rm{nat-rangep}}\,({\rm{app}}\,({\it{m\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{n\/}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}} $-$ {\it{m\/}})\index{nat-rangep})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  replace-nat-rangep \\ \index{replace-nat-rangep}
({\it{m\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\rm{nat-rangep}}\,({\rm{replace}}\,({\it{m\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{n\/}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep})
\end{tabbing}         


\noindent{\sc Event}:   Disable app.

\addvspace{18pt}

\noindent{\sc Event}:   Disable replace.

\addvspace{18pt}

\begin{verbatim};                     BITN
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bitn-0 \\ \index{bitn-0}
({\rm{bitn}}\,({\tt{0}}, {\it{n\/}})\index{bitn} $=$ {\tt{0}}) $\wedge$ (({\it{x\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{bitn}}\,({\it{x\/}}, {\it{i\/}})\index{bitn} $=$ {\tt{0}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-0-1 \\ \index{bitn-0-1}
{\rm{bitn}}\,({\it{x\/}}, {\it{n\/}})\index{bitn} $<$ {\tt{2}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-head \\ \index{bitn-head}
\=\+{\rm{bitn}}\,({\rm{head}}\,({\it{x\/}}, {\it{i\/}})\index{head}, {\it{j\/}})\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{j\/}} $<$ {\it{i\/}}$\;\;${\bf then }{\rm{bitn}}\,({\it{x\/}}, {\it{j\/}})\index{bitn} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-tail \\ \index{bitn-tail}
{\rm{bitn}}\,({\rm{tail}}\,({\it{x\/}}, {\it{i\/}})\index{tail}, {\it{j\/}})\index{bitn} $=$ {\rm{bitn}}\,({\it{x\/}}, {\it{i\/}} $+$ {\it{j\/}})\index{bitn}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-app \\ \index{bitn-app}
\=\+{\rm{bitn}}\,({\rm{app}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{k\/}})\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $<$ {\it{n\/}}$\;\;${\bf then }{\rm{bitn}}\,({\it{x\/}}, {\it{k\/}})\index{bitn} \\ 
{\bf else }{\rm{bitn}}\,({\it{y\/}}, {\it{k\/}} $-$ {\it{n\/}})\index{bitn}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-replace \\ \index{bitn-replace}
\=\+{\rm{bitn}}\,({\rm{replace}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{replace}, {\it{k\/}})\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $<$ {\it{n\/}}$\;\;${\bf then }{\rm{bitn}}\,({\it{x\/}}, {\it{k\/}})\index{bitn} \\ 
{\bf else }{\rm{bitn}}\,({\it{y\/}}, {\it{k\/}})\index{bitn}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable bitn.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  bitn-lognot \\ \index{bitn-lognot}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bitn}}\,({\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot}, {\it{i\/}})\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}}$\;\;${\bf then }{\rm{b-not}}\,({\rm{bitn}}\,({\it{x\/}}, {\it{i\/}})\index{bitn})\index{b-not} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim};               LOGAND, LOGOR, AND LOGEOR.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  logor-equal-0 \\ \index{logor-equal-0}
({\rm{logor}}\,({\it{x\/}}, {\it{y\/}})\index{logor} $=$ {\tt{0}}) $=$ (({\it{x\/}} $\simeq {\tt{0}}$) $\wedge$ ({\it{y\/}} $\simeq {\tt{0}}$))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logeor-equal-0 \\ \index{logeor-equal-0}
({\rm{logeor}}\,({\it{x\/}}, {\it{y\/}})\index{logeor} $=$ {\tt{0}}) $=$ ({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-commutativity \\ \index{logand-commutativity}
{\rm{logand}}\,({\it{x\/}}, {\it{y\/}})\index{logand} $=$ {\rm{logand}}\,({\it{y\/}}, {\it{x\/}})\index{logand}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logor-commutativity \\ \index{logor-commutativity}
{\rm{logor}}\,({\it{x\/}}, {\it{y\/}})\index{logor} $=$ {\rm{logor}}\,({\it{y\/}}, {\it{x\/}})\index{logor}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logeor-commutativity \\ \index{logeor-commutativity}
{\rm{logeor}}\,({\it{x\/}}, {\it{y\/}})\index{logeor} $=$ {\rm{logeor}}\,({\it{y\/}}, {\it{x\/}})\index{logeor}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-logor \\ \index{logand-logor}
{\rm{logand}}\,({\it{x\/}}, {\rm{logor}}\,({\it{y\/}}, {\it{z\/}})\index{logor})\index{logand} $=$ {\rm{logor}}\,({\rm{logand}}\,({\it{x\/}}, {\it{y\/}})\index{logand}, {\rm{logand}}\,({\it{x\/}}, {\it{z\/}})\index{logand})\index{logor}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-logeor \\ \index{logand-logeor}
{\rm{logand}}\,({\it{x\/}}, {\rm{logeor}}\,({\it{y\/}}, {\it{z\/}})\index{logeor})\index{logand} $=$ {\rm{logeor}}\,({\rm{logand}}\,({\it{x\/}}, {\it{y\/}})\index{logand}, {\rm{logand}}\,({\it{x\/}}, {\it{z\/}})\index{logand})\index{logeor}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-uint-la \\ \index{logand-uint-la}
{\rm{nat-to-uint}}\,({\rm{logand}}\,({\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp} $-\;1$, {\it{y\/}})\index{logand})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-uint \\ \index{logand-uint}
\=\+({\rm{exp}}\,({\tt{2}}, {\rm{log}}\,({\tt{2}}, $1\;+$ {\it{x\/}})\index{log})\index{exp} $=$ ($1\;+$ {\it{x\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{logand}}\,({\it{x\/}}, {\it{y\/}})\index{logand})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}})))\-
\end{tabbing}

\begin{verbatim};            HEAD WITH READ/WRITE AND READM/WRITEM
\end{verbatim}\begin{tabbing}{\sc Theorem}:  head-readp \\ \index{head-readp}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{readp}}\,({\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{map\/}})\index{readp} $=$ {\rm{readp}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{readp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-pc-readp \\ \index{head-pc-readp}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{pc-readp}}\,({\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{map\/}})\index{pc-readp} $=$ {\rm{pc-readp}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{pc-readp})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-writep \\ \index{head-writep}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{writep}}\,({\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{map\/}})\index{writep} $=$ {\rm{writep}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{writep})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-read \\ \index{head-read}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{read}}\,({\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{bt\/}})\index{read} $=$ {\rm{read}}\,({\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{read})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-pc-read \\ \index{head-pc-read}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{pc-read}}\,({\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{bt\/}})\index{pc-read} $=$ {\rm{pc-read}}\,({\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{pc-read})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-write \\ \index{head-write}
({\it{n\/}} $\leq$ {\it{k\/}}) $\rightarrow$ ({\rm{write}}\,({\it{value\/}}, {\rm{head}}\,({\it{x\/}}, {\it{k\/}})\index{head}, {\it{n\/}}, {\it{bt\/}})\index{write} $=$ {\rm{write}}\,({\it{value\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-byte-readp \\ \index{head-byte-readp}
{\rm{byte-readp}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{byte-readp} $=$ {\rm{byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-pc-byte-readp \\ \index{head-pc-byte-readp}
{\rm{pc-byte-readp}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{pc-byte-readp} $=$ {\rm{pc-byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-byte-writep \\ \index{head-byte-writep}
{\rm{byte-writep}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{byte-writep} $=$ {\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-byte-read \\ \index{head-byte-read}
{\rm{byte-read}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{byte-read} $=$ {\rm{byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-read}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-byte-pc-read \\ \index{head-byte-pc-read}
{\rm{pc-byte-read}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{pc-byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-read}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-byte-write \\ \index{head-byte-write}
{\rm{byte-write}}\,({\it{value\/}}, {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}})\index{byte-write} $=$ {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-read-memp \\ \index{head-read-memp}
{\rm{read-memp}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{read-memp} $=$ {\rm{read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-pc-read-memp \\ \index{head-pc-read-memp}
{\rm{pc-read-memp}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp} $=$ {\rm{pc-read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-write-memp \\ \index{head-write-memp}
{\rm{write-memp}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{write-memp} $=$ {\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-read-mem \\ \index{head-read-mem}
{\rm{read-mem}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{read-mem} $=$ {\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-pc-read-mem \\ \index{head-pc-read-mem}
{\rm{pc-read-mem}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem} $=$ {\rm{pc-read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-write-mem \\ \index{head-write-mem}
{\rm{write-mem}}\,({\it{value\/}}, {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{k\/}})\index{write-mem} $=$ {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-readm-mem \\ \index{head-readm-mem}
{\rm{readm-mem}}\,({\it{opsz\/}}, {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{n\/}})\index{readm-mem} $=$ {\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{readm-mem}
\end{tabbing}

\begin{verbatim};                  NAT-RANGEP
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-rangep-of-0 \\ \index{nat-rangep-of-0}
{\rm{nat-rangep}}\,({\tt{0}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}
                    
\begin{tabbing}{\sc Theorem}:  nat-rangep-ub \\ \index{nat-rangep-ub}
{\rm{nat-rangep}}\,({\rm{exp}}\,({\tt{2}}, {\it{k\/}})\index{exp} $-\;1$, {\it{n\/}})\index{nat-rangep} $=$ ({\it{n\/}} $\not<$ {\it{k\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-rangep-0 \\ \index{nat-rangep-0}
{\rm{nat-rangep}}\,({\it{x\/}}, {\tt{0}})\index{nat-rangep} $=$ ({\it{x\/}} $\simeq {\tt{0}}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  nat-plus-rangep \\ \index{nat-plus-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{k\/}})\index{nat-rangep} $\rightarrow$ ({\rm{nat-rangep}}\,({\it{x\/}}, {\it{k\/}} $+$ {\it{j\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{j\/}} $+$ {\it{k\/}})\index{nat-rangep})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub1-nat-rangep \\ \index{sub1-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{nat-rangep}}\,({\it{x\/}} $-\;1$, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub1-times2-nat-rangep \\ \index{sub1-times2-nat-rangep}
{\rm{nat-rangep}}\,(({\tt{2}} $*$ {\it{x\/}}) $-\;1$, $1\;+$ {\it{n\/}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{x\/}} $-\;1$, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-nat-rangep \\ \index{difference-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{nat-rangep}}\,({\it{x\/}} $-$ {\it{y\/}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quotient-nat-rangep \\ \index{quotient-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\rightarrow$ {\rm{nat-rangep}}\,({\it{x\/}} $\div$ {\it{y\/}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  times-exp2-nat-rangep \\ \index{times-exp2-nat-rangep}
{\rm{nat-rangep}}\,({\it{x\/}} $*$ {\rm{exp}}\,({\tt{2}}, {\it{i\/}})\index{exp}, {\it{n\/}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}} $-$ {\it{i\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-nat-rangep \\ \index{logand-nat-rangep}
({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\vee$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{logand}}\,({\it{x\/}}, {\it{y\/}})\index{logand}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logor-nat-rangep \\ \index{logor-nat-rangep}
{\rm{nat-rangep}}\,({\rm{logor}}\,({\it{x\/}}, {\it{y\/}})\index{logor}, {\it{n\/}})\index{nat-rangep} $=$ ({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logeor-nat-rangep \\ \index{logeor-nat-rangep}
({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{logeor}}\,({\it{x\/}}, {\it{y\/}})\index{logeor}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-nat-rangep \\ \index{head-nat-rangep}
({\it{m\/}} $\leq$ {\it{n\/}}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{head}}\,({\it{x\/}}, {\it{m\/}})\index{head}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-nat-rangep \\ \index{tail-nat-rangep}
{\rm{nat-rangep}}\,({\rm{tail}}\,({\it{x\/}}, {\it{m\/}})\index{tail}, {\it{n\/}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{m\/}} $+$ {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-nat-rangep \\ \index{read-rn-nat-rangep}
{\rm{nat-rangep}}\,({\rm{read-rn}}\,({\it{n\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-read-nat-rangep \\ \index{byte-read-nat-rangep}
({\tt{8}} $\leq$ {\it{n\/}}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-read}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-read-nat-rangep \\ \index{pc-byte-read-nat-rangep}
{\rm{nat-rangep}}\,({\rm{pc-byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-read}, {\tt{8}})\index{nat-rangep}
\end{tabbing}


\noindent{\sc Event}:   Disable nat-rangep.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  mulu-nat-rangep \\ \index{mulu-nat-rangep}
{\rm{nat-rangep}}\,({\rm{mulu}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}}, {\it{i\/}})\index{mulu}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls-nat-rangep \\ \index{muls-nat-rangep}
{\rm{nat-rangep}}\,({\rm{muls}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}}, {\it{i\/}})\index{muls}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  quot-nat-rangep \\ \index{quot-nat-rangep}
{\rm{nat-rangep}}\,({\rm{quot}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{quot}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  rem-nat-rangep \\ \index{rem-nat-rangep}
{\rm{nat-rangep}}\,({\rm{rem}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{rem}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iquot-nat-rangep \\ \index{iquot-nat-rangep}
{\rm{nat-rangep}}\,({\rm{iquot}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}}, {\it{y\/}}, {\it{j\/}})\index{iquot}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  irem-nat-rangep \\ \index{irem-nat-rangep}
{\rm{nat-rangep}}\,({\rm{irem}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}}, {\it{y\/}}, {\it{j\/}})\index{irem}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  neg-nat-rangep \\ \index{neg-nat-rangep}
{\rm{nat-rangep}}\,({\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{verbatim};                         EXT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ext-0 \\ \index{ext-0}
{\rm{ext}}\,({\it{n\/}}, {\tt{0}}, {\it{size\/}})\index{ext} $=$ {\tt{0}}
\end{tabbing}       

\begin{tabbing}{\sc Theorem}:  ext-lemma \\ \index{ext-lemma}
({\it{size\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext} $=$ {\rm{head}}\,({\it{x\/}}, {\it{size\/}})\index{head})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-ext \\ \index{head-ext}
(({\it{i\/}} $\leq$ {\it{j\/}}) $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ ({\rm{head}}\,({\rm{ext}}\,({\it{j\/}}, {\it{x\/}}, {\it{k\/}})\index{ext}, {\it{i\/}})\index{head} $=$ {\rm{head}}\,({\it{x\/}}, {\it{i\/}})\index{head})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-nat-rangep \\ \index{ext-nat-rangep}
{\rm{nat-rangep}}\,({\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext}, {\it{size\/}})\index{nat-rangep}
\end{tabbing}


\noindent{\sc Event}:   Disable ext.

\addvspace{18pt}

\begin{verbatim};                      CVZNX-FLAGS
\end{verbatim}\begin{tabbing}{\sc Theorem}:  set-cvznx-c \\ \index{set-cvznx-c}
{\rm{ccr-c}}\,({\rm{set-cvznx}}\,({\rm{cvznx}}\,({\it{c\/}}, {\it{v\/}}, {\it{z\/}}, {\it{n\/}}, {\it{x\/}})\index{cvznx}, {\it{ccr\/}})\index{set-cvznx})\index{ccr-c} $=$ {\rm{fix-bit}}\,({\it{c\/}})\index{fix-bit}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-v \\ \index{set-cvznx-v}
{\rm{ccr-v}}\,({\rm{set-cvznx}}\,({\rm{cvznx}}\,({\it{c\/}}, {\it{v\/}}, {\it{z\/}}, {\it{n\/}}, {\it{x\/}})\index{cvznx}, {\it{ccr\/}})\index{set-cvznx})\index{ccr-v} $=$ {\rm{fix-bit}}\,({\it{v\/}})\index{fix-bit}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-z \\ \index{set-cvznx-z}
{\rm{ccr-z}}\,({\rm{set-cvznx}}\,({\rm{cvznx}}\,({\it{c\/}}, {\it{v\/}}, {\it{z\/}}, {\it{n\/}}, {\it{x\/}})\index{cvznx}, {\it{ccr\/}})\index{set-cvznx})\index{ccr-z} $=$ {\rm{fix-bit}}\,({\it{z\/}})\index{fix-bit}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-n \\ \index{set-cvznx-n}
{\rm{ccr-n}}\,({\rm{set-cvznx}}\,({\rm{cvznx}}\,({\it{c\/}}, {\it{v\/}}, {\it{z\/}}, {\it{n\/}}, {\it{x\/}})\index{cvznx}, {\it{ccr\/}})\index{set-cvznx})\index{ccr-n} $=$ {\rm{fix-bit}}\,({\it{n\/}})\index{fix-bit}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-x \\ \index{set-cvznx-x}
{\rm{ccr-x}}\,({\rm{set-cvznx}}\,({\rm{cvznx}}\,({\it{c\/}}, {\it{v\/}}, {\it{z\/}}, {\it{n\/}}, {\it{x\/}})\index{cvznx}, {\it{ccr\/}})\index{set-cvznx})\index{ccr-x} $=$ {\rm{fix-bit}}\,({\it{x\/}})\index{fix-bit}
\end{tabbing}

\begin{verbatim}; the new cvznx-flags replaces the old ones.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  set-set-cvznx1 \\ \index{set-set-cvznx1}
{\rm{set-cvznx}}\,({\it{x\/}}, {\rm{set-cvznx}}\,({\it{y\/}}, {\it{ccr\/}})\index{set-cvznx})\index{set-cvznx} $=$ {\rm{set-cvznx}}\,({\it{x\/}}, {\it{ccr\/}})\index{set-cvznx}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-ccr \\ \index{set-cvznx-ccr}
{\rm{set-cvznx}}\,({\it{ccr\/}}, {\it{ccr\/}})\index{set-cvznx} $=$ {\rm{fix}}\,({\it{ccr\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-set-cvznx2 \\ \index{set-set-cvznx2}
{\rm{set-cvznx}}\,({\rm{set-cvznx}}\,({\it{x\/}}, {\it{ccr\/}})\index{set-cvznx}, {\it{ccr\/}})\index{set-cvznx} $=$ {\rm{set-cvznx}}\,({\it{x\/}}, {\it{ccr\/}})\index{set-cvznx}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  set-cvznx-nat-rangep \\ \index{set-cvznx-nat-rangep}
{\rm{nat-rangep}}\,({\rm{set-cvznx}}\,({\it{x\/}}, {\it{ccr\/}})\index{set-cvznx}, {\tt{8}})\index{nat-rangep} $=$ {\rm{nat-rangep}}\,({\it{ccr\/}}, {\tt{8}})\index{nat-rangep}
\end{tabbing}


\noindent{\sc Event}:   Disable ccr-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ccr-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ccr-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ccr-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ccr-x.

\addvspace{18pt}

\noindent{\sc Event}:   Disable cvznx.

\addvspace{18pt}

\noindent{\sc Event}:   Disable set-cvznx.

\addvspace{18pt}

\begin{verbatim};                       MC ACCESSORS
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mc-status-rewrite \\ \index{mc-status-rewrite}
{\rm{mc-status}}\,({\rm{mc-state}}\,({\it{status\/}}, {\it{rfile\/}}, {\it{pc\/}}, {\it{ccr\/}}, {\it{mem\/}})\index{mc-state})\index{mc-status} $=$ {\it{status\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-rfile-rewrite \\ \index{mc-rfile-rewrite}
{\rm{mc-rfile}}\,({\rm{mc-state}}\,({\it{status\/}}, {\it{rfile\/}}, {\it{pc\/}}, {\it{ccr\/}}, {\it{mem\/}})\index{mc-state})\index{mc-rfile} $=$ {\it{rfile\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-pc-rewrite \\ \index{mc-pc-rewrite}
\=\+{\rm{nat-rangep}}\,({\it{pc\/}}, {\tt{32}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$({\rm{mc-pc}}\,({\rm{mc-state}}\,({\it{status\/}}, {\it{rfile\/}}, {\it{pc\/}}, {\it{ccr\/}}, {\it{mem\/}})\index{mc-state})\index{mc-pc} $=$ {\rm{fix}}\,({\it{pc\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-ccr-rewrite \\ \index{mc-ccr-rewrite}
\=\+{\rm{nat-rangep}}\,({\it{ccr\/}}, {\tt{8}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$({\rm{mc-ccr}}\,({\rm{mc-state}}\,({\it{status\/}}, {\it{rfile\/}}, {\it{pc\/}}, {\it{ccr\/}}, {\it{mem\/}})\index{mc-state})\index{mc-ccr} $=$ {\rm{fix}}\,({\it{ccr\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-mem-rewrite \\ \index{mc-mem-rewrite}
{\rm{mc-mem}}\,({\rm{mc-state}}\,({\it{status\/}}, {\it{rfile\/}}, {\it{pc\/}}, {\it{ccr\/}}, {\it{mem\/}})\index{mc-state})\index{mc-mem} $=$ {\it{mem\/}}
\end{tabbing}

\begin{verbatim}; lemmas about those mc accessors. 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mc-pc-rangep \\ \index{mc-pc-rangep}
{\rm{nat-rangep}}\,({\rm{mc-pc}}\,({\it{s\/}})\index{mc-pc}, {\tt{32}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-ccr-rangep \\ \index{mc-ccr-rangep}
{\rm{nat-rangep}}\,({\rm{mc-ccr}}\,({\it{s\/}})\index{mc-ccr}, {\tt{8}})\index{nat-rangep}
\end{tabbing}


\noindent{\sc Event}:   Disable mc-status.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mc-rfile.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mc-pc.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mc-ccr.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mc-mem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mc-state.

\addvspace{18pt}

\begin{verbatim};           THE BASIC GET-NTH/PUT-NTH RELATIONS
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  get-nth-0 \\ \index{get-nth-0}
({\it{i\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\rm{get-nth}}\,({\tt{0}}, {\it{lst\/}})\index{get-nth})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-nth-0 \\ \index{put-nth-0}
({\it{i\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{put-nth}}\,({\it{v\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth} $=$ {\rm{put-nth}}\,({\it{v\/}}, {\tt{0}}, {\it{lst\/}})\index{put-nth})
\end{tabbing}


\noindent{\sc Event}:   Disable get-nth-0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable put-nth-0.

\addvspace{18pt}
             
\begin{tabbing}{\sc Theorem}:  get-nth-nil \\ \index{get-nth-nil}
({\rm{get-nth}}\,({\it{n\/}}, {\bf{nil}})\index{get-nth} $=$ {\tt{0}}) $\wedge$ ({\rm{get-nth}}\,({\it{n\/}}, {\tt{0}})\index{get-nth} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-put \\ \index{get-put}
\=\+{\rm{get-nth}}\,({\it{n\/}}, {\rm{put-nth}}\,({\it{value\/}}, {\it{m\/}}, {\it{lst\/}})\index{put-nth})\index{get-nth} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{fix}}\,({\it{m\/}}) $=$ {\rm{fix}}\,({\it{n\/}})$\;\;${\bf then }{\it{value\/}} \\ 
{\bf else }{\rm{get-nth}}\,({\it{n\/}}, {\it{lst\/}})\index{get-nth}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-put \\ \index{put-put}
{\rm{put-nth}}\,({\it{value1\/}}, {\it{n\/}}, {\rm{put-nth}}\,({\it{value\/}}, {\it{n\/}}, {\it{lst\/}})\index{put-nth})\index{put-nth} $=$ {\rm{put-nth}}\,({\it{value1\/}}, {\it{n\/}}, {\it{lst\/}})\index{put-nth}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-get \\ \index{put-get}
({\it{n\/}} $<$ {\rm{len}}\,({\it{lst\/}})\index{len}) $\rightarrow$ ({\rm{put-nth}}\,({\rm{get-nth}}\,({\it{n\/}}, {\it{lst\/}})\index{get-nth}, {\it{n\/}}, {\it{lst\/}})\index{put-nth} $=$ {\it{lst\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-nth-len \\ \index{put-nth-len}
\=\+{\rm{len}}\,({\rm{put-nth}}\,({\it{value\/}}, {\it{n\/}}, {\it{lst\/}})\index{put-nth})\index{len} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\rm{len}}\,({\it{lst\/}})\index{len}$\;\;${\bf then }{\rm{len}}\,({\it{lst\/}})\index{len} \\ 
{\bf else }$1\;+$ {\it{n\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};            THE BASIC READ-RN/WRITE-RN RELATIONS
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  head-read-rn \\ \index{head-read-rn}
({\it{n1\/}} $\leq$ {\it{n2\/}}) $\rightarrow$ ({\rm{head}}\,({\rm{read-rn}}\,({\it{n2\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\it{n1\/}})\index{head} $=$ {\rm{read-rn}}\,({\it{n1\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn})
\end{tabbing}

\begin{verbatim}; stop proving.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{read-write-rn-end} \\  
\=\+{\rm{read-write-rn-end}}\,({\it{n2\/}}, {\it{rn\/}}, {\it{n1\/}}, {\it{value\/}}, {\it{rm\/}}, {\it{rfile\/}})\index{read-write-rn-end} \\ 
$=$$\;\;\;\;${\rm{read-rn}}\,({\it{n2\/}}, {\it{rn\/}}, {\rm{write-rn}}\,({\it{n1\/}}, {\it{value\/}}, {\it{rm\/}}, {\it{rfile\/}})\index{write-rn})\index{read-rn}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-write-rn \\ \index{read-write-rn}
\=\+{\rm{read-rn}}\,({\it{n2\/}}, {\it{rn\/}}, {\rm{write-rn}}\,({\it{n1\/}}, {\it{value\/}}, {\it{rm\/}}, {\it{rfile\/}})\index{write-rn})\index{read-rn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{fix}}\,({\it{rm\/}}) $=$ {\rm{fix}}\,({\it{rn\/}}) \\ 
{\bf then }\=\+{\bf if }{\it{n2\/}} $\leq$ {\it{n1\/}}$\;\;${\bf then }{\rm{head}}\,({\it{value\/}}, {\it{n2\/}})\index{head} \\ 
{\bf else }{\rm{replace}}\,({\it{n1\/}}, {\it{value\/}}, {\rm{read-rn}}\,({\it{n2\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn})\index{replace}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{read-rn}}\,({\it{n2\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-write-rn \\ \index{write-write-rn}
\=\+({\it{n1\/}} $\leq$ {\it{n2\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{write-rn}}\,({\it{n2\/}}, {\it{v2\/}}, {\it{rn\/}}, {\rm{write-rn}}\,({\it{n1\/}}, {\it{v1\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{write-rn})\index{write-rn} \\ 
$=$$\;\;\;\;${\rm{write-rn}}\,({\it{n2\/}}, {\it{v2\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{write-rn})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-rn-len \\ \index{write-rn-len}
\=\+{\rm{len}}\,({\rm{write-rn}}\,({\it{oplen\/}}, {\it{value\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{write-rn})\index{len} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{rn\/}} $<$ {\rm{len}}\,({\it{rfile\/}})\index{len}$\;\;${\bf then }{\rm{len}}\,({\it{rfile\/}})\index{len} \\ 
{\bf else }$1\;+$ {\it{rn\/}}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-rn.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-rn.

\addvspace{18pt}

\begin{verbatim};             THE BASIC READM-RN/WRITEM-RN EVENTS
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  readm-rn-len \\ \index{readm-rn-len}
{\rm{len}}\,({\rm{readm-rn}}\,({\it{oplen\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{readm-rn})\index{len} $=$ {\rm{len}}\,({\it{rnlst\/}})\index{len}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{get-vlst} \\  
\=\+{\rm{get-vlst}}\,({\it{oplen\/}}, {\it{value\/}}, {\it{rn\/}}, {\it{rnlst\/}}, {\it{vlst\/}})\index{get-vlst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{rnlst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\it{value\/}} \\ 
{\bf elseif }{\rm{fix}}\,({\it{rn\/}}) $=$ {\rm{fix}}\,({\rm{car}}\,({\it{rnlst\/}})) \\ 
{\bf then }{\rm{get-vlst}}\,({\it{oplen\/}}, {\rm{head}}\,({\rm{car}}\,({\it{vlst\/}}), {\it{oplen\/}})\index{head}, {\it{rn\/}}, {\rm{cdr}}\,({\it{rnlst\/}}), {\rm{cdr}}\,({\it{vlst\/}}))\index{get-vlst} \\ 
{\bf else }{\rm{get-vlst}}\,({\it{oplen\/}}, {\it{value\/}}, {\it{rn\/}}, {\rm{cdr}}\,({\it{rnlst\/}}), {\rm{cdr}}\,({\it{vlst\/}}))\index{get-vlst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; we deliberately put on the hypothesis (numberp value) to restrict the use 
; of this lemma.  The dead loop situation is thereby avoided.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  get-vlst-member \\ \index{get-vlst-member}
\=\+({\it{value\/}} $\in\;${\bf{N}}${}$) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{get-vlst}}\,({\it{oplen\/}}, {\it{value\/}}, {\it{rn\/}}, {\it{rnlst\/}}, {\it{vlst\/}})\index{get-vlst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{n-member}}\,({\it{rn\/}}, {\it{rnlst\/}})\index{n-member}$\;\;${\bf then }{\rm{get-vlst}}\,({\it{oplen\/}}, {\bf{nil}}, {\it{rn\/}}, {\it{rnlst\/}}, {\it{vlst\/}})\index{get-vlst} \\ 
{\bf else }{\it{value\/}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; stop proving.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{read-writem-rn-end} \\  
\=\+{\rm{read-writem-rn-end}}\,({\it{n1\/}}, {\it{rn\/}}, {\it{n2\/}}, {\it{vlst\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{read-writem-rn-end} \\ 
$=$$\;\;\;\;${\rm{read-rn}}\,({\it{n1\/}}, {\it{rn\/}}, {\rm{writem-rn}}\,({\it{n2\/}}, {\it{vlst\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{writem-rn})\index{read-rn}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-writem-rn \\ \index{read-writem-rn}
\=\+{\rm{read-rn}}\,({\it{n1\/}}, {\it{rn\/}}, {\rm{writem-rn}}\,({\it{n2\/}}, {\it{vlst\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{writem-rn})\index{read-rn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{n-member}}\,({\it{rn\/}}, {\it{rnlst\/}})\index{n-member} \\ 
{\bf then }\=\+{\bf if }({\it{n1\/}} $\leq$ {\it{n2\/}}) $\wedge$ ({\it{n2\/}} $\leq$ {\tt{32}}) \\ 
{\bf then }{\rm{get-vlst}}\,({\it{n1\/}}, {\tt{0}}, {\it{rn\/}}, {\it{rnlst\/}}, {\it{vlst\/}})\index{get-vlst} \\ 
{\bf else }{\rm{read-writem-rn-end}}\,({\it{n1\/}}, {\it{rn\/}}, {\it{n2\/}}, {\it{vlst\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{read-writem-rn-end}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{read-rn}}\,({\it{n1\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-writem-rn-end.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  readm-write-rn \\ \index{readm-write-rn}
\=\+($\neg$ {\rm{n-member}}\,({\it{rn\/}}, {\it{rnlst\/}})\index{n-member}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{readm-rn}}\,({\it{n1\/}}, {\it{rnlst\/}}, {\rm{write-rn}}\,({\it{n2\/}}, {\it{value\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{write-rn})\index{readm-rn} \\ 
$=$$\;\;\;\;${\rm{readm-rn}}\,({\it{n1\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{readm-rn})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-0 \\ \index{read-rn-0}
({\it{rn\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{read-rn}}\,({\it{oplen\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn} $=$ {\rm{read-rn}}\,({\it{oplen\/}}, {\tt{0}}, {\it{rfile\/}})\index{read-rn})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vlst-readm-rn \\ \index{get-vlst-readm-rn}
\=\+({\it{n1\/}} $\leq$ {\it{n2\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{get-vlst}}\,({\it{n1\/}}, {\tt{0}}, {\it{rn\/}}, {\it{rnlst\/}}, {\rm{readm-rn}}\,({\it{n2\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{readm-rn})\index{get-vlst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{n-member}}\,({\it{rn\/}}, {\it{rnlst\/}})\index{n-member}$\;\;${\bf then }{\rm{read-rn}}\,({\it{n1\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-rn-0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable get-vlst-member.

\addvspace{18pt}

\noindent{\sc Event}:   Disable get-vlst.

\addvspace{18pt}

\begin{verbatim};           THE BASIC READ-MEM/WRITE-MEM EVENTS
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-readp-$>$readp \\ \index{pc-readp-$>$readp}
{\rm{pc-readp}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{pc-readp} $\rightarrow$ {\rm{readp}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writep-$>$readp \\ \index{writep-$>$readp}
{\rm{writep}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{writep} $\rightarrow$ {\rm{readp}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{readp}
\end{tabbing}

\begin{verbatim}; a read right after a write at the same location returns the new value
; just writen.  But a read right after a write at a different location 
; has the same effect as a read made on the original binary tree.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{modn-eq} \\  
\=\+{\rm{modn-eq}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{modn-eq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }({\rm{bitn}}\,({\it{x\/}}, {\it{n\/}} $-\;1$)\index{bitn} $=$ {\rm{bitn}}\,({\it{y\/}}, {\it{n\/}} $-\;1$)\index{bitn}) $\wedge$ {\rm{modn-eq}}\,({\it{n\/}} $-\;1$, {\it{x\/}}, {\it{y\/}})\index{modn-eq}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-write \\ \index{read-write}
\=\+{\rm{read}}\,({\it{y\/}}, {\it{n\/}}, {\rm{write}}\,({\it{value\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})\index{read} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{modn-eq}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{modn-eq}$\;\;${\bf then }{\it{value\/}} \\ 
{\bf else }{\rm{read}}\,({\it{y\/}}, {\it{n\/}}, {\it{bt\/}})\index{read}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; pc should always be able to go through the memory.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-read-write \\ \index{pc-read-write}
\=\+({\rm{writep}}\,({\it{x\/}}, {\it{n\/}}, {\it{map\/}})\index{writep} $\wedge$ {\rm{pc-readp}}\,({\it{y\/}}, {\it{n\/}}, {\it{map\/}})\index{pc-readp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read}}\,({\it{y\/}}, {\it{n\/}}, {\rm{write}}\,({\it{value\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})\index{pc-read} $=$ {\rm{pc-read}}\,({\it{y\/}}, {\it{n\/}}, {\it{bt\/}})\index{pc-read})\-
\end{tabbing}
 
\begin{verbatim}; write twice at the same location is equivalent to the second write on
; the original binary tree.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-write-la \\ \index{write-write-la}
\=\+{\rm{write}}\,({\it{v2\/}}, {\it{y\/}}, {\it{n\/}}, {\rm{write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})\index{write} \\ 
$=$$\;\;\;\;$\=\+{\bf if }$\neg$ {\rm{modn-eq}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{modn-eq}$\;\;${\bf then }{\rm{write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{n\/}}, {\rm{write}}\,({\it{v2\/}}, {\it{y\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})\index{write} \\ 
{\bf else }{\rm{write}}\,({\it{v2\/}}, {\it{y\/}}, {\it{n\/}}, {\it{bt\/}})\index{write}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-write \\ \index{write-write}
{\rm{write}}\,({\it{v2\/}}, {\it{x\/}}, {\it{n\/}}, {\rm{write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write})\index{write} $=$ {\rm{write}}\,({\it{v2\/}}, {\it{x\/}}, {\it{n\/}}, {\it{bt\/}})\index{write}
\end{tabbing}


\noindent{\sc Event}:   Disable pc-read.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  plus-times-equal \\ \index{plus-times-equal}
\=\+(({\it{a\/}} $<$ {\it{k\/}}) $\wedge$ ({\it{b\/}} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{a\/}} $+$ ({\it{i\/}} $*$ {\it{k\/}})) $=$ ({\it{b\/}} $+$ ({\it{j\/}} $*$ {\it{k\/}}))) \\ 
$=$$\;\;\;\;$(({\rm{fix}}\,({\it{a\/}}) $=$ {\rm{fix}}\,({\it{b\/}})) $\wedge$ ({\rm{fix}}\,({\it{i\/}}) $=$ {\rm{fix}}\,({\it{j\/}}))))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  app-cancel \\ \index{app-cancel}
\=\+({\rm{app}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{app} $=$ {\rm{app}}\,({\it{n\/}}, {\it{x1\/}}, {\it{y1\/}})\index{app}) \\ 
$=$$\;\;\;\;$(({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{x1\/}}, {\it{n\/}})\index{head}) $\wedge$ ({\rm{fix}}\,({\it{y\/}}) $=$ {\rm{fix}}\,({\it{y1\/}})))\-
\end{tabbing}


\noindent{\sc Event}:   Disable plus-times-equal.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  head-app-cancel \\ \index{head-app-cancel}
({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{app}}\,({\it{n\/}}, {\it{x1\/}}, {\it{y1\/}})\index{app}) $=$ (({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{x1\/}}, {\it{n\/}})\index{head}) $\wedge$ ({\it{y1\/}} $\simeq {\tt{0}}$))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-recursion \\ \index{head-recursion}
{\rm{head}}\,({\it{x\/}}, $1\;+$ {\it{n\/}})\index{head} $=$ {\rm{app}}\,({\it{n\/}}, {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}, {\rm{bitn}}\,({\it{x\/}}, {\it{n\/}})\index{bitn})\index{app}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  modn-eq-equal \\ \index{modn-eq-equal}
{\rm{modn-eq}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{modn-eq} $=$ ({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-equal \\ \index{ext-equal}
\=\+(({\it{n\/}} $\leq$ {\it{size\/}}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext} $=$ {\rm{ext}}\,({\it{n\/}}, {\it{y\/}}, {\it{size\/}})\index{ext}) $=$ ({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\rm{head}}\,({\it{y\/}}, {\it{n\/}})\index{head}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-equal-0 \\ \index{ext-equal-0}
\=\+(({\it{n\/}} $\leq$ {\it{size\/}}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext} $=$ {\tt{0}}) $=$ ({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $=$ {\tt{0}}))\-
\end{tabbing}


\noindent{\sc Event}:   Disable head-recursion.

\addvspace{18pt}

\begin{verbatim};               BYTE-READ/BYTE-WRITE
;
; pc-byte-readp --> byte-readp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-byte-readp-$>$byte-readp \\ \index{pc-byte-readp-$>$byte-readp}
{\rm{pc-byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-readp} $\rightarrow$ {\rm{byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{verbatim}; byte-writep --> byte-readp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-writep-$>$readp \\ \index{byte-writep-$>$readp}
{\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep} $\rightarrow$ {\rm{byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-read-write \\ \index{byte-read-write}
\=\+{\rm{byte-read}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{v\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write})\index{byte-read} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{mod32-eq}}\,({\it{x\/}}, {\it{y\/}})\index{mod32-eq} \\ 
{\bf then }\=\+{\bf if }{\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}})\index{nat-rangep}$\;\;${\bf then }{\rm{fix}}\,({\it{v\/}}) \\ 
{\bf else }{\rm{head}}\,({\it{v\/}}, {\tt{8}})\index{head}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-read}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-write-la \\ \index{byte-write-write-la}
\=\+{\rm{byte-write}}\,({\it{v2\/}}, {\it{y\/}}, {\rm{byte-write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write})\index{byte-write} \\ 
$=$$\;\;\;\;$\=\+{\bf if }$\neg$ {\rm{mod32-eq}}\,({\it{x\/}}, {\it{y\/}})\index{mod32-eq}$\;\;${\bf then }{\rm{byte-write}}\,({\it{v1\/}}, {\it{x\/}}, {\rm{byte-write}}\,({\it{v2\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write})\index{byte-write} \\ 
{\bf else }{\rm{byte-write}}\,({\it{v2\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-write \\ \index{byte-write-write}
{\rm{byte-write}}\,({\it{v2\/}}, {\it{x\/}}, {\rm{byte-write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write})\index{byte-write} $=$ {\rm{byte-write}}\,({\it{v2\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-read-write \\ \index{pc-byte-read-write}
\=\+({\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep} $\wedge$ {\rm{pc-byte-readp}}\,({\it{y\/}}, {\it{mem\/}})\index{pc-byte-readp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\it{y\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write})\index{pc-byte-read} $=$ {\rm{pc-byte-read}}\,({\it{y\/}}, {\it{mem\/}})\index{pc-byte-read})\-
\end{tabbing}

\begin{verbatim}; write on memory does not change the properties of the memory.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-write-maintain-pc-byte-readp \\ \index{byte-write-maintain-pc-byte-rea!dp}
{\rm{pc-byte-readp}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write})\index{pc-byte-readp} $=$ {\rm{pc-byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-maintain-byte-readp \\ \index{byte-write-maintain-byte-readp}
{\rm{byte-readp}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write})\index{byte-readp} $=$ {\rm{byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-maintain-byte-writep \\ \index{byte-write-maintain-byte-writep}
{\rm{byte-writep}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write})\index{byte-writep} $=$ {\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{verbatim}; a lemma useful to deal with read-mem/write-mem.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-write-app \\ \index{byte-write-app}
({\tt{8}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\rm{byte-write}}\,({\rm{app}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{app}, {\it{addr\/}}, {\it{mem\/}})\index{byte-write} $=$ {\rm{byte-write}}\,({\it{x\/}}, {\it{addr\/}}, {\it{mem\/}})\index{byte-write})
\end{tabbing}


\noindent{\sc Event}:   Disable pc-byte-readp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable byte-readp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable byte-writep.

\addvspace{18pt}

\noindent{\sc Event}:   Disable pc-byte-read.

\addvspace{18pt}

\noindent{\sc Event}:   Disable byte-read.

\addvspace{18pt}

\noindent{\sc Event}:   Disable byte-write.

\addvspace{18pt}

\begin{verbatim};             THE BASIC READ-MEM/WRITE-MEM EVENTS
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mem-induct0} \\  
\=\+{\rm{mem-induct0}}\,({\it{k\/}}, {\it{n\/}})\index{mem-induct0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{mem-induct0}}\,({\it{k\/}} $-\;1$, {\it{n\/}} $-$ {\tt{8}})\index{mem-induct0}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-nat-rangep \\ \index{pc-read-mem-nat-rangep}
({\it{n\/}} $=$ ({\tt{8}} $*$ {\it{k\/}})) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{pc-read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-nat-rangep \\ \index{read-mem-nat-rangep}
(({\tt{8}} $*$ {\it{k\/}}) $\leq$ {\it{n\/}}) $\rightarrow$ {\rm{nat-rangep}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}

\begin{verbatim}; write on memory does not change the properties of the memory. i.e. RAM is
; still RAM, ROM is still ROM, and UNAVAILABLE is still unavailable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-mem-maintain-pc-byte-readp \\ \index{write-mem-maintain-pc-byte-readp}
{\rm{pc-byte-readp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem})\index{pc-byte-readp} $=$ {\rm{pc-byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-byte-readp \\ \index{write-mem-maintain-byte-readp}
{\rm{byte-readp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem})\index{byte-readp} $=$ {\rm{byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-byte-writep \\ \index{write-mem-maintain-byte-writep}
{\rm{byte-writep}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem})\index{byte-writep} $=$ {\rm{byte-writep}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-maintain-pc-read-memp \\ \index{byte-write-maintain-pc-read-memp}
{\rm{pc-read-memp}}\,({\it{addr\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{pc-read-memp} $=$ {\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-maintain-read-memp \\ \index{byte-write-maintain-read-memp}
{\rm{read-memp}}\,({\it{addr\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{read-memp} $=$ {\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write-maintain-write-memp \\ \index{byte-write-maintain-write-memp}
{\rm{write-memp}}\,({\it{addr\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{write-memp} $=$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-pc-read-memp \\ \index{write-mem-maintain-pc-read-memp}
{\rm{pc-read-memp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{pc-read-memp} $=$ {\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-read-memp \\ \index{write-mem-maintain-read-memp}
{\rm{read-memp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{read-memp} $=$ {\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-write-memp \\ \index{write-mem-maintain-write-memp}
{\rm{write-memp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{write-memp} $=$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp}
\end{tabbing}

\begin{verbatim}; if it is pc-readable, then it must be readable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-read-memp-$>$read-memp \\ \index{pc-read-memp-$>$read-memp}
{\rm{pc-read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp} $\rightarrow$ {\rm{read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-memp}
\end{tabbing}

\begin{verbatim}; if it is writeable, then it must be readable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-memp-$>$read-memp \\ \index{write-memp-$>$read-memp}
{\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\rightarrow$ {\rm{read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-memp}
\end{tabbing}

\begin{verbatim}; program segments are never changed as the memory are changed.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-byte-read-write-mem \\ \index{pc-byte-read-write-mem}
\=\+({\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\wedge$ {\rm{pc-byte-readp}}\,({\it{y\/}}, {\it{mem\/}})\index{pc-byte-readp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\it{y\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem})\index{pc-byte-read} $=$ {\rm{pc-byte-read}}\,({\it{y\/}}, {\it{mem\/}})\index{pc-byte-read})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-byte-write \\ \index{pc-read-mem-byte-write}
\=\+({\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep} $\wedge$ {\rm{pc-read-memp}}\,({\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\it{y\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{pc-read-mem} $=$ {\rm{pc-read-mem}}\,({\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-mem})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-write-mem \\ \index{pc-read-mem-write-mem}
\=\+({\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-memp} $\wedge$ {\rm{pc-read-memp}}\,({\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\it{y\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{pc-read-mem} $=$ {\rm{pc-read-mem}}\,({\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-mem})\-
\end{tabbing}

\begin{verbatim}; a byte-read vs a multi-write.
; stop proving.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{byte-read-write-mem-end} \\  
\=\+{\rm{byte-read-write-mem-end}}\,({\it{x\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}})\index{byte-read-write-mem-end} \\ 
$=$$\;\;\;\;${\rm{byte-read}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem})\index{byte-read}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-read-write-mem \\ \index{byte-read-write-mem}
\=\+{\rm{byte-read}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem})\index{byte-read} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{disjoint}}\,({\it{x\/}}, {\tt{1}}, {\it{y\/}}, {\it{k\/}})\index{disjoint}$\;\;${\bf then }{\rm{byte-read}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-read} \\ 
{\bf else }{\rm{byte-read-write-mem-end}}\,({\it{x\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}})\index{byte-read-write-mem-end}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; a multi-read vs a byte-write.
; stop proving.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{read-mem-byte-write-end} \\  
\=\+{\rm{read-mem-byte-write-end}}\,({\it{x\/}}, {\it{n\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{read-mem-byte-write-end} \\ 
$=$$\;\;\;\;${\rm{read-mem}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{read-mem}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-byte-write \\ \index{read-mem-byte-write}
\=\+{\rm{read-mem}}\,({\it{x\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{read-mem} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{disjoint0}}\,({\it{x\/}}, {\it{n\/}}, {\it{y\/}})\index{disjoint0}$\;\;${\bf then }{\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-mem} \\ 
{\bf else }{\rm{read-mem-byte-write-end}}\,({\it{x\/}}, {\it{n\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}})\index{read-mem-byte-write-end}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; a multi-read vs a multi-write.
; stop proving.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{read-write-mem-end} \\  
\=\+{\rm{read-write-mem-end}}\,({\it{x\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{m\/}}, {\it{n\/}})\index{read-write-mem-end} \\ 
$=$$\;\;\;\;${\rm{read-mem}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{read-mem}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-write-mem1 \\ \index{read-write-mem1}
\=\+{\rm{read-mem}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem}, {\it{n\/}})\index{read-mem} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{disjoint}}\,({\it{x\/}}, {\it{n\/}}, {\it{y\/}}, {\it{k\/}})\index{disjoint}$\;\;${\bf then }{\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-mem} \\ 
{\bf else }{\rm{read-write-mem-end}}\,({\it{x\/}}, {\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{k\/}}, {\it{n\/}})\index{read-write-mem-end}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-sub1-lessp \\ \index{head-sub1-lessp}
(({\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head} $-\;1$) $<$ {\it{x\/}}) $=$ ({\it{x\/}} $\not\simeq {\tt{0}}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-read-write-mem-lemma \\ \index{byte-read-write-mem-lemma}
\=\+({\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{y\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{byte-read}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem})\index{byte-read} \\ 
$=$$\;\;\;\;${\rm{byte-read}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{mem\/}})\index{byte-read})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-write-mem2 \\ \index{read-write-mem2}
\=\+{\rm{uint-rangep}}\,({\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-mem}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem}, {\it{n\/}})\index{read-mem} $=$ {\rm{head}}\,({\it{value\/}}, {\tt{8}} $*$ {\it{n\/}})\index{head})\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-write-mem-end.

\addvspace{18pt}

\noindent{\sc Event}:   Disable read-mem-byte-write-end.

\addvspace{18pt}

\noindent{\sc Event}:   Disable byte-read-write-mem-end.

\addvspace{18pt}

\begin{verbatim}; write to the same location twice, only the second counts.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-mem-byte-write \\ \index{write-mem-byte-write}
\=\+{\rm{write-mem}}\,({\it{v2\/}}, {\it{y\/}}, {\rm{byte-write}}\,({\it{v1\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{write-mem} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{disjoint0}}\,({\it{y\/}}, {\it{n\/}}, {\it{x\/}})\index{disjoint0}$\;\;${\bf then }{\rm{byte-write}}\,({\it{v1\/}}, {\it{x\/}}, {\rm{write-mem}}\,({\it{v2\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem})\index{byte-write} \\ 
{\bf else }{\rm{write-mem}}\,({\it{v2\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{write-write-induct} \\  
\=\+{\rm{write-write-induct}}\,({\it{v1\/}}, {\it{v2\/}}, {\it{n\/}})\index{write-write-induct} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{write-write-induct}}\,({\rm{tail}}\,({\it{v1\/}}, {\sc{b}}\index{b})\index{tail}, {\rm{tail}}\,({\it{v2\/}}, {\sc{b}}\index{b})\index{tail}, {\it{n\/}} $-\;1$)\index{write-write-induct}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-write-mem \\ \index{write-write-mem}
{\rm{write-mem}}\,({\it{v2\/}}, {\it{x\/}}, {\rm{write-mem}}\,({\it{v1\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem}, {\it{n\/}})\index{write-mem} $=$ {\rm{write-mem}}\,({\it{v2\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem}
\end{tabbing}

\begin{verbatim};                LEMMAS ABOUT BITP
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bitp-fix-bit \\ \index{bitp-fix-bit}
{\rm{bitp}}\,({\it{x\/}})\index{bitp} $\rightarrow$ ({\rm{fix-bit}}\,({\it{x\/}})\index{fix-bit} $=$ {\it{x\/}})
\end{tabbing}
                             
\begin{tabbing}{\sc Theorem}:  fix-bit-bitp \\ \index{fix-bit-bitp}
{\rm{bitp}}\,({\rm{fix-bit}}\,({\it{b\/}})\index{fix-bit})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bitn-bitp \\ \index{bitn-bitp}
{\rm{bitp}}\,({\rm{bitn}}\,({\it{x\/}}, {\it{n\/}})\index{bitn})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-c-bitp \\ \index{add-c-bitp}
{\rm{bitp}}\,({\rm{add-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-v-bitp \\ \index{add-v-bitp}
{\rm{bitp}}\,({\rm{add-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-z-bitp \\ \index{add-z-bitp}
{\rm{bitp}}\,({\rm{add-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-z})\index{bitp}
\end{tabbing}
 
\begin{tabbing}{\sc Theorem}:  add-n-bitp \\ \index{add-n-bitp}
{\rm{bitp}}\,({\rm{add-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-c-bitp \\ \index{addx-c-bitp}
{\rm{bitp}}\,({\rm{addx-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{addx-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-v-bitp \\ \index{addx-v-bitp}
{\rm{bitp}}\,({\rm{addx-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{addx-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-z-bitp \\ \index{addx-z-bitp}
{\rm{bitp}}\,({\rm{addx-z}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{addx-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-n-bitp \\ \index{addx-n-bitp}
{\rm{bitp}}\,({\rm{addx-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{addx-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-c-bitp \\ \index{sub-c-bitp}
{\rm{bitp}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-v-bitp \\ \index{sub-v-bitp}
{\rm{bitp}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-z-bitp \\ \index{sub-z-bitp}
{\rm{bitp}}\,({\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-n-bitp \\ \index{sub-n-bitp}
{\rm{bitp}}\,({\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-c-bitp \\ \index{subx-c-bitp}
{\rm{bitp}}\,({\rm{subx-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{subx-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-v-bitp \\ \index{subx-v-bitp}
{\rm{bitp}}\,({\rm{subx-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{subx-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-z-bitp \\ \index{subx-z-bitp}
{\rm{bitp}}\,({\rm{subx-z}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{subx-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-n-bitp \\ \index{subx-n-bitp}
{\rm{bitp}}\,({\rm{subx-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{s\/}}, {\it{d\/}})\index{subx-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  and-z-bitp \\ \index{and-z-bitp}
{\rm{bitp}}\,({\rm{and-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{and-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  and-n-bitp \\ \index{and-n-bitp}
{\rm{bitp}}\,({\rm{and-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{and-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu-v-bitp \\ \index{mulu-v-bitp}
{\rm{bitp}}\,({\rm{mulu-v}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{mulu-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu-z-bitp \\ \index{mulu-z-bitp}
{\rm{bitp}}\,({\rm{mulu-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{mulu-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu-n-bitp \\ \index{mulu-n-bitp}
{\rm{bitp}}\,({\rm{mulu-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{mulu-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls-v-bitp \\ \index{muls-v-bitp}
{\rm{bitp}}\,({\rm{muls-v}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{muls-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls-z-bitp \\ \index{muls-z-bitp}
{\rm{bitp}}\,({\rm{muls-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{muls-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls-n-bitp \\ \index{muls-n-bitp}
{\rm{bitp}}\,({\rm{muls-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}}, {\it{i\/}})\index{muls-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  or-z-bitp \\ \index{or-z-bitp}
{\rm{bitp}}\,({\rm{or-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{or-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  or-n-bitp \\ \index{or-n-bitp}
{\rm{bitp}}\,({\rm{or-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{or-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divs-z-bitp \\ \index{divs-z-bitp}
{\rm{bitp}}\,({\rm{divs-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{i\/}}, {\it{d\/}}, {\it{j\/}})\index{divs-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divs-n-bitp \\ \index{divs-n-bitp}
{\rm{bitp}}\,({\rm{divs-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{i\/}}, {\it{d\/}}, {\it{j\/}})\index{divs-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divu-z-bitp \\ \index{divu-z-bitp}
{\rm{bitp}}\,({\rm{divu-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{divu-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divu-n-bitp \\ \index{divu-n-bitp}
{\rm{bitp}}\,({\rm{divu-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{divu-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  rol-c-bitp \\ \index{rol-c-bitp}
{\rm{bitp}}\,({\rm{rol-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{rol-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  rol-z-bitp \\ \index{rol-z-bitp}
{\rm{bitp}}\,({\rm{rol-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{rol-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  rol-n-bitp \\ \index{rol-n-bitp}
{\rm{bitp}}\,({\rm{rol-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{rol-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ror-c-bitp \\ \index{ror-c-bitp}
{\rm{bitp}}\,({\rm{ror-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{ror-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ror-z-bitp \\ \index{ror-z-bitp}
{\rm{bitp}}\,({\rm{ror-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{ror-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ror-n-bitp \\ \index{ror-n-bitp}
{\rm{bitp}}\,({\rm{ror-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{ror-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-c-bitp \\ \index{lsl-c-bitp}
{\rm{bitp}}\,({\rm{lsl-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-z-bitp \\ \index{lsl-z-bitp}
{\rm{bitp}}\,({\rm{lsl-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-n-bitp \\ \index{lsl-n-bitp}
{\rm{bitp}}\,({\rm{lsl-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-c-bitp \\ \index{lsr-c-bitp}
{\rm{bitp}}\,({\rm{lsr-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsr-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-z-bitp \\ \index{lsr-z-bitp}
{\rm{bitp}}\,({\rm{lsr-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsr-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-n-bitp \\ \index{lsr-n-bitp}
{\rm{bitp}}\,({\rm{lsr-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsr-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-c-bitp \\ \index{asl-c-bitp}
{\rm{bitp}}\,({\rm{asl-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-v-bitp \\ \index{asl-v-bitp}
{\rm{bitp}}\,({\rm{asl-v}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-v})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-z-bitp \\ \index{asl-z-bitp}
{\rm{bitp}}\,({\rm{asl-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asl-n-bitp \\ \index{asl-n-bitp}
{\rm{bitp}}\,({\rm{asl-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-c-bitp \\ \index{asr-c-bitp}
{\rm{bitp}}\,({\rm{asr-c}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-z-bitp \\ \index{asr-z-bitp}
{\rm{bitp}}\,({\rm{asr-z}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  asr-n-bitp \\ \index{asr-n-bitp}
{\rm{bitp}}\,({\rm{asr-n}}\,({\it{len\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxl-c-bitp \\ \index{roxl-c-bitp}
{\rm{bitp}}\,({\rm{roxl-c}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxl-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxl-z-bitp \\ \index{roxl-z-bitp}
{\rm{bitp}}\,({\rm{roxl-z}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxl-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxl-n-bitp \\ \index{roxl-n-bitp}
{\rm{bitp}}\,({\rm{roxl-n}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxl-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxr-c-bitp \\ \index{roxr-c-bitp}
{\rm{bitp}}\,({\rm{roxr-c}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxr-c})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxr-z-bitp \\ \index{roxr-z-bitp}
{\rm{bitp}}\,({\rm{roxr-z}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxr-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  roxr-n-bitp \\ \index{roxr-n-bitp}
{\rm{bitp}}\,({\rm{roxr-n}}\,({\it{len\/}}, {\it{opd\/}}, {\it{cnt\/}}, {\it{x\/}})\index{roxr-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  move-z-bitp \\ \index{move-z-bitp}
{\rm{bitp}}\,({\rm{move-z}}\,({\it{oplen\/}}, {\it{sopd\/}})\index{move-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  move-n-bitp \\ \index{move-n-bitp}
{\rm{bitp}}\,({\rm{move-n}}\,({\it{oplen\/}}, {\it{sopd\/}})\index{move-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-z-bitp \\ \index{ext-z-bitp}
{\rm{bitp}}\,({\rm{ext-z}}\,({\it{oplen\/}}, {\it{opd\/}}, {\it{size\/}})\index{ext-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-n-bitp \\ \index{ext-n-bitp}
{\rm{bitp}}\,({\rm{ext-n}}\,({\it{oplen\/}}, {\it{opd\/}}, {\it{size\/}})\index{ext-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  swap-z-bitp \\ \index{swap-z-bitp}
{\rm{bitp}}\,({\rm{swap-z}}\,({\it{opd\/}})\index{swap-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  swap-n-bitp \\ \index{swap-n-bitp}
{\rm{bitp}}\,({\rm{swap-n}}\,({\it{opd\/}})\index{swap-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-z-bitp \\ \index{not-z-bitp}
{\rm{bitp}}\,({\rm{not-z}}\,({\it{oplen\/}}, {\it{opd\/}})\index{not-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  not-n-bitp \\ \index{not-n-bitp}
{\rm{bitp}}\,({\rm{not-n}}\,({\it{oplen\/}}, {\it{opd\/}})\index{not-n})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  eor-z-bitp \\ \index{eor-z-bitp}
{\rm{bitp}}\,({\rm{eor-z}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{eor-z})\index{bitp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  eor-n-bitp \\ \index{eor-n-bitp}
{\rm{bitp}}\,({\rm{eor-n}}\,({\it{n\/}}, {\it{s\/}}, {\it{d\/}})\index{eor-n})\index{bitp}
\end{tabbing}

\begin{verbatim};                          NEG
; after replacing sub by add and neg.  We can completely get rid of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  neg-head \\ \index{neg-head}
{\rm{neg}}\,({\it{n\/}}, {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head})\index{neg} $=$ {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  neg-neg \\ \index{neg-neg}
{\rm{neg}}\,({\it{n\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg})\index{neg} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  neg-cancel \\ \index{neg-cancel}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg})\index{add} $=$ {\tt{0}}
\end{tabbing}
             
\begin{tabbing}{\sc Theorem}:  neg-add \\ \index{neg-add}
{\rm{neg}}\,({\it{n\/}}, {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{neg} $=$ {\rm{add}}\,({\it{n\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-neg \\ \index{sub-neg}
{\rm{sub}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{sub} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add}
\end{tabbing}


\noindent{\sc Event}:   Disable neg.

\addvspace{18pt}

\begin{verbatim}; x - y = 0 <==> x = y.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-neg-0 \\ \index{add-neg-0}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg})\index{add} $=$ {\tt{0}}) $=$ ({\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}})))\-
\end{tabbing}

\begin{verbatim}; y + (x - y) = x.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-neg-cancel \\ \index{add-neg-cancel}
\=\+({\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg})\index{add})\index{add} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head}) \\ 
$\wedge$$\;\;\;\;$({\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{add}}\,({\it{n\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{y\/}})\index{neg}, {\it{x\/}})\index{add})\index{add} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-leq-1 \\ \index{sub-leq-1}
\=\+({\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg} $\leq$ {\it{y\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{y\/}} $-$ {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}) $\not<$ {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{add}) \\ 
$\wedge$$\;\;\;\;$(({\it{y\/}} $-$ {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}) $\not<$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-leq-2 \\ \index{sub-leq-2}
\=\+({\it{x\/}} $\leq$ {\it{y\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{y\/}} $-$ {\it{x\/}}) $\not<$ {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg})\index{add}) \\ 
$\wedge$$\;\;\;\;$(({\it{y\/}} $-$ {\it{x\/}}) $\not<$ {\rm{add}}\,({\it{n\/}}, {\rm{neg}}\,({\it{n\/}}, {\it{x\/}})\index{neg}, {\it{y\/}})\index{add}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{add-fringe} \\  
\=\+{\rm{add-fringe}}\,({\it{n\/}}, {\it{x\/}})\index{add-fringe} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{x\/}}) $\wedge$ ({\rm{car}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) $\wedge$ ({\rm{cadr}}\,({\it{x\/}}) $=$ {\it{n\/}}) \\ 
{\bf then }{\rm{append}}\,({\rm{add-fringe}}\,({\it{n\/}}, {\rm{caddr}}\,({\it{x\/}}))\index{add-fringe}, {\rm{add-fringe}}\,({\it{n\/}}, {\rm{cadddr}}\,({\it{x\/}}))\index{add-fringe}) \\ 
{\bf else }{\rm{cons}}\,({\it{x\/}}, {\bf{nil}})$\;${\bf  endif}\-\-
\end{tabbing}
  
\begin{tabbing}{\sc Definition}:\index{add-tree} \\  
\=\+{\rm{add-tree}}\,({\it{n\/}}, {\it{l\/}})\index{add-tree} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{l\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\tt{'}}{\tt{'}}{\tt{0}} \\ 
{\bf elseif }{\rm{cdr}}\,({\it{l\/}}) $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\rm{list}}\,({\tt{'}}{\tt{head}}, {\rm{car}}\,({\it{l\/}}), {\it{n\/}}) \\ 
{\bf elseif }{\rm{cddr}}\,({\it{l\/}}) $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\rm{list}}\,({\tt{'}}{\tt{add}}, {\it{n\/}}, {\rm{car}}\,({\it{l\/}}), {\rm{cadr}}\,({\it{l\/}})) \\ 
{\bf else }{\rm{list}}\,({\tt{'}}{\tt{add}}, {\it{n\/}}, {\rm{car}}\,({\it{l\/}}), {\rm{add-tree}}\,({\it{n\/}}, {\rm{cdr}}\,({\it{l\/}}))\index{add-tree})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  numberp-eval\$-add \\ \index{numberp-eval\$-add}
({\rm{car}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) $\rightarrow$ ({\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}}) $\in\;${\bf{N}}${}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  numberp-eval\$-add-tree \\ \index{numberp-eval\$-add-tree}
{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{l\/}})\index{add-tree}, {\it{a\/}}) $\in\;${\bf{N}}${}$
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-equal-cancel-1 \\ \index{add-equal-cancel-1}
({\rm{add}}\,({\it{n\/}}, {\it{a\/}}, {\it{b\/}})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{c\/}}, {\rm{add}}\,({\it{n\/}}, {\it{a\/}}, {\it{d\/}})\index{add})\index{add}) $=$ ({\rm{head}}\,({\it{b\/}}, {\it{n\/}})\index{head} $=$ {\rm{add}}\,({\it{n\/}}, {\it{c\/}}, {\it{d\/}})\index{add})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  eval\$-add-member \\ \index{eval\$-add-member}
\=\+({\it{e\/}} $\in$ {\it{x\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{x\/}})\index{add-tree}, {\it{a\/}}) \\ 
$=$$\;\;\;\;${\rm{add}}\,(\=\+{\rm{eval\$}}\,({\bf{t}}, {\it{n\/}}, {\it{a\/}}), \\ 
{\rm{eval\$}}\,({\bf{t}}, {\it{e\/}}, {\it{a\/}}), \\ 
{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{delete}}\,({\it{e\/}}, {\it{x\/}})\index{delete})\index{add-tree}, {\it{a\/}}))\-\index{add})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-tree-nat-rangep \\ \index{add-tree-nat-rangep}
{\rm{nat-rangep}}\,({\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{x\/}})\index{add-tree}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\it{n\/}}, {\it{a\/}}))\index{nat-rangep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-tree-append \\ \index{add-tree-append}
\=\+{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{append}}\,({\it{x\/}}, {\it{y\/}}))\index{add-tree}, {\it{a\/}}) \\ 
$=$$\;\;\;\;${\rm{add}}\,({\rm{eval\$}}\,({\bf{t}}, {\it{n\/}}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{x\/}})\index{add-tree}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{y\/}})\index{add-tree}, {\it{a\/}}))\index{add}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-tree-add-fringe \\ \index{add-tree-add-fringe}
{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{add-fringe}}\,({\it{n\/}}, {\it{x\/}})\index{add-fringe})\index{add-tree}, {\it{a\/}}) $=$ {\rm{head}}\,({\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\it{n\/}}, {\it{a\/}}))\index{head}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{add-tree-delete-cond} \\  
\=\+{\rm{add-tree-delete-cond}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-tree-delete-cond} \\ 
$=$$\;\;\;\;${\rm{list}}\,(\=\+{\tt{'}}{\tt{and}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{numberp}}, {\it{x\/}}), \\ 
{\rm{list}}\,(\=\+{\tt{'}}{\tt{and}}, \\ 
{\rm{list}}\,({\tt{'}}{\tt{nat-rangep}}, {\it{x\/}}, {\it{n\/}}), \\ 
{\rm{list}}\,({\tt{'}}{\tt{equal}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{delete}}\,({\it{x\/}}, {\it{y\/}})\index{delete})\index{add-tree}, {\tt{'}}{\tt{'}}{\tt{0}}))\-)\-\-
\end{tabbing}
  
\begin{tabbing}{\sc Theorem}:  add-tree-delete-equal \\ \index{add-tree-delete-equal}
\=\+({\it{x\/}} $\in$ {\it{y\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree-delete-cond}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-tree-delete-cond}, {\it{a\/}}) \\ 
$=$$\;\;\;\;$({\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{y\/}})\index{add-tree}, {\it{a\/}}) $=$ {\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-tree-bagdiff \\ \index{add-tree-bagdiff}
\=\+({\rm{subbagp}}\,({\it{x\/}}, {\it{y\/}})\index{subbagp} $\wedge$ {\rm{subbagp}}\,({\it{x\/}}, {\it{z\/}})\index{subbagp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(\=\+{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{bagdiff}}\,({\it{y\/}}, {\it{x\/}})\index{bagdiff})\index{add-tree}, {\it{a\/}}) \\ 
$=$$\;\;\;\;${\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{bagdiff}}\,({\it{z\/}}, {\it{x\/}})\index{bagdiff})\index{add-tree}, {\it{a\/}}))\- \\ 
$=$$\;\;\;\;$({\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{y\/}})\index{add-tree}, {\it{a\/}}) $=$ {\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{z\/}})\index{add-tree}, {\it{a\/}})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{cancel-equal-add} \\  
\=\+{\rm{cancel-equal-add}}\,({\it{x\/}})\index{cancel-equal-add} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{x\/}}) $\wedge$ ({\rm{car}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{equal}}) \\ 
{\bf then }\=\+{\bf if }\=\+{\rm{listp}}\,({\rm{cadr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadr}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{caddr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}})\- \\ 
{\bf then }\=\+{\bf if }{\rm{cadadr}}\,({\it{x\/}}) $=$ {\rm{cadaddr}}\,({\it{x\/}}) \\ 
{\bf then }{\rm{list}}\,(\=\+{\tt{'}}{\tt{equal}}, \\ 
{\rm{add-tree}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{bagdiff}}\,(\=\+{\rm{add-fringe}}\,({\rm{cadadr}}\,({\it{x\/}}), {\rm{cadr}}\,({\it{x\/}}))\index{add-fringe}, \\ 
{\rm{bagint}}\,(\=\+{\rm{add-fringe}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{cadr}}\,({\it{x\/}}))\-\index{add-fringe}, \\ 
{\rm{add-fringe}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{caddr}}\,({\it{x\/}}))\-\index{add-fringe})\-\index{bagint})\-\index{bagdiff})\-\index{add-tree}, \\ 
{\rm{add-tree}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{bagdiff}}\,(\=\+{\rm{add-fringe}}\,({\rm{cadadr}}\,({\it{x\/}}), {\rm{caddr}}\,({\it{x\/}}))\index{add-fringe}, \\ 
{\rm{bagint}}\,(\=\+{\rm{add-fringe}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{cadr}}\,({\it{x\/}}))\-\index{add-fringe}, \\ 
{\rm{add-fringe}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{caddr}}\,({\it{x\/}}))\-\index{add-fringe})\-\index{bagint})\-\index{bagdiff})\-\index{add-tree})\- \\ 
{\bf else }{\it{x\/}}$\;${\bf  endif}\- \\ 
{\bf elseif }\=\+{\rm{listp}}\,({\rm{cadr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caadr}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) \\ 
$\wedge$$\;\;\;\;$({\rm{caddr}}\,({\it{x\/}}) $\in$ {\rm{add-fringe}}\,({\rm{cadadr}}\,({\it{x\/}}), {\rm{cadr}}\,({\it{x\/}}))\index{add-fringe})\- \\ 
{\bf then }{\rm{add-tree-delete-cond}}\,(\=\+{\rm{cadadr}}\,({\it{x\/}}), \\ 
{\rm{caddr}}\,({\it{x\/}}), \\ 
{\rm{add-fringe}}\,({\rm{cadadr}}\,({\it{x\/}}), {\rm{cadr}}\,({\it{x\/}}))\index{add-fringe})\-\index{add-tree-delete-cond} \\ 
{\bf elseif }\=\+{\rm{listp}}\,({\rm{caddr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadr}}\,({\it{x\/}}) $\in$ {\rm{add-fringe}}\,({\rm{cadaddr}}\,({\it{x\/}}), {\rm{caddr}}\,({\it{x\/}}))\index{add-fringe})\- \\ 
{\bf then }{\rm{add-tree-delete-cond}}\,(\=\+{\rm{cadaddr}}\,({\it{x\/}}), \\ 
{\rm{cadr}}\,({\it{x\/}}), \\ 
{\rm{add-fringe}}\,({\rm{cadaddr}}\,({\it{x\/}}), {\rm{caddr}}\,({\it{x\/}}))\index{add-fringe})\-\index{add-tree-delete-cond} \\ 
{\bf else }{\it{x\/}}$\;${\bf  endif}\- \\ 
{\bf else }{\it{x\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  correctness-of-cancel-equal-add \\ \index{correctness-of-cancel-equal-add}
{\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}}) $=$ {\rm{eval\$}}\,({\bf{t}}, {\rm{cancel-equal-add}}\,({\it{x\/}})\index{cancel-equal-add}, {\it{a\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-tree-delete \\ \index{add-tree-delete}
\=\+({\it{x\/}} $\in$ {\it{y\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\rm{delete}}\,({\it{x\/}}, {\it{y\/}})\index{delete})\index{add-tree}, {\it{a\/}}) \\ 
$=$$\;\;\;\;${\rm{sub}}\,({\rm{eval\$}}\,({\bf{t}}, {\it{n\/}}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}}), {\rm{eval\$}}\,({\bf{t}}, {\rm{add-tree}}\,({\it{n\/}}, {\it{y\/}})\index{add-tree}, {\it{a\/}}))\index{sub})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{cancel-add-neg} \\  
\=\+{\rm{cancel-add-neg}}\,({\it{x\/}})\index{cancel-add-neg} \\ 
$=$$\;\;\;\;$\=\+{\bf if }\=\+{\rm{listp}}\,({\it{x\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{car}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{add}}) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cdr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cddr}}\,({\it{x\/}}))\- \\ 
{\bf then }\=\+{\bf if }\=\+{\rm{listp}}\,({\rm{caddr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cdaddr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{listp}}\,({\rm{cddaddr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caaddr}}\,({\it{x\/}}) $=$ {\tt{'}}{\tt{neg}}) \\ 
$\wedge$$\;\;\;\;$({\rm{cadaddr}}\,({\it{x\/}}) $=$ {\rm{cadr}}\,({\it{x\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{caddaddr}}\,({\it{x\/}}) $\in$ {\rm{add-fringe}}\,({\rm{cadr}}\,({\it{x\/}}), {\rm{cadddr}}\,({\it{x\/}}))\index{add-fringe})\- \\ 
{\bf then }{\rm{add-tree}}\,(\=\+{\rm{cadr}}\,({\it{x\/}}), \\ 
{\rm{delete}}\,({\rm{caddaddr}}\,({\it{x\/}}), {\rm{add-fringe}}\,({\rm{cadr}}\,({\it{x\/}}), {\rm{cadddr}}\,({\it{x\/}}))\index{add-fringe})\index{delete})\-\index{add-tree} \\ 
{\bf elseif }\=\+{\rm{list}}\,({\tt{'}}{\tt{neg}}, {\rm{cadr}}\,({\it{x\/}}), {\rm{caddr}}\,({\it{x\/}})) \\ 
$\in$$\;\;\;\;${\rm{add-fringe}}\,({\rm{cadr}}\,({\it{x\/}}), {\rm{cadddr}}\,({\it{x\/}}))\index{add-fringe}\- \\ 
{\bf then }{\rm{add-tree}}\,(\=\+{\rm{cadr}}\,({\it{x\/}}), \\ 
{\rm{delete}}\,(\=\+{\rm{list}}\,({\tt{'}}{\tt{neg}}, {\rm{cadr}}\,({\it{x\/}}), {\rm{caddr}}\,({\it{x\/}})), \\ 
{\rm{add-fringe}}\,({\rm{cadr}}\,({\it{x\/}}), {\rm{cadddr}}\,({\it{x\/}}))\index{add-fringe})\-\index{delete})\-\index{add-tree} \\ 
{\bf else }{\it{x\/}}$\;${\bf  endif}\- \\ 
{\bf else }{\it{x\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  correctness-of-cancel-add-neg \\ \index{correctness-of-cancel-add-neg}
{\rm{eval\$}}\,({\bf{t}}, {\it{x\/}}, {\it{a\/}}) $=$ {\rm{eval\$}}\,({\bf{t}}, {\rm{cancel-add-neg}}\,({\it{x\/}})\index{cancel-add-neg}, {\it{a\/}})
\end{tabbing}


\noindent{\sc Event}:   For efficiency, compile those definitions not yet compiled.

\addvspace{18pt}

\begin{verbatim};                  CONDITION CODES
; this section considers the various condition codes in Bcc and Scc
; instructions. The condition codes are specified as follows:
;  CC  carry clear       ~C                 LS  low or same     C+Z
;  CS  carry set         C                  LT  less than       N*~V+~N*V
;  EQ  equal             Z                  MI  minus           N
;  F   never true        0                  NE  not equal       ~Z
;  GE  greater or equal  N*V+~N*~V          PL  plus            ~N
;  GT  greater than      N*V*~Z+~N*~V*~Z    T   always true     1
;  HI  high              ~C*~Z              VC  overflow clear  ~V
;  LE  less or equal     Z+N*~V+~N*V        VS  overflow set    V

;                           BHI/BLS
; two bridge lemmas.
; the relation between add-c and addx-c.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-addx-c \\ \index{add-addx-c}
{\rm{add-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-c} $=$ {\rm{addx-c}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{addx-c}
\end{tabbing}

\begin{verbatim}; the relation between sub-c and subx-c.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-subx-c \\ \index{sub-subx-c}
{\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c} $=$ {\rm{subx-c}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{subx-c}
\end{tabbing}

\begin{verbatim}; two lemmas for addx-c and subx-c.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  addx-c-la \\ \index{addx-c-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{addx-c}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{addx-c} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{c\/}} $+$ {\it{x\/}} $+$ {\it{y\/}}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-c-la \\ \index{subx-c-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{subx-c}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{subx-c} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $<$ ({\it{c\/}} $+$ {\it{x\/}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable addx-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mbit-means-lessp.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  sub-z-la \\ \index{sub-z-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{fix}}\,({\it{x\/}}) $=$ {\rm{fix}}\,({\it{y\/}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{between-ileq}$\;\;$
{\rm{between-ileq}}\,({\it{x\/}}, {\it{y\/}}, {\it{z\/}})\index{between-ileq} $=$ ({\rm{ileq}}\,({\it{x\/}}, {\it{y\/}})\index{ileq} $\wedge$ {\rm{ileq}}\,({\it{y\/}}, {\it{z\/}})\index{ileq})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-bhi-int \\ \index{sub-bhi-int}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$($\neg$ {\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bhi}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{bhi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{between-ileq}}\,({\tt{0}}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{between-ileq}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-bhi-0 \\ \index{sub-bhi-0}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $\not<$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{bhi}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{bhi} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-bhi-1 \\ \index{sub-bhi-1}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $<$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{bhi}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{bhi} $=$ {\tt{1}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-bls \\ \index{sub-bls}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bls}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{bls} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $<$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the trivial relation between bls and bhi.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bls-bhi \\ \index{bls-bhi}
{\rm{bls}}\,({\it{c\/}}, {\it{z\/}})\index{bls} $=$ {\rm{b-not}}\,({\rm{bhi}}\,({\it{c\/}}, {\it{z\/}})\index{bhi})\index{b-not}
\end{tabbing}
  

\noindent{\sc Event}:   Disable bhi.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bls.

\addvspace{18pt}

\begin{verbatim};                          BEQ/BNE
; the z-flag of move.  
; the unsigned integer interpretation.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-beq-uint \\ \index{move-beq-uint}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the signed integer interpretation.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-beq-int-0 \\ \index{move-beq-int-0}
({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\tt{0}})) $\rightarrow$ ({\rm{beq}}\,({\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z})\index{beq} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  move-beq-int-1 \\ \index{move-beq-int-1}
({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}})) $\rightarrow$ ({\rm{beq}}\,({\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z})\index{beq} $=$ {\tt{1}})
\end{tabbing}

\begin{verbatim}; zero testing on a sign-extended bit vector is equivalent to 
; testing on the original value.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-beq-ext \\ \index{move-beq-ext}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{size\/}}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$({\rm{move-z}}\,({\it{size\/}}, {\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext})\index{move-z} $=$ {\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z})\-
\end{tabbing}

\begin{verbatim}; the z-flag of sub.  
; the unsigned integer interpretation.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-beq-uint \\ \index{sub-beq-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the signed integer interpretation.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-beq-int-0 \\ \index{sub-beq-int-0}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{beq} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-beq-int-1 \\ \index{sub-beq-int-1}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\index{beq} $=$ {\tt{1}})\-
\end{tabbing}

\begin{verbatim}; equality testing on two sign-extended bit vectors is equivalent to 
; testing on their original values.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-beq-ext \\ \index{sub-beq-ext}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{size\/}}) $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$({\rm{sub-z}}\,({\it{size\/}}, {\rm{ext}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext}, {\rm{ext}}\,({\it{n\/}}, {\it{y\/}}, {\it{size\/}})\index{ext})\index{sub-z} $=$ {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z})\-
\end{tabbing}

\begin{verbatim}; the z flag of logor.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  logor-beq-uint \\ \index{logor-beq-uint}
\=\+{\rm{beq}}\,({\rm{or-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{or-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}) $\wedge$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $=$ {\tt{0}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logor-beq-int-0 \\ \index{logor-beq-int-0}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\tt{0}})))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{or-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{or-z})\index{beq} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logor-beq-int-1 \\ \index{logor-beq-int-1}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{or-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{or-z})\index{beq} $=$ {\tt{1}})\-
\end{tabbing}

\begin{verbatim}; the z flag of logeor.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  logeor-beq-uint \\ \index{logeor-beq-uint}
\=\+{\rm{beq}}\,({\rm{eor-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{eor-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logeor-beq-int-0 \\ \index{logeor-beq-int-0}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{eor-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{eor-z})\index{beq} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logeor-beq-int-1 \\ \index{logeor-beq-int-1}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{eor-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{eor-z})\index{beq} $=$ {\tt{1}})\-
\end{tabbing}

\begin{verbatim}; the z flag of logand.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  logand-beq-uint \\ \index{logand-beq-uint}
\=\+({\rm{exp}}\,({\tt{2}}, {\rm{log}}\,({\tt{2}}, $1\;+$ {\it{x\/}})\index{log})\index{exp} $=$ ($1\;+$ {\it{x\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{and-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{and-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}})) $=$ {\tt{0}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  logand-or-beq-uint \\ \index{logand-or-beq-uint}
\=\+({\rm{exp}}\,({\tt{2}}, {\rm{log}}\,({\tt{2}}, $1\;+$ {\it{x\/}})\index{log})\index{exp} $=$ ($1\;+$ {\it{x\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{and-z}}\,({\it{n\/}}, {\it{x\/}}, {\rm{logor}}\,({\it{y\/}}, {\it{z\/}})\index{logor})\index{and-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }\=\+(({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}})) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{z\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}})) $=$ {\tt{0}})\-$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}
            
\begin{tabbing}{\sc Theorem}:  logand-eor-beq-uint \\ \index{logand-eor-beq-uint}
\=\+({\rm{exp}}\,({\tt{2}}, {\rm{log}}\,({\tt{2}}, $1\;+$ {\it{x\/}})\index{log})\index{exp} $=$ ($1\;+$ {\it{x\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{and-z}}\,({\it{n\/}}, {\it{x\/}}, {\rm{logeor}}\,({\it{y\/}}, {\it{z\/}})\index{logeor})\index{and-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }\=\+({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}})) \\ 
$=$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{z\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ ($1\;+$ {\it{x\/}}))\-$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of mulu.  There are three cases to handle.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mulu\_1632-beq \\ \index{mulu\_1632-beq}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{mulu-z}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{mulu-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $=$ {\tt{0}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3264-beq \\ \index{mulu\_3264-beq}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{mulu-z}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $=$ {\tt{0}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3232-beq \\ \index{mulu\_3232-beq}
\=\+{\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}, {\tt{32}})\index{uint-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{mulu-z}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $=$ {\tt{0}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of muls.  There are three cases to handle.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  muls\_1632-beq \\ \index{muls\_1632-beq}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{muls-z}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{muls-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{16}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{16}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3264-beq \\ \index{muls\_3264-beq}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{muls-z}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3232-beq \\ \index{muls\_3232-beq}
\=\+(\=\+{\rm{int-rangep}}\,({\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes}, {\tt{32}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{muls-z}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of divu.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  divu-beq \\ \index{divu-beq}
\=\+({\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{divu-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{divu-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $<$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of divs.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  iquotient=0 \\ \index{iquotient=0}
\=\+({\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ ({\it{y\/}} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{iquotient}}\,({\it{x\/}}, {\it{y\/}})\index{iquotient} $=$ {\tt{0}}) $=$ ({\rm{abs}}\,({\it{x\/}})\index{abs} $<$ {\rm{abs}}\,({\it{y\/}})\index{abs}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  divs-beq \\ \index{divs-beq}
\=\+(\=\+{\rm{int-rangep}}\,({\rm{iquotient}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int})\index{iquotient}, {\it{n\/}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{x\/}}, {\it{i\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int} $\not=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\leq$ {\it{j\/}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{divs-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}}, {\it{y\/}}, {\it{j\/}})\index{divs-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{abs}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{j\/}})\index{nat-to-int})\index{abs} $<$ {\rm{abs}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{i\/}})\index{nat-to-int})\index{abs}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of lsl.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lsl-beq \\ \index{lsl-beq}
\=\+{\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}, {\it{n\/}} $-$ {\it{cnt\/}})\index{uint-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{lsl-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsl-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of lsr.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lsr-beq \\ \index{lsr-beq}
\=\+{\rm{beq}}\,({\rm{lsr-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{lsr-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $<$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  z-flag-la \\ \index{z-flag-la}
({\it{x\/}} $\in\;${\bf{N}}${}$) $\rightarrow$ (({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}}) $=$ ({\it{x\/}} $=$ {\tt{0}}))
\end{tabbing}

\begin{verbatim}; the z-flag of asl.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  asl-beq \\ \index{asl-beq}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{int-rangep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}} $-$ {\it{cnt\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{asl-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}
                        
\begin{verbatim}; the z-flag of asr.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  asr-beq \\ \index{asr-beq}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{asr-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{0}} \\ 
{\bf elseif }{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $<$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the z-flag of ext.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ext-beq-uint \\ \index{ext-beq-uint}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\leq$ {\it{size\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{beq}}\,({\rm{ext-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext-z})\index{beq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}
     
\begin{tabbing}{\sc Theorem}:  ext-beq-int-0 \\ \index{ext-beq-int-0}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $<$ {\it{size\/}}) $\wedge$ ({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{ext-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext-z})\index{beq} $=$ {\tt{0}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ext-beq-int-1 \\ \index{ext-beq-int-1}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $<$ {\it{size\/}}) $\wedge$ ({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{beq}}\,({\rm{ext-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext-z})\index{beq} $=$ {\tt{1}})\-
\end{tabbing}
      

\noindent{\sc Event}:   Disable iquotient=0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable int-to-nat=0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable beq.

\addvspace{18pt}

\begin{verbatim};                         BCS/BCC
; BCS/BCC means carry is set/cleared.
; the c-flag of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-bcs\&cc \\ \index{sub-bcs\&cc}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bcs}}\,({\rm{sub-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-c})\index{bcs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint} $<$ {\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the c-flag of add.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-bcs\&cc \\ \index{add-bcs\&cc}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bcs}}\,({\rm{add-c}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-c})\index{bcs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  tail-mbit \\ \index{tail-mbit}
\=\+({\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{tail}}\,({\it{x\/}}, {\it{n\/}} $-\;1$)\index{tail} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{x\/}} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}} $-\;1$)\index{exp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the c-flag of lsl.  But we only consider special cases: cnt = 0 or 1.  
; I don't know what the meaning of c-flag is when cnt > 1. 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lsl-c-0 \\ \index{lsl-c-0}
{\rm{lsl-c}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{lsl-c} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsl-1-bcs\&cc \\ \index{lsl-1-bcs\&cc}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\tt{1}} $<$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bcs}}\,({\rm{lsl-c}}\,({\it{n\/}}, {\it{x\/}}, {\tt{1}})\index{lsl-c})\index{bcs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{uint-rangep}}\,({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint}, {\it{n\/}} $-\;1$)\index{uint-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the c-flag of lsr.  But we only consider special cases: cnt = 0 or 1.
; I don't know what the meaning of c-flag is when cnt > 1.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  lsr-c-0 \\ \index{lsr-c-0}
{\rm{lsr-c}}\,({\it{n\/}}, {\it{x\/}}, {\tt{0}})\index{lsr-c} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lsr-1-bcs\&cc \\ \index{lsr-1-bcs\&cc}
({\tt{1}} $<$ {\it{n\/}}) $\rightarrow$ ({\rm{bcs}}\,({\rm{lsr-c}}\,({\it{n\/}}, {\it{x\/}}, {\tt{1}})\index{lsr-c})\index{bcs} $=$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\tt{2}}))
\end{tabbing}


\noindent{\sc Event}:   Disable tail-mbit.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bcs.

\addvspace{18pt}

\begin{verbatim};                       BVS/BVC
; BVS/BVC means overflow is set/cleared.
; three bridge lemmas.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-addx-v \\ \index{add-addx-v}
{\rm{add-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-v} $=$ {\rm{addx-v}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{addx-v}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-addx-v \\ \index{subx-addx-v}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$({\rm{subx-v}}\,({\it{n\/}}, {\it{z\/}}, {\it{x\/}}, {\it{y\/}})\index{subx-v} $=$ {\rm{addx-v}}\,({\it{n\/}}, {\rm{b-not}}\,({\it{z\/}})\index{b-not}, {\it{y\/}}, {\rm{lognot}}\,({\it{n\/}}, {\it{x\/}})\index{lognot})\index{addx-v})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  sub-subx-v \\ \index{sub-subx-v}
{\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v} $=$ {\rm{subx-v}}\,({\it{n\/}}, {\tt{0}}, {\it{x\/}}, {\it{y\/}})\index{subx-v}
\end{tabbing}

\begin{verbatim}; lemmas for addx-v and subx-v.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mbit-means-negativep \\ \index{mbit-means-negativep}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bitn}}\,({\it{x\/}}, {\it{n\/}} $-\;1$)\index{bitn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  addx-v-la \\ \index{addx-v-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{addx-v}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{addx-v} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,(\=\+{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\index{iplus}, \\ 
{\it{n\/}})\-\index{int-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  subx-v-la \\ \index{subx-v-la}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{bitp}}\,({\it{c\/}})\index{bitp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{subx-v}}\,({\it{n\/}}, {\it{c\/}}, {\it{x\/}}, {\it{y\/}})\index{subx-v} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,(\=\+{\rm{idifference}}\,(\=\+{\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, \\ 
{\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{c\/}})\index{iplus})\-\index{idifference}, \\ 
{\it{n\/}})\-\index{int-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable addx-v-crock1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-v-crock2.

\addvspace{18pt}

\begin{verbatim}; the v-flag of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-bvs\&vc \\ \index{sub-bvs\&vc}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bvs}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v})\index{bvs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{idifference}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{idifference}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the v-flag of add.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-bvs\&vc \\ \index{add-bvs\&vc}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bvs}}\,({\rm{add-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-v})\index{bvs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{iplus}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; three cases for the v-flag of mulu.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mulu\_1632-bvs \\ \index{mulu\_1632-bvs}
({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) $\rightarrow$ ({\rm{mulu-v}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{mulu-v} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3264-bvs \\ \index{mulu\_3264-bvs}
({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) $\rightarrow$ ({\rm{mulu-v}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu-v} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mulu\_3232-bvs \\ \index{mulu\_3232-bvs}
\=\+{\rm{bvs}}\,({\rm{mulu-v}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{mulu-v})\index{bvs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $*$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $<$ {\rm{exp}}\,({\tt{2}}, {\tt{32}})\index{exp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; three cases for the v-flag of muls.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  muls\_1632-bvs \\ \index{muls\_1632-bvs}
({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) $\rightarrow$ ({\rm{muls-v}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{muls-v} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3264-bvs \\ \index{muls\_3264-bvs}
({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) $\rightarrow$ ({\rm{muls-v}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-v} $=$ {\tt{0}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3232-bvs \\ \index{muls\_3232-bvs}
\=\+{\rm{bvs}}\,({\rm{muls-v}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-v})\index{bvs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes}, {\tt{32}})\index{int-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; the v-flag of asl.  It is an easy copy of the definition of asl-v.
; sometimes, it seems to be better to define those functions directly
; using the intended meaning.  But there are several problems:
; 1. the meaning is not completely clear. It is vague.
; 2. it is impossible to have a clean definition. 
; 3. it is error prone. It does not always work the way you think.
;    Your intended interpretation is just a special case.
; In some sense,  a formal specification should be more syntax-oriented.
; syntax rules are clear and accurate. e.g. M68000 are well-documented.
; But it gives one a hard time to do formal proofs.  We need to assign 
; meanings to these definitions.  To make sure our "intended" meanings
; are consistent with the specification, we need to prove the equivalence.
; this is done formally by a theorem prover, and sometimes, is very hard.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  asl-bvs \\ \index{asl-bvs}
\=\+{\rm{bvs}}\,({\rm{asl-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-v})\index{bvs} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}} $-$ {\it{cnt\/}})\index{int-rangep}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable bvs.

\addvspace{18pt}

\begin{verbatim};                      BMI/BPL
; the n-flag of move.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-bmi \\ \index{move-bmi}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{move-n}}\,({\it{n\/}}, {\it{x\/}})\index{move-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-bmi \\ \index{sub-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{idifference}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{idifference}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }\=\+{\bf if }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of add.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-bmi \\ \index{add-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{add-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{int-rangep}}\,({\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{iplus}, {\it{n\/}})\index{int-rangep} \\ 
{\bf then }\=\+{\bf if }{\rm{negativep}}\,({\rm{iplus}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{iplus}) \\ 
{\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of muls.  There are three cases to handle.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  muls\_1632-bmi \\ \index{muls\_1632-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{16}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{16}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{muls-n}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{16}})\index{muls-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{16}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{16}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{0}} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{16}})\index{nat-to-int}) \\ 
{\bf then }\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{16}})\index{nat-to-int})$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{16}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3264-bmi \\ \index{muls\_3264-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{muls-n}}\,({\tt{64}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{0}} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}) \\ 
{\bf then }\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  muls\_3232-bmi \\ \index{muls\_3232-bmi}
\=\+(\=\+{\rm{int-rangep}}\,({\rm{itimes}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})\index{itimes}, {\tt{32}})\index{int-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{x\/}}, {\tt{32}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\tt{32}})\index{nat-rangep})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{muls-n}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}}, {\tt{32}})\index{muls-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) $\vee$ ({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int} $=$ {\tt{0}}) \\ 
{\bf then }{\tt{0}} \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int}) \\ 
{\bf then }\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\tt{32}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of asl.                 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  asl-bmi \\ \index{asl-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{int-rangep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\it{n\/}} $-$ {\it{cnt\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{asl-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asl-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of asr.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  asr-bmi \\ \index{asr-bmi}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{asr-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{cnt\/}})\index{asr-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the n-flag of ext.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ext-bmi \\ \index{ext-bmi}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $<$ {\it{size\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bmi}}\,({\rm{ext-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{size\/}})\index{ext-n})\index{bmi} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{negativep}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}
              
\begin{verbatim};                   BGE/BLT
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bge-v0 \\ \index{bge-v0}
{\rm{bge}}\,({\tt{0}}, {\it{n\/}})\index{bge} $=$ {\rm{b-not}}\,({\rm{bmi}}\,({\it{n\/}})\index{bmi})\index{b-not}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  blt-v0 \\ \index{blt-v0}
{\rm{blt}}\,({\tt{0}}, {\it{n\/}})\index{blt} $=$ {\rm{bmi}}\,({\it{n\/}})\index{bmi}
\end{tabbing}

\begin{verbatim}; bge of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-bge \\ \index{sub-bge}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bge}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v}, {\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{bge} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; blt of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-blt \\ \index{sub-blt}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{blt}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v}, {\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{blt} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the trivial relation between BGE and BLT.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  blt-bge \\ \index{blt-bge}
{\rm{blt}}\,({\it{v\/}}, {\it{n\/}})\index{blt} $=$ {\rm{b-not}}\,({\rm{bge}}\,({\it{v\/}}, {\it{n\/}})\index{bge})\index{b-not}
\end{tabbing}


\noindent{\sc Event}:   Disable bge.

\addvspace{18pt}

\noindent{\sc Event}:   Disable blt.

\addvspace{18pt}

\begin{verbatim};                       BGT/BLE
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-z-la1 \\ \index{sub-z-la1}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int} $=$ {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable sub-z.

\addvspace{18pt}

\begin{verbatim}; bgt of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-bgt \\ \index{sub-bgt}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bgt}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z}, {\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{bgt} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; ble of sub.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-ble \\ \index{sub-ble}
\=\+({\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ {\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{ble}}\,({\rm{sub-v}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-v}, {\rm{sub-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-z}, {\rm{sub-n}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{sub-n})\index{ble} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{ilessp}}\,({\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}, {\rm{nat-to-int}}\,({\it{y\/}}, {\it{n\/}})\index{nat-to-int})\index{ilessp}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; bgt of move.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-bgt \\ \index{move-bgt}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bgt}}\,({\tt{0}}, {\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z}, {\rm{move-n}}\,({\it{n\/}}, {\it{x\/}})\index{move-n})\index{bgt} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\tt{0}} $<$ {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; ble of move.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-ble \\ \index{move-ble}
\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{ble}}\,({\tt{0}}, {\rm{move-z}}\,({\it{n\/}}, {\it{x\/}})\index{move-z}, {\rm{move-n}}\,({\it{n\/}}, {\it{x\/}})\index{move-n})\index{ble} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\tt{0}} $<$ {\rm{nat-to-int}}\,({\it{x\/}}, {\it{n\/}})\index{nat-to-int}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\tt{1}}$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; the trivial relation between ble and bgt.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ble-bgt \\ \index{ble-bgt}
{\rm{ble}}\,({\it{v\/}}, {\it{z\/}}, {\it{n\/}})\index{ble} $=$ {\rm{b-not}}\,({\rm{bgt}}\,({\it{v\/}}, {\it{z\/}}, {\it{n\/}})\index{bgt})\index{b-not}
\end{tabbing}


\noindent{\sc Event}:   Disable ble.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bgt.

\addvspace{18pt}

\begin{verbatim}; the end of this subsection.  Some lemmas should be disabled, for we 
; no longer need them.
\end{verbatim}
\noindent{\sc Event}:   Disable mbit-means-negativep.

\addvspace{18pt}

\noindent{\sc Event}:   Disable bmi.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-addx-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-subx-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-c-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-c-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-addx-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-addx-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-subx-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-v-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-v-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-z-la.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-z-la1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ilessp-crock1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ilessp-crock2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-bmi-crock1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-bmi-crock2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable nat-to-int=.

\addvspace{18pt}

\begin{verbatim};                          STEPN
; stepping the state s (m+n) steps is equivalent to stepping s m steps and
; n steps further.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{splus}$\;\;$
{\rm{splus}}\,({\it{x\/}}, {\it{y\/}})\index{splus} $=$ ({\it{x\/}} $+$ {\it{y\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-lemma \\ \index{stepn-lemma}
{\rm{stepn}}\,({\it{s\/}}, {\rm{splus}}\,({\it{m\/}}, {\it{n\/}})\index{splus})\index{stepn} $=$ {\rm{stepn}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{m\/}})\index{stepn}, {\it{n\/}})\index{stepn}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-rewriter0 \\ \index{stepn-rewriter0}
{\rm{stepn}}\,({\it{s\/}}, {\tt{0}})\index{stepn} $=$ {\it{s\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-rewriter \\ \index{stepn-rewriter}
({\rm{mc-status}}\,({\it{s\/}})\index{mc-status} $=$ {\tt{'}}{\tt{running}}) $\rightarrow$ ({\rm{stepn}}\,({\it{s\/}}, $1\;+$ {\it{n\/}})\index{stepn} $=$ {\rm{stepn}}\,({\rm{stepi}}\,({\it{s\/}})\index{stepi}, {\it{n\/}})\index{stepn})
\end{tabbing}

\begin{verbatim};                     THEOREMS ABOUT THE MEMORY
; if a portion of memory is ROM, then it still is ROM after a write on memory.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-write-maintain-rom-addrp \\ \index{byte-write-maintain-rom-addrp}
{\rm{rom-addrp}}\,({\it{addr\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{rom-addrp} $=$ {\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-rom-addrp \\ \index{write-mem-maintain-rom-addrp}
{\rm{rom-addrp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{rom-addrp} $=$ {\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp}
\end{tabbing}

\begin{verbatim}; if a portion of memory is RAM, then it still is RAM after a write on memory.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-write-maintain-ram-addrp \\ \index{byte-write-maintain-ram-addrp}
{\rm{ram-addrp}}\,({\it{addr\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{n\/}})\index{ram-addrp} $=$ {\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-maintain-ram-addrp \\ \index{write-mem-maintain-ram-addrp}
{\rm{ram-addrp}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{ram-addrp} $=$ {\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp}
\end{tabbing}

\begin{verbatim}; mcode-addrp claims that the machine code program lst is stored in the 
; memory starting at addr.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mcode-addrp} \\  
\=\+{\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{lst\/}}) \\ 
{\bf then }\=\+{\bf if }{\rm{car}}\,({\it{lst\/}}) $=$ {\tt{-1}} \\ 
{\bf then }{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\tt{1}})\index{add}, {\it{mem\/}}, {\rm{cdr}}\,({\it{lst\/}}))\index{mcode-addrp} \\ 
{\bf else }\=\+({\rm{pc-byte-read}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{car}}\,({\it{lst\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\tt{1}})\index{add}, {\it{mem\/}}, {\rm{cdr}}\,({\it{lst\/}}))\index{mcode-addrp}\-$\;${\bf  endif}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-non-numberp \\ \index{add-non-numberp}
({\it{i\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{i\/}})\index{add} $=$ {\rm{head}}\,({\it{x\/}}, {\it{n\/}})\index{head})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-plus \\ \index{add-plus}
{\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\rm{add}}\,({\it{n\/}}, {\it{y\/}}, {\it{z\/}})\index{add})\index{add} $=$ {\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}} $+$ {\it{z\/}})\index{add}
\end{tabbing}

\begin{verbatim}; four lemmas about pc-read-memp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-read-memp-la0 \\ \index{pc-read-memp-la0}
({\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp} $\wedge$ ({\it{k\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{pc-byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-la1 \\ \index{pc-read-memp-la1}
\=\+({\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp} $\wedge$ ({\it{j\/}} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{pc-byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-la2 \\ \index{pc-read-memp-la2}
({\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp} $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ {\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-la3 \\ \index{pc-read-memp-la3}
\=\+({\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-memp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-la0 \\ \index{write-memp-la0}
({\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{byte-writep}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-la1 \\ \index{write-memp-la1}
({\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\wedge$ ({\it{m\/}} $<$ {\it{n\/}})) $\rightarrow$ {\rm{byte-writep}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{m\/}})\index{add}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-la2 \\ \index{write-memp-la2}
({\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\wedge$ ({\it{m\/}} $\leq$ {\it{n\/}})) $\rightarrow$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-la3 \\ \index{write-memp-la3}
\=\+({\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}


\noindent{\sc Event}:   Disable add-plus.

\addvspace{18pt}

\begin{verbatim}; array index.  There are some good reasons to distinguish this concept
; with add and sub.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{index-n}$\;\;$
{\rm{index-n}}\,({\it{x\/}}, {\it{y\/}})\index{index-n} $=$ {\rm{sub}}\,({\tt{32}}, {\it{y\/}}, {\it{x\/}})\index{sub}
\end{tabbing}

\begin{verbatim}; ROM is pc-readable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-byte-readp-rom0 \\ \index{pc-byte-readp-rom0}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{k\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{pc-byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-readp-rom1 \\ \index{pc-byte-readp-rom1}
\=\+({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{j\/}} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{pc-byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-readp-rom2 \\ \index{pc-byte-readp-rom2}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-readp-rom3 \\ \index{pc-byte-readp-rom3}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{pc-byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-rom0 \\ \index{pc-read-memp-rom0}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ {\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-rom1 \\ \index{pc-read-memp-rom1}
\=\+({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-rom2 \\ \index{pc-read-memp-rom2}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-memp-rom3 \\ \index{pc-read-memp-rom3}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\rm{index-n}}\,({\it{h\/}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{pc-read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-memp}\-
\end{tabbing}

\begin{verbatim}; starting at the same address, a portion of the memory is ROM if a bigger
; portion of the memory is ROM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  rom-addrp-la1 \\ \index{rom-addrp-la1}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp} $\wedge$ ({\it{m\/}} $\leq$ {\it{n\/}})) $\rightarrow$ {\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{m\/}})\index{rom-addrp}
\end{tabbing}

\begin{verbatim}; a portion of the memory is also ROM, if a bigger portion of the memory
; is ROM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  rom-addrp-la2 \\ \index{rom-addrp-la2}
\=\+({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\it{j\/}} $+$ {\rm{index-n}}\,({\it{x\/}}, {\it{addr\/}})\index{index-n}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{rom-addrp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{j\/}})\index{rom-addrp}\-
\end{tabbing}


\noindent{\sc Event}:   Disable rom-addrp.

\addvspace{18pt}

\begin{verbatim}; ROM is readable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-readp-rom0 \\ \index{byte-readp-rom0}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{k\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-rom1 \\ \index{byte-readp-rom1}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{j\/}} $<$ {\it{k\/}})) $\rightarrow$ {\rm{byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-rom2 \\ \index{byte-readp-rom2}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-rom3 \\ \index{byte-readp-rom3}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-rom0 \\ \index{read-memp-rom0}
({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ {\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-rom1 \\ \index{read-memp-rom1}
\=\+({\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-rom2 \\ \index{read-memp-rom2}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-rom3 \\ \index{read-memp-rom3}
\=\+({\rm{rom-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{rom-addrp} $\wedge$ (({\rm{index-n}}\,({\it{h\/}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{verbatim}; integer view.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  read-memp-rom1-int \\ \index{read-memp-rom1-int}
\=\+(\=\+{\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{x\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{verbatim}; RAM is writable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-writep-ram0 \\ \index{byte-writep-ram0}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{k\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{byte-writep}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-writep-ram1 \\ \index{byte-writep-ram1}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{j\/}} $<$ {\it{k\/}})) $\rightarrow$ {\rm{byte-writep}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-writep-ram2 \\ \index{byte-writep-ram2}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-writep}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-writep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-writep-ram3 \\ \index{byte-writep-ram3}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-writep}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-writep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram0 \\ \index{write-memp-ram0}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram1 \\ \index{write-memp-ram1}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram1-int \\ \index{write-memp-ram1-int}
\=\+(\=\+{\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\it{k\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram2 \\ \index{write-memp-ram2}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram3 \\ \index{write-memp-ram3}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{index-n}}\,({\it{h\/}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}

\begin{verbatim}; a portion of a memory is also RAM, if a "bigger" portion of the memory 
; is RAM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  ram-addrp-la1 \\ \index{ram-addrp-la1}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp} $\wedge$ ({\it{m\/}} $\leq$ {\it{n\/}})) $\rightarrow$ {\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{m\/}})\index{ram-addrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ram-addrp-la2 \\ \index{ram-addrp-la2}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp} $\wedge$ (({\it{j\/}} $+$ {\rm{index-n}}\,({\it{x\/}}, {\it{addr\/}})\index{index-n}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{ram-addrp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{j\/}})\index{ram-addrp}\-
\end{tabbing}


\noindent{\sc Event}:   Disable ram-addrp.

\addvspace{18pt}

\begin{verbatim}; RAM is readable.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-readp-ram0 \\ \index{byte-readp-ram0}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{k\/}} $\not\simeq {\tt{0}}$)) $\rightarrow$ {\rm{byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-ram1 \\ \index{byte-readp-ram1}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{j\/}} $<$ {\it{k\/}})) $\rightarrow$ {\rm{byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-ram2 \\ \index{byte-readp-ram2}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-readp}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-readp-ram3 \\ \index{byte-readp-ram3}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $<$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{byte-readp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{byte-readp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram0 \\ \index{read-memp-ram0}
({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ ({\it{j\/}} $\leq$ {\it{k\/}})) $\rightarrow$ {\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram1 \\ \index{read-memp-ram1}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram1-int \\ \index{read-memp-ram1-int}
\=\+(\=\+{\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\it{k\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram2 \\ \index{read-memp-ram2}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram3 \\ \index{read-memp-ram3}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{index-n}}\,({\it{h\/}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{verbatim}; please use the right induction.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mem-induct1} \\  
\=\+{\rm{mem-induct1}}\,({\it{i\/}}, {\it{addr\/}}, {\it{lst\/}})\index{mem-induct1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{mem-induct1}}\,({\it{i\/}} $-\;1$, {\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\tt{1}})\index{add}, {\rm{cdr}}\,({\it{lst\/}}))\index{mem-induct1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim};            OBTAIN MACHINE CODE FROM MEMORY
; please read the right thing.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-byte-read-mcode0 \\ \index{pc-byte-read-mcode0}
\=\+({\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\rm{cons}}\,({\it{x\/}}, {\it{lst\/}}))\index{mcode-addrp} $\wedge$ ({\it{x\/}} $\not=$ {\tt{-1}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-read} $=$ {\it{x\/}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-read-mcode1 \\ \index{pc-byte-read-mcode1}
\=\+({\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} $\wedge$ ({\it{i\/}} $<$ {\rm{len}}\,({\it{lst\/}})\index{len}) $\wedge$ ({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{-1}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-read-mcode2 \\ \index{pc-byte-read-mcode2}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $<$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;$({\rm{get-nth}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{-1}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{get-nth}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-byte-read-mcode3 \\ \index{pc-byte-read-mcode3}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $<$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;$({\rm{get-nth}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{-1}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-byte-read}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{get-nth}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{lst-numberp0} \\  
\=\+{\rm{lst-numberp0}}\,({\it{lst\/}}, {\it{n\/}})\index{lst-numberp0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }({\rm{get-nth}}\,({\it{n\/}} $-\;1$, {\it{lst\/}})\index{get-nth} $\in\;${\bf{N}}${}$) $\wedge$ {\rm{lst-numberp0}}\,({\it{lst\/}}, {\it{n\/}} $-\;1$)\index{lst-numberp0}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{read-lst0} \\  
\=\+{\rm{read-lst0}}\,({\it{lst\/}}, {\it{n\/}})\index{read-lst0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{app}}\,({\sc{b}}\index{b}, {\rm{get-nth}}\,({\it{n\/}} $-\;1$, {\it{lst\/}})\index{get-nth}, {\rm{read-lst0}}\,({\it{lst\/}}, {\it{n\/}} $-\;1$)\index{read-lst0})\index{app}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{tail-lst} \\  
\=\+{\rm{tail-lst}}\,({\it{lst\/}}, {\it{n\/}})\index{tail-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{tail-lst}}\,({\rm{cdr}}\,({\it{lst\/}}), {\it{n\/}} $-\;1$)\index{tail-lst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{lst-numberp} \\  
{\rm{lst-numberp}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{lst-numberp} $=$ {\rm{lst-numberp0}}\,({\rm{tail-lst}}\,({\it{lst\/}}, {\it{m\/}})\index{tail-lst}, {\it{n\/}})\index{lst-numberp0}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{read-lst}$\;\;$
{\rm{read-lst}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{read-lst} $=$ {\rm{read-lst0}}\,({\rm{tail-lst}}\,({\it{lst\/}}, {\it{m\/}})\index{tail-lst}, {\it{n\/}})\index{read-lst0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-nth-tail-lst \\ \index{get-nth-tail-lst}
{\rm{get-nth}}\,({\it{n\/}}, {\rm{tail-lst}}\,({\it{x\/}}, {\it{m\/}})\index{tail-lst})\index{get-nth} $=$ {\rm{get-nth}}\,({\it{m\/}} $+$ {\it{n\/}}, {\it{x\/}})\index{get-nth}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-mcode0 \\ \index{pc-read-mem-mcode0}
\=\+({\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} $\wedge$ ({\it{j\/}} $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) $\wedge$ {\rm{lst-numberp}}\,({\tt{0}}, {\it{lst\/}}, {\it{j\/}})\index{lst-numberp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-mem} $=$ {\rm{read-lst}}\,({\tt{0}}, {\it{lst\/}}, {\it{j\/}})\index{read-lst})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-mcode1 \\ \index{pc-read-mem-mcode1}
\=\+(\=\+{\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\it{i\/}}, {\it{lst\/}}, {\it{j\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{pc-read-mem} $=$ {\rm{read-lst}}\,({\it{i\/}}, {\it{lst\/}}, {\it{j\/}})\index{read-lst})\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-lst.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lst-numberp.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-mcode2 \\ \index{pc-read-mem-mcode2}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{k\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem} $=$ {\rm{read-lst}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{read-lst})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-mcode3 \\ \index{pc-read-mem-mcode3}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $+$ {\it{k\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem} $=$ {\rm{read-lst}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{read-lst})\-
\end{tabbing}

\begin{verbatim}; sometimes,  we obtain machine code by read-mem.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  read-$>$pc-read-mem \\ \index{read-$>$pc-read-mem}
{\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem} $=$ {\rm{pc-read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{pc-read-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-mcode1-int \\ \index{read-mem-mcode1-int}
\=\+(\=\+{\rm{mcode-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}, {\it{lst\/}}, {\it{j\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-mem} \\ 
$=$$\;\;\;\;${\rm{read-lst}}\,({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}, {\it{lst\/}}, {\it{j\/}})\index{read-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-mcode2 \\ \index{read-mem-mcode2}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n} $+$ {\it{k\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem} $=$ {\rm{read-lst}}\,({\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{read-lst})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-mcode3 \\ \index{read-mem-mcode3}
\=\+(\=\+{\rm{mcode-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp} \\ 
$\wedge$$\;\;\;\;$(({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n} $+$ {\it{k\/}}) $\leq$ {\rm{len}}\,({\it{lst\/}})\index{len}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-numberp}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{lst-numberp})\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{read-mem} $=$ {\rm{read-lst}}\,({\rm{index-n}}\,({\it{j\/}}, {\it{i\/}})\index{index-n}, {\it{lst\/}}, {\it{k\/}})\index{read-lst})\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-$>$pc-read-mem.

\addvspace{18pt}

\begin{verbatim}; program segment remains unchanged after any write on memory,  because 
; program is in ROM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  byte-write-mcode-addrp \\ \index{byte-write-mcode-addrp}
\=\+({\rm{pc-read-memp}}\,({\it{pc\/}}, {\it{mem\/}}, {\rm{len}}\,({\it{lst\/}})\index{len})\index{pc-read-memp} $\wedge$ {\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mcode-addrp}}\,({\it{pc\/}}, {\rm{byte-write}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}})\index{byte-write}, {\it{lst\/}})\index{mcode-addrp} \\ 
$=$$\;\;\;\;${\rm{mcode-addrp}}\,({\it{pc\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-mcode-addrp \\ \index{write-mem-mcode-addrp}
\=\+({\rm{pc-read-memp}}\,({\it{pc\/}}, {\it{mem\/}}, {\rm{len}}\,({\it{lst\/}})\index{len})\index{pc-read-memp} $\wedge$ {\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mcode-addrp}}\,({\it{pc\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-mem}, {\it{lst\/}})\index{mcode-addrp} \\ 
$=$$\;\;\;\;${\rm{mcode-addrp}}\,({\it{pc\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp})\-\-
\end{tabbing}

\begin{verbatim};               DISJOINT0 AND DISJOINT

\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint0-head \\ \index{disjoint0-head}
\=\+({\rm{disjoint0}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{m\/}}, {\it{y\/}})\index{disjoint0} $=$ {\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}})\index{disjoint0}) \\ 
$\wedge$$\;\;\;\;$({\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\rm{head}}\,({\it{y\/}}, {\tt{32}})\index{head})\index{disjoint0} $=$ {\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}})\index{disjoint0})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-head \\ \index{disjoint-head}
\=\+({\rm{disjoint}}\,({\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint}) \\ 
$\wedge$$\;\;\;\;$({\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\rm{head}}\,({\it{y\/}}, {\tt{32}})\index{head}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-la0 \\ \index{disjoint0-la0}
({\rm{disjoint0}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}})\index{disjoint0} $\wedge$ ({\it{i\/}} $<$ {\it{m\/}})) $\rightarrow$ ($\neg$ {\rm{mod32-eq}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{b\/}})\index{mod32-eq})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-la1 \\ \index{disjoint0-la1}
({\rm{disjoint0}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}})\index{disjoint0} $\wedge$ ({\it{i\/}} $<$ {\it{m\/}})) $\rightarrow$ {\rm{disjoint0}}\,({\it{a\/}}, {\it{i\/}}, {\it{b\/}})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-la2 \\ \index{disjoint0-la2}
({\rm{disjoint0}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}})\index{disjoint0} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}})) $\rightarrow$ {\rm{disjoint0}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\it{b\/}})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-la0 \\ \index{disjoint-la0}
({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $<$ {\it{n\/}})) $\rightarrow$ {\rm{disjoint0}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{j\/}})\index{add})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-la1 \\ \index{disjoint-la1}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{i\/}} $<$ {\it{m\/}}) $\wedge$ ({\it{j\/}} $<$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$($\neg$ {\rm{mod32-eq}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{j\/}})\index{add})\index{mod32-eq})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-la2 \\ \index{disjoint-la2}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{k\/}} $<$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint0}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add})\index{disjoint0}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-la3 \\ \index{disjoint-la3}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ (({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim}; 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-0 \\ \index{disjoint-0}
({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) $\rightarrow$ {\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-1 \\ \index{disjoint-1}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ (({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2 \\ \index{disjoint-2}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3 \\ \index{disjoint-3}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ (({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-4 \\ \index{disjoint-4}
\=\+({\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-5 \\ \index{disjoint-5}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-6 \\ \index{disjoint-6}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-7 \\ \index{disjoint-7}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-8 \\ \index{disjoint-8}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ (({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-9 \\ \index{disjoint-9}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-10 \\ \index{disjoint-10}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-11 \\ \index{disjoint-11}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-12 \\ \index{disjoint-12}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-13 \\ \index{disjoint-13}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-14 \\ \index{disjoint-14}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-15 \\ \index{disjoint-15}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim}; the commutativity of disjoint.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-commutativity \\ \index{disjoint-commutativity}
{\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{y\/}}, {\it{n\/}}, {\it{x\/}}, {\it{m\/}})\index{disjoint}
\end{tabbing}

\begin{verbatim}; the dual events of the above 16 events.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-0\~ \\ \index{disjoint-0\~}
({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) $\rightarrow$ {\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-1\~ \\ \index{disjoint-1\~}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ (({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2\~ \\ \index{disjoint-2\~}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3\~ \\ \index{disjoint-3\~}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ (({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-4\~ \\ \index{disjoint-4\~}
\=\+({\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-5\~ \\ \index{disjoint-5\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-6\~ \\ \index{disjoint-6\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-7\~ \\ \index{disjoint-7\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}
\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-8\~ \\ \index{disjoint-8\~}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ (({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-9\~ \\ \index{disjoint-9\~}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-10\~ \\ \index{disjoint-10\~}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-11\~ \\ \index{disjoint-11\~}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}
\begin{verbatim};
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-12\~ \\ \index{disjoint-12\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-13\~ \\ \index{disjoint-13\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}
                      
\begin{tabbing}{\sc Theorem}:  disjoint-14\~ \\ \index{disjoint-14\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}}, {\it{a\/}}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-15\~ \\ \index{disjoint-15\~}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{verbatim}; disjoint with asl.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  times-plus-lessp-cancel \\ \index{times-plus-lessp-cancel}
\=\+(({\it{a\/}} $\leq$ {\it{k\/}}) $\wedge$ ({\it{b\/}} $\leq$ {\it{k\/}}) $\wedge$ ({\it{a\/}} $<$ {\it{b\/}})) \\ 
$\rightarrow$$\;\;\;\;$((({\it{a\/}} $+$ ({\it{i\/}} $*$ {\it{k\/}})) $<$ ({\it{b\/}} $+$ ({\it{j\/}} $*$ {\it{k\/}}))) $=$ ({\it{i\/}} $\leq$ {\it{j\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2-asl \\ \index{disjoint-2-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2\~-asl \\ \index{disjoint-2\~-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3-asl \\ \index{disjoint-3-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3\~-asl \\ \index{disjoint-3\~-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{k\/}} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-9-asl \\ \index{disjoint-9-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-9\~-asl \\ \index{disjoint-9\~-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-11-asl \\ \index{disjoint-11-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-11\~-asl \\ \index{disjoint-11\~-asl}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{m\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$(({\it{l\/}} $+$ {\rm{index-n}}\,({\it{k1\/}}, {\it{k\/}})\index{index-n}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k1\/}})\index{add}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{opsz\/}})\index{disjoint}\-
\end{tabbing}


\noindent{\sc Event}:   Disable times-plus-lessp-cancel.

\addvspace{18pt}

\begin{verbatim}; a set of rewrite rules for disjoint0 and disjoint.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint0-x-x \\ \index{disjoint0-x-x}
{\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\it{x\/}})\index{disjoint0} $=$ ({\it{m\/}} $\simeq {\tt{0}}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-deduction0 \\ \index{disjoint0-deduction0}
{\rm{disjoint0}}\,({\it{x\/}}, {\tt{0}}, {\it{y\/}})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-deduction1 \\ \index{disjoint0-deduction1}
\=\+({\rm{disjoint0}}\,({\it{x\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{disjoint0} $=$ {\rm{disjoint0}}\,({\tt{0}}, {\it{m\/}}, {\it{y\/}})\index{disjoint0}) \\ 
$\wedge$$\;\;\;\;$({\rm{disjoint0}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{m\/}}, {\it{x\/}})\index{disjoint0} $=$ {\rm{disjoint0}}\,({\it{y\/}}, {\it{m\/}}, {\tt{0}})\index{disjoint0})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint0-deduction2 \\ \index{disjoint0-deduction2}
{\rm{disjoint0}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{z\/}})\index{add})\index{disjoint0} $=$ {\rm{disjoint0}}\,({\it{y\/}}, {\it{m\/}}, {\it{z\/}})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-x-x \\ \index{disjoint-x-x}
{\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{x\/}}, {\it{n\/}})\index{disjoint} $=$ (({\it{m\/}} $\simeq {\tt{0}}$) $\vee$ ({\it{n\/}} $\simeq {\tt{0}}$))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-deduction0 \\ \index{disjoint-deduction0}
{\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\it{y\/}}, {\tt{0}})\index{disjoint} $\wedge$ {\rm{disjoint}}\,({\it{x\/}}, {\tt{0}}, {\it{y\/}}, {\it{n\/}})\index{disjoint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-deduction1 \\ \index{disjoint-deduction1}
\=\+({\rm{disjoint}}\,({\it{x\/}}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\tt{0}}, {\it{m\/}}, {\it{y\/}}, {\it{n\/}})\index{disjoint}) \\ 
$\wedge$$\;\;\;\;$({\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{m\/}}, {\it{x\/}}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{y\/}}, {\it{m\/}}, {\tt{0}}, {\it{n\/}})\index{disjoint})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-deduction2 \\ \index{disjoint-deduction2}
{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{z\/}})\index{add}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{y\/}}, {\it{m\/}}, {\it{z\/}}, {\it{n\/}})\index{disjoint}
\end{tabbing}

\begin{verbatim};                     INDEX-N
\end{verbatim}\begin{tabbing}{\sc Theorem}:  index-n-0 \\ \index{index-n-0}
({\rm{index-n}}\,({\it{x\/}}, {\tt{0}})\index{index-n} $=$ {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}) $\wedge$ ({\rm{index-n}}\,({\tt{0}}, {\it{x\/}})\index{index-n} $=$ {\rm{neg}}\,({\tt{32}}, {\it{x\/}})\index{neg})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  index-n-x-x \\ \index{index-n-x-x}
{\rm{index-n}}\,({\it{x\/}}, {\it{x\/}})\index{index-n} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  index-n-deduction0 \\ \index{index-n-deduction0}
\=\+({\rm{index-n}}\,({\it{x\/}}, {\rm{neg}}\,({\tt{32}}, {\it{y\/}})\index{neg})\index{index-n} $=$ {\rm{index-n}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\tt{0}})\index{index-n}) \\ 
$\wedge$$\;\;\;\;$({\rm{index-n}}\,({\rm{neg}}\,({\tt{32}}, {\it{x\/}})\index{neg}, {\it{y\/}})\index{index-n} $=$ {\rm{index-n}}\,({\tt{0}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{index-n})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  index-n-deduction1 \\ \index{index-n-deduction1}
\=\+({\rm{index-n}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{x\/}})\index{index-n} $=$ {\rm{index-n}}\,({\it{y\/}}, {\tt{0}})\index{index-n}) \\ 
$\wedge$$\;\;\;\;$({\rm{index-n}}\,({\it{y\/}}, {\rm{add}}\,({\tt{32}}, {\it{y\/}}, {\it{x\/}})\index{add})\index{index-n} $=$ {\rm{index-n}}\,({\tt{0}}, {\it{x\/}})\index{index-n})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  index-n-deduction2 \\ \index{index-n-deduction2}
{\rm{index-n}}\,({\rm{add}}\,({\tt{32}}, {\it{z\/}}, {\it{x\/}})\index{add}, {\rm{add}}\,({\tt{32}}, {\it{z\/}}, {\it{y\/}})\index{add})\index{index-n} $=$ {\rm{index-n}}\,({\it{x\/}}, {\it{y\/}})\index{index-n}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-deduction3 \\ \index{disjoint-deduction3}
{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{y\/}}, {\it{x\/}})\index{add}, {\it{m\/}}, {\rm{add}}\,({\tt{32}}, {\it{z\/}}, {\it{x\/}})\index{add}, {\it{n\/}})\index{disjoint} $=$ {\rm{disjoint}}\,({\it{y\/}}, {\it{m\/}}, {\it{z\/}}, {\it{n\/}})\index{disjoint}
\end{tabbing}


\noindent{\sc Event}:   Disable index-n.

\addvspace{18pt}

\begin{verbatim};           READ-MEM/WRITE-MEM WITH MEM-LST/MEM-ILST
;
; starting at address a, the contents of the memory are equal to the elements 
; of lst.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mem-lst} \\  
\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$ \\ 
{\bf else }\=\+({\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem} $=$ {\rm{car}}\,({\it{lst\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\sc{l}}\index{l}, {\it{a\/}}, {\it{opsz\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-\;1$, {\rm{cdr}}\,({\it{lst\/}}))\index{mem-lst}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{mem-ilst} \\  
\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$ \\ 
{\bf else }\=\+({\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-to-int} $=$ {\rm{car}}\,({\it{lst\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{mem-ilst}}\,({\it{opsz\/}}, {\rm{add}}\,({\sc{l}}\index{l}, {\it{a\/}}, {\it{opsz\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-\;1$, {\rm{cdr}}\,({\it{lst\/}}))\index{mem-ilst}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; every element in lst is in "good" range.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mem-lst-nat-rangep \\ \index{mem-lst-nat-rangep}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ (({\tt{8}} $*$ {\it{opsz\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{nat-rangep}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth}, {\it{k\/}})\index{nat-rangep}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-ilst-int-rangep \\ \index{mem-ilst-int-rangep}
\=\+({\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} $\wedge$ ({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}}))) \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth}, {\it{oplen\/}})\index{int-rangep}\-
\end{tabbing}

\begin{verbatim}; every element in lst is a natural number.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mem-lst-numberp \\ \index{mem-lst-numberp}
{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\rightarrow$ ({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $\in\;${\bf{N}}${}$)
\end{tabbing}

\begin{verbatim}; every element in lst is bounded by 2^(8*opsz).
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mem-lst-lessp \\ \index{mem-lst-lessp}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{k\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\tt{8}} $*$ {\it{opsz\/}})\index{exp})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $<$ {\it{k\/}})\-
\end{tabbing}

\begin{verbatim}; every element in lst is an integer. 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mem-ilst-integerp \\ \index{mem-ilst-integerp}
{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} $\rightarrow$ {\rm{integerp}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth})\index{integerp}
\end{tabbing}

\begin{verbatim}; a trivial, but useful, instantiation!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  readm-mem-lst \\ \index{readm-mem-lst}
{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\rm{readm-mem}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}})\index{readm-mem})\index{mem-lst}
\end{tabbing}

\begin{verbatim}; head with mem-lst/mem-ilst.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  head-mem-lst \\ \index{head-mem-lst}
{\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $=$ {\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  head-mem-ilst \\ \index{head-mem-ilst}
{\rm{mem-ilst}}\,({\it{opsz\/}}, {\rm{head}}\,({\it{x\/}}, {\tt{32}})\index{head}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} $=$ {\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-non-numberp \\ \index{read-mem-non-numberp}
({\it{x\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem} $=$ {\rm{read-mem}}\,({\tt{0}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem})
\end{tabbing}
                     
\begin{tabbing}{\sc Theorem}:  mem-lst-non-numberp \\ \index{mem-lst-non-numberp}
({\it{x\/}} $\not\in\;${\bf{N}}${}$) $\rightarrow$ ({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $=$ {\rm{mem-lst}}\,({\it{opsz\/}}, {\tt{0}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-same \\ \index{mem-lst-same}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $=$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint})) \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst}\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-mem-non-numberp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mem-lst-non-numberp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mem-lst-same.

\addvspace{18pt}

\begin{verbatim};                    CANONICAL FORMS
; Sometimes,  it is possible to have more than one representation
; for one concept.  We have to tell the prover only to use the canonical
; representations.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  pc-byte-read=pc-read-mem-1 \\ \index{pc-byte-read=pc-read-mem-1}
{\rm{pc-byte-read}}\,({\it{addr\/}}, {\it{mem\/}})\index{pc-byte-read} $=$ {\rm{pc-read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\tt{1}})\index{pc-read-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-read=read-mem-1 \\ \index{byte-read=read-mem-1}
{\rm{byte-read}}\,({\it{addr\/}}, {\it{mem\/}})\index{byte-read} $=$ {\rm{read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\tt{1}})\index{read-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-write=write-mem-1 \\ \index{byte-write=write-mem-1}
{\rm{byte-write}}\,({\it{value\/}}, {\it{addr\/}}, {\it{mem\/}})\index{byte-write} $=$ {\rm{write-mem}}\,({\it{value\/}}, {\it{addr\/}}, {\it{mem\/}}, {\tt{1}})\index{write-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  byte-writep=write-memp-1 \\ \index{byte-writep=write-memp-1}
{\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep} $=$ {\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{1}})\index{write-memp}
\end{tabbing}

\begin{verbatim};        GET-LST, PUT-LST, GET-VALS, PUT-VALS, MCAR, and MCDR
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{get-lst} \\  
\=\+{\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{app}}\,(\=\+{\tt{8}} $*$ {\it{opsz\/}}, \\ 
{\rm{get-nth}}\,({\it{m\/}} $+$ ({\it{n\/}} $-\;1$), {\it{lst\/}})\index{get-nth}, \\ 
{\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\it{lst\/}}, {\it{n\/}} $-\;1$)\index{get-lst})\-\index{app}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{put-lst} \\  
\=\+{\rm{put-lst}}\,({\it{opsz\/}}, {\it{v\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{k\/}})\index{put-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{put-lst}}\,(\=\+{\it{opsz\/}}, \\ 
{\rm{tail}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{tail}, \\ 
{\it{n\/}}, \\ 
{\rm{put-nth}}\,({\rm{head}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{head}, {\it{n\/}} $+$ ({\it{k\/}} $-\;1$), {\it{lst\/}})\index{put-nth}, \\ 
{\it{k\/}} $-\;1$)\-\index{put-lst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{get-vals} \\  
\=\+{\rm{get-vals}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{get-vals}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}} $-\;1$)\index{get-vals}, \\ 
{\rm{list}}\,({\rm{get-nth}}\,({\it{m\/}} $+$ ({\it{n\/}} $-\;1$), {\it{lst\/}})\index{get-nth}))\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{put-vals} \\  
\=\+{\rm{put-vals}}\,({\it{vals\/}}, {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{put-vals} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{put-vals}}\,(\=\+{\it{vals\/}}, \\ 
{\it{m\/}}, \\ 
{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{n\/}} $-\;1$, {\it{vals\/}})\index{get-nth}, {\it{m\/}} $+$ ({\it{n\/}} $-\;1$), {\it{lst\/}})\index{put-nth}, \\ 
{\it{n\/}} $-\;1$)\-\index{put-vals}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{bv-to-lst} \\  
\=\+{\rm{bv-to-lst}}\,({\it{opsz\/}}, {\it{bv\/}}, {\it{n\/}})\index{bv-to-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{append}}\,(\=\+{\rm{bv-to-lst}}\,({\it{opsz\/}}, {\rm{tail}}\,({\it{bv\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{tail}, {\it{n\/}} $-\;1$)\index{bv-to-lst}, \\ 
{\rm{list}}\,({\rm{head}}\,({\it{bv\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{head}))\-$\;${\bf  endif}\-\-
\end{tabbing}
     
\begin{tabbing}{\sc Definition}:\index{lst-to-bv} \\  
\=\+{\rm{lst-to-bv}}\,({\it{opsz\/}}, {\it{lst\/}}, {\it{n\/}})\index{lst-to-bv} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{app}}\,(\=\+{\tt{8}} $*$ {\it{opsz\/}}, \\ 
{\rm{get-nth}}\,({\it{n\/}} $-\;1$, {\it{lst\/}})\index{get-nth}, \\ 
{\rm{lst-to-bv}}\,({\it{opsz\/}}, {\it{lst\/}}, {\it{n\/}} $-\;1$)\index{lst-to-bv})\-\index{app}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; mcar returns the list consisting of the first n elements of lst.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mcar} \\  
\=\+{\rm{mcar}}\,({\it{n\/}}, {\it{lst\/}})\index{mcar} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\rm{car}}\,({\it{lst\/}}), {\rm{mcar}}\,({\it{n\/}} $-\;1$, {\rm{cdr}}\,({\it{lst\/}}))\index{mcar})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; mcdr returns the list discarding the first n elements of lst.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mcdr} \\  
\=\+{\rm{mcdr}}\,({\it{n\/}}, {\it{lst\/}})\index{mcdr} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{mcdr}}\,({\it{n\/}} $-\;1$, {\rm{cdr}}\,({\it{lst\/}}))\index{mcdr}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; a predicate to recognize proper list.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{proper-lstp} \\  
\=\+{\rm{proper-lstp}}\,({\it{lst\/}})\index{proper-lstp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\it{lst\/}} $=$ {\bf{nil}} \\ 
{\bf else }{\rm{proper-lstp}}\,({\rm{cdr}}\,({\it{lst\/}}))\index{proper-lstp}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  append-len \\ \index{append-len}
{\rm{len}}\,({\rm{append}}\,({\it{x\/}}, {\it{y\/}}))\index{len} $=$ ({\rm{len}}\,({\it{x\/}})\index{len} $+$ {\rm{len}}\,({\it{y\/}})\index{len})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-len \\ \index{get-vals-len}
{\rm{len}}\,({\rm{get-vals}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals})\index{len} $=$ {\rm{fix}}\,({\it{n\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-to-lst-len \\ \index{bv-to-lst-len}
{\rm{len}}\,({\rm{bv-to-lst}}\,({\it{opsz\/}}, {\it{bv\/}}, {\it{n\/}})\index{bv-to-lst})\index{len} $=$ {\rm{fix}}\,({\it{n\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-proper-lstp \\ \index{get-vals-proper-lstp}
{\rm{proper-lstp}}\,({\rm{get-vals}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals})\index{proper-lstp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bv-to-lst-proper-lstp \\ \index{bv-to-lst-proper-lstp}
{\rm{proper-lstp}}\,({\rm{bv-to-lst}}\,({\it{opsz\/}}, {\it{bv\/}}, {\it{n\/}})\index{bv-to-lst})\index{proper-lstp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mcdr-listp-len \\ \index{mcdr-listp-len}
{\rm{listp}}\,({\rm{mcdr}}\,({\it{n\/}}, {\it{lst\/}})\index{mcdr}) $=$ ({\it{n\/}} $<$ {\rm{len}}\,({\it{lst\/}})\index{len})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  cdr-mcdr \\ \index{cdr-mcdr}
{\rm{cdr}}\,({\rm{mcdr}}\,({\it{n\/}}, {\it{lst\/}})\index{mcdr}) $=$ {\rm{mcdr}}\,($1\;+$ {\it{n\/}}, {\it{lst\/}})\index{mcdr}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mcar-mcar \\ \index{mcar-mcar}
({\it{m\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\rm{mcar}}\,({\it{m\/}}, {\rm{mcar}}\,({\it{n\/}}, {\it{lst\/}})\index{mcar})\index{mcar} $=$ {\rm{mcar}}\,({\it{m\/}}, {\it{lst\/}})\index{mcar})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mcdr-mcdr \\ \index{mcdr-mcdr}
{\rm{mcdr}}\,({\it{n\/}}, {\rm{mcdr}}\,({\it{m\/}}, {\it{lst\/}})\index{mcdr})\index{mcdr} $=$ {\rm{mcdr}}\,({\it{m\/}} $+$ {\it{n\/}}, {\it{lst\/}})\index{mcdr}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mcar-nth \\ \index{mcar-nth}
\=\+{\rm{get-nth}}\,({\it{n\/}}, {\rm{mcar}}\,({\it{m\/}}, {\it{lst\/}})\index{mcar})\index{get-nth} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\it{m\/}}$\;\;${\bf then }{\rm{get-nth}}\,({\it{n\/}}, {\it{lst\/}})\index{get-nth} \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mcdr-nth \\ \index{mcdr-nth}
{\rm{get-nth}}\,({\it{n\/}}, {\rm{mcdr}}\,({\it{m\/}}, {\it{lst\/}})\index{mcdr})\index{get-nth} $=$ {\rm{get-nth}}\,({\it{m\/}} $+$ {\it{n\/}}, {\it{lst\/}})\index{get-nth}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-lst-cdr \\ \index{get-lst-cdr}
{\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\rm{cdr}}\,({\it{lst\/}}), {\it{n\/}})\index{get-lst} $=$ {\rm{get-lst}}\,({\it{opsz\/}}, $1\;+$ {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-lst}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-lst-mcdr \\ \index{get-lst-mcdr}
{\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\rm{mcdr}}\,({\it{j\/}}, {\it{lst\/}})\index{mcdr}, {\it{n\/}})\index{get-lst} $=$ {\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}} $+$ {\it{j\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-lst}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-lst-mcar \\ \index{get-lst-mcar}
\=\+(({\it{m\/}} $+$ {\it{n\/}}) $\leq$ {\it{j\/}}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\rm{mcar}}\,({\it{j\/}}, {\it{lst\/}})\index{mcar}, {\it{n\/}})\index{get-lst} $=$ {\rm{get-lst}}\,({\it{opsz\/}}, {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-lst})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-cdr \\ \index{get-vals-cdr}
{\rm{get-vals}}\,({\it{m\/}}, {\rm{cdr}}\,({\it{lst\/}}), {\it{n\/}})\index{get-vals} $=$ {\rm{get-vals}}\,($1\;+$ {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-mcdr \\ \index{get-vals-mcdr}
{\rm{get-vals}}\,({\it{m\/}}, {\rm{mcdr}}\,({\it{j\/}}, {\it{lst\/}})\index{mcdr}, {\it{n\/}})\index{get-vals} $=$ {\rm{get-vals}}\,({\it{m\/}} $+$ {\it{j\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-mcar \\ \index{get-vals-mcar}
(({\it{m\/}} $+$ {\it{n\/}}) $\leq$ {\it{j\/}}) $\rightarrow$ ({\rm{get-vals}}\,({\it{m\/}}, {\rm{mcar}}\,({\it{j\/}}, {\it{lst\/}})\index{mcar}, {\it{n\/}})\index{get-vals} $=$ {\rm{get-vals}}\,({\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-nth-append \\ \index{get-nth-append}
\=\+{\rm{get-nth}}\,({\it{i\/}}, {\rm{append}}\,({\it{x\/}}, {\it{y\/}}))\index{get-nth} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\rm{len}}\,({\it{x\/}})\index{len}$\;\;${\bf then }{\rm{get-nth}}\,({\it{i\/}}, {\it{x\/}})\index{get-nth} \\ 
{\bf else }{\rm{get-nth}}\,({\it{i\/}} $-$ {\rm{len}}\,({\it{x\/}})\index{len}, {\it{y\/}})\index{get-nth}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-append \\ \index{get-vals-append}
({\it{n\/}} $\leq$ {\rm{len}}\,({\it{x\/}})\index{len}) $\rightarrow$ ({\rm{get-vals}}\,({\tt{0}}, {\rm{append}}\,({\it{x\/}}, {\it{y\/}}), {\it{n\/}})\index{get-vals} $=$ {\rm{get-vals}}\,({\tt{0}}, {\it{x\/}}, {\it{n\/}})\index{get-vals})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-vals-append \\ \index{put-vals-append}
({\it{n\/}} $\leq$ {\rm{len}}\,({\it{x\/}})\index{len}) $\rightarrow$ ({\rm{put-vals}}\,({\rm{append}}\,({\it{x\/}}, {\it{y\/}}), {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{put-vals} $=$ {\rm{put-vals}}\,({\it{x\/}}, {\it{m\/}}, {\it{lst\/}}, {\it{n\/}})\index{put-vals})
\end{tabbing}

\begin{verbatim}; another induction hint for many theorems about memory.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mem-induct2} \\  
\=\+{\rm{mem-induct2}}\,({\it{opsz\/}}, {\it{addr\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{j\/}})\index{mem-induct2} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{mem-induct2}}\,(\=\+{\it{opsz\/}}, \\ 
{\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{opsz\/}})\index{add}, \\ 
{\it{i\/}} $-\;1$, \\ 
{\it{n\/}} $-\;1$, \\ 
{\rm{cdr}}\,({\it{lst\/}}), \\ 
{\it{j\/}} $-$ {\it{opsz\/}})\-\index{mem-induct2}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-lst-la \\ \index{read-mem-lst-la}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} ${}${\bf{mod}}${}$ {\it{opsz\/}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $\div$ {\it{opsz\/}}) $<$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem} $=$ {\rm{get-nth}}\,({\it{j\/}} $\div$ {\it{opsz\/}}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-get-lst0 \\ \index{mem-lst-get-lst0}
\=\+({\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{k\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem})\index{nat-to-uint} $=$ {\rm{get-lst}}\,({\tt{1}}, {\tt{0}}, {\it{lst\/}}, {\it{k\/}})\index{get-lst})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-get-lst \\ \index{mem-lst-get-lst}
\=\+({\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ (({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $+$ {\it{k\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{read-mem})\index{nat-to-uint} \\ 
$=$$\;\;\;\;${\rm{get-lst}}\,({\tt{1}}, {\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint}, {\it{lst\/}}, {\it{k\/}})\index{get-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-get-vals0 \\ \index{mem-lst-get-vals0}
\=\+({\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{k\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{bv-to-lst}}\,({\tt{1}}, {\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{k\/}})\index{read-mem}, {\it{k\/}})\index{bv-to-lst} $=$ {\rm{get-vals}}\,({\tt{0}}, {\it{lst\/}}, {\it{k\/}})\index{get-vals})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-get-vals \\ \index{mem-lst-get-vals}
\=\+({\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ (({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $+$ {\it{k\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{bv-to-lst}}\,({\tt{1}}, {\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{read-mem}, {\it{k\/}})\index{bv-to-lst} \\ 
$=$$\;\;\;\;${\rm{get-vals}}\,({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint}, {\it{lst\/}}, {\it{k\/}})\index{get-vals})\-\-
\end{tabbing}

\begin{verbatim}; read is equivalent to get-nth.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  read-mem-lst0 \\ \index{read-mem-lst0}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$)) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem})\index{nat-to-uint} $=$ {\rm{get-nth}}\,({\tt{0}}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  iread-mem-get0 \\ \index{iread-mem-get0}
\=\+({\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} $\wedge$ ({\it{n\/}} $\not\simeq {\tt{0}}$) $\wedge$ ({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}}))) \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem}, {\it{oplen\/}})\index{nat-to-int} $=$ {\rm{get-nth}}\,({\tt{0}}, {\it{lst\/}})\index{get-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-lst \\ \index{read-mem-lst}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\it{opsz\/}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}) $<$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem})\index{nat-to-uint} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-lst-int \\ \index{read-mem-lst-int}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} ${}${\bf{mod}}${}$ {\it{opsz\/}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\div$ {\it{opsz\/}}) $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem})\index{nat-to-uint} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\div$ {\it{opsz\/}}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-ilst \\ \index{read-mem-ilst}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;$({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\it{opsz\/}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}) $<$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem}, {\it{oplen\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-ilst-int \\ \index{read-mem-ilst-int}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;$({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} ${}${\bf{mod}}${}$ {\it{opsz\/}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}) $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem}, {\it{oplen\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $\div$ {\it{opsz\/}}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{verbatim}; write to some location else does not affect mem-lst.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-else-mem-lst \\ \index{write-else-mem-lst}
\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{opsz\/}} $*$ {\it{n\/}}, {\it{x\/}}, {\it{m\/}})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$=$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-else-mem-ilst \\ \index{write-else-mem-ilst}
\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{opsz\/}} $*$ {\it{n\/}}, {\it{x\/}}, {\it{m\/}})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$=$$\;\;\;\;${\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst})\-\-
\end{tabbing}

\begin{verbatim}; some conditions that makes disjoint true.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint0-leq \\ \index{disjoint0-leq}
((({\it{a\/}} $+$ {\it{m\/}}) $\leq$ {\tt{4294967296}}) $\wedge$ ({\it{b\/}} $<$ {\it{a\/}})) $\rightarrow$ {\rm{disjoint0}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}})\index{disjoint0}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-leq \\ \index{disjoint-leq}
((({\it{a\/}} $+$ {\it{m\/}}) $\leq$ {\tt{4294967296}}) $\wedge$ (({\it{b\/}} $+$ {\it{n\/}}) $\leq$ {\it{a\/}})) $\rightarrow$ {\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-leq1 \\ \index{disjoint-leq1}
((({\it{a\/}} $+$ {\it{m\/}}) $\leq$ {\tt{4294967296}}) $\wedge$ (({\it{b\/}} $+$ {\it{n\/}}) $\leq$ {\it{a\/}})) $\rightarrow$ {\rm{disjoint}}\,({\it{b\/}}, {\it{n\/}}, {\it{a\/}}, {\it{m\/}})\index{disjoint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-times-lessp \\ \index{plus-times-lessp}
\=\+((({\it{x\/}} $+$ ({\it{y\/}} $*$ {\it{z\/}})) $<$ {\it{w\/}}) $\wedge$ ({\it{z1\/}} $<$ {\it{z\/}})) \\ 
$\rightarrow$$\;\;\;\;$(({\it{x\/}} $+$ {\it{y\/}} $+$ ({\it{y\/}} $*$ {\it{z1\/}})) $<$ {\it{w\/}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-lst-la \\ \index{write-mem-lst-la}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{head}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{head}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $=$ ({\it{opsz\/}} $*$ {\it{i\/}})) \\ 
$\wedge$$\;\;\;\;$({\it{i\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{mem-induct3} \\  
\=\+{\rm{mem-induct3}}\,({\it{v\/}}, {\it{v1\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{i\/}}, {\it{lst\/}}, {\it{k\/}})\index{mem-induct3} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{mem-induct3}}\,(\=\+{\rm{tail}}\,({\it{v\/}}, {\tt{8}})\index{tail}, \\ 
{\rm{tail}}\,({\it{v1\/}}, {\tt{8}})\index{tail}, \\ 
{\it{a\/}}, \\ 
{\rm{byte-write}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}} $+$ ({\it{k\/}} $-\;1$))\index{add}, {\it{mem\/}})\index{byte-write}, \\ 
{\it{i\/}}, \\ 
{\rm{put-nth}}\,({\rm{head}}\,({\it{v\/}}, {\tt{8}})\index{head}, {\it{i\/}} $+$ ({\it{k\/}} $-\;1$), {\it{lst\/}})\index{put-nth}, \\ 
{\it{k\/}} $-\;1$)\-\index{mem-induct3}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-put-lst \\ \index{mem-lst-put-lst}
\=\+(\=\+{\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{k\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $=$ {\it{i\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-uint}}\,({\it{v\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{k\/}}) $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-lst}}\,({\tt{1}}, {\it{v1\/}}, {\it{i\/}}, {\it{lst\/}}, {\it{k\/}})\index{put-lst})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{mem-induct4} \\  
\=\+{\rm{mem-induct4}}\,({\it{v\/}}, {\it{vals\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{i\/}}, {\it{lst\/}}, {\it{k\/}})\index{mem-induct4} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{k\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{mem-induct4}}\,(\=\+{\rm{tail}}\,({\it{v\/}}, {\tt{8}})\index{tail}, \\ 
{\rm{get-vals}}\,({\tt{0}}, {\it{vals\/}}, {\it{k\/}} $-\;1$)\index{get-vals}, \\ 
{\it{a\/}}, \\ 
{\rm{byte-write}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}} $+$ ({\it{k\/}} $-\;1$))\index{add}, {\it{mem\/}})\index{byte-write}, \\ 
{\it{i\/}}, \\ 
{\rm{put-nth}}\,({\rm{head}}\,({\it{v\/}}, {\tt{8}})\index{head}, {\it{i\/}} $+$ ({\it{k\/}} $-\;1$), {\it{lst\/}})\index{put-nth}, \\ 
{\it{k\/}} $-\;1$)\-\index{mem-induct4}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-vals-0 \\ \index{get-vals-0}
(({\rm{len}}\,({\it{lst\/}})\index{len} $=$ {\it{n\/}}) $\wedge$ {\rm{proper-lstp}}\,({\it{lst\/}})\index{proper-lstp}) $\rightarrow$ ({\rm{get-vals}}\,({\tt{0}}, {\it{lst\/}}, {\it{n\/}})\index{get-vals} $=$ {\it{lst\/}})
\end{tabbing}        

\begin{tabbing}{\sc Theorem}:  mem-lst-put-vals \\ \index{mem-lst-put-vals}
\=\+(\=\+{\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{k\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $=$ {\it{i\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{vals\/}} $=$ {\rm{bv-to-lst}}\,({\tt{1}}, {\it{v\/}}, {\it{k\/}})\index{bv-to-lst}) \\ 
$\wedge$$\;\;\;\;$(({\it{i\/}} $+$ {\it{k\/}}) $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\tt{1}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-vals}}\,({\it{vals\/}}, {\it{i\/}}, {\it{lst\/}}, {\it{k\/}})\index{put-vals})\index{mem-lst}\-
\end{tabbing}


\noindent{\sc Event}:   Disable get-vals-0.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  write-mem-lst \\ \index{write-mem-lst}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $=$ ({\it{opsz\/}} $*$ {\it{i\/}})) \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-uint}}\,({\it{v\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{i\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-ilst \\ \index{write-mem-ilst}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{j\/}})\index{nat-to-uint} $=$ ({\it{opsz\/}} $*$ {\it{i\/}})) \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-int}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{i\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-ilst}}\,(\=\+{\it{opsz\/}}, \\ 
{\it{a\/}}, \\ 
{\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, \\ 
{\it{n\/}}, \\ 
{\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\-\index{mem-ilst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-lst0 \\ \index{write-mem-lst0}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-uint}}\,({\it{v\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\tt{0}}, {\it{lst\/}})\index{put-nth})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-ilst0 \\ \index{write-mem-ilst0}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-int}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{n\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\tt{0}}, {\it{lst\/}})\index{put-nth})\index{mem-ilst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-lst-int \\ \index{write-mem-lst-int}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$(({\it{opsz\/}} $*$ {\it{i\/}}) $=$ {\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-uint}}\,({\it{v\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{i\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-ilst-int \\ \index{write-mem-ilst-int}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$(({\it{opsz\/}} $*$ {\it{i\/}}) $=$ {\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{j\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-int}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{i\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-ilst}}\,(\=\+{\it{opsz\/}}, \\ 
{\it{a\/}}, \\ 
{\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{j\/}})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, \\ 
{\it{n\/}}, \\ 
{\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\-\index{mem-ilst}\-
\end{tabbing}

\begin{verbatim};                    INTEGER VIEWS
;                    A + OPSZ * I
; to deal with the address calculation a+2*i or a+4*i, we introduce 
; the following set of lemmas.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  read-mem-lst-asl \\ \index{read-mem-lst-asl}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{i\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem})\index{nat-to-uint} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-ilst-asl \\ \index{read-mem-ilst-asl}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{i\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-mem}, {\it{oplen\/}})\index{nat-to-int} \\ 
$=$$\;\;\;\;${\rm{get-nth}}\,({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}, {\it{lst\/}})\index{get-nth})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-lst-asl \\ \index{write-mem-lst-asl}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $=$ {\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-uint}}\,({\it{v\/}})\index{nat-to-uint}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,(\=\+{\it{opsz\/}}, \\ 
{\it{a\/}}, \\ 
{\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{i\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, \\ 
{\it{n\/}}, \\ 
{\rm{put-nth}}\,({\it{v1\/}}, {\it{j\/}}, {\it{lst\/}})\index{put-nth})\-\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-mem-ilst-asl \\ \index{write-mem-ilst-asl}
\=\+(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$\wedge$$\;\;\;\;${\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$({\it{v1\/}} $=$ {\rm{nat-to-int}}\,({\it{v\/}}, {\tt{8}} $*$ {\it{opsz\/}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $=$ {\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int}) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $<$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{v\/}} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-ilst}}\,(\=\+{\it{opsz\/}}, \\ 
{\it{a\/}}, \\ 
{\rm{write-mem}}\,({\it{v\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{asl}}\,({\tt{32}}, {\it{i\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-mem}, \\ 
{\it{n\/}}, \\ 
{\rm{put-nth}}\,({\it{v1\/}}, {\it{j\/}}, {\it{lst\/}})\index{put-nth})\-\index{mem-ilst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  times-lessp-cancel1 \\ \index{times-lessp-cancel1}
(({\it{y\/}} $*$ {\it{x\/}}) $<$ ({\it{x\/}} $+$ ({\it{z\/}} $*$ {\it{x\/}}))) $=$ (({\it{x\/}} $\not\simeq {\tt{0}}$) $\wedge$ ({\it{y\/}} $\leq$ {\it{z\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram1-asl \\ \index{read-memp-ram1-asl}
\=\+(\=\+{\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{n\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-rom1-asl \\ \index{read-memp-rom1-asl}
\=\+(\=\+{\rm{rom-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{n\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram1-asl \\ \index{write-memp-ram1-asl}
\=\+(\=\+{\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp} \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $=$ {\rm{exp}}\,({\tt{2}}, {\it{cnt\/}})\index{exp}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $<$ ({\it{n\/}} $\div$ {\it{opsz\/}})) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{x\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\rm{asl}}\,({\tt{32}}, {\it{x\/}}, {\it{cnt\/}})\index{asl})\index{add}, {\it{mem\/}}, {\it{opsz\/}})\index{write-memp}\-
\end{tabbing}

\begin{verbatim};             BASIC READM-MEM/WRITEM-MEM EVENTS
;
\end{verbatim}\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-pc-byte-readp \\ \index{writem-mem-maintain-pc-byte-rea!dp}
{\rm{pc-byte-readp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem})\index{pc-byte-readp} $=$ {\rm{pc-byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{pc-byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-pc-read-memp \\ \index{writem-mem-maintain-pc-read-memp}
{\rm{pc-read-memp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{pc-read-memp} $=$ {\rm{pc-read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-byte-readp \\ \index{writem-mem-maintain-byte-readp}
{\rm{byte-readp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem})\index{byte-readp} $=$ {\rm{byte-readp}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-readp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-read-memp \\ \index{writem-mem-maintain-read-memp}
{\rm{read-memp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{read-memp} $=$ {\rm{read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-byte-writep \\ \index{writem-mem-maintain-byte-writep}
{\rm{byte-writep}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem})\index{byte-writep} $=$ {\rm{byte-writep}}\,({\it{x\/}}, {\it{mem\/}})\index{byte-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-write-memp \\ \index{writem-mem-maintain-write-memp}
{\rm{write-memp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{write-memp} $=$ {\rm{write-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{write-memp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-rom-addrp \\ \index{writem-mem-maintain-rom-addrp}
{\rm{rom-addrp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{rom-addrp} $=$ {\rm{rom-addrp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{rom-addrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-maintain-ram-addrp \\ \index{writem-mem-maintain-ram-addrp}
{\rm{ram-addrp}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{ram-addrp} $=$ {\rm{ram-addrp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{ram-addrp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  pc-read-mem-writem-mem \\ \index{pc-read-mem-writem-mem}
\=\+({\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{opsz\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len})\index{write-memp} $\wedge$ {\rm{pc-read-memp}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-memp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{pc-read-mem}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{pc-read-mem} \\ 
$=$$\;\;\;\;${\rm{pc-read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{pc-read-mem})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-mem-mcode-addrp \\ \index{writem-mem-mcode-addrp}
\=\+({\rm{pc-read-memp}}\,({\it{pc\/}}, {\it{mem\/}}, {\rm{len}}\,({\it{lst\/}})\index{len})\index{pc-read-memp} $\wedge$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{opsz\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len})\index{write-memp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mcode-addrp}}\,({\it{pc\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{lst\/}})\index{mcode-addrp} \\ 
$=$$\;\;\;\;${\rm{mcode-addrp}}\,({\it{pc\/}}, {\it{mem\/}}, {\it{lst\/}})\index{mcode-addrp})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-else-mem-lst \\ \index{writem-else-mem-lst}
\=\+{\rm{disjoint}}\,({\it{addr\/}}, {\it{opsz1\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len}, {\it{a\/}}, {\it{opsz\/}} $*$ {\it{n\/}})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{writem-mem}}\,({\it{opsz1\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$=$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  writem-else-mem-ilst \\ \index{writem-else-mem-ilst}
\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{opsz\/}} $*$ {\it{n\/}}, {\it{addr\/}}, {\it{opsz1\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\rm{writem-mem}}\,({\it{opsz1\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$=$$\;\;\;\;${\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-writem-mem \\ \index{read-writem-mem}
\=\+{\rm{disjoint}}\,({\it{addr\/}}, {\it{n\/}}, {\it{addr1\/}}, {\it{opsz\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{read-mem}}\,({\it{addr\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr1\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{read-mem} \\ 
$=$$\;\;\;\;${\rm{read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-mem})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  readm-write-mem \\ \index{readm-write-mem}
\=\+{\rm{disjoint}}\,({\it{addr\/}}, {\it{opsz\/}} $*$ {\it{n\/}}, {\it{addr1\/}}, {\it{k\/}})\index{disjoint} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{readm-mem}}\,({\it{opsz\/}}, {\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{addr1\/}}, {\it{mem\/}}, {\it{k\/}})\index{write-mem}, {\it{n\/}})\index{readm-mem} \\ 
$=$$\;\;\;\;${\rm{readm-mem}}\,({\it{opsz\/}}, {\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{readm-mem})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{modn-lst} \\  
\=\+{\rm{modn-lst}}\,({\it{n\/}}, {\it{lst\/}})\index{modn-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{nil}} \\ 
{\bf else }{\rm{cons}}\,({\rm{head}}\,({\rm{car}}\,({\it{lst\/}}), {\it{n\/}})\index{head}, {\rm{modn-lst}}\,({\it{n\/}}, {\rm{cdr}}\,({\it{lst\/}}))\index{modn-lst})$\;${\bf  endif}\-\-
\end{tabbing}
          
\begin{tabbing}{\sc Theorem}:  modn-readm-rn \\ \index{modn-readm-rn}
{\rm{modn-lst}}\,({\it{oplen\/}}, {\rm{readm-rn}}\,({\it{oplen\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{readm-rn})\index{modn-lst} $=$ {\rm{readm-rn}}\,({\it{oplen\/}}, {\it{rnlst\/}}, {\it{rfile\/}})\index{readm-rn}
\end{tabbing}           

\begin{tabbing}{\sc Theorem}:  readm-writem-mem \\ \index{readm-writem-mem}
\=\+({\rm{uint-rangep}}\,({\it{opsz\/}} $*$ {\it{n\/}}, {\tt{32}})\index{uint-rangep} $\wedge$ ({\it{n\/}} $=$ {\rm{len}}\,({\it{vlst\/}})\index{len})) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{readm-mem}}\,({\it{opsz\/}}, {\it{addr\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{n\/}})\index{readm-mem} \\ 
$=$$\;\;\;\;${\rm{modn-lst}}\,({\tt{8}} $*$ {\it{opsz\/}}, {\it{vlst\/}})\index{modn-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-leq-uint \\ \index{disjoint-leq-uint}
\=\+(\=\+(({\rm{nat-to-uint}}\,({\it{a\/}})\index{nat-to-uint} $+$ {\it{m\/}}) $\leq$ {\tt{4294967296}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{b\/}})\index{nat-to-uint} $+$ {\it{n\/}}) $\leq$ {\rm{nat-to-uint}}\,({\it{a\/}})\index{nat-to-uint}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-leq1-uint \\ \index{disjoint-leq1-uint}
\=\+(\=\+(({\rm{nat-to-uint}}\,({\it{a\/}})\index{nat-to-uint} $+$ {\it{m\/}}) $\leq$ {\tt{4294967296}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{b\/}})\index{nat-to-uint} $+$ {\it{n\/}}) $\leq$ {\rm{nat-to-uint}}\,({\it{a\/}})\index{nat-to-uint}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{n\/}}, {\it{a\/}}, {\it{m\/}})\index{disjoint}\-
\end{tabbing}


\noindent{\sc Event}:   Disable disjoint-leq.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-leq1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint0-leq.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-commutativity.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-leq-uint.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-leq1-uint.

\addvspace{18pt}

\begin{verbatim};              MEM-LST WITH MCAR AND MCDR
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mem-lst-plus \\ \index{mem-lst-plus}
\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{m\/}} $+$ {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$=$$\;\;\;\;$(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{m\/}}, {\rm{mcar}}\,({\it{m\/}}, {\it{lst\/}})\index{mcar})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{opsz\/}} $*$ {\it{m\/}})\index{add}, {\it{mem\/}}, {\it{n\/}}, {\rm{mcdr}}\,({\it{m\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcar \\ \index{mem-lst-mcar}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{k\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{k\/}}, {\rm{mcar}}\,({\it{k\/}}, {\it{lst\/}})\index{mcar})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcar-1 \\ \index{mem-lst-mcar-1}
\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\rm{mcar}}\,({\it{n\/}}, {\it{lst\/}})\index{mcar})\index{mem-lst} \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}} $-\;1$, {\rm{mcar}}\,({\it{n\/}} $-\;1$, {\it{lst\/}})\index{mcar})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcar-2 \\ \index{mem-lst-mcar-2}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\rm{mcar}}\,({\it{n\/}}, {\it{lst\/}})\index{mcar})\index{mem-lst} $\wedge$ ({\it{k\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}} $-$ {\it{k\/}}, {\rm{mcar}}\,({\it{n\/}} $-$ {\it{k\/}}, {\it{lst\/}})\index{mcar})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-difference \\ \index{plus-difference}
\=\+({\it{m\/}} $+$ ({\it{n\/}} $-$ {\it{m\/}})) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\it{m\/}}$\;\;${\bf then }{\rm{fix}}\,({\it{m\/}}) \\ 
{\bf else }{\rm{fix}}\,({\it{n\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-len \\ \index{mem-lst-len}
{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\rightarrow$ ({\it{n\/}} $\not<$ {\rm{len}}\,({\it{lst\/}})\index{len})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcdr \\ \index{mem-lst-mcdr}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{i\/}} $=$ ({\it{opsz\/}} $*$ {\it{m\/}}))) \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-$ {\it{m\/}}, {\rm{mcdr}}\,({\it{m\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcdr-0 \\ \index{mem-lst-mcdr-0}
\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{opsz\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-\;1$, {\rm{mcdr}}\,({\tt{1}}, {\it{lst\/}})\index{mcdr})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcdr-uint \\ \index{mem-lst-mcdr-uint}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $=$ ({\it{opsz\/}} $*$ {\it{m\/}})) \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $\not\simeq {\tt{0}}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-$ {\it{m\/}}, {\rm{mcdr}}\,({\it{m\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcdr-1 \\ \index{mem-lst-mcdr-1}
\=\+{\rm{mem-lst}}\,({\tt{1}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-$ {\it{j\/}}, {\rm{mcdr}}\,({\it{k\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst} \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,({\tt{1}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\rm{add}}\,({\tt{32}}, {\it{i\/}}, {\tt{1}})\index{add})\index{add}, {\it{mem\/}}, ({\it{n\/}} $-\;1$) $-$ {\it{j\/}}, {\rm{mcdr}}\,($1\;+$ {\it{k\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-mcdr-uint-1 \\ \index{mem-lst-mcdr-uint-1}
\=\+(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{b\/}})\index{add}, {\it{mem\/}}, {\it{n\/}} $-$ {\it{j\/}}, {\rm{mcdr}}\,({\it{k\/}}, {\it{lst\/}})\index{mcdr})\index{mem-lst} \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $=$ ({\it{opsz\/}} $*$ {\it{m\/}})) \\ 
$\wedge$$\;\;\;\;$({\it{opsz\/}} $\not\simeq {\tt{0}}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{mem-lst}}\,(\=\+{\it{opsz\/}}, \\ 
{\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{i\/}})\index{add})\index{add}, \\ 
{\it{mem\/}}, \\ 
{\it{n\/}} $-$ ({\it{m\/}} $+$ {\it{j\/}}), \\ 
{\rm{mcdr}}\,({\it{m\/}} $+$ {\it{k\/}}, {\it{lst\/}})\index{mcdr})\-\index{mem-lst}\-
\end{tabbing}


\noindent{\sc Event}:   Disable mem-lst-len.

\addvspace{18pt}

\noindent{\sc Event}:   Disable plus-difference.

\addvspace{18pt}

\begin{verbatim};                 LSTCPY AND LSTMCPY
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{lstcpy} \\  
\=\+{\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{lstcpy}}\,(\=\+$1\;+$ {\it{i1\/}}, \\ 
{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i2\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i1\/}}, {\it{lst1\/}})\index{put-nth}, \\ 
$1\;+$ {\it{i2\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} $-\;1$)\-\index{lstcpy}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstcpy-0 \\ \index{lstcpy-0}
{\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\tt{0}})\index{lstcpy} $=$ {\it{lst1\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstcpy-lstcpy \\ \index{lstcpy-lstcpy}
\=\+(({\it{j1\/}} $=$ ({\it{h1\/}} $+$ {\it{i1\/}})) $\wedge$ ({\it{j2\/}} $=$ ({\it{h1\/}} $+$ {\it{i2\/}}))) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{lstcpy}}\,({\it{j1\/}}, {\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{h1\/}})\index{lstcpy}, {\it{j2\/}}, {\it{lst2\/}}, {\it{h2\/}})\index{lstcpy} \\ 
$=$$\;\;\;\;${\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{h1\/}} $+$ {\it{h2\/}})\index{lstcpy})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{lstmcpy} \\  
\=\+{\rm{lstmcpy}}\,({\it{opsz\/}}, {\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstmcpy} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{lstmcpy}}\,(\=\+{\it{opsz\/}}, \\ 
{\it{opsz\/}} $+$ {\it{i1\/}}, \\ 
{\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{opsz\/}})\index{lstcpy}, \\ 
{\it{opsz\/}} $+$ {\it{i2\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} $-\;1$)\-\index{lstmcpy}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstmcpy-cpy \\ \index{lstmcpy-cpy}
{\rm{lstmcpy}}\,({\it{h\/}}, {\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstmcpy} $=$ {\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{h\/}} $*$ {\it{n\/}})\index{lstcpy}
\end{tabbing}
  
\begin{tabbing}{\sc Theorem}:  put-commutativity \\ \index{put-commutativity}
\=\+({\it{j\/}} $<$ {\it{i\/}}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\rm{put-nth}}\,({\it{v2\/}}, {\it{j\/}}, {\it{lst\/}})\index{put-nth})\index{put-nth} $=$ {\rm{put-nth}}\,({\it{v2\/}}, {\it{j\/}}, {\rm{put-nth}}\,({\it{v1\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{put-nth})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstcpy-put-nth \\ \index{lstcpy-put-nth}
\=\+({\it{i\/}} $<$ {\it{j1\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{put-nth}}\,({\it{v\/}}, {\it{i\/}}, {\rm{lstcpy}}\,({\it{j1\/}}, {\it{lst1\/}}, {\it{j2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy})\index{put-nth} \\ 
$=$$\;\;\;\;${\rm{lstcpy}}\,({\it{j1\/}}, {\rm{put-nth}}\,({\it{v\/}}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, {\it{j2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy})\-\-
\end{tabbing}

\begin{verbatim}; a variant for lstcpy.       
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{lstcpy1} \\  
\=\+{\rm{lstcpy1}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{lstcpy1}}\,(\=\+{\it{i1\/}}, \\ 
{\rm{put-nth}}\,(\=\+{\rm{get-nth}}\,({\it{i2\/}} $+$ ({\it{n\/}} $-\;1$), {\it{lst2\/}})\index{get-nth}, \\ 
{\it{i1\/}} $+$ ({\it{n\/}} $-\;1$), \\ 
{\it{lst1\/}})\-\index{put-nth}, \\ 
{\it{i2\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} $-\;1$)\-\index{lstcpy1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstcpy-add1 \\ \index{lstcpy-add1}
\=\+{\rm{lstcpy}}\,({\it{i1\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i2\/}} $+$ {\it{h\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i1\/}} $+$ {\it{h\/}}, {\it{lst1\/}})\index{put-nth}, {\it{i2\/}}, {\it{lst2\/}}, {\it{h\/}})\index{lstcpy} \\ 
$=$$\;\;\;\;${\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, $1\;+$ {\it{h\/}})\index{lstcpy}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lstcpy-cpy1 \\ \index{lstcpy-cpy1}
{\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy} $=$ {\rm{lstcpy1}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy1}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-get-lst-is-cpy \\ \index{put-get-lst-is-cpy}
\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{mem-lst} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{put-lst}}\,({\it{opsz\/}}, {\rm{get-lst}}\,({\it{opsz\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{get-lst}, {\it{i1\/}}, {\it{lst1\/}}, {\it{n\/}})\index{put-lst} \\ 
$=$$\;\;\;\;${\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-get-vals-is-cpy \\ \index{put-get-vals-is-cpy}
{\rm{put-vals}}\,({\rm{get-vals}}\,({\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{get-vals}, {\it{i1\/}}, {\it{lst1\/}}, {\it{n\/}})\index{put-vals} $=$ {\rm{lstcpy}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{i2\/}}, {\it{lst2\/}}, {\it{n\/}})\index{lstcpy}
\end{tabbing}


\noindent{\sc Event}:   Disable lstcpy-cpy1.

\addvspace{18pt}

\begin{verbatim};            MMOV1-LST, MMOV-LST1, MMOVN-LST AND MMOVN-LST1
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mmov1-lst} \\  
\=\+{\rm{mmov1-lst}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{mmov1-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{mmov1-lst}}\,($1\;+$ {\it{i\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, {\it{lst2\/}}, {\it{n\/}} $-\;1$)\index{mmov1-lst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; the same as mov1-lst.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{mmov1-lst1} \\  
\=\+{\rm{mmov1-lst1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{mmov1-lst1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{mmov1-lst1}}\,(\=\+{\it{i\/}} $-\;1$, \\ 
{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}} $-\;1$, {\it{lst2\/}})\index{get-nth}, {\it{i\/}} $-\;1$, {\it{lst1\/}})\index{put-nth}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} $-\;1$)\-\index{mmov1-lst1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{movn-lst} \\  
{\rm{movn-lst}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}})\index{movn-lst} $=$ {\rm{put-vals}}\,({\rm{get-vals}}\,({\it{i\/}}, {\it{lst2\/}}, {\it{n\/}})\index{get-vals}, {\it{i\/}}, {\it{lst1\/}}, {\it{n\/}})\index{put-vals}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{mmovn-lst} \\  
\=\+{\rm{mmovn-lst}}\,({\it{h\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{nt\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{mmovn-lst}}\,({\it{h\/}}, {\rm{movn-lst}}\,({\it{h\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}})\index{movn-lst}, {\it{lst2\/}}, {\it{h\/}} $+$ {\it{i\/}}, {\it{nt\/}} $-\;1$)\index{mmovn-lst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{mmovn-lst1} \\  
\=\+{\rm{mmovn-lst1}}\,({\it{h\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{nt\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{mmovn-lst1}}\,(\=\+{\it{h\/}}, \\ 
{\rm{movn-lst}}\,({\it{h\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}} $-$ {\it{h\/}})\index{movn-lst}, \\ 
{\it{lst2\/}}, \\ 
{\it{i\/}} $-$ {\it{h\/}}, \\ 
{\it{nt\/}} $-\;1$)\-\index{mmovn-lst1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mmov1-lst-0 \\ \index{mmov1-lst-0}
{\rm{mmov1-lst}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\tt{0}})\index{mmov1-lst} $=$ {\it{lst1\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mmov1-lst1-0 \\ \index{mmov1-lst1-0}
{\rm{mmov1-lst1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\tt{0}})\index{mmov1-lst1} $=$ {\it{lst1\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mmovn-lst-0 \\ \index{mmovn-lst-0}
{\rm{mmovn-lst}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\tt{0}})\index{mmovn-lst} $=$ {\it{lst1\/}}
\end{tabbing}
            
\begin{tabbing}{\sc Theorem}:  mmovn-lst1-0 \\ \index{mmovn-lst1-0}
{\rm{mmovn-lst1}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\tt{0}})\index{mmovn-lst1} $=$ {\it{lst1\/}}
\end{tabbing}

\begin{verbatim};                     MOD32-EQ
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mod32-eq-deduction0 \\ \index{mod32-eq-deduction0}
{\rm{mod32-eq}}\,({\it{x\/}}, {\it{x\/}})\index{mod32-eq}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mod32-eq-deduction1 \\ \index{mod32-eq-deduction1}
\=\+({\rm{mod32-eq}}\,({\tt{0}}, {\rm{neg}}\,({\tt{32}}, {\it{x\/}})\index{neg})\index{mod32-eq} $=$ {\rm{mod32-eq}}\,({\it{x\/}}, {\tt{0}})\index{mod32-eq}) \\ 
$\wedge$$\;\;\;\;$({\rm{mod32-eq}}\,({\rm{neg}}\,({\tt{32}}, {\it{x\/}})\index{neg}, {\tt{0}})\index{mod32-eq} $=$ {\rm{mod32-eq}}\,({\it{x\/}}, {\tt{0}})\index{mod32-eq})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mod32-eq-deduction2 \\ \index{mod32-eq-deduction2}
\=\+({\rm{mod32-eq}}\,({\it{x\/}}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{mod32-eq} $=$ {\rm{mod32-eq}}\,({\tt{0}}, {\it{y\/}})\index{mod32-eq}) \\ 
$\wedge$$\;\;\;\;$({\rm{mod32-eq}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\it{x\/}})\index{mod32-eq} $=$ {\rm{mod32-eq}}\,({\it{y\/}}, {\tt{0}})\index{mod32-eq})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mod32-eq-deduction3 \\ \index{mod32-eq-deduction3}
{\rm{mod32-eq}}\,({\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{y\/}})\index{add}, {\rm{add}}\,({\tt{32}}, {\it{x\/}}, {\it{z\/}})\index{add})\index{mod32-eq} $=$ {\rm{mod32-eq}}\,({\it{y\/}}, {\it{z\/}})\index{mod32-eq}
\end{tabbing}


\noindent{\sc Event}:   Disable mod32-eq.

\addvspace{18pt}

\begin{verbatim}; generate all the cases from between-ileq.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  between-ileq-la \\ \index{between-ileq-la}
\=\+({\rm{integerp}}\,({\it{x\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{y\/}})\index{integerp} $\wedge$ {\rm{integerp}}\,({\it{z\/}})\index{integerp}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{between-ileq}}\,({\it{x\/}}, {\it{y\/}}, {\it{z\/}})\index{between-ileq} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{ilessp}}\,({\it{z\/}}, {\it{x\/}})\index{ilessp}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }({\it{x\/}} $=$ {\it{y\/}}) $\vee$ {\rm{between-ileq}}\,({\rm{iplus}}\,({\it{x\/}}, {\tt{1}})\index{iplus}, {\it{y\/}}, {\it{z\/}})\index{between-ileq}$\;${\bf  endif}\-)\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable between-ileq.

\addvspace{18pt}

\begin{verbatim}; readm-mem, mem-lst, and mem-ilst is not changed if read-mem is not
; changed.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  read-mem-plus \\ \index{read-mem-plus}
\=\+{\rm{read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{m\/}} $+$ {\it{k\/}})\index{read-mem} \\ 
$=$$\;\;\;\;${\rm{app}}\,({\tt{8}} $*$ {\it{k\/}}, {\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{m\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{read-mem}, {\rm{read-mem}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{m\/}})\index{read-mem})\index{app}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-readm-mem \\ \index{stepn-readm-mem}
\=\+(\=\+{\rm{read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{opsz\/}} $*$ {\it{k\/}})\index{read-mem} \\ 
$=$$\;\;\;\;${\rm{read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{opsz\/}} $*$ {\it{k\/}})\index{read-mem})\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{readm-mem} \\ 
$=$$\;\;\;\;${\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{readm-mem})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-mem-lst \\ \index{stepn-mem-lst}
\=\+({\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{readm-mem} $=$ {\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{readm-mem}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}}, {\it{lst\/}})\index{mem-lst} \\ 
$=$$\;\;\;\;${\rm{mem-lst}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}}, {\it{lst\/}})\index{mem-lst})\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-mem-ilst \\ \index{stepn-mem-ilst}
\=\+({\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{readm-mem} $=$ {\rm{readm-mem}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{readm-mem}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}}, {\it{lst\/}})\index{mem-ilst} \\ 
$=$$\;\;\;\;${\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}}, {\it{lst\/}})\index{mem-ilst})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable read-mem-plus.

\addvspace{18pt}

\begin{verbatim};                   DISABLE EVENTS
; many events are no longer useful upon the completion of this system.
; before we enter the verification phase, we simply disable them.

;;;;;;;; disable arithmetic events.
\end{verbatim}
\noindent{\sc Event}:   Disable plus-add1-1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable remainder-exit.

\addvspace{18pt}

\noindent{\sc Event}:   Disable quotient-exit.

\addvspace{18pt}

\begin{verbatim};;;;;;; disable definitions in the specification.
; operations:  The semantics of these operations has been established as 
; rewrite rules in the library, which will be triggered to apply when
; nat-to-uint or nat-to-int are presented.
\end{verbatim}
\noindent{\sc Event}:   Disable mulu.

\addvspace{18pt}

\noindent{\sc Event}:   Disable muls.

\addvspace{18pt}

\noindent{\sc Event}:   Disable quot.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable iquot.

\addvspace{18pt}

\noindent{\sc Event}:   Disable irem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsr.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asr.

\addvspace{18pt}

\begin{verbatim}; condition codes:  To avoid to open up these flag definitions is one of the 
; several efforts to keep the proving space managable.  Another point is
; that one flag might have different semantics in different situations.
\end{verbatim}
\noindent{\sc Event}:   Disable fix-bit.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable addx-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable sub-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable subx-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable and-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable and-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mulu-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mulu-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mulu-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable muls-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable muls-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable muls-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable or-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable or-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable divs-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable divs-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable divu-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable divu-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rol-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rol-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable rol-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ror-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ror-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ror-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsl-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsl-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsl-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsr-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsr-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable lsr-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl-v.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asl-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asr-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asr-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable asr-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxl-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxl-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxl-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxr-c.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxr-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable roxr-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable move-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable move-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ext-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable ext-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable swap-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable swap-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable not-n.

\addvspace{18pt}

\noindent{\sc Event}:   Disable eor-z.

\addvspace{18pt}

\noindent{\sc Event}:   Disable eor-n.

\addvspace{18pt}

\begin{verbatim}; read/write defns:  for each of them, we have had a set of rewrite rules. 
; their definitions are not needed to open up.
\end{verbatim}
\noindent{\sc Event}:   Disable pc-read-memp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable pc-read-mem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable read-memp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable read-mem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-memp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-mem.

\addvspace{18pt}

\noindent{\sc Event}:   Disable readm-rn.

\addvspace{18pt}

\noindent{\sc Event}:   Disable writem-rn.

\addvspace{18pt}

\begin{verbatim};;;;;;;; disable intermediate lemmas for read/write events:  to prove 
; some important theorems about read/write,  we proved many intermediate
; lemmas.  It is time to discard them.
\end{verbatim}
\noindent{\sc Event}:   Disable pc-read-memp-la0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable pc-read-memp-la1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable pc-read-memp-la2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable pc-read-memp-la3.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-memp-la0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-memp-la1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-memp-la2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable write-memp-la3.

\addvspace{18pt}

\begin{verbatim};;;;;;;; disable intermediate lemmas for disjoint0/disjoint events.
\end{verbatim}
\noindent{\sc Event}:   Disable disjoint0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint0-la0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint0-la1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint0-la2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-la0.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-la1.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-la2.

\addvspace{18pt}

\noindent{\sc Event}:   Disable disjoint-la3.

\addvspace{18pt}

\begin{verbatim};;;;;;;; disable intermediate lemmas for add/sub/neg events.
\end{verbatim}
\noindent{\sc Event}:   Disable add-non-numberp.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-commutativity.

\addvspace{18pt}

\noindent{\sc Event}:   Disable add-commutativity1.

\addvspace{18pt}

\begin{verbatim};;;;;;;;  disable mapping functions.
\end{verbatim}
\noindent{\sc Event}:   Disable nat-to-uint.

\addvspace{18pt}

\noindent{\sc Event}:   Disable uint-to-nat.

\addvspace{18pt}

\begin{verbatim};;;;;;;;  disable miscellaneous lemmas.
\end{verbatim}
\noindent{\sc Event}:   Disable stepn.

\addvspace{18pt}

\begin{verbatim}; addressing mode checking for each instruction.  Their arguments are 
; always "concrete" values.  For all the instructions, the oplen and ins 
; have to become known at the execution time.  Theoretically,  it would
; be nice to disable them.  But we do not want disabling to slow down
; the prover.  Therefore, we only disable them when we feel necessary.
\end{verbatim}
\noindent{\sc Event}:   Let us define the theory {\it{mode-guards}} to consist of the following events: add-addr-modep1,
add-addr-modep2,
adda-addr-modep,
sub-addr-modep1,
sub-addr-modep2,
suba-addr-modep,
and-addr-modep1,
and-addr-modep2,
mul\&div-addr-modep,
or-addr-modep1,
or-addr-modep2,
s\&r-addr-modep,
move-addr-modep,
movea-addr-modep,
lea-addr-modep,
clr-addr-modep,
move-from-ccr-addr-modep,
negx-addr-modep,
neg-addr-modep,
move-to-ccr-addr-modep,
pea-addr-modep,
movem-rn-ea-addr-modep,
movem-ea-rn-addr-modep,
tst-addr-modep,
tas-addr-modep,
jmp-addr-modep,
jsr-addr-modep,
not-addr-modep,
scc-addr-modep,
addq-addr-modep,
subq-addr-modep,
cmp-addr-modep,
cmpa-addr-modep,
eor\&eori-addr-modep,
bchg-addr-modep,
bclr-addr-modep,
bset-addr-modep,
btst-addr-modep,
ori-addr-modep,
andi-addr-modep,
subi-addr-modep,
addi-addr-modep,
cmpi-addr-modep.\index{mode-guards}

\addvspace{18pt}

\begin{verbatim}; the classification of instructions, according to the opcode.
\end{verbatim}
\noindent{\sc Event}:   Let us define the theory {\it{groups}} to consist of the following events: bit-group,
move-ins,
move-group,
misc-group,
scc-group,
bcc-group,
or-group,
sub-group,
cmp-group,
and-group,
add-group,
s\&r-group.\index{groups}

\addvspace{18pt}

\begin{verbatim};             INVARIANTS OF THE SPEC
\end{verbatim}\begin{tabbing}{\sc Conservative Axiom}:  h-invariant \\ \index{h-invariant}
\=\+({\rm{p}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{k\/}})\index{p} $=$ {\rm{p}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{p}) \\ 
$\wedge$$\;\;\;\;$(\=\+({\rm{p}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{p} $\wedge$ {\rm{write-memp}}\,({\it{y\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-memp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{y\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{h}))\-\-
\end{tabbing}\noindent Simultaneously, we introduce the new function symbols {\it p\/} and {\it h\/}.

\begin{tabbing}{\sc Theorem}:  addr-index2-mem \\ \index{addr-index2-mem}
{\rm{mc-mem}}\,({\rm{car}}\,({\rm{addr-index2}}\,({\it{pc\/}}, {\it{addr\/}}, {\it{indexwd\/}}, {\it{s\/}})\index{addr-index2}))\index{mc-mem} $=$ {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  immediate-mem \\ \index{immediate-mem}
{\rm{mc-mem}}\,({\rm{car}}\,({\rm{immediate}}\,({\it{oplen\/}}, {\it{pc\/}}, {\it{s\/}})\index{immediate}))\index{mc-mem} $=$ {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  effec-addr-mem \\ \index{effec-addr-mem}
{\rm{mc-mem}}\,({\rm{car}}\,({\rm{effec-addr}}\,({\it{oplen\/}}, {\it{mode\/}}, {\it{rn\/}}, {\it{s\/}})\index{effec-addr}))\index{mc-mem} $=$ {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mc-instate-mem \\ \index{mc-instate-mem}
{\rm{mc-mem}}\,({\rm{car}}\,({\rm{mc-instate}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{mc-instate}))\index{mc-mem} $=$ {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mapping-h \\ \index{mapping-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{car}}\,({\it{s\&addr\/}}))\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{mapping}}\,({\it{oplen\/}}, {\it{v\&cvznx\/}}, {\it{s\&addr\/}})\index{mapping})\index{mc-mem}, {\it{k\/}})\index{h} \\ 
$=$$\;\;\;\;${\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{car}}\,({\it{s\&addr\/}}))\index{mc-mem}, {\it{k\/}})\index{h})\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{t3}$\;\;$
{\rm{t3}}\,({\it{x\/}}, {\it{y\/}}, {\it{z\/}})\index{t3} $=$ {\bf{t}}
\end{tabbing}
  
\begin{verbatim}; add-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-group-h \\ \index{add-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{add-group}}\,({\it{opmode\/}}, {\it{ins\/}}, {\it{s\/}})\index{add-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; sub-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  sub-group-h \\ \index{sub-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{sub-group}}\,({\it{opmode\/}}, {\it{ins\/}}, {\it{s\/}})\index{sub-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}
     
\begin{verbatim}; and-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  and-group-h \\ \index{and-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{and-group}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{and-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; or-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  or-group-h \\ \index{or-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{or-group}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{or-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; scc-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  scc-group-h \\ \index{scc-group-h}
{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} $\rightarrow$ ({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{scc-group}}\,({\it{ins\/}}, {\it{s\/}})\index{scc-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})
\end{tabbing}

\begin{verbatim}; cmp-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  cmp-group-h \\ \index{cmp-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{cmp-group}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{cmp-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; bcc-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  bcc-group-h \\ \index{bcc-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{bcc-group}}\,({\it{disp\/}}, {\it{ins\/}}, {\it{s\/}})\index{bcc-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; bit-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  write-mem-maintain-movep-writep \\ \index{write-mem-maintain-movep-writep}
{\rm{movep-writep}}\,({\it{addr\/}}, {\rm{write-mem}}\,({\it{value\/}}, {\it{x\/}}, {\it{mem\/}}, {\it{m\/}})\index{write-mem}, {\it{n\/}})\index{movep-writep} $=$ {\rm{movep-writep}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{movep-writep}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  movep-write-h \\ \index{movep-write-h}
\=\+({\rm{p}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{p} $\wedge$ {\rm{movep-writep}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{movep-writep}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{movep-write}}\,({\it{value\/}}, {\it{addr\/}}, {\it{mem\/}}, {\it{n\/}})\index{movep-write}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  bit-group-h \\ \index{bit-group-h}
{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} $\rightarrow$ ({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{bit-group}}\,({\it{ins\/}}, {\it{s\/}})\index{bit-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})
\end{tabbing}

\begin{verbatim}; move-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  move-h \\ \index{move-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{move-ins}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{move-ins})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  move-group-h \\ \index{move-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{move-group}}\,({\it{oplen\/}}, {\it{ins\/}}, {\it{s\/}})\index{move-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{verbatim}; s&r-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  s\&r-group-h \\ \index{s\&r-group-h}
{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} $\rightarrow$ ({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{s\&r-group}}\,({\it{ins\/}}, {\it{s\/}})\index{s\&r-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})
\end{tabbing}

\begin{verbatim}; misc-group.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  writem-mem-h \\ \index{writem-mem-h}
\=\+({\rm{p}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{p} $\wedge$ {\rm{write-memp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{opsz\/}} $*$ {\rm{len}}\,({\it{vlst\/}})\index{len})\index{write-memp}) \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{writem-mem}}\,({\it{opsz\/}}, {\it{vlst\/}}, {\it{addr\/}}, {\it{mem\/}})\index{writem-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\it{mem\/}}, {\it{k\/}})\index{h})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  movem-rnlst-len \\ \index{movem-rnlst-len}
{\rm{len}}\,({\rm{movem-rnlst}}\,({\it{mask\/}}, {\it{i\/}})\index{movem-rnlst})\index{len} $=$ {\rm{movem-len}}\,({\it{mask\/}})\index{movem-len}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  movem-pre-rnlst-len \\ \index{movem-pre-rnlst-len}
{\rm{len}}\,({\rm{movem-pre-rnlst}}\,({\it{mask\/}}, {\it{i\/}}, {\it{lst\/}})\index{movem-pre-rnlst})\index{len} $=$ ({\rm{movem-len}}\,({\it{mask\/}})\index{movem-len} $+$ {\rm{len}}\,({\it{lst\/}})\index{len})
\end{tabbing}          

\begin{tabbing}{\sc Theorem}:  misc-group-h \\ \index{misc-group-h}
\=\+{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} \\ 
$\rightarrow$$\;\;\;\;$({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{misc-group}}\,({\it{ins\/}}, {\it{s\/}})\index{misc-group})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})\-
\end{tabbing}
             
\begin{tabbing}{\sc Theorem}:  stepi-h \\ \index{stepi-h}
{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} $\rightarrow$ ({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepi}}\,({\it{s\/}})\index{stepi})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepi-p \\ \index{stepi-p}
{\rm{t3}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{t3} $\rightarrow$ ({\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepi}}\,({\it{s\/}})\index{stepi})\index{mc-mem}, {\it{k\/}})\index{p} $=$ {\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-h \\ \index{stepn-h}
{\rm{p}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{p} $\rightarrow$ ({\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{h} $=$ {\rm{h}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{h})
\end{tabbing}

\begin{verbatim}; the instantiations.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stepn-pc-read-memp \\ \index{stepn-pc-read-memp}
\=\+{\rm{t3}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{t3} \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{pc-read-memp} $=$ {\rm{pc-read-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{pc-read-memp})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-read-memp \\ \index{stepn-read-memp}
\=\+{\rm{t3}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{t3} \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{read-memp} $=$ {\rm{read-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{read-memp})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-write-memp \\ \index{stepn-write-memp}
\=\+{\rm{t3}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{t3} \\ 
$\rightarrow$$\;\;\;\;$({\rm{write-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{write-memp} $=$ {\rm{write-memp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{write-memp})\-
\end{tabbing}

\begin{verbatim}; after the execution of n arbitrary instructions, ROM is still ROM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stepn-rom-addrp \\ \index{stepn-rom-addrp}
{\rm{rom-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{rom-addrp} $=$ {\rm{rom-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{rom-addrp}
\end{tabbing}

\begin{verbatim}; after the execution of n arbitrary instructions, RAM is still RAM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stepn-ram-addrp \\ \index{stepn-ram-addrp}
{\rm{ram-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{ram-addrp} $=$ {\rm{ram-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{ram-addrp}
\end{tabbing}

\begin{verbatim}; after the execution of n arbitrary instructions, the contents of 
; the memory are not modified if that portion of the memory is ROM. 
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stepn-pc-read-mem \\ \index{stepn-pc-read-mem}
\=\+{\rm{rom-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{rom-addrp} \\ 
$\rightarrow$$\;\;\;\;$({\rm{pc-read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{pc-read-mem} $=$ {\rm{pc-read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{pc-read-mem})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  stepn-read-mem \\ \index{stepn-read-mem}
\=\+{\rm{rom-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{rom-addrp} \\ 
$\rightarrow$$\;\;\;\;$({\rm{read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{k\/}})\index{read-mem} $=$ {\rm{read-mem}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{k\/}})\index{read-mem})\-
\end{tabbing}

\begin{verbatim}; after the execution of n arbitrary instructions, the program segment 
; maintains the same.  Since we always require programs in ROM.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stepn-mcode-addrp \\ \index{stepn-mcode-addrp}
\=\+{\rm{rom-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\rm{len}}\,({\it{lst\/}})\index{len})\index{rom-addrp} \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{mcode-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\rm{stepn}}\,({\it{s\/}}, {\it{n\/}})\index{stepn})\index{mc-mem}, {\it{lst\/}})\index{mcode-addrp} \\ 
$=$$\;\;\;\;${\rm{mcode-addrp}}\,({\it{x\/}}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{lst\/}})\index{mcode-addrp})\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable splus.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mcode-addrp.

\addvspace{18pt}

\begin{verbatim}; end of the proving phase. ****************

;-------------------------------------------------------------------------
;                  VERIFICATION PHASE
;-------------------------------------------------------------------------
; our goal is to verify programs at machine code level. Before we go to 
; specific programs, we introduce some conventions of machine code program
; constructs.  This section provides some useful concepts for us to specify
; and verify machine code programs.
;
; look up as unsigned integers.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{uread-mem}$\;\;$
{\rm{uread-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{uread-mem} $=$ {\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-mem})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{uread-dn} \\  
{\rm{uread-dn}}\,({\it{oplen\/}}, {\it{dn\/}}, {\it{s\/}})\index{uread-dn} $=$ {\rm{nat-to-uint}}\,({\rm{read-dn}}\,({\it{oplen\/}}, {\it{dn\/}}, {\it{s\/}})\index{read-dn})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{uread-an} \\  
{\rm{uread-an}}\,({\it{oplen\/}}, {\it{an\/}}, {\it{s\/}})\index{uread-an} $=$ {\rm{nat-to-uint}}\,({\rm{read-an}}\,({\it{oplen\/}}, {\it{an\/}}, {\it{s\/}})\index{read-an})\index{nat-to-uint}
\end{tabbing}

\begin{verbatim}; look up as signed integers.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{iread-mem} \\  
{\rm{iread-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{iread-mem} $=$ {\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\it{n\/}})\index{read-mem}, {\tt{8}} $*$ {\it{n\/}})\index{nat-to-int}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{iread-dn} \\  
{\rm{iread-dn}}\,({\it{oplen\/}}, {\it{dn\/}}, {\it{s\/}})\index{iread-dn} $=$ {\rm{nat-to-int}}\,({\rm{read-dn}}\,({\it{oplen\/}}, {\it{dn\/}}, {\it{s\/}})\index{read-dn}, {\it{oplen\/}})\index{nat-to-int}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{iread-an} \\  
{\rm{iread-an}}\,({\it{oplen\/}}, {\it{an\/}}, {\it{s\/}})\index{iread-an} $=$ {\rm{nat-to-int}}\,({\rm{read-an}}\,({\it{oplen\/}}, {\it{an\/}}, {\it{s\/}})\index{read-an}, {\it{oplen\/}})\index{nat-to-int}
\end{tabbing}

\begin{verbatim}; the return address of subroutine call.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{rts-addr} \\  
{\rm{rts-addr}}\,({\it{s\/}})\index{rts-addr} $=$ {\rm{read-mem}}\,({\rm{read-an}}\,({\tt{32}}, {\tt{7}}, {\it{s\/}})\index{read-an}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\tt{4}})\index{read-mem}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{linked-rts-addr} \\  
{\rm{linked-rts-addr}}\,({\it{s\/}})\index{linked-rts-addr} $=$ {\rm{read-mem}}\,({\rm{add}}\,({\tt{32}}, {\rm{read-an}}\,({\tt{32}}, {\tt{6}}, {\it{s\/}})\index{read-an}, {\tt{4}})\index{add}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\tt{4}})\index{read-mem}
\end{tabbing}

\begin{verbatim}; the saved A6 on the stack.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{linked-a6} \\  
{\rm{linked-a6}}\,({\it{s\/}})\index{linked-a6} $=$ {\rm{read-mem}}\,({\rm{read-an}}\,({\tt{32}}, {\tt{6}}, {\it{s\/}})\index{read-an}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\tt{4}})\index{read-mem}
\end{tabbing}

\begin{verbatim}; for MOVEM instruction.  After the link, A6 points to some place
; on the stack.  s is the current machine state, opsz is the 
; operation size of the MOVEM,  i is the offset relative to a6,
; and n is the number of registers moved.  
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{movem-saved} \\  
\=\+{\rm{movem-saved}}\,({\it{s\/}}, {\it{opsz\/}}, {\it{i\/}}, {\it{n\/}})\index{movem-saved} \\ 
$=$$\;\;\;\;${\rm{readm-mem}}\,({\it{opsz\/}}, {\rm{sub}}\,({\tt{32}}, {\it{i\/}}, {\rm{read-an}}\,({\tt{32}}, {\tt{6}}, {\it{s\/}})\index{read-an})\index{sub}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\it{n\/}})\index{readm-mem}\-
\end{tabbing}

\begin{verbatim}; when only one register is saved,  we use MOVE instead of MOVEM.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{rn-saved} \\  
{\rm{rn-saved}}\,({\it{s\/}})\index{rn-saved} $=$ {\rm{read-mem}}\,({\rm{sub}}\,({\tt{32}}, {\tt{4}}, {\rm{read-an}}\,({\tt{32}}, {\tt{6}}, {\it{s\/}})\index{read-an})\index{sub}, {\rm{mc-mem}}\,({\it{s\/}})\index{mc-mem}, {\tt{4}})\index{read-mem}
\end{tabbing}

\begin{verbatim}; We do not want to deal with nat-to-int and int-to-nat in the logic 
; level.  In the logic level, the proof concerns purely the algorithmic
; correctness in the problem.  It is hoped to be machine independent.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{lst-int} \\  
\=\+{\rm{lst-int}}\,({\it{n\/}}, {\it{lst\/}})\index{lst-int} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{cons}}\,({\rm{nat-to-int}}\,({\rm{car}}\,({\it{lst\/}}), {\it{n\/}})\index{nat-to-int}, {\rm{lst-int}}\,({\it{n\/}}, {\rm{cdr}}\,({\it{lst\/}}))\index{lst-int})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-lst-int \\ \index{get-lst-int}
{\rm{get-nth}}\,({\it{i\/}}, {\rm{lst-int}}\,({\it{n\/}}, {\it{lst\/}})\index{lst-int})\index{get-nth} $=$ {\rm{nat-to-int}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth}, {\it{n\/}})\index{nat-to-int}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-lst-int \\ \index{put-lst-int}
\=\+{\rm{put-nth}}\,({\rm{nat-to-int}}\,({\it{value\/}}, {\it{n\/}})\index{nat-to-int}, {\it{i\/}}, {\rm{lst-int}}\,({\it{n\/}}, {\it{lst\/}})\index{lst-int})\index{put-nth} \\ 
$=$$\;\;\;\;${\rm{lst-int}}\,({\it{n\/}}, {\rm{put-nth}}\,({\it{value\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{lst-int}\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{lst-integerp} \\  
\=\+{\rm{lst-integerp}}\,({\it{lst\/}})\index{lst-integerp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{lst\/}} $\simeq\;${{\bf{nil}}}${}$$\;\;${\bf then }{\bf{t}} \\ 
{\bf else }{\rm{integerp}}\,({\rm{car}}\,({\it{lst\/}}))\index{integerp} $\wedge$ {\rm{lst-integerp}}\,({\rm{cdr}}\,({\it{lst\/}}))\index{lst-integerp}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-lst-integerp \\ \index{get-lst-integerp}
{\rm{lst-integerp}}\,({\it{lst\/}})\index{lst-integerp} $\rightarrow$ {\rm{integerp}}\,({\rm{get-nth}}\,({\it{n\/}}, {\it{lst\/}})\index{get-nth})\index{integerp}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-lst-integerp \\ \index{mem-lst-integerp}
\=\+({\rm{mem-lst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-lst} $\wedge$ ({\it{oplen\/}} $=$ ({\tt{8}} $*$ {\it{opsz\/}}))) \\ 
$\rightarrow$$\;\;\;\;${\rm{lst-integerp}}\,({\rm{lst-int}}\,({\it{oplen\/}}, {\it{lst\/}})\index{lst-int})\index{lst-integerp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mem-ilst-lst-integerp \\ \index{mem-ilst-lst-integerp}
{\rm{mem-ilst}}\,({\it{opsz\/}}, {\it{a\/}}, {\it{mem\/}}, {\it{n\/}}, {\it{lst\/}})\index{mem-ilst} $\rightarrow$ {\rm{lst-integerp}}\,({\it{lst\/}})\index{lst-integerp}
\end{tabbing}


\noindent{\sc Event}:   Disable mem-lst.

\addvspace{18pt}

\noindent{\sc Event}:   Disable mem-ilst.

\addvspace{18pt}

\begin{verbatim}; a trick to get all the appearances of a term replaced by another 
; term. For example, in subroutines, a6 is used as the addresss register
; for LINK. It is often relative to sp(a7).  We'd like to have a6 
; replaced by a7.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{equal*}$\;\;$
{\rm{equal*}}\,({\it{x\/}}, {\it{y\/}})\index{equal*} $=$ ({\it{x\/}} $=$ {\it{y\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  equal*-reflex \\ \index{equal*-reflex}
{\rm{equal*}}\,({\it{x\/}}, {\it{x\/}})\index{equal*}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-equal* \\ \index{read-rn-equal*}
{\rm{equal*}}\,({\rm{read-rn}}\,({\it{oplen\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\it{x\/}})\index{equal*} $\rightarrow$ ({\rm{read-rn}}\,({\it{oplen\/}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn} $=$ {\it{x\/}})
\end{tabbing}


\noindent{\sc Event}:   Disable equal*.

\addvspace{18pt}

\begin{verbatim}; the registers d0, d1, a0, and a1 are available for any subroutines.  
; There is no obligation for subroutines to restore their previous values.
; Therefore, we do not need to keep track of them.  We handle a7
; (the stack pointer) separately to make sure it is set correctly.  
; a6 (the frame pointer) perhaps also deserves special treatment.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{d2-7a2-5p} \\  
\=\+{\rm{d2-7a2-5p}}\,({\it{rn\/}})\index{d2-7a2-5p} \\ 
$=$$\;\;\;\;$(\=\+({\it{rn\/}} $\not\simeq {\tt{0}}$) \\ 
$\wedge$$\;\;\;\;$({\it{rn\/}} $\not=$ {\tt{1}}) \\ 
$\wedge$$\;\;\;\;$({\it{rn\/}} $\not=$ {\tt{8}}) \\ 
$\wedge$$\;\;\;\;$({\it{rn\/}} $\not=$ {\tt{9}}) \\ 
$\wedge$$\;\;\;\;$({\it{rn\/}} $\not=$ {\tt{14}}) \\ 
$\wedge$$\;\;\;\;$({\it{rn\/}} $\not=$ {\tt{15}}))\-\-
\end{tabbing}

\begin{verbatim}; d2 will be used for some purpose.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{d3-7a2-5p}$\;\;$
{\rm{d3-7a2-5p}}\,({\it{rn\/}})\index{d3-7a2-5p} $=$ ({\rm{d2-7a2-5p}}\,({\it{rn\/}})\index{d2-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{2}}))
\end{tabbing}

\begin{verbatim}; d2 and d3 will be used for some purpose.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{d4-7a2-5p} \\  
{\rm{d4-7a2-5p}}\,({\it{rn\/}})\index{d4-7a2-5p} $=$ ({\rm{d2-7a2-5p}}\,({\it{rn\/}})\index{d2-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{2}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{3}}))
\end{tabbing}

\begin{verbatim}; d2, d3, and d4 will be used for some purpose.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{d5-7a2-5p} \\  
\=\+{\rm{d5-7a2-5p}}\,({\it{rn\/}})\index{d5-7a2-5p} \\ 
$=$$\;\;\;\;$({\rm{d2-7a2-5p}}\,({\it{rn\/}})\index{d2-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{2}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{3}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{4}}))\-
\end{tabbing}

\begin{verbatim}; a2 will be used for some purpose.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{d2-7a3-5p}$\;\;$
{\rm{d2-7a3-5p}}\,({\it{rn\/}})\index{d2-7a3-5p} $=$ ({\rm{d2-7a2-5p}}\,({\it{rn\/}})\index{d2-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{10}}))
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{d4-7a4-5p} \\  
{\rm{d4-7a4-5p}}\,({\it{rn\/}})\index{d4-7a4-5p} $=$ ({\rm{d4-7a2-5p}}\,({\it{rn\/}})\index{d4-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{10}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{11}}))
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{d4-7a5p} \\  
\=\+{\rm{d4-7a5p}}\,({\it{rn\/}})\index{d4-7a5p} \\ 
$=$$\;\;\;\;$({\rm{d4-7a2-5p}}\,({\it{rn\/}})\index{d4-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{10}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{11}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{12}}))\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{d5-7a4-5p} \\  
\=\+{\rm{d5-7a4-5p}}\,({\it{rn\/}})\index{d5-7a4-5p} \\ 
$=$$\;\;\;\;$({\rm{d4-7a2-5p}}\,({\it{rn\/}})\index{d4-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{4}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{10}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{11}}))\-
\end{tabbing}
            
\begin{tabbing}{\sc Definition}:\index{d6-7a2-5p} \\  
{\rm{d6-7a2-5p}}\,({\it{rn\/}})\index{d6-7a2-5p} $=$ ({\rm{d4-7a2-5p}}\,({\it{rn\/}})\index{d4-7a2-5p} $\wedge$ ({\it{rn\/}} $\not=$ {\tt{4}}) $\wedge$ ({\it{rn\/}} $\not=$ {\tt{5}}))
\end{tabbing}
            
\begin{verbatim}; something I don't know where to put yet.
; the mean (i+j)/2 < j iff i < j.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  mean-lessp-lemma \\ \index{mean-lessp-lemma}
(({\it{i\/}} $+$ {\it{j\/}}) $<$ ({\tt{2}} $*$ {\it{j\/}})) $=$ ({\it{i\/}} $<$ {\it{j\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mean-lessp \\ \index{mean-lessp}
\=\+(((({\it{i\/}} $+$ {\it{j\/}}) $\div$ {\tt{2}}) $<$ {\it{j\/}}) $=$ ({\it{i\/}} $<$ {\it{j\/}})) \\ 
$\wedge$$\;\;\;\;$(((({\it{j\/}} $+$ {\it{i\/}}) $\div$ {\tt{2}}) $<$ {\it{j\/}}) $=$ ({\it{i\/}} $<$ {\it{j\/}}))\-
\end{tabbing}

\begin{verbatim}; swap the ith and jth elements of the list.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{swap} \\  
{\rm{swap}}\,({\it{i\/}}, {\it{j\/}}, {\it{lst\/}})\index{swap} $=$ {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth}, {\it{j\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{j\/}}, {\it{lst\/}})\index{get-nth}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{put-nth}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  get-swap \\ \index{get-swap}
\=\+{\rm{get-nth}}\,({\it{k\/}}, {\rm{swap}}\,({\it{i\/}}, {\it{j\/}}, {\it{lst\/}})\index{swap})\index{get-nth} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{fix}}\,({\it{k\/}}) $=$ {\rm{fix}}\,({\it{i\/}})$\;\;${\bf then }{\rm{get-nth}}\,({\it{j\/}}, {\it{lst\/}})\index{get-nth} \\ 
{\bf elseif }{\rm{fix}}\,({\it{k\/}}) $=$ {\rm{fix}}\,({\it{j\/}})$\;\;${\bf then }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} \\ 
{\bf else }{\rm{get-nth}}\,({\it{k\/}}, {\it{lst\/}})\index{get-nth}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable get-nth.

\addvspace{18pt}

\noindent{\sc Event}:   Disable put-nth.

\addvspace{18pt}

\begin{verbatim}; C conventions.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{null}$\;\;$
{\sc{null}}\index{null} $=$ {\tt{0}}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{eof}$\;\;$
{\sc{eof}}\index{eof} $=$ {\tt{-1}}
\end{tabbing}

\begin{verbatim}; the Nqthm counterparts of the Berkeley C string functions.
; memchr.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{memchr1} \\  
\=\+{\rm{memchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{memchr1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\it{lst\/}}, {\it{ch\/}})\index{memchr1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memchr} \\  
\=\+{\rm{memchr}}\,({\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{memchr1}}\,({\tt{0}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr1}$\;${\bf  endif}\-\-
\end{tabbing}      

\begin{verbatim}; memcmp.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{memcmp1} \\  
\=\+{\rm{memcmp1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{memcmp1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} \\ 
{\bf then }\=\+{\bf if }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{memcmp1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\it{lst1\/}}, {\it{lst2\/}})\index{memcmp1}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{idifference}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth}, {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth})\index{idifference}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memcmp} \\  
\=\+{\rm{memcmp}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{memcmp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{memcmp1}}\,({\tt{0}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{memcmp1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; memset.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{memset1} \\  
\=\+{\rm{memset1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memset1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\rm{put-nth}}\,({\it{ch\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth} \\ 
{\bf else }{\rm{memset1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\rm{put-nth}}\,({\it{ch\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth}, {\it{ch\/}})\index{memset1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memset} \\  
\=\+{\rm{memset}}\,({\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memset} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $=$ {\tt{0}}$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{memset1}}\,({\tt{0}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memset1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strlen.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strlen} \\  
\=\+{\rm{strlen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{strlen} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\it{i\/}} \\ 
{\bf else }{\rm{strlen}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{strlen}$\;${\bf  endif}\- \\ 
{\bf else }{\it{i\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strcpy.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcpy} \\  
\=\+{\rm{strcpy}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcpy} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n2\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{put-nth}}\,({\sc{null}}\index{null}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf else }{\rm{strcpy}}\,($1\;+$ {\it{i\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, {\it{n2\/}}, {\it{lst2\/}})\index{strcpy}$\;${\bf  endif}\- \\ 
{\bf else }{\it{lst1\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strcmp.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcmp} \\  
\=\+{\rm{strcmp}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strcmp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strcmp}}\,($1\;+$ {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strcmp}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{idifference}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth}, {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth})\index{idifference}$\;${\bf  endif}\- \\ 
{\bf else }{\tt{0}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strcoll.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcoll}$\;\;$
{\rm{strcoll}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strcoll} $=$ {\rm{strcmp}}\,({\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strcmp}
\end{tabbing}

\begin{verbatim}; strcat.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcpy1} \\  
\=\+{\rm{strcpy1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{j\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcpy1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{j\/}} $<$ {\it{n2\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{j\/}}, {\it{lst2\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{put-nth}}\,({\sc{null}}\index{null}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf else }{\rm{strcpy1}}\,(\=\+$1\;+$ {\it{i\/}}, \\ 
{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{j\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, \\ 
$1\;+$ {\it{j\/}}, \\ 
{\it{n2\/}}, \\ 
{\it{lst2\/}})\-\index{strcpy1}$\;${\bf  endif}\- \\ 
{\bf else }{\it{lst1\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strcat} \\  
\=\+{\rm{strcat}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\tt{0}}, {\it{lst1\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{strcpy1}}\,({\tt{0}}, {\it{lst1\/}}, {\tt{0}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcpy1} \\ 
{\bf else }{\rm{strcpy1}}\,({\rm{strlen}}\,({\tt{1}}, {\it{n1\/}}, {\it{lst1\/}})\index{strlen}, {\it{lst1\/}}, {\tt{0}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcpy1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strncat.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcpy2} \\  
\=\+{\rm{strcpy2}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{j\/}}, {\it{n\/}}, {\it{lst2\/}})\index{strcpy2} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{j\/}}, {\it{lst2\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{put-nth}}\,({\sc{null}}\index{null}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}} \\ 
{\bf then }{\rm{put-nth}}\,({\sc{null}}\index{null}, $1\;+$ {\it{i\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{j\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth})\index{put-nth} \\ 
{\bf else }{\rm{strcpy2}}\,(\=\+$1\;+$ {\it{i\/}}, \\ 
{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{j\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, \\ 
$1\;+$ {\it{j\/}}, \\ 
{\it{n\/}} $-\;1$, \\ 
{\it{lst2\/}})\-\index{strcpy2}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strncat} \\  
\=\+{\rm{strncat}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{n\/}}, {\it{lst2\/}})\index{strncat} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $=$ {\tt{0}}$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf elseif }{\rm{get-nth}}\,({\tt{0}}, {\it{lst1\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{strcpy2}}\,({\tt{0}}, {\it{lst1\/}}, {\tt{0}}, {\it{n\/}}, {\it{lst2\/}})\index{strcpy2} \\ 
{\bf else }{\rm{strcpy2}}\,({\rm{strlen}}\,({\tt{1}}, {\it{n1\/}}, {\it{lst1\/}})\index{strlen}, {\it{lst1\/}}, {\tt{0}}, {\it{n\/}}, {\it{lst2\/}})\index{strcpy2}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strncmp.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strncmp1} \\  
\=\+{\rm{strncmp1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncmp1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strncmp1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\it{lst1\/}}, {\it{lst2\/}})\index{strncmp1}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{idifference}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth}, {\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth})\index{idifference}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strncmp} \\  
\=\+{\rm{strncmp}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncmp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strncmp1}}\,({\tt{0}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncmp1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strncpy.      
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{zero-list1} \\  
\=\+{\rm{zero-list1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{zero-list1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\it{lst\/}} \\ 
{\bf else }{\rm{zero-list1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\rm{put-nth}}\,({\tt{0}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{zero-list1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{zero-list} \\  
{\rm{zero-list}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{zero-list} $=$ {\rm{zero-list1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\rm{put-nth}}\,({\tt{0}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{zero-list1}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strncpy1} \\  
\=\+{\rm{strncpy1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncpy1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\rm{zero-list}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst1\/}})\index{zero-list} \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf else }{\rm{strncpy1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, {\it{lst2\/}})\index{strncpy1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strncpy} \\  
\=\+{\rm{strncpy}}\,({\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncpy} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{strncpy1}}\,({\tt{0}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{strncpy1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strchr.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strchr} \\  
\=\+{\rm{strchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{strchr}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strcspn.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strcspn} \\  
\=\+{\rm{strcspn}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{strchr}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr}$\;\;${\bf then }{\rm{fix}}\,({\it{i1\/}}) \\ 
{\bf else }{\rm{strcspn}}\,($1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strrchr.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strrchr} \\  
\=\+{\rm{strrchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{j\/}})\index{strrchr} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf else }{\rm{strrchr}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\rm{fix}}\,({\it{i\/}}))\index{strrchr}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\it{j\/}} \\ 
{\bf else }{\rm{strrchr}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{j\/}})\index{strrchr}$\;${\bf  endif}\- \\ 
{\bf else }{\it{j\/}}$\;${\bf  endif}\-\-
\end{tabbing}       

\begin{verbatim}; strspn.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strchr1} \\  
\=\+{\rm{strchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf else }{\rm{strchr1}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strchr1-bounds \\ \index{strchr1-bounds}
\=\+({\it{n\/}} $\not<$ {\rm{strchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1}) \\ 
$\wedge$$\;\;\;\;$({\rm{strchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1} $\rightarrow$ ({\rm{strchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1} $\not<$ {\it{i\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strchr1-false-0 \\ \index{strchr1-false-0}
$\neg$ {\rm{strchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\tt{0}})\index{strchr1}
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strspn} \\  
\=\+{\rm{strspn}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{strchr1}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr1} \\ 
{\bf then }{\rm{strspn}}\,($1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn} \\ 
{\bf else }{\rm{fix}}\,({\it{i1\/}})$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strpbrk.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strpbrk} \\  
\=\+{\rm{strpbrk}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf elseif }{\rm{strchr1}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr1}$\;\;${\bf then }{\rm{fix}}\,({\it{i1\/}}) \\ 
{\bf else }{\rm{strpbrk}}\,($1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strstr.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strstr1} \\  
\=\+{\rm{strstr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf let }\=\+{\it{j\/}}{\bf $\;$ be$\;\;$}{\rm{strchr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\rm{get-nth}}\,({\tt{0}}, {\it{lst2\/}})\index{get-nth})\index{strchr1}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\it{j\/}} $\in\;${\bf{N}}${}$ \\ 
{\bf then }\=\+{\bf if }\=\+{\rm{strncmp}}\,({\it{len\/}}, {\rm{mcdr}}\,($1\;+$ {\it{j\/}}, {\it{lst1\/}})\index{mcdr}, {\rm{mcdr}}\,({\tt{1}}, {\it{lst2\/}})\index{mcdr})\index{strncmp} \\ 
$=$$\;\;\;\;${\tt{0}}\-$\;\;${\bf then }{\it{j\/}} \\ 
{\bf else }{\rm{strstr1}}\,($1\;+$ {\it{j\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-$\;${\bf  endlet}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strstr} \\  
\=\+{\rm{strstr}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strstr} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\tt{0}}, {\it{lst2\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strstr1}}\,({\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{strlen}}\,({\tt{0}}, {\it{n2\/}} $-\;1$, {\rm{mcdr}}\,({\tt{1}}, {\it{lst2\/}})\index{mcdr})\index{strlen})\index{strstr1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; memmove.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{memmove-1} \\  
\=\+{\rm{memmove-1}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}}, {\it{n\/}})\index{memmove-1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{n\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}}$\;\;${\bf then }{\rm{mmovn-lst}}\,({\tt{4}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst} \\ 
{\bf else }{\rm{mmov1-lst}}\,(\=\+{\it{i\/}} $+$ ({\tt{4}} $*$ {\it{nt\/}}), \\ 
{\rm{mmovn-lst}}\,({\tt{4}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} ${}${\bf{mod}}${}$ {\tt{4}})\-\index{mmov1-lst}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memmove-0} \\  
\=\+{\rm{memmove-0}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}}, {\it{n\/}})\index{memmove-0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\tt{4}}$\;\;${\bf then }{\rm{mmov1-lst}}\,({\it{i\/}} $+$ {\it{nt\/}}, {\rm{mmov1-lst}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{nt\/}})\index{mmov1-lst}, {\it{lst2\/}}, {\it{n\/}})\index{mmov1-lst} \\ 
{\bf else }{\rm{memmove-1}}\,(\=\+{\rm{mmov1-lst}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{nt\/}})\index{mmov1-lst}, \\ 
{\it{lst2\/}}, \\ 
{\it{i\/}} $+$ {\it{nt\/}}, \\ 
{\it{n\/}} $\div$ {\tt{4}}, \\ 
{\it{n\/}})\-\index{memmove-1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memmove-4} \\  
\=\+{\rm{memmove-4}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}}, {\it{n\/}})\index{memmove-4} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{n\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}}$\;\;${\bf then }{\rm{mmovn-lst1}}\,({\tt{4}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst1} \\ 
{\bf else }{\rm{mmov1-lst1}}\,(\=\+{\it{i\/}} $-$ ({\tt{4}} $*$ {\it{nt\/}}), \\ 
{\rm{mmovn-lst1}}\,({\tt{4}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}})\index{mmovn-lst1}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}} ${}${\bf{mod}}${}$ {\tt{4}})\-\index{mmov1-lst1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memmove-3} \\  
\=\+{\rm{memmove-3}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\it{i\/}}, {\it{nt\/}}, {\it{n\/}})\index{memmove-3} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $<$ {\tt{4}} \\ 
{\bf then }{\rm{mmov1-lst1}}\,({\it{i\/}} $-$ {\it{nt\/}}, {\rm{mmov1-lst1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{nt\/}})\index{mmov1-lst1}, {\it{lst2\/}}, {\it{n\/}})\index{mmov1-lst1} \\ 
{\bf else }{\rm{memmove-4}}\,(\=\+{\rm{mmov1-lst1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{nt\/}})\index{mmov1-lst1}, \\ 
{\it{lst2\/}}, \\ 
{\it{i\/}} $-$ {\it{nt\/}}, \\ 
{\it{n\/}} $\div$ {\tt{4}}, \\ 
{\it{n\/}})\-\index{memmove-4}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memmove} \\  
\=\+{\rm{memmove}}\,({\it{str1\/}}, {\it{str2\/}}, {\it{n\/}}, {\it{lst1\/}}, {\it{lst2\/}})\index{memmove} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf elseif }{\rm{nat-to-uint}}\,({\it{str1\/}})\index{nat-to-uint} $=$ {\rm{nat-to-uint}}\,({\it{str2\/}})\index{nat-to-uint}$\;\;${\bf then }{\it{lst2\/}} \\ 
{\bf else }\=\+{\bf let }\=\+{\it{x1\/}}{\bf $\;$ be$\;\;$}{\rm{nat-to-uint}}\,({\it{str1\/}})\index{nat-to-uint}, \\ 
{\it{x2\/}}{\bf $\;$ be$\;\;$}{\rm{nat-to-uint}}\,({\it{str2\/}})\index{nat-to-uint}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\it{x1\/}} $<$ {\it{x2\/}} \\ 
{\bf then }\=\+{\bf if }\=\+(({\it{x1\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\it{x2\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}})\- \\ 
{\bf then }\=\+{\bf if }{\it{n\/}} $<$ {\tt{4}}$\;\;${\bf then }{\rm{mmov1-lst}}\,({\tt{0}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{mmov1-lst} \\ 
{\bf else }{\rm{memmove-1}}\,(\=\+{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\tt{0}}, \\ 
{\it{n\/}} $\div$ {\tt{4}}, \\ 
{\it{n\/}})\-\index{memmove-1}$\;${\bf  endif}\- \\ 
{\bf elseif }\=\+(({\it{x1\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ ({\it{x2\/}} ${}${\bf{mod}}${}$ {\tt{4}})) \\ 
$\wedge$$\;\;\;\;$({\tt{3}} $<$ {\it{n\/}})\- \\ 
{\bf then }{\rm{memmove-0}}\,(\=\+{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\tt{0}}, \\ 
{\tt{4}} $-$ ({\it{x1\/}} ${}${\bf{mod}}${}$ {\tt{4}}), \\ 
({\it{n\/}} $+$ ({\it{x1\/}} ${}${\bf{mod}}${}$ {\tt{4}})) $-$ {\tt{4}})\-\index{memmove-0} \\ 
{\bf else }{\rm{memmove-0}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\tt{0}}, {\it{n\/}}, {\tt{0}})\index{memmove-0}$\;${\bf  endif}\- \\ 
{\bf else }\=\+{\bf let }\=\+{\it{y1\/}}{\bf $\;$ be$\;\;$}{\it{n\/}} $+$ {\it{x1\/}}, \\ 
{\it{y2\/}}{\bf $\;$ be$\;\;$}{\it{n\/}} $+$ {\it{x2\/}}\- \\ 
{\bf in} \\ 
\=\+{\bf if }\=\+(({\it{y1\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}}) \\ 
$\wedge$$\;\;\;\;$(({\it{y2\/}} ${}${\bf{mod}}${}$ {\tt{4}}) $=$ {\tt{0}})\- \\ 
{\bf then }\=\+{\bf if }{\it{n\/}} $<$ {\tt{4}} \\ 
{\bf then }{\rm{mmov1-lst1}}\,(\=\+{\it{n\/}}, \\ 
{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}})\-\index{mmov1-lst1} \\ 
{\bf else }{\rm{memmove-4}}\,(\=\+{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}}, \\ 
{\it{n\/}} $\div$ {\tt{4}}, \\ 
{\it{n\/}})\-\index{memmove-4}$\;${\bf  endif}\- \\ 
{\bf elseif }\=\+(\=\+({\it{y1\/}} ${}${\bf{mod}}${}$ {\tt{4}}) \\ 
$=$$\;\;\;\;$({\it{y2\/}} ${}${\bf{mod}}${}$ {\tt{4}}))\- \\ 
$\wedge$$\;\;\;\;$({\tt{4}} $<$ {\it{n\/}})\- \\ 
{\bf then }{\rm{memmove-3}}\,(\=\+{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}}, \\ 
{\it{y1\/}} ${}${\bf{mod}}${}$ {\tt{4}}, \\ 
{\it{n\/}} $-$ ({\it{y1\/}} ${}${\bf{mod}}${}$ {\tt{4}}))\-\index{memmove-3} \\ 
{\bf else }{\rm{memmove-3}}\,(\=\+{\it{lst1\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{n\/}}, \\ 
{\it{n\/}}, \\ 
{\tt{0}})\-\index{memmove-3}$\;${\bf  endif}\-$\;${\bf  endlet}\-$\;${\bf  endif}\-$\;${\bf  endlet}\-$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; dual events of string functions.  They are for internal use only and
; hardly visible for users.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strlen*} \\  
\=\+{\rm{strlen*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{strlen*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\it{i*\/}} \\ 
{\bf else }{\rm{strlen*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{strlen*}$\;${\bf  endif}\- \\ 
{\bf else }{\it{i*\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{memchr*} \\  
\=\+{\rm{memchr*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\it{i*\/}} \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{memchr*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}} $-\;1$, {\it{lst\/}}, {\it{ch\/}})\index{memchr*}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strchr*} \\  
\=\+{\rm{strchr*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\it{i*\/}} \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf else }{\rm{strchr*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr*}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strchr1*} \\  
\=\+{\rm{strchr1*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}}$\;\;${\bf then }{\it{i*\/}} \\ 
{\bf else }{\rm{strchr1*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr1*}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strcspn*} \\  
\=\+{\rm{strcspn*}}\,({\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{strchr}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr}$\;\;${\bf then }{\it{i1*\/}} \\ 
{\bf else }{\rm{strcspn*}}\,({\rm{add}}\,({\tt{32}}, {\it{i1*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn*}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strrchr*} \\  
\=\+{\rm{strrchr*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{j*\/}})\index{strrchr*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\it{ch\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\it{i*\/}} \\ 
{\bf else }{\rm{strrchr*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{i*\/}})\index{strrchr*}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\it{j*\/}} \\ 
{\bf else }{\rm{strrchr*}}\,({\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{j*\/}})\index{strrchr*}$\;${\bf  endif}\- \\ 
{\bf else }{\it{j*\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strpbrk*} \\  
\=\+{\rm{strpbrk*}}\,({\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\bf{f}} \\ 
{\bf elseif }{\rm{strchr1}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr1}$\;\;${\bf then }{\it{i1*\/}} \\ 
{\bf else }{\rm{strpbrk*}}\,({\rm{add}}\,({\tt{32}}, {\it{i1*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk*}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strspn*} \\  
\=\+{\rm{strspn*}}\,({\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i1\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{strchr1}}\,({\tt{0}}, {\it{n2\/}}, {\it{lst2\/}}, {\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth})\index{strchr1} \\ 
{\bf then }{\rm{strspn*}}\,({\rm{add}}\,({\tt{32}}, {\it{i1*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn*} \\ 
{\bf else }{\it{i1*\/}}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strstr1*} \\  
\=\+{\rm{strstr1*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n1\/}} \\ 
{\bf then }\=\+{\bf let }\=\+{\it{j*\/}}{\bf $\;$ be$\;\;$}{\rm{strchr1*}}\,({\it{i*\/}}, {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\rm{get-nth}}\,({\tt{0}}, {\it{lst2\/}})\index{get-nth})\index{strchr1*}, \\ 
{\it{j\/}}{\bf $\;$ be$\;\;$}{\rm{strchr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\rm{get-nth}}\,({\tt{0}}, {\it{lst2\/}})\index{get-nth})\index{strchr1}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\it{j\/}} $\in\;${\bf{N}}${}$ \\ 
{\bf then }\=\+{\bf if }\=\+{\rm{strncmp}}\,({\it{len\/}}, {\rm{mcdr}}\,($1\;+$ {\it{j\/}}, {\it{lst1\/}})\index{mcdr}, {\rm{mcdr}}\,({\tt{1}}, {\it{lst2\/}})\index{mcdr})\index{strncmp} \\ 
$=$$\;\;\;\;${\tt{0}}\-$\;\;${\bf then }{\it{j*\/}} \\ 
{\bf else }{\rm{strstr1*}}\,(\=\+{\rm{add}}\,({\tt{32}}, {\it{j*\/}}, {\tt{1}})\index{add}, \\ 
$1\;+$ {\it{j\/}}, \\ 
{\it{n1\/}}, \\ 
{\it{lst1\/}}, \\ 
{\it{n2\/}}, \\ 
{\it{lst2\/}}, \\ 
{\it{len\/}})\-\index{strstr1*}$\;${\bf  endif}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-$\;${\bf  endlet}\- \\ 
{\bf else }{\bf{f}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strstr*} \\  
\=\+{\rm{strstr*}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strstr*} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\tt{0}}, {\it{lst2\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strstr1*}}\,(\=\+{\tt{0}}, \\ 
{\tt{0}}, \\ 
{\it{n1\/}}, \\ 
{\it{lst1\/}}, \\ 
{\it{n2\/}}, \\ 
{\it{lst2\/}}, \\ 
{\rm{strlen}}\,({\tt{0}}, {\it{n2\/}} $-\;1$, {\rm{mcdr}}\,({\tt{1}}, {\it{lst2\/}})\index{mcdr})\index{strlen})\-\index{strstr1*}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; strtok.
; the location of the token.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strtok-tok} \\  
\=\+{\rm{strtok-tok}}\,({\it{str1\/}}, {\it{last\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-tok} \\ 
$=$$\;\;\;\;$\=\+{\bf let }\=\+{\it{i*\/}}{\bf $\;$ be$\;\;$}{\rm{strspn*}}\,({\tt{0}}, {\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn*}, \\ 
{\it{i\/}}{\bf $\;$ be$\;\;$}{\rm{strspn}}\,({\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{str1\/}})\index{nat-to-uint} $=$ {\tt{0}} \\ 
{\bf then }\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{last\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{add}}\,({\tt{32}}, {\it{last\/}}, {\it{i*\/}})\index{add}$\;${\bf  endif}\- \\ 
{\bf elseif }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{add}}\,({\tt{32}}, {\it{str1\/}}, {\it{i*\/}})\index{add}$\;${\bf  endif}\-$\;${\bf  endlet}\-\-
\end{tabbing}

\begin{verbatim}; the new lst1.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strtok-lst0} \\  
\=\+{\rm{strtok-lst0}}\,({\it{i1\/}}, {\it{lst1\/}}, {\it{ch\/}})\index{strtok-lst0} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{ch\/}} $=$ {\tt{0}}$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{put-nth}}\,({\tt{0}}, {\it{i1\/}}, {\it{lst1\/}})\index{put-nth}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strtok-lst1} \\  
\=\+{\rm{strtok-lst1}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-lst1} \\ 
$=$$\;\;\;\;$\=\+{\bf let }\=\+{\it{i\/}}{\bf $\;$ be$\;\;$}{\rm{strcspn}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn}\- \\ 
{\bf in} \\ 
{\rm{strtok-lst0}}\,({\it{i\/}}, {\it{lst1\/}}, {\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth})\index{strtok-lst0}$\;${\bf  endlet}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strtok-lst2} \\  
\=\+{\rm{strtok-lst2}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-lst2} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{strtok-lst1}}\,($1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-lst1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strtok-lst} \\  
\=\+{\rm{strtok-lst}}\,({\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-lst} \\ 
$=$$\;\;\;\;${\rm{strtok-lst2}}\,({\rm{strspn}}\,({\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-lst2}\-
\end{tabbing}

\begin{verbatim}; the new value of the static variable.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strtok-last0} \\  
\=\+{\rm{strtok-last0}}\,({\it{str1\/}}, {\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last0} \\ 
$=$$\;\;\;\;$\=\+{\bf let }\=\+{\it{i*\/}}{\bf $\;$ be$\;\;$}{\rm{strcspn*}}\,({\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn*}, \\ 
{\it{i\/}}{\bf $\;$ be$\;\;$}{\rm{strcspn}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{add}}\,({\tt{32}}, {\it{str1\/}}, {\rm{add}}\,({\tt{32}}, {\it{i*\/}}, {\tt{1}})\index{add})\index{add}$\;${\bf  endif}\-$\;${\bf  endlet}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strtok-last1} \\  
\=\+{\rm{strtok-last1}}\,({\it{str1\/}}, {\it{i1*\/}}, {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i1\/}}, {\it{lst1\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\tt{0}} \\ 
{\bf else }{\rm{strtok-last0}}\,({\it{str1\/}}, {\rm{add}}\,({\tt{32}}, {\it{i1*\/}}, {\tt{1}})\index{add}, $1\;+$ {\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last0}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strtok-last} \\  
\=\+{\rm{strtok-last}}\,({\it{str1\/}}, {\it{last\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last} \\ 
$=$$\;\;\;\;$\=\+{\bf let }\=\+{\it{i*\/}}{\bf $\;$ be$\;\;$}{\rm{strspn*}}\,({\tt{0}}, {\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn*}, \\ 
{\it{i\/}}{\bf $\;$ be$\;\;$}{\rm{strspn}}\,({\tt{0}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn}\- \\ 
{\bf in} \\ 
\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{str1\/}})\index{nat-to-uint} $=$ {\tt{0}} \\ 
{\bf then }\=\+{\bf if }{\rm{nat-to-uint}}\,({\it{last\/}})\index{nat-to-uint} $=$ {\tt{0}}$\;\;${\bf then }{\it{last\/}} \\ 
{\bf else }{\rm{strtok-last1}}\,({\it{last\/}}, {\it{i*\/}}, {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last1}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{strtok-last1}}\,({\it{str1\/}}, {\it{i*\/}}, {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strtok-last1}$\;${\bf  endif}\-$\;${\bf  endlet}\-\-
\end{tabbing}

\begin{verbatim}; strxfrm.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{strxfrm1} \\  
\=\+{\rm{strxfrm1}}\,({\it{i\/}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{strxfrm1} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\rm{put-nth}}\,({\tt{0}}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf elseif }({\it{n\/}} $-\;1$) $=$ {\tt{0}}$\;\;${\bf then }{\rm{put-nth}}\,({\tt{0}}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth} \\ 
{\bf else }{\rm{strxfrm1}}\,($1\;+$ {\it{i\/}}, {\rm{put-nth}}\,({\rm{get-nth}}\,({\it{i\/}}, {\it{lst2\/}})\index{get-nth}, {\it{i\/}}, {\it{lst1\/}})\index{put-nth}, {\it{lst2\/}}, {\it{n\/}} $-\;1$)\index{strxfrm1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{strxfrm} \\  
\=\+{\rm{strxfrm}}\,({\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{strxfrm} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{n\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{lst1\/}} \\ 
{\bf else }{\rm{strxfrm1}}\,({\tt{0}}, {\it{lst1\/}}, {\it{lst2\/}}, {\it{n\/}})\index{strxfrm1}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; a list of characters.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{lst-of-chrp} \\  
\=\+{\rm{lst-of-chrp}}\,({\it{lst\/}})\index{lst-of-chrp} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{listp}}\,({\it{lst\/}}) \\ 
{\bf then }\=\+({\rm{car}}\,({\it{lst\/}}) $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\rm{car}}\,({\it{lst\/}}) $<$ {\tt{256}}) \\ 
$\wedge$$\;\;\;\;${\rm{lst-of-chrp}}\,({\rm{cdr}}\,({\it{lst\/}}))\index{lst-of-chrp}\- \\ 
{\bf else }{\bf{t}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{verbatim}; theorems about lst-of-chrp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  get-lst-of-chrp \\ \index{get-lst-of-chrp}
{\rm{lst-of-chrp}}\,({\it{lst\/}})\index{lst-of-chrp} $\rightarrow$ (({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $<$ {\tt{256}}) $\wedge$ ({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $\in\;${\bf{N}}${}$))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  put-lst-of-chrp \\ \index{put-lst-of-chrp}
\=\+{\rm{lst-of-chrp}}\,({\it{lst\/}})\index{lst-of-chrp} \\ 
$\rightarrow$$\;\;\;\;$({\rm{lst-of-chrp}}\,({\rm{put-nth}}\,({\it{x\/}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{lst-of-chrp} $=$ (({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{x\/}} $<$ {\tt{256}})))\-
\end{tabbing}

\begin{verbatim}#|
(prove-lemma lessp-read-mem-1 (rewrite)
     (lessp (read-mem x mem 1) 256)
     ((use (byte-read-nat-rangep (n 8)))
      (enable nat-rangep)))

(prove-lemma mem-lst-of-chrp (rewrite)
     (implies (mem-lst 1 x mem n lst)
              (lst-of-chrp lst))
     ((enable mem-lst)))
|#

\end{verbatim}
\noindent{\sc Event}:   Disable lst-of-chrp.

\addvspace{18pt}

\begin{verbatim}; the predicate stringp.
\end{verbatim}\begin{tabbing}{\sc Definition}:\index{slen} \\  
\=\+{\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{i\/}} $<$ {\it{n\/}} \\ 
{\bf then }\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\sc{null}}\index{null}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf else }{\rm{slen}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen}$\;${\bf  endif}\- \\ 
{\bf else }{\rm{fix}}\,({\it{i\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Definition}:\index{stringp}$\;\;$
{\rm{stringp}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{stringp} $=$ ({\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen} $<$ {\it{n\/}})
\end{tabbing}

\begin{verbatim}; events for slen, which is part of stringp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  slen-ubound \\ \index{slen-ubound}
({\it{i\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\it{n\/}} $\not<$ {\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  slen-lbound \\ \index{slen-lbound}
{\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen} $\not<$ {\it{i\/}}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  slen-01 \\ \index{slen-01}
\=\+({\rm{slen}}\,({\it{i\/}}, {\tt{0}}, {\it{lst\/}})\index{slen} $=$ {\rm{fix}}\,({\it{i\/}})) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{slen}}\,({\it{i\/}}, {\tt{1}}, {\it{lst\/}})\index{slen} \\ 
$=$$\;\;\;\;$\=\+{\bf if }({\it{i\/}} $<$ {\tt{1}}) $\wedge$ ({\rm{get-nth}}\,({\tt{0}}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{0}})$\;\;${\bf then }{\tt{1}} \\ 
{\bf else }{\rm{fix}}\,({\it{i\/}})$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  slen-add1 \\ \index{slen-add1}
\=\+{\rm{slen}}\,({\it{i\/}}, $1\;+$ {\it{i\/}}, {\it{lst\/}})\index{slen} \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $=$ {\tt{0}}$\;\;${\bf then }{\rm{fix}}\,({\it{i\/}}) \\ 
{\bf else }$1\;+$ {\it{i\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  slen-put0 \\ \index{slen-put0}
{\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\rm{put-nth}}\,({\tt{0}}, {\it{i\/}}, {\it{lst\/}})\index{put-nth})\index{slen} $=$ {\rm{fix}}\,({\it{i\/}})
\end{tabbing}
              
\begin{tabbing}{\sc Theorem}:  slen-put \\ \index{slen-put}
({\it{j\/}} $<$ {\it{i\/}}) $\rightarrow$ ({\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\rm{put-nth}}\,({\it{v\/}}, {\it{j\/}}, {\it{lst\/}})\index{put-nth})\index{slen} $=$ {\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-slen-mcdr \\ \index{lessp-slen-mcdr}
\=\+({\rm{slen}}\,({\it{i\/}} $+$ {\it{k\/}}, {\it{n1\/}}, {\it{lst1\/}})\index{slen} $<$ {\it{n1\/}}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\rm{mcdr}}\,({\it{k\/}}, {\it{lst1\/}})\index{mcdr})\index{slen} $<$ ({\it{n1\/}} $-$ {\it{k\/}})) $=$ {\bf{t}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-slen-mcdr-0 \\ \index{lessp-slen-mcdr-0}
\=\+({\rm{slen}}\,($1\;+$ {\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}})\index{slen} $<$ {\it{n1\/}}) \\ 
$\rightarrow$$\;\;\;\;$(({\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\rm{mcdr}}\,({\tt{1}}, {\it{lst1\/}})\index{mcdr})\index{slen} $<$ ({\it{n1\/}} $-\;1$)) $=$ {\bf{t}})\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  slen-rec \\ \index{slen-rec}
\=\+(({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{0}}) $\wedge$ ({\it{i\/}} $<$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;$({\rm{slen}}\,($1\;+$ {\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen} $=$ {\rm{slen}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{slen})\-
\end{tabbing}


\noindent{\sc Event}:   Disable slen.

\addvspace{18pt}

\begin{verbatim}; theorems about stringp.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  stringp-la \\ \index{stringp-la}
\=\+({\rm{stringp}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}})\index{stringp} $\wedge$ {\rm{int-rangep}}\,({\it{n\/}}, {\it{nn\/}})\index{int-rangep} $\wedge$ ({\rm{get-nth}}\,({\it{i\/}}, {\it{lst\/}})\index{get-nth} $\not=$ {\tt{0}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,($1\;+$ {\it{i\/}}, {\it{nn\/}})\index{int-rangep}\-
\end{tabbing}

\begin{verbatim}; theorems about strchr.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  strchr-bounds \\ \index{strchr-bounds}
\=\+({\it{n\/}} $\not<$ {\rm{strchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr}) \\ 
$\wedge$$\;\;\;\;$({\rm{strchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr} $\rightarrow$ ({\rm{strchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{strchr} $\not<$ {\it{i\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  memchr-bounds \\ \index{memchr-bounds}
\=\+(({\it{i\/}} $+$ {\it{n\/}}) $\not<$ {\rm{memchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr1}) \\ 
$\wedge$$\;\;\;\;$({\rm{memchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr1} $\rightarrow$ ({\rm{memchr1}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}})\index{memchr1} $\not<$ {\it{i\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strpbrk-bounds \\ \index{strpbrk-bounds}
\=\+({\it{n1\/}} $\not<$ {\rm{strpbrk}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk}) \\ 
$\wedge$$\;\;\;\;$({\rm{strpbrk}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk} $\rightarrow$ ({\rm{strpbrk}}\,({\it{i1\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strpbrk} $\not<$ {\it{i1\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strrchr-bounds \\ \index{strrchr-bounds}
({\it{j\/}} $\leq$ {\it{n\/}}) $\rightarrow$ ({\it{n\/}} $\not<$ {\rm{strrchr}}\,({\it{i\/}}, {\it{n\/}}, {\it{lst\/}}, {\it{ch\/}}, {\it{j\/}})\index{strrchr})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strstr-bounds \\ \index{strstr-bounds}
\=\+({\it{n1\/}} $\not<$ {\rm{strstr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1}) \\ 
$\wedge$$\;\;\;\;$(\=\+{\rm{strstr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1} \\ 
$\rightarrow$$\;\;\;\;$({\rm{strstr1}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}}, {\it{len\/}})\index{strstr1} $\not<$ {\it{i\/}}))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strspn-ubound \\ \index{strspn-ubound}
({\it{n1\/}} $\not\simeq {\tt{0}}$) $\rightarrow$ ({\rm{strspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn} $<$ {\it{n1\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strspn-bounds \\ \index{strspn-bounds}
\=\+({\it{n1\/}} $\not<$ {\rm{strspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn}) \\ 
$\wedge$$\;\;\;\;$({\rm{strspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn} $\rightarrow$ ({\rm{strspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strspn} $\not<$ {\it{i\/}}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  strcspn-bounds \\ \index{strcspn-bounds}
\=\+({\it{n1\/}} $\not<$ {\rm{strcspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn}) \\ 
$\wedge$$\;\;\;\;$({\rm{strcspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn} $\rightarrow$ ({\rm{strcspn}}\,({\it{i\/}}, {\it{n1\/}}, {\it{lst1\/}}, {\it{n2\/}}, {\it{lst2\/}})\index{strcspn} $\not<$ {\it{i\/}}))\-
\end{tabbing}

\begin{verbatim}; a lemma to establish nat-rangep.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  nat-rangep-la \\ \index{nat-rangep-la}
({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}) $\rightarrow$ {\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep}
\end{tabbing}


\noindent{\sc Event}:   Disable nat-rangep-la.

\addvspace{18pt}

\begin{verbatim}; some useful lemmas.  I do not know where to put them yet.
; I will put them in the right place.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  disjoint-1-int \\ \index{disjoint-1-int}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$({\it{j\/}} $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{k\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{k\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2-int \\ \index{disjoint-2-int}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2\~-int \\ \index{disjoint-2\~-int}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3-int \\ \index{disjoint-3-int}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-int}}\,({\it{k\/}}, {\tt{32}})\index{nat-to-int} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{i\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$) \\ 
$\wedge$$\;\;\;\;$({\rm{nat-to-int}}\,({\it{k\/}}, {\tt{32}})\index{nat-to-int} $\in\;${\bf{N}}${}$))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-memp-ram1-uint \\ \index{read-memp-ram1-uint}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{read-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{read-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  write-memp-ram1-uint \\ \index{write-memp-ram1-uint}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{write-memp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{write-memp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-1-uint \\ \index{disjoint-1-uint}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ ({\it{j\/}} $\leq$ {\it{m\/}}) $\wedge$ (({\rm{nat-to-uint}}\,({\it{k\/}})\index{nat-to-uint} $+$ {\it{l\/}}) $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2-uint \\ \index{disjoint-2-uint}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-2\~-uint \\ \index{disjoint-2\~-uint}
\=\+({\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} $\wedge$ (({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) $\wedge$ ({\it{l\/}} $\leq$ {\it{n\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{b\/}}, {\it{l\/}}, {\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-3-uint \\ \index{disjoint-3-uint}
\=\+(\=\+{\rm{disjoint}}\,({\it{a\/}}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{i\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{k\/}})\index{nat-to-uint} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-5-uint \\ \index{disjoint-5-uint}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\tt{0}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{k\/}})\index{nat-to-uint} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\it{a\/}}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}     

\begin{tabbing}{\sc Theorem}:  disjoint-6-uint \\ \index{disjoint-6-uint}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$({\it{l\/}} $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\it{b\/}}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  disjoint-7-uint \\ \index{disjoint-7-uint}
\=\+(\=\+{\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i\/}})\index{add}, {\it{m\/}}, {\it{b\/}}, {\it{n\/}})\index{disjoint} \\ 
$\wedge$$\;\;\;\;$(({\it{j\/}} $+$ {\rm{index-n}}\,({\it{i1\/}}, {\it{i\/}})\index{index-n}) $\leq$ {\it{m\/}}) \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{k\/}})\index{nat-to-uint} $+$ {\it{l\/}}) $\leq$ {\it{n\/}}))\- \\ 
$\rightarrow$$\;\;\;\;${\rm{disjoint}}\,({\rm{add}}\,({\tt{32}}, {\it{a\/}}, {\it{i1\/}})\index{add}, {\it{j\/}}, {\rm{add}}\,({\tt{32}}, {\it{b\/}}, {\it{k\/}})\index{add}, {\it{l\/}})\index{disjoint}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-int-8\_32 \\ \index{read-rn-int-8\_32}
{\rm{nat-to-int}}\,({\rm{read-rn}}\,({\tt{8}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\tt{32}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-rn}}\,({\tt{8}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-int-16\_32 \\ \index{read-rn-int-16\_32}
{\rm{nat-to-int}}\,({\rm{read-rn}}\,({\tt{16}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\tt{32}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-rn}}\,({\tt{16}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-rn-int-8\_16 \\ \index{read-rn-int-8\_16}
{\rm{nat-to-int}}\,({\rm{read-rn}}\,({\tt{8}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn}, {\tt{16}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-rn}}\,({\tt{8}}, {\it{rn\/}}, {\it{rfile\/}})\index{read-rn})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-int-8\_32 \\ \index{read-mem-int-8\_32}
{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{1}})\index{read-mem}, {\tt{32}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{1}})\index{read-mem})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-int-16\_32 \\ \index{read-mem-int-16\_32}
{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{2}})\index{read-mem}, {\tt{32}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{2}})\index{read-mem})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  read-mem-int-8\_16 \\ \index{read-mem-int-8\_16}
{\rm{nat-to-int}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{1}})\index{read-mem}, {\tt{16}})\index{nat-to-int} $=$ {\rm{nat-to-uint}}\,({\rm{read-mem}}\,({\it{x\/}}, {\it{mem\/}}, {\tt{1}})\index{read-mem})\index{nat-to-uint}
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  idifference-int-rangep \\ \index{idifference-int-rangep}
\=\+(({\it{x\/}} $\in\;${\bf{N}}${}$) $\wedge$ ({\it{y\/}} $\in\;${\bf{N}}${}$) $\wedge$ {\rm{int-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{int-rangep} $\wedge$ {\rm{int-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{int-rangep}) \\ 
$\rightarrow$$\;\;\;\;${\rm{int-rangep}}\,({\rm{idifference}}\,({\it{x\/}}, {\it{y\/}})\index{idifference}, {\it{n\/}})\index{int-rangep}\-
\end{tabbing}


\noindent{\sc Event}:   Disable idifference.

\addvspace{18pt}

\begin{verbatim}; some more arithmetic.
\end{verbatim}\begin{tabbing}{\sc Theorem}:  difference-cancel-1 \\ \index{difference-cancel-1}
\=\+({\it{i\/}} $\leq$ {\it{j\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+((({\it{i\/}} $+$ {\it{j\/}}) $-$ ({\tt{2}} $*$ {\it{i\/}})) $=$ ({\it{j\/}} $-$ {\it{i\/}})) \\ 
$\wedge$$\;\;\;\;$((({\tt{2}} $*$ {\it{j\/}}) $-$ ({\it{i\/}} $+$ {\it{j\/}})) $=$ ({\it{j\/}} $-$ {\it{i\/}})))\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-is-1 \\ \index{difference-is-1}
(({\it{x\/}} $-$ {\it{y\/}}) $=$ {\tt{1}}) $=$ ({\it{x\/}} $=$ ($1\;+$ {\it{y\/}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mean-difference-1 \\ \index{mean-difference-1}
({\it{i\/}} $\leq$ {\it{j\/}}) $\rightarrow$ (((({\it{i\/}} $+$ {\it{j\/}}) $\div$ {\tt{2}}) $-$ {\it{i\/}}) $=$ (({\it{j\/}} $-$ {\it{i\/}}) $\div$ {\tt{2}}))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  mean-difference-2 \\ \index{mean-difference-2}
({\it{i\/}} $\leq$ {\it{j\/}}) $\rightarrow$ ((({\it{j\/}} $-$ {\it{i\/}}) $\div$ {\tt{2}}) $\not<$ (({\it{j\/}} $-\;1$) $-$ (({\it{i\/}} $+$ {\it{j\/}}) $\div$ {\tt{2}})))
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-0 \\ \index{plus-0}
({\tt{0}} $+$ {\it{x\/}}) $=$ {\rm{fix}}\,({\it{x\/}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus-times-sub1 \\ \index{plus-times-sub1}
\=\+({\it{x\/}} $+$ ({\it{x\/}} $*$ ({\it{y\/}} $-\;1$))) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{y\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\rm{fix}}\,({\it{x\/}}) \\ 
{\bf else }{\it{x\/}} $*$ {\it{y\/}}$\;${\bf  endif}\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable plus-times-sub1.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  plus2-times-sub1 \\ \index{plus2-times-sub1}
\=\+({\it{x\/}} $+$ {\it{y\/}} $+$ ({\it{x\/}} $*$ ({\it{z\/}} $-\;1$))) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{z\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{x\/}} $+$ {\it{y\/}} \\ 
{\bf else }{\it{y\/}} $+$ ({\it{x\/}} $*$ {\it{z\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  plus3-times-sub1 \\ \index{plus3-times-sub1}
\=\+({\it{x\/}} $+$ {\it{y\/}} $+$ {\it{z\/}} $+$ ({\it{x\/}} $*$ ({\it{z1\/}} $-\;1$))) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{z1\/}} $\simeq {\tt{0}}$$\;\;${\bf then }{\it{x\/}} $+$ {\it{y\/}} $+$ {\it{z\/}} \\ 
{\bf else }{\it{y\/}} $+$ {\it{z\/}} $+$ ({\it{x\/}} $*$ {\it{z1\/}})$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-cancel-4294967295 \\ \index{lessp-cancel-4294967295}
(({\tt{4294967295}} $+$ {\it{x\/}}) $<$ {\tt{4294967296}}) $=$ ({\it{x\/}} $\simeq {\tt{0}}$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-cancel-4294967295 \\ \index{difference-cancel-4294967295}
(({\tt{4294967295}} $+$ {\it{x\/}}) $-$ {\tt{4294967296}}) $=$ ({\it{x\/}} $-\;1$)
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  lessp-cancel-4294967292 \\ \index{lessp-cancel-4294967292}
(({\tt{4294967292}} $+$ {\it{x\/}}) $<$ {\tt{4294967296}}) $=$ ({\it{x\/}} $<$ {\tt{4}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-cancel-4294967292 \\ \index{difference-cancel-4294967292}
(({\tt{4294967292}} $+$ {\it{x\/}}) $-$ {\tt{4294967296}}) $=$ ({\it{x\/}} $-$ {\tt{4}})
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-lessp-cancel-1 \\ \index{difference-lessp-cancel-1}
\=\+(({\it{a\/}} $-$ {\it{c\/}}) $<$ ({\it{c\/}} $*$ ({\it{b\/}} $-\;1$))) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{c\/}} $\leq$ {\it{a\/}}$\;\;${\bf then }{\it{a\/}} $<$ ({\it{c\/}} $*$ {\it{b\/}}) \\ 
{\bf else }{\tt{1}} $<$ {\it{b\/}}$\;${\bf  endif}\-\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  difference-lessp-cancel-2 \\ \index{difference-lessp-cancel-2}
\=\+({\it{c\/}} $\leq$ {\it{a\/}}) \\ 
$\rightarrow$$\;\;\;\;$(\=\+(({\it{a\/}} $-$ {\it{c\/}}) $<$ ({\it{d\/}} $+$ ({\it{c\/}} $*$ ({\it{b\/}} $-\;1$)))) \\ 
$=$$\;\;\;\;$\=\+{\bf if }{\it{b\/}} $\simeq {\tt{0}}$$\;\;${\bf then }({\it{a\/}} $-$ {\it{c\/}}) $<$ {\it{d\/}} \\ 
{\bf else }{\it{a\/}} $<$ ({\it{d\/}} $+$ ({\it{c\/}} $*$ {\it{b\/}}))$\;${\bf  endif}\-)\-\-
\end{tabbing}

\begin{verbatim}; two funny lemmas.  But seems more useful than add-uint!
\end{verbatim}\begin{tabbing}{\sc Theorem}:  add-uintxx \\ \index{add-uintxx}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}))\- \\ 
$\rightarrow$$\;\;\;\;$({\rm{nat-to-uint}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{nat-to-uint} $=$ ({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}))\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  add-uintxxx \\ \index{add-uintxxx}
\=\+(\=\+{\rm{nat-rangep}}\,({\it{x\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;${\rm{nat-rangep}}\,({\it{y\/}}, {\it{n\/}})\index{nat-rangep} \\ 
$\wedge$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $\not<$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}))\- \\ 
$\rightarrow$$\;\;\;\;$(\=\+{\rm{nat-to-uint}}\,({\rm{add}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{add})\index{nat-to-uint} \\ 
$=$$\;\;\;\;$(({\rm{nat-to-uint}}\,({\it{x\/}})\index{nat-to-uint} $+$ {\rm{nat-to-uint}}\,({\it{y\/}})\index{nat-to-uint}) $-$ {\rm{exp}}\,({\tt{2}}, {\it{n\/}})\index{exp}))\-\-
\end{tabbing}


\noindent{\sc Event}:   Disable add-uintxxx.

\addvspace{18pt}

\begin{tabbing}{\sc Theorem}:  ram-addrp-3 \\ \index{ram-addrp-3}
\=\+({\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{i\/}})\index{add}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{index-n}}\,({\it{h\/}}, {\it{i\/}})\index{index-n} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{ram-addrp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  ram-addrp-4 \\ \index{ram-addrp-4}
\=\+({\rm{ram-addrp}}\,({\it{addr\/}}, {\it{mem\/}}, {\it{k\/}})\index{ram-addrp} $\wedge$ (({\rm{nat-to-uint}}\,({\it{h\/}})\index{nat-to-uint} $+$ {\it{j\/}}) $\leq$ {\it{k\/}})) \\ 
$\rightarrow$$\;\;\;\;${\rm{ram-addrp}}\,({\rm{add}}\,({\tt{32}}, {\it{addr\/}}, {\it{h\/}})\index{add}, {\it{mem\/}}, {\it{j\/}})\index{ram-addrp}\-
\end{tabbing}

\begin{tabbing}{\sc Theorem}:  and-z-commutativity \\ \index{and-z-commutativity}
{\rm{and-z}}\,({\it{n\/}}, {\it{x\/}}, {\it{y\/}})\index{and-z} $=$ {\rm{and-z}}\,({\it{n\/}}, {\it{y\/}}, {\it{x\/}})\index{and-z}
\end{tabbing}

\begin{verbatim}; finally, establish the database.
\end{verbatim}
\noindent{\sc Event}:   Make the library {\tt{"mc20-2"}} and compile it.

\addvspace{18pt}

%\end{list}
\printindex
\end{document}
