wmob1011286289117:~/class/march2007 kaufmann$ ls
101ordinalsmakeord.lisp notes.txt
101ordinals.lisp rev3.lisp
101.lisp simpledemo.lisp
wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>3
3
ACL2 !>(+ 3 4)
7
ACL2 !>(thm (equal (car (cons x y))
x))
But we reduce the conjecture to T, by the simple :rewrite rule CAR
CONS.
Q.E.D.
Summary
Form: ( THM ...)
Rules: ((:REWRITE CARCONS))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
Proof succeeded.
ACL2 !>(defun app (x y)
(if (consp x)
(cons (car x)
(app (cdr x) y))
y))
The admission of APP is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of APP is described by the
theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive
type reasoning.
Summary
Form: ( DEFUN APP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.03 seconds (prove: 0.00, print: 0.01, other: 0.03)
APP
ACL2 !>:pbt 1
L 1:x(DEFUN APP (X Y) ...)
ACL2 !>:pbt 0
0 (EXITBOOTSTRAPMODE)
L 1:x(DEFUN APP (X Y) ...)
ACL2 !>:u
0:x(EXITBOOTSTRAPMODE)
ACL2 !>:pbt 0
0:x(EXITBOOTSTRAPMODE)
ACL2 !>:oops
Installing the requested world. Note that functions being redefined
during this procedure will not have compiled definitions, even if they
had compiled definitions before the last :ubt or :u.
L 1:x(DEFUN APP (X Y) ...)
ACL2 !>:pbt 0
0 (EXITBOOTSTRAPMODE)
L 1:x(DEFUN APP (X Y) ...)
ACL2 !>(app '(3 4 5) '(a b))
(3 4 5 A B)
ACL2 !>(defun rev (x)
(if (consp x)
(app (rev (cdr x))
(list (car x)))
nil))
The admission of REV is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV is described by the
theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive
type reasoning and the :typeprescription rule APP.
Summary
Form: ( DEFUN REV ...)
Rules: ((:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION APP))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01)
REV
ACL2 !>(defthm revapp
(equal (rev (app x y))
(app (rev y) (rev x))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, to
Subgoal *1/2'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL))).
We generalize this conjecture, replacing (REV Y) by RV. This produces
Subgoal *1/2''
(IMPLIES (NOT (CONSP X))
(EQUAL RV (APP RV NIL))).
We suspect that the term (NOT (CONSP X)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1/2'''
(EQUAL RV (APP RV NIL)).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.2.
Perhaps we can prove *1.2 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.2/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(EQUAL RV (APP RV NIL)).
Perhaps we can prove *1.1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (APP RV 'NIL). This
suggestion was produced using the :induction rule APP. If we let (:P RV)
denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV))
(IMPLIES (AND (CONSP RV) (:P (CDR RV)))
(:P RV))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV))
(EQUAL RV (APP RV NIL))).
This simplifies, using the :definition APP and primitive type reasoning,
to
Subgoal *1.1/2'
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
Name the formula above *1.1.1.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(EQUAL (CDR RV) (APP (CDR RV) NIL)))
(EQUAL RV (APP RV NIL))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rule CONSCARCDR.
So we now return to *1.1.1, which is
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
No induction schemes are suggested by *1.1.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.14 seconds (prove: 0.06, print: 0.07, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm appnil
(implies (truelistp x)
(equal (app x nil)
x)))
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP X 'NIL). This
suggestion was produced using the :induction rules APP and TRUELISTP.
If we let (:P X) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (CONSP X)) (TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definition TRUELISTP,
the :executablecounterparts of APP, CONSP and EQUAL and primitive
type reasoning.
Subgoal *1/2
(IMPLIES (AND (CONSP X)
(EQUAL (APP (CDR X) NIL) (CDR X))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :rewrite rule CONSCAR
CDR.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(NOT (TRUELISTP (CDR X)))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM APPNIL ...)
Rules: ((:DEFINITION APP)
(:DEFINITION TRUELISTP)
(:EXECUTABLECOUNTERPART APP)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION TRUELISTP)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.04 seconds (prove: 0.01, print: 0.03, other: 0.00)
APPNIL
ACL2 !>(defthm revapp
(equal (rev (app x y))
(app (rev y) (rev x))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, to
Subgoal *1/2'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL))).
We generalize this conjecture, replacing (REV Y) by RV. This produces
Subgoal *1/2''
(IMPLIES (NOT (CONSP X))
(EQUAL RV (APP RV NIL))).
We suspect that the term (NOT (CONSP X)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1/2'''
(EQUAL RV (APP RV NIL)).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.2.
Perhaps we can prove *1.2 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.2/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(EQUAL RV (APP RV NIL)).
Perhaps we can prove *1.1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (APP RV 'NIL). This
suggestion was produced using the :induction rule APP. If we let (:P RV)
denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV))
(IMPLIES (AND (CONSP RV) (:P (CDR RV)))
(:P RV))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV))
(EQUAL RV (APP RV NIL))).
This simplifies, using the :definition APP and primitive type reasoning,
to
Subgoal *1.1/2'
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
Name the formula above *1.1.1.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(EQUAL (CDR RV) (APP (CDR RV) NIL)))
(EQUAL RV (APP RV NIL))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rule CONSCARCDR.
So we now return to *1.1.1, which is
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
No induction schemes are suggested by *1.1.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.19 seconds (prove: 0.05, print: 0.14, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm truelistprev
(truelistp (rev x)))
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(TRUELISTP (REV X))).
But simplification reduces this to T, using the :definition REV and
the :executablecounterpart of TRUELISTP.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (REV X))).
This simplifies, using the :definition REV, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (APP (REV (CDR X)) (LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(TRUELISTP (REV X2)))
(TRUELISTP (APP (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (TRUELISTP (REV X2))
(TRUELISTP (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/1'4'
(IMPLIES (TRUELISTP RV)
(TRUELISTP (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)).
This suggestion was produced using the :induction rules APP and TRUE
LISTP. If we let (:P RV X1) denote *1.1 above then the induction
scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV X1))
(IMPLIES (AND (CONSP RV) (:P (CDR RV) X1))
(:P RV X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1.1/3
(IMPLIES (AND (NOT (CONSP RV)) (TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, the :executablecounterpart of CONSP and primitive type
reasoning.
Subgoal *1.1/2
(IMPLIES (AND (CONSP RV)
(TRUELISTP (APP (CDR RV) (LIST X1)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :typeprescription rule
APP.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(NOT (TRUELISTP (CDR RV)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proofs of *1.1 and *1.
Q.E.D.
The storage of TRUELISTPREV depends upon the :typeprescription rule
TRUELISTP.
Summary
Form: ( DEFTHM TRUELISTPREV ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART TRUELISTP)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:TYPEPRESCRIPTION APP)
(:TYPEPRESCRIPTION TRUELISTP))
Warnings: None
Time: 0.10 seconds (prove: 0.02, print: 0.08, other: 0.00)
TRUELISTPREV
ACL2 !>(defthm revapp
(equal (rev (app x y))
(app (rev y) (rev x))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
But simplification reduces this to T, using the :definitions APP and
REV, primitive type reasoning and the :rewrite rules APPNIL and TRUE
LISTPREV.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proofs of *1.1 and *1.
Q.E.D.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE APPNIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE TRUELISTPREV))
Warnings: None
Time: 0.13 seconds (prove: 0.04, print: 0.09, other: 0.00)
REVAPP
ACL2 !>:u
4:x(DEFTHM TRUELISTPREV ...)
ACL2 !>:u
3:x(DEFTHM APPNIL ...)
ACL2 !>(defthm revapp
(equal (rev (app x y))
(app (rev y) (rev x))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, to
Subgoal *1/2'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL))).
We generalize this conjecture, replacing (REV Y) by RV. This produces
Subgoal *1/2''
(IMPLIES (NOT (CONSP X))
(EQUAL RV (APP RV NIL))).
We suspect that the term (NOT (CONSP X)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1/2'''
(EQUAL RV (APP RV NIL)).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.2.
Perhaps we can prove *1.2 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.2/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(EQUAL RV (APP RV NIL)).
Perhaps we can prove *1.1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (APP RV 'NIL). This
suggestion was produced using the :induction rule APP. If we let (:P RV)
denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV))
(IMPLIES (AND (CONSP RV) (:P (CDR RV)))
(:P RV))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV))
(EQUAL RV (APP RV NIL))).
This simplifies, using the :definition APP and primitive type reasoning,
to
Subgoal *1.1/2'
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
Name the formula above *1.1.1.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(EQUAL (CDR RV) (APP (CDR RV) NIL)))
(EQUAL RV (APP RV NIL))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rule CONSCARCDR.
So we now return to *1.1.1, which is
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
No induction schemes are suggested by *1.1.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.12 seconds (prove: 0.04, print: 0.08, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(verify (IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL))))
>: p
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL)))
>: th
*** Toplevel hypotheses:
There are no toplevel hypotheses.
The current subterm is:
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APP (REV Y) NIL)))
>: promote
>: th
*** Toplevel hypotheses:
1. (NOT (CONSP X))
The current subterm is:
(EQUAL (REV Y) (APP (REV Y) NIL))
>: 2
>: p
(APP (REV Y) NIL)
>: undo
Undoing: (:DV 2)
>: p
(EQUAL (REV Y) (APP (REV Y) NIL))
>: (dv 2 0)
>: p
(APP (REV Y) NIL)
>: ptop
(EQUAL (REV Y)
(*** (APP (REV Y) NIL) ***))
>: p
(APP (REV Y) NIL)
>: th
*** Toplevel hypotheses:
1. (NOT (CONSP X))
The current subterm is:
(APP (REV Y) NIL)
>: showrewrites
1. APPNIL
New term: (REV Y)
Hypotheses: ((TRUELISTP (REV Y)))
Equiv: EQUAL
2. APP
New term: (AND (CONSP (REV Y))
(CONS (CAR (REV Y))
(APP (CDR (REV Y)) NIL)))
Hypotheses:
Equiv: EQUAL
>: sr
1. APPNIL
New term: (REV Y)
Hypotheses: ((TRUELISTP (REV Y)))
Equiv: EQUAL
2. APP
New term: (AND (CONSP (REV Y))
(CONS (CAR (REV Y))
(APP (CDR (REV Y)) NIL)))
Hypotheses:
Equiv: EQUAL
>: (r 1)
Rewriting with APPNIL.
Creating one new goal: (MAIN . 1).
>: goals
MAIN
(MAIN . 1)
>: p
(REV Y)
>: ptop
(EQUAL (REV Y) (*** (REV Y) ***))
>: top
>: p
(EQUAL (REV Y) (REV Y))
>: s
The proof of the current goal, MAIN, has been completed. However,
the following subgoals remain to be proved:
(MAIN . 1).
Now proving (MAIN . 1).
>: goals
(MAIN . 1)
>: th
*** Toplevel hypotheses:
1. (NOT (CONSP X))
The current subterm is:
(TRUELISTP (REV Y))
>: exit
Exiting....
NIL
ACL2 !>(goodbye)
Quitting ACL2 and lisp; this may take a moment. For
faster response time, exit the ACL2 loop with :q
and then: type (GOODBYE) or (CCL:QUIT), then .
ACL2 !>ACL2 !>wmob1011286289117:~/class/march2007 kaufmann$
wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>(certifybook "simpledemo")
CERTIFICATION ATTEMPT FOR
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 Version 3.1
* Step 1: Read "/Users/kaufmann/class/march2007/simpledemo.lisp"
and compute its check sum.
* Step 2: There were six forms in the file. We now attempt to establish
that each form, whether local or nonlocal, is indeed an admissible
embedded event form in the context of the previously admitted ones.
Note that prooftree output is inhibited during this check; see :DOC
prooftree.
ACL2 >>(DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
The admission of APP is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of APP is described by the
theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive
type reasoning.
Summary
Form: ( DEFUN APP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02)
APP
ACL2 >>(DEFUN REV (X)
(IF (CONSP X)
(APP (REV (CDR X)) (LIST (CAR X)))
NIL))
The admission of REV is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV is described by the
theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive
type reasoning and the :typeprescription rule APP.
Summary
Form: ( DEFUN REV ...)
Rules: ((:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION APP))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01)
REV
ACL2 >>(DEFTHM APPNIL
(IMPLIES (TRUELISTP X)
(EQUAL (APP X NIL) X)))
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP X 'NIL). This
suggestion was produced using the :induction rules APP and TRUELISTP.
If we let (:P X) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (CONSP X)) (TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definition TRUELISTP,
the :executablecounterparts of APP, CONSP and EQUAL and primitive
type reasoning.
Subgoal *1/2
(IMPLIES (AND (CONSP X)
(EQUAL (APP (CDR X) NIL) (CDR X))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :rewrite rule CONSCAR
CDR.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(NOT (TRUELISTP (CDR X)))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM APPNIL ...)
Rules: ((:DEFINITION APP)
(:DEFINITION TRUELISTP)
(:EXECUTABLECOUNTERPART APP)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION TRUELISTP)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.02, other: 0.00)
APPNIL
ACL2 >>(DEFTHM TRUELISTPREV (TRUELISTP (REV X)))
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(TRUELISTP (REV X))).
But simplification reduces this to T, using the :definition REV and
the :executablecounterpart of TRUELISTP.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (REV X))).
This simplifies, using the :definition REV, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (APP (REV (CDR X)) (LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(TRUELISTP (REV X2)))
(TRUELISTP (APP (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (TRUELISTP (REV X2))
(TRUELISTP (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/1'4'
(IMPLIES (TRUELISTP RV)
(TRUELISTP (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)).
This suggestion was produced using the :induction rules APP and TRUE
LISTP. If we let (:P RV X1) denote *1.1 above then the induction
scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV X1))
(IMPLIES (AND (CONSP RV) (:P (CDR RV) X1))
(:P RV X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1.1/3
(IMPLIES (AND (NOT (CONSP RV)) (TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, the :executablecounterpart of CONSP and primitive type
reasoning.
Subgoal *1.1/2
(IMPLIES (AND (CONSP RV)
(TRUELISTP (APP (CDR RV) (LIST X1)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :typeprescription rule
APP.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(NOT (TRUELISTP (CDR RV)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proofs of *1.1 and *1.
Q.E.D.
The storage of TRUELISTPREV depends upon the :typeprescription rule
TRUELISTP.
Summary
Form: ( DEFTHM TRUELISTPREV ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART TRUELISTP)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:TYPEPRESCRIPTION APP)
(:TYPEPRESCRIPTION TRUELISTP))
Warnings: None
Time: 0.05 seconds (prove: 0.01, print: 0.03, other: 0.00)
TRUELISTPREV
ACL2 >>(DEFTHM REVAPP
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
But simplification reduces this to T, using the :definitions APP and
REV, primitive type reasoning and the :rewrite rules APPNIL and TRUE
LISTPREV.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proofs of *1.1 and *1.
Q.E.D.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE APPNIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE TRUELISTPREV))
Warnings: None
Time: 0.09 seconds (prove: 0.03, print: 0.06, other: 0.00)
REVAPP
* Step 3: That completes the admissibility check. Each form read
was an embedded event form and was admissible. We now retract back
to the initial world and try to include the book. This may expose
local incompatibilities.
Summary
Form: ( INCLUDEBOOK "simpledemo" ...)
Rules: NIL
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02)
ACL2 Warning [Guards] in (CERTIFYBOOK "simpledemo" ...): The book
"/Users/kaufmann/class/march2007/simpledemo.lisp" defines the functions
APP and REV, which have not had their guards verified. See :DOC guards.
* Step 4: Write the certificate for
"/Users/kaufmann/class/march2007/simpledemo.lisp" in
"/Users/kaufmann/class/march2007/simpledemo.cert". The final check
sum alist is
(("/Users/kaufmann/class/march2007/simpledemo.lisp"
"simpledemo" "simpledemo"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 112006708)).
* Step 5: Compile the functions defined in
"/Users/kaufmann/class/march2007/simpledemo.lisp".
"/Users/kaufmann/class/march2007/simpledemo.dfsl"
Summary
Form: (CERTIFYBOOK "simpledemo" ...)
Rules: NIL
Warnings: Guards
Time: 0.25 seconds (prove: 0.05, print: 0.12, other: 0.09)
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 !>:pbt 0
0 (EXITBOOTSTRAPMODE)
1:x(CERTIFYBOOK "simpledemo")
ACL2 !>:u
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(includebook "simpledemo")
Summary
Form: ( INCLUDEBOOK "simpledemo" ...)
Rules: NIL
Warnings: None
Time: 0.03 seconds (prove: 0.00, print: 0.00, other: 0.03)
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 !>:pbt 0
0 (EXITBOOTSTRAPMODE)
1:x(INCLUDEBOOK "simpledemo")
ACL2 !>:pcb! :x
1:x(INCLUDEBOOK "simpledemo")
(INCLUDEBOOK
"/Users/kaufmann/class/march2007/simpledemo.lisp")
L (DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
L (DEFUN REV (X)
(IF (CONSP X)
(APP (REV (CDR X)) (LIST (CAR X)))
NIL))
(DEFTHM APPNIL
(IMPLIES (TRUELISTP X)
(EQUAL (APP X NIL) X)))
(DEFTHM TRUELISTPREV (TRUELISTP (REV X)))
(DEFTHM REVAPP
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X))))
ACL2 !>(goodbye)
Quitting ACL2 and lisp; this may take a moment. For
faster response time, exit the ACL2 loop with :q
and then: type (GOODBYE) or (CCL:QUIT), then .
ACL2 !>ACL2 !>wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>(certifybook "simpledemo")
CERTIFICATION ATTEMPT FOR
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 Version 3.1
* Step 1: Read "/Users/kaufmann/class/march2007/simpledemo.lisp"
and compute its check sum.
* Step 2: There were six forms in the file. We now attempt to establish
that each form, whether local or nonlocal, is indeed an admissible
embedded event form in the context of the previously admitted ones.
Note that prooftree output is inhibited during this check; see :DOC
prooftree.
ACL2 >>(DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
The admission of APP is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of APP is described by the
theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive
type reasoning.
Summary
Form: ( DEFUN APP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02)
APP
ACL2 >>(DEFUN REV (X)
(IF (CONSP X)
(APP (REV (CDR X)) (LIST (CAR X)))
NIL))
The admission of REV is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV is described by the
theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive
type reasoning and the :typeprescription rule APP.
Summary
Form: ( DEFUN REV ...)
Rules: ((:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION APP))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01)
REV
ACL2 >>(LOCAL (DEFTHM APPNIL
(IMPLIES (TRUELISTP X)
(EQUAL (APP X NIL) X))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP X 'NIL). This
suggestion was produced using the :induction rules APP and TRUELISTP.
If we let (:P X) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (CONSP X)) (TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definition TRUELISTP,
the :executablecounterparts of APP, CONSP and EQUAL and primitive
type reasoning.
Subgoal *1/2
(IMPLIES (AND (CONSP X)
(EQUAL (APP (CDR X) NIL) (CDR X))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :rewrite rule CONSCAR
CDR.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(NOT (TRUELISTP (CDR X)))
(TRUELISTP X))
(EQUAL (APP X NIL) X)).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM APPNIL ...)
Rules: ((:DEFINITION APP)
(:DEFINITION TRUELISTP)
(:EXECUTABLECOUNTERPART APP)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION TRUELISTP)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.02, other: 0.00)
APPNIL
ACL2 >>(LOCAL (DEFTHM TRUELISTPREV (TRUELISTP (REV X))))
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
(IMPLIES (AND (CONSP X) (:P (CDR X)))
(:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(TRUELISTP (REV X))).
But simplification reduces this to T, using the :definition REV and
the :executablecounterpart of TRUELISTP.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (REV X))).
This simplifies, using the :definition REV, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (APP (REV (CDR X)) (LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(TRUELISTP (REV X2)))
(TRUELISTP (APP (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (TRUELISTP (REV X2))
(TRUELISTP (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/1'4'
(IMPLIES (TRUELISTP RV)
(TRUELISTP (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)).
This suggestion was produced using the :induction rules APP and TRUE
LISTP. If we let (:P RV X1) denote *1.1 above then the induction
scheme we'll use is
(AND (IMPLIES (NOT (CONSP RV)) (:P RV X1))
(IMPLIES (AND (CONSP RV) (:P (CDR RV) X1))
(:P RV X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1.1/3
(IMPLIES (AND (NOT (CONSP RV)) (TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, the :executablecounterpart of CONSP and primitive type
reasoning.
Subgoal *1.1/2
(IMPLIES (AND (CONSP RV)
(TRUELISTP (APP (CDR RV) (LIST X1)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But simplification reduces this to T, using the :definitions APP and
TRUELISTP, primitive type reasoning and the :typeprescription rule
APP.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV)
(NOT (TRUELISTP (CDR RV)))
(TRUELISTP RV))
(TRUELISTP (APP RV (LIST X1)))).
But we reduce the conjecture to T, by primitive type reasoning.
That completes the proofs of *1.1 and *1.
Q.E.D.
The storage of TRUELISTPREV depends upon the :typeprescription rule
TRUELISTP.
Summary
Form: ( DEFTHM TRUELISTPREV ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART TRUELISTP)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:TYPEPRESCRIPTION APP)
(:TYPEPRESCRIPTION TRUELISTP))
Warnings: None
Time: 0.07 seconds (prove: 0.01, print: 0.06, other: 0.00)
TRUELISTPREV
ACL2 >>(DEFTHM REVAPP
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X))))
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP X Y). This
suggestion was produced using the :induction rules APP and REV. If
we let (:P X Y) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) Y))
(:P X Y))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
But simplification reduces this to T, using the :definitions APP and
REV, primitive type reasoning and the :rewrite rules APPNIL and TRUE
LISTPREV.
Subgoal *1/1
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X)))).
This simplifies, using the :definitions APP and REV, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/1'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APP (CDR X) Y))
(APP (REV Y) (REV (CDR X)))))
(EQUAL (APP (REV (APP (CDR X) Y))
(LIST (CAR X)))
(APP (REV Y)
(APP (REV (CDR X)) (LIST (CAR X)))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2))))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1/1'''
(IMPLIES (EQUAL (REV (APP X2 Y))
(APP (REV Y) (REV X2)))
(EQUAL (APP (REV (APP X2 Y)) (LIST X1))
(APP (REV Y)
(APP (REV X2) (LIST X1))))).
We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for
(REV (APP X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/1'4'
(EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1))
(APP (REV Y) (APP (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/1'5'
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1)))).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (APP RV0 RV). This
suggestion was produced using the :induction rule APP. If we let
(:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP RV0))
(:P RV RV0 X1))
(IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1))
(:P RV RV0 X1))).
This induction is justified by the same argument used to admit APP.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (NOT (CONSP RV0))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP and
primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (CONSP RV0)
(EQUAL (APP (APP (CDR RV0) RV) (LIST X1))
(APP (CDR RV0) (APP RV (LIST X1)))))
(EQUAL (APP (APP RV0 RV) (LIST X1))
(APP RV0 (APP RV (LIST X1))))).
But simplification reduces this to T, using the :definition APP, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS.
That completes the proofs of *1.1 and *1.
Q.E.D.
Summary
Form: ( DEFTHM REVAPP ...)
Rules: ((:DEFINITION APP)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION APP)
(:INDUCTION REV)
(:REWRITE APPNIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE TRUELISTPREV))
Warnings: None
Time: 0.09 seconds (prove: 0.03, print: 0.06, other: 0.00)
REVAPP
* Step 3: That completes the admissibility check. Each form read
was an embedded event form and was admissible. We now retract back
to the initial world and try to include the book. This may expose
local incompatibilities.
Summary
Form: ( INCLUDEBOOK "simpledemo" ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
ACL2 Warning [Guards] in (CERTIFYBOOK "simpledemo" ...): The book
"/Users/kaufmann/class/march2007/simpledemo.lisp" defines the functions
APP and REV, which have not had their guards verified. See :DOC guards.
* Step 4: Write the certificate for
"/Users/kaufmann/class/march2007/simpledemo.lisp" in
"/Users/kaufmann/class/march2007/simpledemo.cert". The final check
sum alist is
(("/Users/kaufmann/class/march2007/simpledemo.lisp"
"simpledemo" "simpledemo"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 111692738)).
* Step 5: Compile the functions defined in
"/Users/kaufmann/class/march2007/simpledemo.lisp".
"/Users/kaufmann/class/march2007/simpledemo.dfsl"
Summary
Form: (CERTIFYBOOK "simpledemo" ...)
Rules: NIL
Warnings: Guards
Time: 0.28 seconds (prove: 0.05, print: 0.15, other: 0.08)
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 !>:pcb! :x
1:x(CERTIFYBOOK "simpledemo")
(INCLUDEBOOK
"/Users/kaufmann/class/march2007/simpledemo.lisp"
:LOADCOMPILEDFILE NIL
:UNCERTIFIEDOKP NIL
:DEFAXIOMSOKP NIL
:SKIPPROOFSOKP NIL)
L (DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
L (DEFUN REV (X)
(IF (CONSP X)
(APP (REV (CDR X)) (LIST (CAR X)))
NIL))
(DEFTHM REVAPP
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X))))
ACL2 !>:pe app
1:x(CERTIFYBOOK "simpledemo")
\
[Included books, outermost to innermost:
"/Users/kaufmann/class/march2007/simpledemo.lisp"
]
\
>L (DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
ACL2 !>:pe appnil
ACL2 Error in :PE: The object APPNIL is not a logical name. See
:DOC logicalname.
ACL2 !>:u
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(includebook "simpledemo")
Summary
Form: ( INCLUDEBOOK "simpledemo" ...)
Rules: NIL
Warnings: None
Time: 0.03 seconds (prove: 0.00, print: 0.00, other: 0.03)
"/Users/kaufmann/class/march2007/simpledemo.lisp"
ACL2 !>:pe appnil
ACL2 Error in :PE: The object APPNIL is not a logical name. See
:DOC logicalname.
ACL2 !>:pcb! :x
1:x(INCLUDEBOOK "simpledemo")
(INCLUDEBOOK
"/Users/kaufmann/class/march2007/simpledemo.lisp")
L (DEFUN APP (X Y)
(IF (CONSP X)
(CONS (CAR X) (APP (CDR X) Y))
Y))
L (DEFUN REV (X)
(IF (CONSP X)
(APP (REV (CDR X)) (LIST (CAR X)))
NIL))
(DEFTHM REVAPP
(EQUAL (REV (APP X Y))
(APP (REV Y) (REV X))))
ACL2 !>:u
0:x(EXITBOOTSTRAPMODE)
ACL2 !>:pbt 0
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(if (p y)
(cons (m y) 2)
1))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
ACL2 Error in ( DEFUN F4 ...): The symbol P (in package "ACL2") has
neither a function nor macro definition in ACL2. Please define it.
Summary
Form: ( DEFUN F4 ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(encapsulate
((p (x) t)
(m (x) t)
(up (x) t)
(dn (x) t))
(local (defun p (x) (posp x))) ; or, (not (zp x))
(local (defun m (x) (nfix x))) ; or, (acl2count x)
(defthm opm (op (m x)))
(local (defun dn (x) (1 x))) ; or, ( x 1)
(defthm dngoesdown
(implies (p x)
(o< (m (dn x)) (m x))))
(local (defun up (x) (1+ x))) ; or, x
)
To verify that the six encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 !>>(LOCAL (DEFUN P (X) (POSP X)))
Since P is nonrecursive, its admission is trivial. We observe that
the type of P is described by the theorem
(OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compoundrecognizer
rule POSPCOMPOUNDRECOGNIZER.
Summary
Form: ( DEFUN P ...)
Rules: ((:COMPOUNDRECOGNIZER POSPCOMPOUNDRECOGNIZER))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
P
ACL2 !>>(LOCAL (DEFUN M (X) (NFIX X)))
Since M is nonrecursive, its admission is trivial. We observe that
the type of M is described by the theorem
(AND (INTEGERP (M X)) (<= 0 (M X))). We used the :typeprescription
rule NFIX.
Summary
Form: ( DEFUN M ...)
Rules: ((:TYPEPRESCRIPTION NFIX))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
M
ACL2 !>>(DEFTHM OPM (OP (M X)))
ACL2 Warning [Nonrec] in ( DEFTHM OPM ...): A :REWRITE rule generated
from OPM will be triggered only by terms containing the nonrecursive
function symbol M. Unless this function is disabled, this rule is
unlikely ever to be used.
By the simple :definition M we reduce the conjecture to
Goal'
(OP (NFIX X)).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NFIX, OFINP and
OP.
Q.E.D.
The storage of OPM depends upon the :typeprescription rule OP.
Summary
Form: ( DEFTHM OPM ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION OP)
(:TYPEPRESCRIPTION OP))
Warnings: Nonrec
Time: 0.06 seconds (prove: 0.00, print: 0.00, other: 0.05)
OPM
ACL2 !>>(LOCAL (DEFUN DN (X) (1 X)))
Since DN is nonrecursive, its admission is trivial. We observe that
the type of DN is described by the theorem (ACL2NUMBERP (DN X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN DN ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
DN
ACL2 !>>(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
ACL2 Warning [Nonrec] in ( DEFTHM DNGOESDOWN ...): A :REWRITE rule
generated from DNGOESDOWN will be triggered only by terms containing
the nonrecursive function symbols DN and M. Unless these functions
are disabled, this rule is unlikely ever to be used.
By the simple :definitions DN, M, P and POSP we reduce the conjecture
to
Goal'
(IMPLIES (AND (INTEGERP X) (< 0 X))
(O< (NFIX (+ 1 X)) (NFIX X))).
This simplifies, using the :definitions NFIX, OFINP and O< and primitive
type reasoning, to
Goal''
(IMPLIES (AND (INTEGERP X) (< 0 X))
(< (+ 1 X) X)).
But simplification reduces this to T, using linear arithmetic and primitive
type reasoning.
Q.E.D.
The storage of DNGOESDOWN depends upon the :typeprescription rule
O<.
Summary
Form: ( DEFTHM DNGOESDOWN ...)
Rules: ((:DEFINITION DN)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:DEFINITION P)
(:DEFINITION POSP)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION O<))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
DNGOESDOWN
ACL2 !>>(LOCAL (DEFUN UP (X) (1+ X)))
Since UP is nonrecursive, its admission is trivial. We observe that
the type of UP is described by the theorem (ACL2NUMBERP (UP X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN UP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
UP
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
The following constraint is associated with every one of the functions
P, M, UP and DN:
(AND (OP (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X))))
Summary
Form: ( ENCAPSULATE ((P ...) ...) ...)
Rules: NIL
Warnings: Nonrec
Time: 0.11 seconds (prove: 0.00, print: 0.02, other: 0.09)
T
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(if (p y)
(cons (m y) 2)
1))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))).
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS and OPM, to the following two conjectures.
Subgoal 3.3.2
(IMPLIES (P X) (NOT (EQUAL 0 (M X)))).
Name the formula above *1.
Subgoal 3.3.1
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *2.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP '(1 . 0))).
By the :executablecounterpart of OP we reduce the conjecture to
Subgoal 3.2'
(IMPLIES (AND (P X) (NOT Q)) (P Y)).
This simplifies, using trivial observations, to
Subgoal 3.2''
(IMPLIES (P X) (P Y)).
Name the formula above *3.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS and OPM, to the following two conjectures.
Subgoal 3.1.2
(IMPLIES (AND (P X) (P Y))
(NOT (EQUAL 0 (M Y)))).
Name the formula above *4.
Subgoal 3.1.1
(IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y))))
(< 0 (M Y))).
Name the formula above *5.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 '(1 . 0))).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *6.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< '(1 . 0) (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of <, EQUAL, OFINP, OFIRST
COEFF and OFIRSTEXPT, primitive type reasoning and the :rewrite rules
CARCONS, CDRCONS and DEFAULT<1, to
Subgoal 1.1'
(IMPLIES (AND (P X)
(P Y)
(NOT (P (DN X)))
(M X)
(NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *7.
But this formula is subsumed by *5, which we'll try to prove later.
We therefore regard *7 as proved (pending the proof of the more general
*5).
We next consider *6, which is
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *6. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTCOEFF)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DEFAULT<1)
(:REWRITE DNGOESDOWN)
(:REWRITE OPM))
Warnings: None
Time: 0.12 seconds (prove: 0.03, print: 0.08, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>:startprooftree
Proof tree output is now enabled. Note that :STARTPROOFTREE works
by removing 'prooftree from the inhibitoutputlst; see :DOC set
inhibitoutputlst.
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(if (p y)
(cons (m y) 2)
1))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS and OPM, to the following two conjectures.
Subgoal 3.3.2
(IMPLIES (P X) (NOT (EQUAL 0 (M X)))).
Name the formula above *1.
Subgoal 3.3.1
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *2.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP '(1 . 0))).
By the :executablecounterpart of OP we reduce the conjecture to
Subgoal 3.2'
(IMPLIES (AND (P X) (NOT Q)) (P Y)).
This simplifies, using trivial observations, to
Subgoal 3.2''
(IMPLIES (P X) (P Y)).
Name the formula above *3.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS and OPM, to the following two conjectures.
Subgoal 3.1.2
(IMPLIES (AND (P X) (P Y))
(NOT (EQUAL 0 (M Y)))).
Name the formula above *4.
Subgoal 3.1.1
(IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y))))
(< 0 (M Y))).
Name the formula above *5.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 '(1 . 0))).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *6.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< '(1 . 0) (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of <, EQUAL, OFINP, OFIRST
COEFF and OFIRSTEXPT, primitive type reasoning and the :rewrite rules
CARCONS, CDRCONS and DEFAULT<1, to
Subgoal 1.1'
(IMPLIES (AND (P X)
(P Y)
(NOT (P (DN X)))
(M X)
(NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *7.
But this formula is subsumed by *5, which we'll try to prove later.
We therefore regard *7 as proved (pending the proof of the more general
*5).
We next consider *6, which is
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *6. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTCOEFF)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DEFAULT<1)
(:REWRITE DNGOESDOWN)
(:REWRITE OPM))
Warnings: None
Time: 0.26 seconds (prove: 0.04, print: 0.08, proof tree: 0.14, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma1
(implies (p x)
(not (equal 0 (m x)))) ; (equal (equal 0 (m x)) nil)
:hints (("Goal" :intheory (disable dngoesdown)
:use dngoesdown)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL 0 (M X)))).
This simplifies, using the :definitions OFINP and O< and the :executable
counterpart of OFINP, to
Goal'''
(IMPLIES (AND (NOT (CONSP (M (DN X))))
(< (M (DN X)) 0)
(P X))
(NOT (EQUAL 0 (M X)))).
This simplifies, using trivial observations, to
Goal'4'
(IMPLIES (AND (< (M (DN X)) 0) (P X))
(NOT (EQUAL 0 (M X)))).
Normally we would attempt to prove this formula by induction. However,
we prefer in this instance to focus on the original input conjecture
rather than this simplified special case. We therefore abandon our
previous work on this conjecture and reassign the name *1 to the original
conjecture. (See :DOC otfflg.) [Note: Thanks again for the hint.]
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM LEMMA1 ...)
Rules: ((:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART OFINP))
Warnings: None
Time: 0.07 seconds (prove: 0.02, print: 0.02, proof tree: 0.01, other: 0.01)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma11
(not (< (m x) 0)))
<< Starting proof tree logging >>
Name the formula above *1.
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM LEMMA11 ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma11
(not (< (m x) 0))
:hints (("Goal" :use opm
:intheory (disable opm))))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from OPM. We are left with the following
subgoal.
Goal'
(IMPLIES (OP (M X)) (<= 0 (M X))).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions OFINP and OP.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA11 ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION OFINP)
(:DEFINITION OP))
Warnings: None
Time: 0.03 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.01)
LEMMA11
ACL2 !>(defthm lemma1
(implies (p x)
(not (equal 0 (m x))))
:hints (("Goal" :intheory (disable dngoesdown)
:use dngoesdown)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL 0 (M X)))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and the :rewrite rule
LEMMA11.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA1 ...)
Rules: ((:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART OFINP)
(:REWRITE LEMMA11))
Warnings: None
Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02)
LEMMA1
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(if (p y)
(cons (m y) 2)
1))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS, LEMMA1 and OPM, to
Subgoal 3.3'
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *1.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP '(1 . 0))).
By the :executablecounterpart of OP we reduce the conjecture to
Subgoal 3.2'
(IMPLIES (AND (P X) (NOT Q)) (P Y)).
This simplifies, using trivial observations, to
Subgoal 3.2''
(IMPLIES (P X) (P Y)).
Name the formula above *2.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS, LEMMA1 and OPM, to
Subgoal 3.1'
(IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y))))
(< 0 (M Y))).
Name the formula above *3.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 '(1 . 0))).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *4.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< '(1 . 0) (CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of <, EQUAL, OFINP, OFIRST
COEFF and OFIRSTEXPT, primitive type reasoning and the :rewrite rules
CARCONS, CDRCONS and DEFAULT<1, to
Subgoal 1.1'
(IMPLIES (AND (P X)
(P Y)
(NOT (P (DN X)))
(M X)
(NOT (CONSP (M X))))
(< 0 (M X))).
Name the formula above *5.
But this formula is subsumed by *3, which we'll try to prove later.
We therefore regard *5 as proved (pending the proof of the more general
*3).
We next consider *4, which is
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *4. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTCOEFF)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DEFAULT<1)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE OPM))
Warnings: None
Time: 0.17 seconds (prove: 0.04, print: 0.07, proof tree: 0.06, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma2
(implies (and (p x) (not (consp (m x))))
(< 0 (m x)))
:hints (("Goal" :use (lemma1 opm)
:intheory (disable lemma1 opm))))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypotheses provided by the :USE hint.
These hypotheses can be obtained from LEMMA1 and OPM. We are left
with the following subgoal.
Goal'
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(OP (M X)))
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X)))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(OP (M X))
(P X)
(NOT (CONSP (M X))))
(< 0 (M X))).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NOT, OFINP and
OP.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA2 ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OP))
Warnings: None
Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.01)
LEMMA2
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(if (p y)
(cons (m y) 2)
1))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP '(1 . 0))).
By the :executablecounterpart of OP we reduce the conjecture to
Subgoal 3.2'
(IMPLIES (AND (P X) (NOT Q)) (P Y)).
This simplifies, using trivial observations, to
Subgoal 3.2''
(IMPLIES (P X) (P Y)).
Name the formula above *1.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (UP X)) (CONS (M (UP X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 '(1 . 0))).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (COND ((NOT Q) (CONS (M Y) 1))
((P (DN X)) (CONS (M (DN X)) 2))
(T 1))
0)
0)
(IF (P X)
(CONS (COND (Q (CONS (M X) 1))
((P Y) (CONS (M Y) 2))
(T 1))
0)
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *2.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< '(1 . 0) (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
<, EQUAL, OFINP, OFIRSTCOEFF and OFIRSTEXPT, primitive type reasoning
and the :rewrite rules CARCONS, CDRCONS, DEFAULT<1 and LEMMA2.
So we now return to *2, which is
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *2. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTCOEFF)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DEFAULT<1)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE LEMMA2)
(:REWRITE OPM))
Warnings: None
Time: 0.13 seconds (prove: 0.02, print: 0.07, proof tree: 0.04, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(cons (if q
(cons (m x) 1)
(cons (m y) 2))
0)
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0). The non
trivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (IF (NOT Q)
(CONS (M Y) 1)
(CONS (M (UP X)) 2))
0)
0)
(IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (IF (NOT Q)
(CONS (M Y) 1)
(CONS (M (DN X)) 2))
0)
0)
(IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0)).
This simplifies, using trivial observations, to the following three
conjectures.
Subgoal 3.3
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.2
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q))
(OP (CONS (CONS (M Y) 2) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT, OP, ORST and O<, the :executablecounterparts of OFINP, O
FIRSTEXPT, OP and POSP, primitive type reasoning and the :rewrite
rules CARCONS, CDRCONS and OPM, to the following two conjectures.
Subgoal 3.1.2
(IMPLIES (P X) (NOT (EQUAL 0 (M Y)))).
Name the formula above *1.
Subgoal 3.1.1
(IMPLIES (AND (P X) (NOT (CONSP (M Y))))
(< 0 (M Y))).
Name the formula above *2.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(CONS (IF (NOT Q)
(CONS (M Y) 1)
(CONS (M (UP X)) 2))
0)
0)
(IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(CONS (IF (NOT Q)
(CONS (M Y) 1)
(CONS (M (DN X)) 2))
0)
0)
(IF (P X)
(CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2))
0)
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following two conjectures.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *3.
Subgoal 1.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
So we now return to *3, which is
(IMPLIES (AND (P X) (P Y))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *3. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE LEMMA2)
(:REWRITE OPM))
Warnings: None
Time: 0.27 seconds (prove: 0.02, print: 0.09, proof tree: 0.15, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(if q
(cons (cons (m x) 1) 0) ; (makeord (m x) 1 0)
(if (p y)
(cons (cons (m y) 2) 0) ; (makeord (m y) 2 0)
1))
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O<, the :executablecounterparts of < and EQUAL, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS and DNGOES
DOWN, to
Subgoal 1.2'
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
Name the formula above *1.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
So we now return to *1, which is
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(NOT (EQUAL (M (DN X)) (M X)))).
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE LEMMA2)
(:REWRITE OPM))
Warnings: None
Time: 0.14 seconds (prove: 0.02, print: 0.10, proof tree: 0.02, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma3
(implies (p x)
(not (equal (m (dn x)) (m x))))
:hints (("Goal" :intheory (disable dngoesdown)
:use dngoesdown)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X)
(NOT (EQUAL (M (DN X)) (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL (M (DN X)) (M X)))).
This simplifies, using trivial observations, to
Goal'''
(IMPLIES (AND (O< (M X) (M X)) (P X))
(NOT (EQUAL (M (DN X)) (M X)))).
We now use the conclusion by substituting (M (DN X)) for (M X) and
hiding the conclusion. This produces
Goal'4'
(IMPLIES (AND (O< (M (DN X)) (M (DN X))) (P X))
(NOT (HIDE (EQUAL (M (DN X)) (M X))))).
We remove HIDE from the conclusion, which was used heuristically to
transform Goal''' by substituting into the rest of that goal. This
produces
Goal'5'
(IMPLIES (AND (O< (M (DN X)) (M (DN X))) (P X))
(NOT (EQUAL (M (DN X)) (M X)))).
This simplifies, using trivial observations, to
Goal'6'
(IMPLIES (AND (O< (M X) (M X)) (P X))
(NOT (EQUAL (M (DN X)) (M X)))).
Normally we would attempt to prove this formula by induction. However,
we prefer in this instance to focus on the original input conjecture
rather than this simplified special case. We therefore abandon our
previous work on this conjecture and reassign the name *1 to the original
conjecture. (See :DOC otfflg.) [Note: Thanks again for the hint.]
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM LEMMA3 ...)
Rules: ((:DEFINITION HIDE) (:DEFINITION NOT))
Warnings: None
Time: 0.09 seconds (prove: 0.03, print: 0.03, proof tree: 0.02, other: 0.02)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma31
(not (o< x x)))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (O< X X). This suggestion
was produced using the :induction rule O<. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(= (OFIRSTCOEFF X) (OFIRSTCOEFF X))
(:P (ORST X)))
(:P X))
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(NOT (= (OFIRSTCOEFF X)
(OFIRSTCOEFF X))))
(:P X))
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(NOT (EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X)))
(:P (OFIRSTEXPT X)))
(:P X))
(IMPLIES (AND (OFINP X) (OFINP X))
(:P X))).
This induction is justified by the same argument used to admit O<.
When applied to the goal at hand the above induction scheme produces
the following four nontautological subgoals.
Subgoal *1/4
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(= (OFIRSTCOEFF X) (OFIRSTCOEFF X))
(O<= (ORST X) (ORST X)))
(O<= X X)).
By the simple :definitions =, OFINP and ORST we reduce the conjecture
to
Subgoal *1/4'
(IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X)))
(O<= X X)).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O< and primitive type reasoning, to
Subgoal *1/4''
(IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X)))
(O<= (ORST X) (ORST X))).
But we reduce the conjecture to T, by the simple :definition ORST.
Subgoal *1/3
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(NOT (= (OFIRSTCOEFF X)
(OFIRSTCOEFF X))))
(O<= X X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/2
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(NOT (EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X)))
(O<= (OFIRSTEXPT X) (OFIRSTEXPT X)))
(O<= X X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/1
(IMPLIES (AND (OFINP X) (OFINP X))
(O<= X X)).
By the simple :definition OFINP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X)) (O<= X X)).
This simplifies, using the :definitions OFINP and O<, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X)) (<= X X)).
But simplification reduces this to T, using linear arithmetic.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA31 ...)
Rules: ((:DEFINITION =)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART NOT)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION O<))
Warnings: None
Time: 0.06 seconds (prove: 0.01, print: 0.04, proof tree: 0.02, other: 0.00)
LEMMA31
ACL2 !>(defthm lemma3
(implies (p x)
(not (equal (m (dn x)) (m x))))
:hints (("Goal" :intheory (disable dngoesdown)
:use dngoesdown)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X)
(NOT (EQUAL (M (DN X)) (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL (M (DN X)) (M X)))).
But simplification reduces this to T, using the :rewrite rule LEMMA
31.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA3 ...)
Rules: ((:DEFINITION NOT) (:REWRITE LEMMA31))
Warnings: None
Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02)
LEMMA3
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure
(if (p x)
(if q
(cons (cons (m x) 1) 0) ; (makeord (m x) 1 0)
(if (p y)
(cons (cons (m y) 2) 0) ; (makeord (m y) 2 0)
1))
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTEXPT and O<, primitive type reasoning and the :rewrite rules
CARCONS, DNGOESDOWN and LEMMA3.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Q.E.D.
That completes the proof of the measure theorem for F4. Thus, we admit
this function under the principle of definition.We observe that the
type of F4 is described by the theorem
(AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))).
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE LEMMA2)
(:REWRITE LEMMA3)
(:REWRITE OPM))
Warnings: None
Time: 0.10 seconds (prove: 0.02, print: 0.06, proof tree: 0.02, other: 0.01)
F4
ACL2 !>Bye.
Quitting ACL2 and lisp; this may take a moment. For
faster response time, exit the ACL2 loop with :q
and then: type (GOODBYE) or (CCL:QUIT), then .
ACL2 !>ACL2 !>wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>(certifybook "101")
CERTIFICATION ATTEMPT FOR "/Users/kaufmann/class/march2007/101.lisp"
ACL2 Version 3.1
* Step 1: Read "/Users/kaufmann/class/march2007/101.lisp" and compute
its check sum.
* Step 2: There were eight forms in the file. We now attempt to establish
that each form, whether local or nonlocal, is indeed an admissible
embedded event form in the context of the previously admitted ones.
Note that prooftree output is inhibited during this check; see :DOC
prooftree.
ACL2 >>(ENCAPSULATE ((P (X) T)
(M (X) T)
(UP (X) T)
(DN (X) T))
(LOCAL (DEFUN P (X) (POSP X)))
(LOCAL (DEFUN M (X) (NFIX X)))
(DEFTHM OPM (OP (M X)))
(LOCAL (DEFUN DN (X) (1 X)))
(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
(LOCAL (DEFUN UP (X) (1+ X))))
To verify that the six encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 >>(LOCAL (DEFUN P (X) (POSP X)))
Since P is nonrecursive, its admission is trivial. We observe that
the type of P is described by the theorem
(OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compoundrecognizer
rule POSPCOMPOUNDRECOGNIZER.
Summary
Form: ( DEFUN P ...)
Rules: ((:COMPOUNDRECOGNIZER POSPCOMPOUNDRECOGNIZER))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
P
ACL2 >>(LOCAL (DEFUN M (X) (NFIX X)))
Since M is nonrecursive, its admission is trivial. We observe that
the type of M is described by the theorem
(AND (INTEGERP (M X)) (<= 0 (M X))). We used the :typeprescription
rule NFIX.
Summary
Form: ( DEFUN M ...)
Rules: ((:TYPEPRESCRIPTION NFIX))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
M
ACL2 >>(DEFTHM OPM (OP (M X)))
ACL2 Warning [Nonrec] in ( DEFTHM OPM ...): A :REWRITE rule generated
from OPM will be triggered only by terms containing the nonrecursive
function symbol M. Unless this function is disabled, this rule is
unlikely ever to be used.
By the simple :definition M we reduce the conjecture to
Goal'
(OP (NFIX X)).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NFIX, OFINP and
OP.
Q.E.D.
The storage of OPM depends upon the :typeprescription rule OP.
Summary
Form: ( DEFTHM OPM ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION OP)
(:TYPEPRESCRIPTION OP))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
OPM
ACL2 >>(LOCAL (DEFUN DN (X) (1 X)))
Since DN is nonrecursive, its admission is trivial. We observe that
the type of DN is described by the theorem (ACL2NUMBERP (DN X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN DN ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
DN
ACL2 >>(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
ACL2 Warning [Nonrec] in ( DEFTHM DNGOESDOWN ...): A :REWRITE rule
generated from DNGOESDOWN will be triggered only by terms containing
the nonrecursive function symbols DN and M. Unless these functions
are disabled, this rule is unlikely ever to be used.
By the simple :definitions DN, M, P and POSP we reduce the conjecture
to
Goal'
(IMPLIES (AND (INTEGERP X) (< 0 X))
(O< (NFIX (+ 1 X)) (NFIX X))).
This simplifies, using the :definitions NFIX, OFINP and O< and primitive
type reasoning, to
Goal''
(IMPLIES (AND (INTEGERP X) (< 0 X))
(< (+ 1 X) X)).
But simplification reduces this to T, using linear arithmetic and primitive
type reasoning.
Q.E.D.
The storage of DNGOESDOWN depends upon the :typeprescription rule
O<.
Summary
Form: ( DEFTHM DNGOESDOWN ...)
Rules: ((:DEFINITION DN)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:DEFINITION P)
(:DEFINITION POSP)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION O<))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
DNGOESDOWN
ACL2 >>(LOCAL (DEFUN UP (X) (1+ X)))
Since UP is nonrecursive, its admission is trivial. We observe that
the type of UP is described by the theorem (ACL2NUMBERP (UP X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN UP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
UP
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
The following constraint is associated with every one of the functions
P, M, UP and DN:
(AND (OP (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X))))
Summary
Form: ( ENCAPSULATE ((P ...) ...) ...)
Rules: NIL
Warnings: Nonrec
Time: 0.05 seconds (prove: 0.00, print: 0.02, other: 0.03)
T
ACL2 >>(DEFTHM LEMMA11 (NOT (< (M X) 0))
:HINTS (("Goal" :USE OPM
:INTHEORY (DISABLE OPM))))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from OPM. We are left with the following
subgoal.
Goal'
(IMPLIES (OP (M X)) (<= 0 (M X))).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions OFINP and OP.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA11 ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION OFINP)
(:DEFINITION OP))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01)
LEMMA11
ACL2 >>(DEFTHM LEMMA1
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))
:HINTS (("Goal" :INTHEORY (DISABLE DNGOESDOWN)
:USE DNGOESDOWN)))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL 0 (M X)))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and the :rewrite rule
LEMMA11.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA1 ...)
Rules: ((:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART OFINP)
(:REWRITE LEMMA11))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01)
LEMMA1
ACL2 >>(DEFTHM LEMMA2
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X)))
:HINTS (("Goal" :USE (LEMMA1 OPM)
:INTHEORY (DISABLE LEMMA1 OPM))))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypotheses provided by the :USE hint.
These hypotheses can be obtained from LEMMA1 and OPM. We are left
with the following subgoal.
Goal'
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(OP (M X)))
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X)))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(OP (M X))
(P X)
(NOT (CONSP (M X))))
(< 0 (M X))).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NOT, OFINP and
OP.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA2 ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OP))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01)
LEMMA2
ACL2 >>(DEFTHM LEMMA31 (NOT (O< X X)))
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (O< X X). This suggestion
was produced using the :induction rule O<. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(= (OFIRSTCOEFF X) (OFIRSTCOEFF X))
(:P (ORST X)))
(:P X))
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(NOT (= (OFIRSTCOEFF X)
(OFIRSTCOEFF X))))
(:P X))
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(NOT (EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X)))
(:P (OFIRSTEXPT X)))
(:P X))
(IMPLIES (AND (OFINP X) (OFINP X))
(:P X))).
This induction is justified by the same argument used to admit O<.
When applied to the goal at hand the above induction scheme produces
the following four nontautological subgoals.
Subgoal *1/4
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(= (OFIRSTCOEFF X) (OFIRSTCOEFF X))
(O<= (ORST X) (ORST X)))
(O<= X X)).
By the simple :definitions =, OFINP and ORST we reduce the conjecture
to
Subgoal *1/4'
(IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X)))
(O<= X X)).
This simplifies, using the :definitions OFINP, OFIRSTCOEFF, OFIRST
EXPT and O< and primitive type reasoning, to
Subgoal *1/4''
(IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X)))
(O<= (ORST X) (ORST X))).
But we reduce the conjecture to T, by the simple :definition ORST.
Subgoal *1/3
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X))
(NOT (= (OFIRSTCOEFF X)
(OFIRSTCOEFF X))))
(O<= X X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/2
(IMPLIES (AND (NOT (OFINP X))
(NOT (OFINP X))
(NOT (EQUAL (OFIRSTEXPT X)
(OFIRSTEXPT X)))
(O<= (OFIRSTEXPT X) (OFIRSTEXPT X)))
(O<= X X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/1
(IMPLIES (AND (OFINP X) (OFINP X))
(O<= X X)).
By the simple :definition OFINP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X)) (O<= X X)).
This simplifies, using the :definitions OFINP and O<, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X)) (<= X X)).
But simplification reduces this to T, using linear arithmetic.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA31 ...)
Rules: ((:DEFINITION =)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART NOT)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION O<))
Warnings: None
Time: 0.03 seconds (prove: 0.01, print: 0.03, other: 0.00)
LEMMA31
ACL2 >>(DEFTHM LEMMA3
(IMPLIES (P X)
(NOT (EQUAL (M (DN X)) (M X))))
:HINTS (("Goal" :INTHEORY (DISABLE DNGOESDOWN)
:USE DNGOESDOWN)))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X)
(NOT (EQUAL (M (DN X)) (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL (M (DN X)) (M X)))).
But simplification reduces this to T, using the :rewrite rule LEMMA
31.
Q.E.D.
Summary
Form: ( DEFTHM LEMMA3 ...)
Rules: ((:DEFINITION NOT) (:REWRITE LEMMA31))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01)
LEMMA3
ACL2 >>(DEFUN
F4 (X Y Q)
(DECLARE
(XARGS :MEASURE (IF (P X)
(IF Q (CONS (CONS (M X) 1) 0)
(IF (P Y) (CONS (CONS (M Y) 2) 0) 1))
0)))
(IF (P X)
(IF Q (F4 Y (DN X) (NOT Q))
(F4 Y (UP X) (NOT Q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)))).
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT, OP, ORST and O<, the :executablecounterparts
of OFINP, OFIRSTEXPT, OP and POSP, primitive type reasoning and
the :rewrite rules CARCONS, CDRCONS, LEMMA1, LEMMA2 and OPM.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (UP X))
(CONS (CONS (M (UP X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (CONS (CONS (M Y) 1) 0)
(CONS (CONS (M Y) 2) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTCOEFF, OFIRSTEXPT and O<, the :executablecounterparts of
< and EQUAL, primitive type reasoning and the :rewrite rules CARCONS
and CDRCONS.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (CONS (CONS (M Y) 1) 0))
((P (DN X))
(CONS (CONS (M (DN X)) 2) 0))
(T 1))
0)
(IF (P X)
(COND (Q (CONS (CONS (M X) 1) 0))
((P Y) (CONS (CONS (M Y) 2) 0))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (CONS (CONS (M (DN X)) 2) 0)
(CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP,
OFIRSTEXPT and O<, primitive type reasoning and the :rewrite rules
CARCONS, DNGOESDOWN and LEMMA3.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (CONS (CONS (M X) 1) 0))).
But simplification reduces this to T, using the :definitions OFINP
and O<, the :executablecounterpart of OFINP and primitive type reasoning.
Q.E.D.
That completes the proof of the measure theorem for F4. Thus, we admit
this function under the principle of definition.We observe that the
type of F4 is described by the theorem
(AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))).
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:DEFINITION OFINP)
(:DEFINITION OFIRSTCOEFF)
(:DEFINITION OFIRSTEXPT)
(:DEFINITION OP)
(:DEFINITION ORST)
(:DEFINITION O<)
(:EXECUTABLECOUNTERPART <)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFINP)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:EXECUTABLECOUNTERPART POSP)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE LEMMA2)
(:REWRITE LEMMA3)
(:REWRITE OPM))
Warnings: None
Time: 0.08 seconds (prove: 0.02, print: 0.05, other: 0.01)
F4
* Step 3: That completes the admissibility check. Each form read
was an embedded event form and was admissible. We now retract back
to the initial world and try to include the book. This may expose
local incompatibilities.
Summary
Form: ( INCLUDEBOOK "101" ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
ACL2 Warning [Guards] in (CERTIFYBOOK "101" ...): The book
"/Users/kaufmann/class/march2007/101.lisp" defines the function F4,
which has not had its guards verified. See :DOC guards.
* Step 4: Write the certificate for
"/Users/kaufmann/class/march2007/101.lisp" in
"/Users/kaufmann/class/march2007/101.cert". The final check sum alist
is
(("/Users/kaufmann/class/march2007/101.lisp"
"101" "101"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 142813943)).
* Step 5: Compile the functions defined in
"/Users/kaufmann/class/march2007/101.lisp".
"/Users/kaufmann/class/march2007/101.dfsl"
Summary
Form: (CERTIFYBOOK "101" ...)
Rules: NIL
Warnings: Guards and Nonrec
Time: 0.29 seconds (prove: 0.04, print: 0.12, other: 0.13)
"/Users/kaufmann/class/march2007/101.lisp"
ACL2 !>:u
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(encapsulate
((p (x) t)
(m (x) t)
(up (x) t)
(dn (x) t))
(local (defun p (x) (posp x))) ; or, (not (zp x))
(local (defun m (x) (nfix x))) ; or, (acl2count x)
(defthm opm (op (m x)))
(local (defun dn (x) (1 x))) ; or, ( x 1)
(defthm dngoesdown
(implies (p x)
(o< (m (dn x)) (m x))))
(local (defun up (x) (1+ x))) ; or, x
)
To verify that the six encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 !>>(LOCAL (DEFUN P (X) (POSP X)))
Since P is nonrecursive, its admission is trivial. We observe that
the type of P is described by the theorem
(OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compoundrecognizer
rule POSPCOMPOUNDRECOGNIZER.
Summary
Form: ( DEFUN P ...)
Rules: ((:COMPOUNDRECOGNIZER POSPCOMPOUNDRECOGNIZER))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.01, other: 0.01)
P
ACL2 !>>(LOCAL (DEFUN M (X) (NFIX X)))
Since M is nonrecursive, its admission is trivial. We observe that
the type of M is described by the theorem
(AND (INTEGERP (M X)) (<= 0 (M X))). We used the :typeprescription
rule NFIX.
Summary
Form: ( DEFUN M ...)
Rules: ((:TYPEPRESCRIPTION NFIX))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
M
ACL2 !>>(DEFTHM OPM (OP (M X)))
ACL2 Warning [Nonrec] in ( DEFTHM OPM ...): A :REWRITE rule generated
from OPM will be triggered only by terms containing the nonrecursive
function symbol M. Unless this function is disabled, this rule is
unlikely ever to be used.
By the simple :definition M we reduce the conjecture to
Goal'
(OP (NFIX X)).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NFIX, OFINP and
OP.
Q.E.D.
The storage of OPM depends upon the :typeprescription rule OP.
Summary
Form: ( DEFTHM OPM ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION OP)
(:TYPEPRESCRIPTION OP))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01)
OPM
ACL2 !>>(LOCAL (DEFUN DN (X) (1 X)))
Since DN is nonrecursive, its admission is trivial. We observe that
the type of DN is described by the theorem (ACL2NUMBERP (DN X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN DN ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
DN
ACL2 !>>(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
ACL2 Warning [Nonrec] in ( DEFTHM DNGOESDOWN ...): A :REWRITE rule
generated from DNGOESDOWN will be triggered only by terms containing
the nonrecursive function symbols DN and M. Unless these functions
are disabled, this rule is unlikely ever to be used.
By the simple :definitions DN, M, P and POSP we reduce the conjecture
to
Goal'
(IMPLIES (AND (INTEGERP X) (< 0 X))
(O< (NFIX (+ 1 X)) (NFIX X))).
This simplifies, using the :definitions NFIX, OFINP and O< and primitive
type reasoning, to
Goal''
(IMPLIES (AND (INTEGERP X) (< 0 X))
(< (+ 1 X) X)).
But simplification reduces this to T, using linear arithmetic and primitive
type reasoning.
Q.E.D.
The storage of DNGOESDOWN depends upon the :typeprescription rule
O<.
Summary
Form: ( DEFTHM DNGOESDOWN ...)
Rules: ((:DEFINITION DN)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:DEFINITION P)
(:DEFINITION POSP)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION O<))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.01, other: 0.00)
DNGOESDOWN
ACL2 !>>(LOCAL (DEFUN UP (X) (1+ X)))
Since UP is nonrecursive, its admission is trivial. We observe that
the type of UP is described by the theorem (ACL2NUMBERP (UP X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN UP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
UP
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
The following constraint is associated with every one of the functions
P, M, UP and DN:
(AND (OP (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X))))
Summary
Form: ( ENCAPSULATE ((P ...) ...) ...)
Rules: NIL
Warnings: Nonrec
Time: 0.06 seconds (prove: 0.00, print: 0.02, other: 0.04)
T
ACL2 !>(includebook "ordinals/ordinals" :dir :system)
Summary
Form: ( INCLUDEBOOK "ordinals/ordinals" ...)
Rules: NIL
Warnings: None
Time: 1.56 seconds (prove: 0.00, print: 0.00, other: 1.56)
"/Users/kaufmann/acl2/v31/books/ordinals/ordinals.lisp"
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure (if (p x)
(if q
(o^ (omega) (m x))
(if (p y)
(o* (o^ (omega) (m y)) 2)
1))
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))).
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M, OPO^ and OMEGAOP.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterpart
of OP and the :rewrite rules OPM, OPO*, OPO^ and OMEGAOP.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (O^ (OMEGA) (M Y))
(O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterparts
of EQUAL, NOT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), OPM, OPO^, OMEGAOP and
~(a=0) & b>1 <=> a < ab and the :typeprescription rule OMEGA.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules 0 <
w^a and OPM.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (O* (O^ (OMEGA) (M (DN X))) 2)
(O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :executablecounterparts
of OFIRSTEXPT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), DNGOESDOWN, O*OFIRSTEXPT,
OFIRSTEXPT<, OPM, OPO*, OPO^, OMEGAOP, O^OMEGAOFIRST
EXPT and a+0 = a and the :typeprescription rule OMEGA.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (O^ (OMEGA) (M X)))).
Name the formula above *1.
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE (a = 0) & ~(b = 0) <=> (a^b = 0))
(:REWRITE 0 < w^a)
(:REWRITE DNGOESDOWN)
(:REWRITE O*OFIRSTEXPT)
(:REWRITE OFIRSTEXPT<)
(:REWRITE OPM)
(:REWRITE OPO*)
(:REWRITE OPO^)
(:REWRITE OMEGAOP)
(:REWRITE O^OMEGAOFIRSTEXPT)
(:REWRITE a+0 = a)
(:REWRITE ~(a=0) & b>1 <=> a < ab)
(:TYPEPRESCRIPTION OMEGA))
Warnings: None
Time: 0.11 seconds (prove: 0.05, print: 0.06, other: 0.01)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>:startprooftree
Proof tree output is now enabled. Note that :STARTPROOFTREE works
by removing 'prooftree from the inhibitoutputlst; see :DOC set
inhibitoutputlst.
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure (if (p x)
(if q
(o^ (omega) (m x))
(if (p y)
(o* (o^ (omega) (m y)) 2)
1))
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M, OPO^ and OMEGAOP.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterpart
of OP and the :rewrite rules OPM, OPO*, OPO^ and OMEGAOP.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (O^ (OMEGA) (M Y))
(O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterparts
of EQUAL, NOT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), OPM, OPO^, OMEGAOP and
~(a=0) & b>1 <=> a < ab and the :typeprescription rule OMEGA.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules 0 <
w^a and OPM.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (O* (O^ (OMEGA) (M (DN X))) 2)
(O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :executablecounterparts
of OFIRSTEXPT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), DNGOESDOWN, O*OFIRSTEXPT,
OFIRSTEXPT<, OPM, OPO*, OPO^, OMEGAOP, O^OMEGAOFIRST
EXPT and a+0 = a and the :typeprescription rule OMEGA.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (O^ (OMEGA) (M X)))).
Name the formula above *1.
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture
for F4 has failed.
Summary
Form: ( DEFUN F4 ...)
Rules: ((:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE (a = 0) & ~(b = 0) <=> (a^b = 0))
(:REWRITE 0 < w^a)
(:REWRITE DNGOESDOWN)
(:REWRITE O*OFIRSTEXPT)
(:REWRITE OFIRSTEXPT<)
(:REWRITE OPM)
(:REWRITE OPO*)
(:REWRITE OPO^)
(:REWRITE OMEGAOP)
(:REWRITE O^OMEGAOFIRSTEXPT)
(:REWRITE a+0 = a)
(:REWRITE ~(a=0) & b>1 <=> a < ab)
(:TYPEPRESCRIPTION OMEGA))
Warnings: None
Time: 0.21 seconds (prove: 0.04, print: 0.15, proof tree: 0.02, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm lemma1
(implies (p x)
(not (equal 0 (m x))))
:hints (("Goal" :intheory (disable dngoesdown)
:use dngoesdown)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL 0 (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M and ~(a<0).
Q.E.D.
Summary
Form: ( DEFTHM LEMMA1 ...)
Rules: ((:DEFINITION NOT)
(:REWRITE OPM)
(:REWRITE ~(a<0)))
Warnings: None
Time: 0.05 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02)
LEMMA1
ACL2 !>(defun f4 (x y q)
(declare (xargs :measure (if (p x)
(if q
(o^ (omega) (m x))
(if (p y)
(o* (o^ (omega) (m y)) 2)
1))
0)))
(if (p x)
(if q
(f4 y (dn x) (not q))
(f4 y (up x) (not q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))).
<< Starting proof tree logging >>
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M, OPO^ and OMEGAOP.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterpart
of OP and the :rewrite rules OPM, OPO*, OPO^ and OMEGAOP.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (O^ (OMEGA) (M Y))
(O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterparts
of EQUAL, NOT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), OPM, OPO^, OMEGAOP and
~(a=0) & b>1 <=> a < ab and the :typeprescription rule OMEGA.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules 0 <
w^a and OPM.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (O* (O^ (OMEGA) (M (DN X))) 2)
(O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :executablecounterparts
of OFIRSTEXPT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), DNGOESDOWN, O*OFIRSTEXPT,
OFIRSTEXPT<, OPM, OPO*, OPO^, OMEGAOP, O^OMEGAOFIRST
EXPT and a+0 = a and the :typeprescription rule OMEGA.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :compoundrecognizer
rule OFINPCR, primitive type reasoning, the :rewrite rules AC<,
LEMMA1, OINFPO^1, OPM and OMEGAOP and the :typeprescription
rule OMEGA.
Q.E.D.
That completes the proof of the measure theorem for F4. Thus, we admit
this function under the principle of definition.We observe that the
type of F4 is described by the theorem
(AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))).
Summary
Form: ( DEFUN F4 ...)
Rules: ((:COMPOUNDRECOGNIZER OFINPCR)
(:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE (a = 0) & ~(b = 0) <=> (a^b = 0))
(:REWRITE 0 < w^a)
(:REWRITE AC<)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE O*OFIRSTEXPT)
(:REWRITE OFIRSTEXPT<)
(:REWRITE OINFPO^1)
(:REWRITE OPM)
(:REWRITE OPO*)
(:REWRITE OPO^)
(:REWRITE OMEGAOP)
(:REWRITE O^OMEGAOFIRSTEXPT)
(:REWRITE a+0 = a)
(:REWRITE ~(a=0) & b>1 <=> a < ab)
(:TYPEPRESCRIPTION OMEGA))
Warnings: None
Time: 0.15 seconds (prove: 0.06, print: 0.07, proof tree: 0.01, other: 0.01)
F4
ACL2 !>:u
3:x(DEFTHM LEMMA1 ...)
3
3
ACL2 !>:pbt 1
1 (ENCAPSULATE ((P ...) (M ...) (UP ...) (DN ...))
...)
d 2 (INCLUDEBOOK "ordinals/ordinals"
:DIR ...)
3:x(DEFTHM LEMMA1 ...)
ACL2 !>:ubt! 1
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(certifybook "101ordinals")
CERTIFICATION ATTEMPT FOR
"/Users/kaufmann/class/march2007/101ordinals.lisp"
ACL2 Version 3.1
* Step 1: Read "/Users/kaufmann/class/march2007/101ordinals.lisp"
and compute its check sum.
* Step 2: There were five forms in the file. We now attempt to establish
that each form, whether local or nonlocal, is indeed an admissible
embedded event form in the context of the previously admitted ones.
Note that prooftree output is inhibited during this check; see :DOC
prooftree.
ACL2 >>(ENCAPSULATE ((P (X) T)
(M (X) T)
(UP (X) T)
(DN (X) T))
(LOCAL (DEFUN P (X) (POSP X)))
(LOCAL (DEFUN M (X) (NFIX X)))
(DEFTHM OPM (OP (M X)))
(LOCAL (DEFUN DN (X) (1 X)))
(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
(LOCAL (DEFUN UP (X) (1+ X))))
To verify that the six encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 >>(LOCAL (DEFUN P (X) (POSP X)))
Since P is nonrecursive, its admission is trivial. We observe that
the type of P is described by the theorem
(OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compoundrecognizer
rule POSPCOMPOUNDRECOGNIZER.
Summary
Form: ( DEFUN P ...)
Rules: ((:COMPOUNDRECOGNIZER POSPCOMPOUNDRECOGNIZER))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
P
ACL2 >>(LOCAL (DEFUN M (X) (NFIX X)))
Since M is nonrecursive, its admission is trivial. We observe that
the type of M is described by the theorem
(AND (INTEGERP (M X)) (<= 0 (M X))). We used the :typeprescription
rule NFIX.
Summary
Form: ( DEFUN M ...)
Rules: ((:TYPEPRESCRIPTION NFIX))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
M
ACL2 >>(DEFTHM OPM (OP (M X)))
ACL2 Warning [Nonrec] in ( DEFTHM OPM ...): A :REWRITE rule generated
from OPM will be triggered only by terms containing the nonrecursive
function symbol M. Unless this function is disabled, this rule is
unlikely ever to be used.
By the simple :definition M we reduce the conjecture to
Goal'
(OP (NFIX X)).
But simplification reduces this to T, using the :compoundrecognizer
rule NATPCOMPOUNDRECOGNIZER and the :definitions NFIX, OFINP and
OP.
Q.E.D.
The storage of OPM depends upon the :typeprescription rule OP.
Summary
Form: ( DEFTHM OPM ...)
Rules: ((:COMPOUNDRECOGNIZER NATPCOMPOUNDRECOGNIZER)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION OP)
(:TYPEPRESCRIPTION OP))
Warnings: Nonrec
Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
OPM
ACL2 >>(LOCAL (DEFUN DN (X) (1 X)))
Since DN is nonrecursive, its admission is trivial. We observe that
the type of DN is described by the theorem (ACL2NUMBERP (DN X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN DN ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
DN
ACL2 >>(DEFTHM DNGOESDOWN
(IMPLIES (P X) (O< (M (DN X)) (M X))))
ACL2 Warning [Nonrec] in ( DEFTHM DNGOESDOWN ...): A :REWRITE rule
generated from DNGOESDOWN will be triggered only by terms containing
the nonrecursive function symbols DN and M. Unless these functions
are disabled, this rule is unlikely ever to be used.
By the simple :definitions DN, M, P and POSP we reduce the conjecture
to
Goal'
(IMPLIES (AND (INTEGERP X) (< 0 X))
(O< (NFIX (+ 1 X)) (NFIX X))).
This simplifies, using the :definitions NFIX, OFINP and O< and primitive
type reasoning, to
Goal''
(IMPLIES (AND (INTEGERP X) (< 0 X))
(< (+ 1 X) X)).
But simplification reduces this to T, using linear arithmetic and primitive
type reasoning.
Q.E.D.
The storage of DNGOESDOWN depends upon the :typeprescription rule
O<.
Summary
Form: ( DEFTHM DNGOESDOWN ...)
Rules: ((:DEFINITION DN)
(:DEFINITION M)
(:DEFINITION NFIX)
(:DEFINITION OFINP)
(:DEFINITION O<)
(:DEFINITION P)
(:DEFINITION POSP)
(:FAKERUNEFORLINEAR NIL)
(:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION O<))
Warnings: Nonrec
Time: 0.09 seconds (prove: 0.00, print: 0.00, other: 0.09)
DNGOESDOWN
ACL2 >>(LOCAL (DEFUN UP (X) (1+ X)))
Since UP is nonrecursive, its admission is trivial. We observe that
the type of UP is described by the theorem (ACL2NUMBERP (UP X)).
We used primitive type reasoning.
Summary
Form: ( DEFUN UP ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
UP
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
The following constraint is associated with every one of the functions
P, M, UP and DN:
(AND (OP (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X))))
Summary
Form: ( ENCAPSULATE ((P ...) ...) ...)
Rules: NIL
Warnings: Nonrec
Time: 0.13 seconds (prove: 0.00, print: 0.02, other: 0.11)
T
ACL2 >>(INCLUDEBOOK "ordinals/ordinals"
:DIR :SYSTEM)
Summary
Form: ( INCLUDEBOOK "ordinals/ordinals" ...)
Rules: NIL
Warnings: None
Time: 1.49 seconds (prove: 0.00, print: 0.00, other: 1.49)
"/Users/kaufmann/acl2/v31/books/ordinals/ordinals.lisp"
ACL2 >>(DEFTHM LEMMA1
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))
:HINTS (("Goal" :INTHEORY (DISABLE DNGOESDOWN)
:USE DNGOESDOWN)))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
We augment the goal with the hypothesis provided by the :USE hint.
The hypothesis can be obtained from DNGOESDOWN. We are left with
the following subgoal.
Goal'
(IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X)))
(IMPLIES (P X) (NOT (EQUAL 0 (M X))))).
By case analysis we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X)))
(P X))
(NOT (EQUAL 0 (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M and ~(a<0).
Q.E.D.
Summary
Form: ( DEFTHM LEMMA1 ...)
Rules: ((:DEFINITION NOT)
(:REWRITE OPM)
(:REWRITE ~(a<0)))
Warnings: None
Time: 0.02 seconds (prove: 0.01, print: 0.00, other: 0.01)
LEMMA1
ACL2 >>(DEFUN
F4 (X Y Q)
(DECLARE
(XARGS :MEASURE (IF (P X)
(IF Q (O^ (OMEGA) (M X))
(IF (P Y) (O* (O^ (OMEGA) (M Y)) 2) 1))
0)))
(IF (P X)
(IF Q (F4 Y (DN X) (NOT Q))
(F4 Y (UP X) (NOT Q)))
4))
For the admission of F4 we will use the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0).
The nontrivial part of the measure conjecture is
Goal
(AND (OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)))).
By case analysis we reduce the conjecture to the following three conjectures.
Subgoal 3
(OP (IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0)).
This simplifies, using trivial observations, to the following four
conjectures.
Subgoal 3.4
(IMPLIES (NOT (P X)) (OP 0)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.3
(IMPLIES (AND (P X) Q)
(OP (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules OP
M, OPO^ and OMEGAOP.
Subgoal 3.2
(IMPLIES (AND (P X) (NOT Q) (NOT (P Y)))
(OP 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
OP.
Subgoal 3.1
(IMPLIES (AND (P X) (NOT Q) (P Y))
(OP (O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterpart
of OP and the :rewrite rules OPM, OPO*, OPO^ and OMEGAOP.
Subgoal 2
(IMPLIES (AND (P X) (NOT Q))
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (UP X))
(O* (O^ (OMEGA) (M (UP X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :executablecounterpart of NOT, to the following
two conjectures.
Subgoal 2.2
(IMPLIES (AND (P X) (P Y))
(O< (O^ (OMEGA) (M Y))
(O* (O^ (OMEGA) (M Y)) 2))).
But simplification reduces this to T, using the :executablecounterparts
of EQUAL, NOT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), OPM, OPO^, OMEGAOP and
~(a=0) & b>1 <=> a < ab and the :typeprescription rule OMEGA.
Subgoal 2.1
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 1)).
But we reduce the conjecture to T, by the :executablecounterpart of
O<.
Subgoal 1
(IMPLIES (AND (P X) Q)
(O< (IF (P Y)
(COND ((NOT Q) (O^ (OMEGA) (M Y)))
((P (DN X))
(O* (O^ (OMEGA) (M (DN X))) 2))
(T 1))
0)
(IF (P X)
(COND (Q (O^ (OMEGA) (M X)))
((P Y) (O* (O^ (OMEGA) (M Y)) 2))
(T 1))
0))).
This simplifies, using the :congruence rule IFFIMPLIESEQUALNOT and
the :executablecounterpart of NOT, to the following three conjectures.
Subgoal 1.3
(IMPLIES (AND (P X) (NOT (P Y)))
(O< 0 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :rewrite rules 0 <
w^a and OPM.
Subgoal 1.2
(IMPLIES (AND (P X) (P Y) (P (DN X)))
(O< (O* (O^ (OMEGA) (M (DN X))) 2)
(O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :executablecounterparts
of OFIRSTEXPT and OP, primitive type reasoning, the :rewrite rules
(a = 0) & ~(b = 0) <=> (a^b = 0), DNGOESDOWN, O*OFIRSTEXPT,
OFIRSTEXPT<, OPM, OPO*, OPO^, OMEGAOP, O^OMEGAOFIRST
EXPT and a+0 = a and the :typeprescription rule OMEGA.
Subgoal 1.1
(IMPLIES (AND (P X) (P Y) (NOT (P (DN X))))
(O< 1 (O^ (OMEGA) (M X)))).
But simplification reduces this to T, using the :compoundrecognizer
rule OFINPCR, primitive type reasoning, the :rewrite rules AC<,
LEMMA1, OINFPO^1, OPM and OMEGAOP and the :typeprescription
rule OMEGA.
Q.E.D.
That completes the proof of the measure theorem for F4. Thus, we admit
this function under the principle of definition.We observe that the
type of F4 is described by the theorem
(AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))).
Summary
Form: ( DEFUN F4 ...)
Rules: ((:COMPOUNDRECOGNIZER OFINPCR)
(:CONGRUENCE IFFIMPLIESEQUALNOT)
(:DEFINITION NOT)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART NOT)
(:EXECUTABLECOUNTERPART OFIRSTEXPT)
(:EXECUTABLECOUNTERPART OP)
(:EXECUTABLECOUNTERPART O<)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE (a = 0) & ~(b = 0) <=> (a^b = 0))
(:REWRITE 0 < w^a)
(:REWRITE AC<)
(:REWRITE DNGOESDOWN)
(:REWRITE LEMMA1)
(:REWRITE O*OFIRSTEXPT)
(:REWRITE OFIRSTEXPT<)
(:REWRITE OINFPO^1)
(:REWRITE OPM)
(:REWRITE OPO*)
(:REWRITE OPO^)
(:REWRITE OMEGAOP)
(:REWRITE O^OMEGAOFIRSTEXPT)
(:REWRITE a+0 = a)
(:REWRITE ~(a=0) & b>1 <=> a < ab)
(:TYPEPRESCRIPTION OMEGA))
Warnings: None
Time: 0.09 seconds (prove: 0.04, print: 0.05, other: 0.01)
F4
* Step 3: That completes the admissibility check. Each form read
was an embedded event form and was admissible. We now retract back
to the initial world and try to include the book. This may expose
local incompatibilities.
Summary
Form: ( INCLUDEBOOK "101ordinals" ...)
Rules: NIL
Warnings: None
Time: 1.50 seconds (prove: 0.00, print: 0.00, other: 1.50)
ACL2 Warning [Guards] in (CERTIFYBOOK "101ordinals" ...): The book
"/Users/kaufmann/class/march2007/101ordinals.lisp" defines the function
F4, which has not had its guards verified. Moreover, this book's included
subbooks define function OMEGA, which has not had its guards verified.
See :DOC guards.
* Step 4: Write the certificate for
"/Users/kaufmann/class/march2007/101ordinals.lisp" in
"/Users/kaufmann/class/march2007/101ordinals.cert". The final check
sum alist is
(("/Users/kaufmann/class/march2007/101ordinals.lisp"
"101ordinals" "101ordinals"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 259302823)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinals.lisp"
"ordinals/ordinals" "ordinals"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 238631597)
("/Users/kaufmann/acl2/v31/books/ordinals/limits.lisp"
"limits" "limits"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 66388984)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinalexponentiation.lisp"
"ordinalexponentiation"
"ordinalexponentiation"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 3368885)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinalmultiplication.lisp"
"ordinalmultiplication"
"ordinalmultiplication"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 65294701)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinaladdition.lisp"
"ordinaladdition" "ordinaladdition"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 42533600)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinalbasicthms.lisp"
"ordinalbasicthms"
"ordinalbasicthms"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 193499191)
(LOCAL ("/Users/kaufmann/acl2/v31/books/ordinals/topwithmeta.lisp"
"topwithmeta" "topwithmeta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 142395086))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/topwithmeta.lisp"
"../arithmetic/topwithmeta"
"topwithmeta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 175638983))
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/meta.lisp"
"../meta/meta" "meta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 146179060))
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/metatimesequal.lisp"
"metatimesequal" "metatimesequal"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 69450866))
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/metapluslessp.lisp"
"metapluslessp" "metapluslessp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 113270299))
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/metaplusequal.lisp"
"metaplusequal" "metaplusequal"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 220828626))
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/termdefuns.lisp"
"termdefuns" "termdefuns"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 99009733))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/top.lisp"
"top" "top"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 51353441))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/rationals.lisp"
"rationals" "rationals"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 192778911))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/natpposp.lisp"
"natpposp" "natpposp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 77763855))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/rationallistp.lisp"
"rationallistp" "rationallistp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 64148425))
("/Users/kaufmann/acl2/v31/books/ordinals/ordinaltotalorder.lisp"
"ordinaltotalorder"
"ordinaltotalorder"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 134357633)
("/Users/kaufmann/acl2/v31/books/ordinals/ordinaldefinitions.lisp"
"ordinaldefinitions"
"ordinaldefinitions"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 21541141)
("/Users/kaufmann/acl2/v31/books/ordinals/topwithmeta.lisp"
"topwithmeta" "topwithmeta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 142395086)
("/Users/kaufmann/acl2/v31/books/arithmetic/topwithmeta.lisp"
"../arithmetic/topwithmeta"
"topwithmeta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 175638983)
("/Users/kaufmann/acl2/v31/books/meta/meta.lisp"
"../meta/meta" "meta"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 146179060)
("/Users/kaufmann/acl2/v31/books/meta/metatimesequal.lisp"
"metatimesequal" "metatimesequal"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 69450866)
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/equalities.lisp"
"../arithmetic/equalities" "equalities"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 103475026))
("/Users/kaufmann/acl2/v31/books/meta/metapluslessp.lisp"
"metapluslessp" "metapluslessp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 113270299)
("/Users/kaufmann/acl2/v31/books/meta/metaplusequal.lisp"
"metaplusequal" "metaplusequal"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 220828626)
(LOCAL ("/Users/kaufmann/acl2/v31/books/meta/termlemmas.lisp"
"termlemmas" "termlemmas"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 185835692))
("/Users/kaufmann/acl2/v31/books/meta/termdefuns.lisp"
"termdefuns" "termdefuns"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 99009733)
("/Users/kaufmann/acl2/v31/books/arithmetic/top.lisp"
"top" "top"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 51353441)
("/Users/kaufmann/acl2/v31/books/arithmetic/rationals.lisp"
"rationals" "rationals"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 192778911)
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/modgcd.lisp"
"modgcd" "modgcd"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 49344105))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/inequalities.lisp"
"inequalities" "inequalities"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 130234613))
(LOCAL ("/Users/kaufmann/acl2/v31/books/arithmetic/equalities.lisp"
"equalities" "equalities"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 103475026))
(LOCAL ("/Users/kaufmann/acl2/v31/books/cowles/acl2crg.lisp"
"../cowles/acl2crg" "acl2crg"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 260688904))
(LOCAL ("/Users/kaufmann/acl2/v31/books/cowles/acl2agp.lisp"
"acl2agp" "acl2agp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 106260818))
(LOCAL ("/Users/kaufmann/acl2/v31/books/cowles/acl2asg.lisp"
"acl2asg" "acl2asg"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 44566077))
("/Users/kaufmann/acl2/v31/books/arithmetic/natpposp.lisp"
"natpposp" "natpposp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 77763855)
("/Users/kaufmann/acl2/v31/books/arithmetic/inequalities.lisp"
"inequalities" "inequalities"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 130234613)
("/Users/kaufmann/acl2/v31/books/arithmetic/rationallistp.lisp"
"rationallistp" "rationallistp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 64148425)
("/Users/kaufmann/acl2/v31/books/arithmetic/equalities.lisp"
"equalities" "equalities"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 103475026)
("/Users/kaufmann/acl2/v31/books/cowles/acl2crg.lisp"
"../cowles/acl2crg" "acl2crg"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 260688904)
("/Users/kaufmann/acl2/v31/books/cowles/acl2agp.lisp"
"acl2agp" "acl2agp"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 106260818)
("/Users/kaufmann/acl2/v31/books/cowles/acl2asg.lisp"
"acl2asg" "acl2asg"
((:SKIPPEDPROOFSP) (:AXIOMSP) (:TTAGS))
. 44566077)).
* Step 5: Compile the functions defined in
"/Users/kaufmann/class/march2007/101ordinals.lisp".
"/Users/kaufmann/class/march2007/101ordinals.dfsl"
Summary
Form: (CERTIFYBOOK "101ordinals" ...)
Rules: NIL
Warnings: Guards and Nonrec
Time: 3.38 seconds (prove: 0.04, print: 0.07, proof tree: 0.00, other: 3.26)
"/Users/kaufmann/class/march2007/101ordinals.lisp"
ACL2 !>:doc books
 BOOKS files of ACL2 event forms

 This documentation topic is about ACL2 input files. However, there are two
 traditional (paper) books published about ACL2: a textbook and a case
 studies book. Further information is available by following links from the
 ACL2 home page, http://www.cs.utexas.edu/users/moore/acl2/. Now, on to
 the real content of this topic:

 A ``book'' is a file of ACL2 events that have been certified as
 admissible. Using includebook you can construct a new logical
 world by assuming the events in any number of mutually compatible
 books. Relevant documented topics are listed below. Following this list
 is a ``guided tour'' through the topics.
 You may start guided tour by typing :more.
 BOOKCONTENTS
 restrictions on the forms inside books
 BOOKEXAMPLE
 how to create, certify, and use a simple book
 BOOKMAKEFILES
 makefile support provided with the ACL2 distribution
 BOOKNAME conventions associated with book names
 CBD connected book directory string
 CERTIFICATE how a book is known to be admissible and where its defpkgs reside
 CERTIFYBOOK
 how to produce a certificate for a book
 FULLBOOKNAME
 book naming conventions assumed by ACL2
 INCLUDEBOOK
 load the events in a file
 KEEP how we know if includebook read the correct files
 MAKEFILES See :DOC BOOKMAKEFILES.
 PATHNAME introduction to filename conventions in ACL2
 PORTCULLIS the gate guarding the entrance to a certified book
 SETCBD to set the connected book directory
 UNCERTIFIEDBOOKS
 invalid certificates and uncertified books
(type :more for more, :more! for the rest)
ACL2 !>:more!
 Introduction.

 A ``book'' is a file of ACL2 forms. Books are prepared entirely by
 the user of the system, i.e., they are ``source'' files not
 ``object'' files. Some of the forms in a book are marked local
 and the others are considered ``nonlocal.''

 Includebook lets you load a book into any ACL2 world. If
 completed without error, the inclusion of a book extends the logic
 of the host world by the addition of just the nonlocal events in
 the book. You may extend the world by successively including a
 variety of books to obtain the desired collection of definitions and
 rules. Unless name conflicts occur (which are detected and
 signalled) inclusion of a book is consistency preserving provided
 the book itself is consistent as discussed later. However,
 includebook merely assumes the validity of the events in a book;
 if you include a book that contains an inconsistency (e.g., an
 inadmissible definition) then the resulting theory is inconsistent.

 It is possible to ``certify'' a book, with certifybook,
 guaranteeing that the errorfree inclusion of the certified forms
 will produce a consistent extension of a consistent logic.
 Certification processes both the local and nonlocal forms, so
 you can mark as local those events you need for certification
 that you want to hide from users of the book (e.g., hacks, crocks,
 and kludges on the way to a good set of :rewrite rules).
 Certification can also ``compile'' a book, thereby speeding up the
 execution of the functions defined within it. The desire to compile
 books is largely responsible for the restrictions we put on the
 forms allowed in books.

 Extensive documentation is available on the various aspects of
 books. We recommend that you read it all before using books. It
 has been written so as to make sense when read in a certain linear
 sequence, called the ``guided tour'', though in general you may
 browse through it randomly. If you are on the guided tour, you
 should next read the documentation on bookexample
 (see :DOC BOOKEXAMPLE and use :more to read through it).
*
ACL2 !>:program
ACL2 p!>(defun fact (n)
(if (equal n 0)
1
(* n (fact ( n 1)))))
Summary
Form: ( DEFUN FACT ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.01)
FACT
ACL2 p!>(fact 8)
40320
ACL2 p!>(trace$ fact)
NIL
ACL2 p!>(fact 8)
1> (ACL2_*1*_ACL2::FACT 8)
2> (FACT 8)
<2 (FACT 40320)
<1 (ACL2_*1*_ACL2::FACT 40320)
40320
ACL2 p!>(untrace$)
NIL
ACL2 p!>(fact 1)
> Error in process listener(3): Stack overflow on control stack.
> While executing: FACT
> Type :GO to continue, :POP to abort.
> If continued: Skip evaluation of (acl2::acl2defaultrestart)
Type :? for other options.
1 > [RAW LISP] :popo
:POPO
1 > [RAW LISP] :pop
ACL2 p!>:logic
ACL2 !>(thm (equal (fact n) 0))
ACL2 Error in ( THM ...): Function symbols of mode :program are not
allowed in the present context. Yet, the function symbol FACT occurs
in the translation of the form
(EQUAL (FACT N) 0),
which is
(EQUAL (FACT N) '0).
Summary
Form: ( THM ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defun foo (x) t)
ACL2 Error in ( DEFUN FOO ...): The formal variable X is not used
in the definition of FOO but is not DECLAREd IGNOREd or IGNORABLE.
Any formal variable not used in the body of a definition must be so
declared. To remove this requirement, see :DOC setignoreok.
Summary
Form: ( DEFUN FOO ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.01)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defun foo (x) (declare (ignore x)) t)
Since FOO is nonrecursive, its admission is trivial. We observe that
the type of FOO is described by the theorem (FOO X).
Summary
Form: ( DEFUN FOO ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
FOO
ACL2 !>(foo 3)
T
ACL2 !>:u
4:x(LOGIC)
ACL2 !>(setignoreok t)
T
ACL2 !>(defun foo (x) t)
ACL2 Error in ( DEFUN FOO ...): The first formal of FOO, X, is irrelevant.
See :DOC irrelevantformals.
Summary
Form: ( DEFUN FOO ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(setirrelevantformalsok t)
T
ACL2 !>(defun foo (x) t)
Since FOO is nonrecursive, its admission is trivial. We observe that
the type of FOO is described by the theorem (FOO X).
Summary
Form: ( DEFUN FOO ...)
Rules: NIL
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
FOO
ACL2 !>:ubt! 1
0:x(EXITBOOTSTRAPMODE)
ACL2 !>(rebuild "101.lisp" t)
ACL2 loading "101.lisp".
"ACL2"
ACL2 Warning [Nonrec] in ( DEFTHM OPM ...): A :REWRITE rule generated
from OPM will be triggered only by terms containing the nonrecursive
function symbol M. Unless this function is disabled, this rule is
unlikely ever to be used.
ACL2 Warning [Nonrec] in ( DEFTHM DNGOESDOWN ...): A :REWRITE rule
generated from DNGOESDOWN will be triggered only by terms containing
the nonrecursive function symbols DN and M. Unless these functions
are disabled, this rule is unlikely ever to be used.
T
LEMMA11
LEMMA1
LEMMA2
LEMMA31
LEMMA3
F4
Finished loading "101.lisp".
T
ACL2 !>:ubt! lemma2
3:x(DEFTHM LEMMA1 ...)
ACL2 !>(defthm lemma2
(implies (and (p x) (not (consp (m x))))
(< 0 (m x)))
:hints (("Goal" :use (lemma1 opm)
;; :intheory (disable lemma1 opm)
)))
<< Starting proof tree logging >>
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
ACL2 Warning [Use] in ( DEFTHM LEMMA2 ...): It is unusual to :USE
an enabled :REWRITE or :DEFINITION rule, so you may want to consider
disabling (:REWRITE LEMMA1) and (:REWRITE OPM).
We augment the goal with the hypotheses provided by the :USE hint.
These hypotheses can be obtained from LEMMA1 and OPM. We are left
with the following subgoal.
Goal'
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(OP (M X)))
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X)))).
By the simple :rewrite rule OPM we reduce the conjecture to
Goal''
(IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X))))
(P X)
(NOT (CONSP (M X))))
(< 0 (M X))).
This simplifies, using the :executablecounterpart of NOT and the :rewrite
rule LEMMA1, to
Goal'''
(IMPLIES (AND (P X) (NOT (CONSP (M X))))
(< 0 (M X))).
Normally we would attempt to prove this formula by induction. However,
we prefer in this instance to focus on the original input conjecture
rather than this simplified special case. We therefore abandon our
previous work on this conjecture and reassign the name *1 to the original
conjecture. (See :DOC otfflg.)
No induction schemes are suggested by *1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM LEMMA2 ...)
Rules: ((:DEFINITION NOT)
(:EXECUTABLECOUNTERPART NOT)
(:REWRITE LEMMA1)
(:REWRITE OPM))
Warnings: Use
Time: 0.04 seconds (prove: 0.01, print: 0.02, proof tree: 0.01, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>:q
Exiting the ACL2 readevalprint loop. To reenter, execute (LP).
? [RAW LISP] (goodbye)
wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>(defun rev (x)
(if (endp x)
nil
(append (rev (cdr x))
(list (car x)))))
The admission of REV is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV is described by the
theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive
type reasoning and the :typeprescription rule BINARYAPPEND.
Summary
Form: ( DEFUN REV ...)
Rules: ((:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION BINARYAPPEND))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02)
REV
ACL2 !>(defun rev3 (x)
(cond
((endp x)
nil)
((endp (cdr x))
(list (car x))) ; or x, but then (rev3 x) may not equal (rev x) [see below]
(t
; Think of x as a@b@c where a and c are single elements. Let* sequentially
; binds variables. For example, we assign
; b@c to (cdr x),
; c@revb to to the concatenation of c with the reverse of b,
; and so on.
(let* ((b@c (cdr x))
(c@revb (rev3 b@c)) ; note recursive call of rev3
(revb (cdr c@revb))
(b (rev revb)) ; note call of rev rather than recursive call
(a (car x))
(a@b (cons a b))
(revb@a (rev a@b)) ; note call of rev rather than recursive call
(c (car c@revb))
(c@revb@a (cons c revb@a)))
c@revb@a))))
The admission of REV3 is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV3 is described by the
theorem (OR (CONSP (REV3 X)) (EQUAL (REV3 X) NIL)). We used primitive
type reasoning.
Summary
Form: ( DEFUN REV3 ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02)
REV3
ACL2 !>(defthm revisrev3 ; proof fails
(equal (rev x)
(rev3 x)))
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X). This suggestion
was produced using the :induction rules REV and REV3. If we let (:P X)
denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(:P (CDR X)))
(:P X))
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/3''
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, to the following
two conjectures.
Subgoal *1/3.2
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using primitive type reasoning and the :rewrite rule
CONSEQUAL, to
Subgoal *1/3.2'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.2''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'''
(IMPLIES (AND (CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We now use the second hypothesis by crossfertilizing (REV3 X2) for
(REV X2) and throwing away the hypothesis. This produces
Subgoal *1/3.2'4'
(IMPLIES (AND (CONSP X2) (CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We generalize this conjecture, replacing (REV X2) by L. This produces
Subgoal *1/3.2'5'
(IMPLIES (AND (CONSP X2) (CONSP L))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR L)))
(LIST X1)))).
The destructor terms (CAR L) and (CDR L) can be eliminated by using
CARCDRELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L)
by L2. This produces the following goal.
Subgoal *1/3.2'6'
(IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'7'
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.
Subgoal *1/3.1
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(NOT (CONSP (REV (CDR X)))))
(EQUAL (LIST (CAR X))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, the :executable
counterparts of CAR, CDR, CONSP and REV, primitive type reasoning,
the :rewrite rule CDRCONS and the :typeprescription rule REV, to
Subgoal *1/3.1'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(NOT (REV3 (CDR X))))
(CONSP (REV (CDR X)))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.1'''
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Name the formula above *1.2.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(LIST (CAR X)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterpart of CONSP and primitive
type reasoning.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV X) (REV3 X))).
But simplification reduces this to T, using the :definitions REV and
REV3 and the :executablecounterpart of EQUAL.
So we now return to *1.2, which is
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Perhaps we can prove *1.2 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rules REV and REV3. If
we let (:P X2) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P (CDR X2)))
(:P X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P X2))
(IMPLIES (ENDP X2) (:P X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following five nontautological subgoals.
Subgoal *1.2/5
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(CONSP (REV (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/5'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(CONSP (REV (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(REV3 (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(REV3 (CDR X2))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.2/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/2'
(IMPLIES (AND (CONSP X2)
(NOT (CONSP (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definition REV3 and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (ENDP X2)
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. We will choose arbitrarily among these.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rule REV3. If we let
(:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P L2 X1 (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (ENDP X2) (:P L2 X1 X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following four nontautological subgoals.
Subgoal *1.1/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1.1/4''
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 (CDR X2)))))
(LIST (CAR X2)))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2)
by X4. This produces the following goal.
Subgoal *1.1/4'''
(IMPLIES (AND (CONSP (CONS X3 X4))
(CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1/4'4'
(IMPLIES (AND (CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (CDR (REV3 X4)) (LIST X1)))).
We now use the second hypothesis by substituting
(APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1))
and throwing away the hypothesis. This produces
Subgoal *1.1/4'5'
(IMPLIES (CONSP X4)
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.1.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/2'
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV3, the
:executablecounterpart of CONSP and the :rewrite rule CDRCONS, to
Subgoal *1.1/2''
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2)
by X4. This produces the following goal.
Subgoal *1.1/2'''
(IMPLIES (AND (CONSP (CONS X3 X4))
(NOT (CONSP X4)))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1/2'4'
(IMPLIES (NOT (CONSP X4))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
We suspect that the term (NOT (CONSP X4)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1.1/2'5'
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1))).
Name the formula above *1.1.2.
Subgoal *1.1/1
(IMPLIES (AND (ENDP X2) (CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
But we reduce the conjecture to T, by case analysis.
So we now return to *1.1.2, which is
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1))).
Perhaps we can prove *1.1.2 by induction. One induction scheme is
suggested by this conjecture.
We will induct according to a scheme suggested by (REV L2). This suggestion
was produced using the :induction rule REV. If we let (:P L2 X1)
denote *1.1.2 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1))
(:P L2 X1))
(IMPLIES (ENDP L2) (:P L2 X1))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1.2/2
(IMPLIES (AND (NOT (ENDP L2))
(EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2/2'
(IMPLIES (AND (CONSP L2)
(EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definition REV, to
Subgoal *1.1.2/2''
(IMPLIES (AND (CONSP L2)
(EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND (REV (CDR L2)) (LIST (CAR L2))))
(LIST X1)))).
The destructor terms (CAR L2) and (CDR L2) can be eliminated by using
CARCDRELIM to replace L2 by (CONS L3 L4), (CAR L2) by L3 and (CDR L2)
by L4. This produces the following goal.
Subgoal *1.1.2/2'''
(IMPLIES (AND (CONSP (CONS L3 L4))
(EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND (REV L4) (LIST L3)))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1.2/2'4'
(IMPLIES (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1)))
(EQUAL (LIST X1)
(APPEND (REV (APPEND (REV L4) (LIST L3)))
(LIST X1)))).
We generalize this conjecture, replacing (REV L4) by RV. This produces
Subgoal *1.1.2/2'5'
(IMPLIES (EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1)))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
Name the formula above *1.1.2.1.
Subgoal *1.1.2/1
(IMPLIES (ENDP L2)
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2/1'
(IMPLIES (NOT (CONSP L2))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterparts of CONSP and REV and primitive
type reasoning.
So we now return to *1.1.2.1, which is
(IMPLIES (EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1)))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
Perhaps we can prove *1.1.2.1 by induction. Two induction schemes
are suggested by this conjecture. Subsumption reduces that number
to one.
We will induct according to a scheme suggested by
(BINARYAPPEND RV (CONS L3 'NIL)). This suggestion was produced using
the :induction rules BINARYAPPEND and REV. If we let (:P L3 RV X1)
denote *1.1.2.1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP RV))
(:P L3 (CDR RV) X1))
(:P L3 RV X1))
(IMPLIES (ENDP RV) (:P L3 RV X1))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following three nontautological subgoals.
Subgoal *1.1.2.1/3
(IMPLIES (AND (NOT (ENDP RV))
(EQUAL (LIST X1)
(APPEND (REV (APPEND (CDR RV) (LIST L3)))
(LIST X1)))
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2.1/3'
(IMPLIES (AND (CONSP RV)
(EQUAL (LIST X1)
(APPEND (REV (APPEND (CDR RV) (LIST L3)))
(LIST X1)))
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1.1.2.1/3''
(IMPLIES (AND (CONSP RV)
(EQUAL (LIST X1)
(APPEND (REV (APPEND (CDR RV) (LIST L3)))
(LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (CDR RV)) (LIST (CAR RV)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND (CDR RV) (LIST L3)))
(LIST (CAR RV)))
(LIST X1)))).
The destructor terms (CAR RV) and (CDR RV) can be eliminated by using
CARCDRELIM to replace RV by (CONS RV1 RV2), (CAR RV) by RV1 and (CDR RV)
by RV2. This produces the following goal.
Subgoal *1.1.2.1/3'''
(IMPLIES (AND (CONSP (CONS RV1 RV2))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV2 (LIST L3)))
(LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND RV2 (LIST L3)))
(LIST RV1))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1.2.1/3'4'
(IMPLIES (AND (EQUAL (LIST X1)
(APPEND (REV (APPEND RV2 (LIST L3)))
(LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND RV2 (LIST L3)))
(LIST RV1))
(LIST X1)))).
We generalize this conjecture, replacing (APPEND RV2 (LIST L3)) by
L and restricting the type of the new variable L to be that of the
term it replaces, as established by primitive type reasoning and BINARY
APPEND. This produces
Subgoal *1.1.2.1/3'5'
(IMPLIES (AND (CONSP L)
(EQUAL (LIST X1)
(APPEND (REV L) (LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV L) (LIST RV1))
(LIST X1)))).
We generalize this conjecture, replacing (REV L) by RV. This produces
Subgoal *1.1.2.1/3'6'
(IMPLIES (AND (CONSP L)
(EQUAL (LIST X1) (APPEND RV (LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND RV (LIST RV1))
(LIST X1)))).
We suspect that the term (CONSP L) is irrelevant to the truth of this
conjecture and throw it out. We will thus try to prove
Subgoal *1.1.2.1/3'7'
(IMPLIES (AND (EQUAL (LIST X1) (APPEND RV (LIST X1)))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND RV (LIST RV1))
(LIST X1)))).
Name the formula above *1.1.2.1.1.
Subgoal *1.1.2.1/2
(IMPLIES (AND (NOT (ENDP RV))
(NOT (EQUAL (LIST X1)
(APPEND (REV (CDR RV)) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2.1/2'
(IMPLIES (AND (CONSP RV)
(NOT (EQUAL (LIST X1)
(APPEND (REV (CDR RV)) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1.1.2.1/2''
(IMPLIES (AND (CONSP RV)
(NOT (EQUAL (LIST X1)
(APPEND (REV (CDR RV)) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (CDR RV)) (LIST (CAR RV)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND (CDR RV) (LIST L3)))
(LIST (CAR RV)))
(LIST X1)))).
The destructor terms (CAR RV) and (CDR RV) can be eliminated by using
CARCDRELIM to replace RV by (CONS RV1 RV2), (CAR RV) by RV1 and (CDR RV)
by RV2. This produces the following goal.
Subgoal *1.1.2.1/2'''
(IMPLIES (AND (CONSP (CONS RV1 RV2))
(NOT (EQUAL (LIST X1)
(APPEND (REV RV2) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND RV2 (LIST L3)))
(LIST RV1))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1.2.1/2'4'
(IMPLIES (AND (NOT (EQUAL (LIST X1)
(APPEND (REV RV2) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV RV2) (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND RV2 (LIST L3)))
(LIST RV1))
(LIST X1)))).
We generalize this conjecture, replacing (REV RV2) by RV. This produces
Subgoal *1.1.2.1/2'5'
(IMPLIES (AND (NOT (EQUAL (LIST X1) (APPEND RV (LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND RV (LIST RV1))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (APPEND (REV (APPEND RV2 (LIST L3)))
(LIST RV1))
(LIST X1)))).
Name the formula above *1.1.2.1.2.
Subgoal *1.1.2.1/1
(IMPLIES (AND (ENDP RV)
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2.1/1'
(IMPLIES (AND (NOT (CONSP RV))
(EQUAL (LIST X1)
(APPEND (REV RV) (LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (APPEND RV (LIST L3)))
(LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV, the
:executablecounterparts of CONSP and REV, primitive type reasoning
and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1.1.2.1/1''
(CONSP RV).
We suspect that this conjecture is not a theorem. We might as well
be trying to prove
Subgoal *1.1.2.1/1'''
NIL.
Obviously, the proof attempt has failed.
Summary
Form: ( DEFTHM REVISREV3 ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION REV3)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CAR)
(:EXECUTABLECOUNTERPART CDR)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:INDUCTION REV3)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSEQUAL)
(:TYPEPRESCRIPTION BINARYAPPEND)
(:TYPEPRESCRIPTION REV))
Warnings: None
Time: 0.53 seconds (prove: 0.21, print: 0.32, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>Bye.
Quitting ACL2 and lisp; this may take a moment. For
faster response time, exit the ACL2 loop with :q
and then: type (GOODBYE) or (CCL:QUIT), then .
ACL2 !>ACL2 !>
wmob1011286289117:~/class/march2007 kaufmann$ acl2
Welcome to OpenMCL Version 1.0 (DarwinPPC32)!
ACL2 Version 3.1 built November 28, 2006 23:08:33.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>;; Ready to execute ACL2LOAD  hit when ready
(acl2::ld "/Users/kaufmann/class/march2007/tempemacsfile.lisp" :LDPREEVALPRINT acl2::t :lderroraction :return)
ACL2 Version 3.1. Level 2. Cbd "/Users/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>>(DEFUN REV (X)
(IF (ENDP X)
NIL
(APPEND (REV (CDR X)) (LIST (CAR X)))))
The admission of REV is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV is described by the
theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive
type reasoning and the :typeprescription rule BINARYAPPEND.
Summary
Form: ( DEFUN REV ...)
Rules: ((:FAKERUNEFORTYPESET NIL)
(:TYPEPRESCRIPTION BINARYAPPEND))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02)
REV
ACL2 !>>(DEFUN REV3 (X)
(COND ((ENDP X) NIL)
((ENDP (CDR X)) (LIST (CAR X)))
(T (LET* ((B@C (CDR X))
(C@REVB (REV3 B@C))
(REVB (CDR C@REVB))
(B (REV REVB))
(A (CAR X))
(A@B (CONS A B))
(REVB@A (REV A@B))
(C (CAR C@REVB))
(C@REVB@A (CONS C REVB@A)))
C@REVB@A))))
The admission of REV3 is trivial, using the relation O< (which is known
to be wellfounded on the domain recognized by OP) and the measure
(ACL2COUNT X). We observe that the type of REV3 is described by the
theorem (OR (CONSP (REV3 X)) (EQUAL (REV3 X) NIL)). We used primitive
type reasoning.
Summary
Form: ( DEFUN REV3 ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02)
REV3
ACL2 !>>Bye.
:EOF
ACL2 !>(defthm revisrev3 ; proof fails
(equal (rev x)
(rev3 x)))
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X). This suggestion
was produced using the :induction rules REV and REV3. If we let (:P X)
denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(:P (CDR X)))
(:P X))
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/3''
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, to the following
two conjectures.
Subgoal *1/3.2
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using primitive type reasoning and the :rewrite rule
CONSEQUAL, to
Subgoal *1/3.2'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.2''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'''
(IMPLIES (AND (CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We now use the second hypothesis by crossfertilizing (REV3 X2) for
(REV X2) and throwing away the hypothesis. This produces
Subgoal *1/3.2'4'
(IMPLIES (AND (CONSP X2) (CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We generalize this conjecture, replacing (REV X2) by L. This produces
Subgoal *1/3.2'5'
(IMPLIES (AND (CONSP X2) (CONSP L))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR L)))
(LIST X1)))).
The destructor terms (CAR L) and (CDR L) can be eliminated by using
CARCDRELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L)
by L2. This produces the following goal.
Subgoal *1/3.2'6'
(IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'7'
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.
Subgoal *1/3.1
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(NOT (CONSP (REV (CDR X)))))
(EQUAL (LIST (CAR X))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, the :executable
counterparts of CAR, CDR, CONSP and REV, primitive type reasoning,
the :rewrite rule CDRCONS and the :typeprescription rule REV, to
Subgoal *1/3.1'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(NOT (REV3 (CDR X))))
(CONSP (REV (CDR X)))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.1'''
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Name the formula above *1.2.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(LIST (CAR X)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterpart of CONSP and primitive
type reasoning.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV X) (REV3 X))).
But simplification reduces this to T, using the :definitions REV and
REV3 and the :executablecounterpart of EQUAL.
So we now return to *1.2, which is
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Perhaps we can prove *1.2 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rules REV and REV3. If
we let (:P X2) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P (CDR X2)))
(:P X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P X2))
(IMPLIES (ENDP X2) (:P X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following five nontautological subgoals.
Subgoal *1.2/5
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(CONSP (REV (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/5'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(CONSP (REV (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(REV3 (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(REV3 (CDR X2))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.2/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/2'
(IMPLIES (AND (CONSP X2)
(NOT (CONSP (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definition REV3 and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (ENDP X2)
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. We will choose arbitrarily among these.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rule REV3. If we let
(:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P L2 X1 (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (ENDP X2) (:P L2 X1 X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following four nontautological subgoals.
Subgoal *1.1/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1.1/4''
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 (CDR X2)))))
(LIST (CAR X2)))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2)
by X4. This produces the following goal.
Subgoal *1.1/4'''
(IMPLIES (AND (CONSP (CONS X3 X4))
(CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1/4'4'
(IMPLIES (AND (CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (CDR (REV3 X4)) (LIST X1)))).
We now use the second hypothesis by substituting
(APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1))
and throwing away the hypothesis. This produces
Subgoal *1.1/4'5'
(IMPLIES (CONSP X4)
(EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3))
(LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.1.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/2'
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
Cc Cc(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV3, the
:executablecounterpart of CONSP and the :rewrite rule CDRCONS, to
Subgoal *1.1/2''
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR
> Break in process listener(3):
> While executing: #
> Type :GO to continue, :POP to abort.
> If continued: Return from BREAK.
Type :? for other options.
1 > [RAW LISP] :pop
Here is the current pstack [see :DOC pstack]:
(WATERFALL)
ACL2 !>(defthm revrev ; fails > to do list: (revrev revisrev3)
(equal (rev (rev x))
x))
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
This simplifies, using the :definition REV, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X))))
X)).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (REV X2)) X2))
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (EQUAL (REV (REV X2)) X2)
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 X2))).
We now use the hypothesis by crossfertilizing (REV (REV X2)) for X2
and throwing away the hypothesis. This produces
Subgoal *1/2'5'
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 (REV (REV X2)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/2'6'
(EQUAL (REV (APPEND RV (LIST X1)))
(CONS X1 (REV RV))).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (REV X)) X)).
This simplifies, using the :definition REV, the :executablecounterpart
of REV and primitive type reasoning, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X)) (NOT X)).
Name the formula above *1.2.
No induction schemes are suggested by *1.2. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVREV ...)
Rules: ((:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV))
Warnings: None
Time: 0.06 seconds (prove: 0.02, print: 0.04, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>:startprooftree
Proof tree output is now enabled. Note that :STARTPROOFTREE works
by removing 'prooftree from the inhibitoutputlst; see :DOC set
inhibitoutputlst.
ACL2 !>(defthm revrev ; fails > to do list: (revrev revisrev3)
(equal (rev (rev x))
x))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
This simplifies, using the :definition REV, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X))))
X)).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (REV X2)) X2))
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (EQUAL (REV (REV X2)) X2)
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 X2))).
We now use the hypothesis by crossfertilizing (REV (REV X2)) for X2
and throwing away the hypothesis. This produces
Subgoal *1/2'5'
(EQUAL (REV (APPEND (REV X2) (LIST X1)))
(CONS X1 (REV (REV X2)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/2'6'
(EQUAL (REV (APPEND RV (LIST X1)))
(CONS X1 (REV RV))).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (REV X)) X)).
This simplifies, using the :definition REV, the :executablecounterpart
of REV and primitive type reasoning, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X)) (NOT X)).
Name the formula above *1.2.
No induction schemes are suggested by *1.2. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVREV ...)
Rules: ((:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV))
Warnings: None
Time: 0.10 seconds (prove: 0.02, print: 0.04, proof tree: 0.04, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm revappend ; fails > to do list: (revappend revrev revisrev3)
(equal (rev (append x y))
(append (rev y) (rev x))))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (BINARYAPPEND X Y).
This suggestion was produced using the :induction rules BINARYAPPEND
and REV. If we let (:P X Y) denote *1 above then the induction scheme
we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y))
(:P X Y))
(IMPLIES (ENDP X) (:P X Y))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
This simplifies, using the :definitions BINARYAPPEND and REV, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (APPEND (REV (APPEND (CDR X) Y))
(LIST (CAR X)))
(APPEND (REV Y)
(REV (CDR X))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2))))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2)))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
We now use the hypothesis by substituting (APPEND (REV Y) (REV X2))
for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/2'5'
(EQUAL (APPEND (APPEND (REV Y) (REV X2))
(LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1))).
We generalize this conjecture, replacing (REV X2) by RV and (REV Y)
by RV0. This produces
Subgoal *1/2'6'
(EQUAL (APPEND (APPEND RV0 RV) (LIST X1))
(APPEND RV0 RV (LIST X1))).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
This simplifies, using the :definitions BINARYAPPEND and REV, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APPEND (REV Y) NIL))).
We generalize this conjecture, replacing (REV Y) by RV. This produces
Subgoal *1/1'''
(IMPLIES (NOT (CONSP X))
(EQUAL RV (APPEND RV NIL))).
We suspect that the term (NOT (CONSP X)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1/1'4'
(EQUAL RV (APPEND RV NIL)).
Name the formula above *1.2.
Perhaps we can prove *1.2 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (BINARYAPPEND RV 'NIL).
This suggestion was produced using the :induction rule BINARYAPPEND.
If we let (:P RV) denote *1.2 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV)))
(:P RV))
(IMPLIES (ENDP RV) (:P RV))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1.2/2
(IMPLIES (AND (NOT (ENDP RV))
(EQUAL (CDR RV) (APPEND (CDR RV) NIL)))
(EQUAL RV (APPEND RV NIL))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/2'
(IMPLIES (AND (CONSP RV)
(EQUAL (CDR RV) (APPEND (CDR RV) NIL)))
(EQUAL RV (APPEND RV NIL))).
But simplification reduces this to T, using the :definition BINARY
APPEND, primitive type reasoning and the :rewrite rule CONSCARCDR.
Subgoal *1.2/1
(IMPLIES (ENDP RV)
(EQUAL RV (APPEND RV NIL))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/1'
(IMPLIES (NOT (CONSP RV))
(EQUAL RV (APPEND RV NIL))).
This simplifies, using the :definition BINARYAPPEND and primitive
type reasoning, to
Subgoal *1.2/1''
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
Name the formula above *1.2.1.
No induction schemes are suggested by *1.2.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVAPPEND ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.34 seconds (prove: 0.04, print: 0.12, proof tree: 0.18, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm appendassoc
(equal (append (append x y) z)
(append x (append y z))))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (BINARYAPPEND X Y).
This suggestion was produced using the :induction rule BINARYAPPEND.
If we let (:P X Y Z) denote *1 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y Z))
(:P X Y Z))
(IMPLIES (ENDP X) (:P X Y Z))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (APPEND (APPEND (CDR X) Y) Z)
(APPEND (CDR X) Y Z)))
(EQUAL (APPEND (APPEND X Y) Z)
(APPEND X Y Z))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (APPEND (APPEND (CDR X) Y) Z)
(APPEND (CDR X) Y Z)))
(EQUAL (APPEND (APPEND X Y) Z)
(APPEND X Y Z))).
But simplification reduces this to T, using the :definition BINARY
APPEND, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (APPEND (APPEND X Y) Z)
(APPEND X Y Z))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (APPEND (APPEND X Y) Z)
(APPEND X Y Z))).
But simplification reduces this to T, using the :definition BINARY
APPEND and primitive type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM APPENDASSOC ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:REWRITE CARCONS)
(:REWRITE CDRCONS))
Warnings: None
Time: 0.05 seconds (prove: 0.01, print: 0.03, proof tree: 0.01, other: 0.00)
APPENDASSOC
ACL2 !>(defthm revappend ; fails > to do list: (revappend revrev revisrev3)
(equal (rev (append x y))
(append (rev y) (rev x))))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (BINARYAPPEND X Y).
This suggestion was produced using the :induction rules BINARYAPPEND
and REV. If we let (:P X Y) denote *1 above then the induction scheme
we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y))
(:P X Y))
(IMPLIES (ENDP X) (:P X Y))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
This simplifies, using the :definitions BINARYAPPEND and REV, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (APPEND (REV (APPEND (CDR X) Y))
(LIST (CAR X)))
(APPEND (REV Y)
(REV (CDR X))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2))))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2)))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
We now use the hypothesis by substituting (APPEND (REV Y) (REV X2))
for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/2'5'
(EQUAL (APPEND (APPEND (REV Y) (REV X2))
(LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1))).
But we reduce the conjecture to T, by the simple :rewrite rule APPEND
ASSOC.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
This simplifies, using the :definitions BINARYAPPEND and REV, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X))
(EQUAL (REV Y) (APPEND (REV Y) NIL))).
We generalize this conjecture, replacing (REV Y) by RV. This produces
Subgoal *1/1'''
(IMPLIES (NOT (CONSP X))
(EQUAL RV (APPEND RV NIL))).
We suspect that the term (NOT (CONSP X)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1/1'4'
(EQUAL RV (APPEND RV NIL)).
Name the formula above *1.1.
Perhaps we can prove *1.1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (BINARYAPPEND RV 'NIL).
This suggestion was produced using the :induction rule BINARYAPPEND.
If we let (:P RV) denote *1.1 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV)))
(:P RV))
(IMPLIES (ENDP RV) (:P RV))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP RV))
(EQUAL (CDR RV) (APPEND (CDR RV) NIL)))
(EQUAL RV (APPEND RV NIL))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/2'
(IMPLIES (AND (CONSP RV)
(EQUAL (CDR RV) (APPEND (CDR RV) NIL)))
(EQUAL RV (APPEND RV NIL))).
But simplification reduces this to T, using the :definition BINARY
APPEND, primitive type reasoning and the :rewrite rule CONSCARCDR.
Subgoal *1.1/1
(IMPLIES (ENDP RV)
(EQUAL RV (APPEND RV NIL))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/1'
(IMPLIES (NOT (CONSP RV))
(EQUAL RV (APPEND RV NIL))).
This simplifies, using the :definition BINARYAPPEND and primitive
type reasoning, to
Subgoal *1.1/1''
(IMPLIES (NOT (CONSP RV)) (NOT RV)).
Name the formula above *1.1.1.
No induction schemes are suggested by *1.1.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVAPPEND ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:REWRITE APPENDASSOC)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.19 seconds (prove: 0.03, print: 0.10, proof tree: 0.05, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm appendnil
(implies (truelistp x)
(equal (append x nil) x)))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. These merge into one derived induction scheme.
We will induct according to a scheme suggested by (BINARYAPPEND X 'NIL).
This suggestion was produced using the :induction rules BINARYAPPEND
and TRUELISTP. If we let (:P X) denote *1 above then the induction
scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (APPEND (CDR X) NIL) (CDR X))
(TRUELISTP X))
(EQUAL (APPEND X NIL) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(EQUAL (APPEND (CDR X) NIL) (CDR X))
(TRUELISTP X))
(EQUAL (APPEND X NIL) X)).
But simplification reduces this to T, using the :definitions BINARY
APPEND and TRUELISTP, primitive type reasoning and the :rewrite rule
CONSCARCDR.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(NOT (TRUELISTP (CDR X)))
(TRUELISTP X))
(EQUAL (APPEND X NIL) X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/1
(IMPLIES (AND (ENDP X) (TRUELISTP X))
(EQUAL (APPEND X NIL) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (AND (NOT (CONSP X)) (TRUELISTP X))
(EQUAL (APPEND X NIL) X)).
But simplification reduces this to T, using the :definition TRUELISTP,
the :executablecounterparts of BINARYAPPEND, CONSP and EQUAL and
primitive type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM APPENDNIL ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION TRUELISTP)
(:EXECUTABLECOUNTERPART BINARYAPPEND)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION TRUELISTP)
(:REWRITE CONSCARCDR))
Warnings: None
Time: 0.09 seconds (prove: 0.01, print: 0.04, proof tree: 0.04, other: 0.00)
APPENDNIL
ACL2 !>(defthm truelistprev
(truelistp (rev x)))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(TRUELISTP (REV (CDR X))))
(TRUELISTP (REV X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (REV X))).
This simplifies, using the :definition REV, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(TRUELISTP (REV (CDR X))))
(TRUELISTP (APPEND (REV (CDR X)) (LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(TRUELISTP (REV X2)))
(TRUELISTP (APPEND (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (TRUELISTP (REV X2))
(TRUELISTP (APPEND (REV X2) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by RV. This produces
Subgoal *1/2'5'
(IMPLIES (TRUELISTP RV)
(TRUELISTP (APPEND RV (LIST X1)))).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (ENDP X) (TRUELISTP (REV X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(TRUELISTP (REV X))).
But simplification reduces this to T, using the :definition REV and
the :executablecounterpart of TRUELISTP.
So we now return to *1.1, which is
(IMPLIES (TRUELISTP RV)
(TRUELISTP (APPEND RV (LIST X1)))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. These merge into one derived induction
scheme.
We will induct according to a scheme suggested by
(BINARYAPPEND RV (CONS X1 'NIL)). This suggestion was produced using
the :induction rules BINARYAPPEND and TRUELISTP. If we let (:P RV X1)
denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV) X1))
(:P RV X1))
(IMPLIES (ENDP RV) (:P RV X1))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following three nontautological subgoals.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP RV))
(TRUELISTP (APPEND (CDR RV) (LIST X1)))
(TRUELISTP RV))
(TRUELISTP (APPEND RV (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/3'
(IMPLIES (AND (CONSP RV)
(TRUELISTP (APPEND (CDR RV) (LIST X1)))
(TRUELISTP RV))
(TRUELISTP (APPEND RV (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and TRUELISTP, primitive type reasoning and the :typeprescription
rule BINARYAPPEND.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP RV))
(NOT (TRUELISTP (CDR RV)))
(TRUELISTP RV))
(TRUELISTP (APPEND RV (LIST X1)))).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (ENDP RV) (TRUELISTP RV))
(TRUELISTP (APPEND RV (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/1'
(IMPLIES (AND (NOT (CONSP RV)) (TRUELISTP RV))
(TRUELISTP (APPEND RV (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and TRUELISTP, the :executablecounterpart of CONSP and primitive
type reasoning.
That completes the proofs of *1.1 and *1.
Q.E.D.
The storage of TRUELISTPREV depends upon the :typeprescription rule
TRUELISTP.
Summary
Form: ( DEFTHM TRUELISTPREV ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART TRUELISTP)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:TYPEPRESCRIPTION BINARYAPPEND)
(:TYPEPRESCRIPTION TRUELISTP))
Warnings: None
Time: 0.13 seconds (prove: 0.02, print: 0.05, proof tree: 0.05, other: 0.00)
TRUELISTPREV
ACL2 !>(defthm revappend
(equal (rev (append x y))
(append (rev y) (rev x))))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Three induction schemes are
suggested by this conjecture. Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.
We will induct according to a scheme suggested by (BINARYAPPEND X Y).
This suggestion was produced using the :induction rules BINARYAPPEND
and REV. If we let (:P X Y) denote *1 above then the induction scheme
we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y))
(:P X Y))
(IMPLIES (ENDP X) (:P X Y))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
This simplifies, using the :definitions BINARYAPPEND and REV, primitive
type reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(EQUAL (REV (APPEND (CDR X) Y))
(APPEND (REV Y) (REV (CDR X)))))
(EQUAL (APPEND (REV (APPEND (CDR X) Y))
(LIST (CAR X)))
(APPEND (REV Y)
(REV (CDR X))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2'''
(IMPLIES (AND (CONSP (CONS X1 X2))
(EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2))))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2'4'
(IMPLIES (EQUAL (REV (APPEND X2 Y))
(APPEND (REV Y) (REV X2)))
(EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1)))).
We now use the hypothesis by substituting (APPEND (REV Y) (REV X2))
for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces
Subgoal *1/2'5'
(EQUAL (APPEND (APPEND (REV Y) (REV X2))
(LIST X1))
(APPEND (REV Y) (REV X2) (LIST X1))).
But we reduce the conjecture to T, by the simple :rewrite rule APPEND
ASSOC.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (APPEND X Y))
(APPEND (REV Y) (REV X)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, primitive type reasoning and the :rewrite rules APPEND
NIL and TRUELISTPREV.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM REVAPPEND ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:REWRITE APPENDASSOC)
(:REWRITE APPENDNIL)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE TRUELISTPREV))
Warnings: None
Time: 0.10 seconds (prove: 0.03, print: 0.05, proof tree: 0.02, other: 0.00)
REVAPPEND
ACL2 !>(defthm revrev ; fails > to do list: (revrev revisrev3)
(equal (rev (rev x))
x))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X)))
(EQUAL (REV (REV X)) X)).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterparts of CONSP and REV, primitive
type reasoning and the :rewrite rules CARCONS, CDRCONS, CONSCAR
CDR and REVAPPEND.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV (REV X)) X)).
This simplifies, using the :definition REV, the :executablecounterpart
of REV and primitive type reasoning, to
Subgoal *1/1''
(IMPLIES (NOT (CONSP X)) (NOT X)).
Name the formula above *1.1.
No induction schemes are suggested by *1.1. Consequently, the proof
attempt has failed.
Summary
Form: ( DEFTHM REVREV ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR)
(:REWRITE REVAPPEND))
Warnings: None
Time: 0.08 seconds (prove: 0.01, print: 0.03, proof tree: 0.04, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defthm revrev ; succeeds > to do list: (revisrev3)
(implies (truelistp x)
(equal (rev (rev x))
x)))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. These merge into one derived induction scheme.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rules REV and TRUELISTP. If we
let (:P X) denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(EQUAL (REV (REV (CDR X))) (CDR X))
(TRUELISTP X))
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(EQUAL (REV (REV (CDR X))) (CDR X))
(TRUELISTP X))
(EQUAL (REV (REV X)) X)).
But simplification reduces this to T, using the :definitions BINARY
APPEND, REV and TRUELISTP, the :executablecounterparts of CONSP and
REV, primitive type reasoning and the :rewrite rules CARCONS, CDR
CONS, CONSCARCDR and REVAPPEND.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(NOT (TRUELISTP (CDR X)))
(TRUELISTP X))
(EQUAL (REV (REV X)) X)).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1/1
(IMPLIES (AND (ENDP X) (TRUELISTP X))
(EQUAL (REV (REV X)) X)).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (AND (NOT (CONSP X)) (TRUELISTP X))
(EQUAL (REV (REV X)) X)).
But simplification reduces this to T, using the :definition TRUELISTP,
the :executablecounterparts of CONSP, EQUAL and REV and primitive
type reasoning.
That completes the proof of *1.
Q.E.D.
Summary
Form: ( DEFTHM REVREV ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSCARCDR)
(:REWRITE REVAPPEND))
Warnings: None
Time: 0.06 seconds (prove: 0.01, print: 0.03, proof tree: 0.01, other: 0.00)
REVREV
ACL2 !>(defthm revisrev3 ; proof fails > why didn't revrev apply?
(equal (rev x)
(rev3 x)))
ACL2 Warning [Subsume] in ( DEFTHM REVISREV3 ...): A newly proposed
:REWRITE rule generated from REVISREV3 probably subsumes the previously
added :REWRITE rules REVREV and REVAPPEND, in the sense that the
new rule will now probably be applied whenever the old rules would
have been.
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X). This suggestion
was produced using the :induction rules REV and REV3. If we let (:P X)
denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(:P (CDR X)))
(:P X))
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS and CDRCONS, to
Subgoal *1/3''
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, to the following
two conjectures.
Subgoal *1/3.2
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using primitive type reasoning and the :rewrite rule
CONSEQUAL, to
Subgoal *1/3.2'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.2''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'''
(IMPLIES (AND (CONSP X2)
(EQUAL (REV X2) (REV3 X2))
(CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We now use the second hypothesis by crossfertilizing (REV3 X2) for
(REV X2) and throwing away the hypothesis. This produces
Subgoal *1/3.2'4'
(IMPLIES (AND (CONSP X2) (CONSP (REV X2)))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR (REV X2))))
(LIST X1)))).
We generalize this conjecture, replacing (REV X2) by L. This produces
Subgoal *1/3.2'5'
(IMPLIES (AND (CONSP X2) (CONSP L))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV (CDR L)))
(LIST X1)))).
The destructor terms (CAR L) and (CDR L) can be eliminated by using
CARCDRELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L)
by L2. This produces the following goal.
Subgoal *1/3.2'6'
(IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.2'7'
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.
Subgoal *1/3.1
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(NOT (CONSP (REV (CDR X)))))
(EQUAL (LIST (CAR X))
(CONS (CAR (REV (CDR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, the :executable
counterparts of CAR, CDR, CONSP and REV, primitive type reasoning,
the :rewrite rule CDRCONS and the :typeprescription rule REV, to
Subgoal *1/3.1'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(NOT (REV3 (CDR X))))
(CONSP (REV (CDR X)))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3.1''
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3.1'''
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Name the formula above *1.2.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(LIST (CAR X)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterpart of CONSP and primitive
type reasoning.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV X) (REV3 X))).
But simplification reduces this to T, using the :definitions REV and
REV3 and the :executablecounterpart of EQUAL.
So we now return to *1.2, which is
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Perhaps we can prove *1.2 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rules REV and REV3. If
we let (:P X2) denote *1.2 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P (CDR X2)))
(:P X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P X2))
(IMPLIES (ENDP X2) (:P X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following five nontautological subgoals.
Subgoal *1.2/5
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(CONSP (REV (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/5'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(CONSP (REV (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(REV3 (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(REV3 (CDR X2))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.2/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.2/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.2/2'
(IMPLIES (AND (CONSP X2)
(NOT (CONSP (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definition REV3 and
primitive type reasoning.
Subgoal *1.2/1
(IMPLIES (AND (ENDP X2)
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
That completes the proof of *1.2.
We therefore turn our attention to *1.1, which is
(IMPLIES (CONSP X2)
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. We will choose arbitrarily among these.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rule REV3. If we let
(:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P L2 X1 (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P L2 X1 X2))
(IMPLIES (ENDP X2) (:P L2 X1 X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following four nontautological subgoals.
Subgoal *1.1/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND, REV and REV3,
the :executablecounterpart of CONSP, primitive type reasoning and
the :rewrite rules APPENDASSOC, CARCONS and CDRCONS, to
Subgoal *1.1/4''
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (REV (REV (CDR (REV3 (CDR X2)))))
(LIST (CAR X2) X1))
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2)
by X4. This produces the following goal.
Subgoal *1.1/4'''
(IMPLIES (AND (CONSP (CONS X3 X4))
(CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3 X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1/4'4'
(IMPLIES (AND (CONSP X4)
(EQUAL (APPEND (CDR (REV3 X4)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1))))
(EQUAL (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3 X1))
(APPEND (CDR (REV3 X4)) (LIST X1)))).
We now use the second hypothesis by substituting
(APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1))
and throwing away the hypothesis. This produces
Subgoal *1.1/4'5'
(IMPLIES (CONSP X4)
(EQUAL (APPEND (REV (REV (CDR (REV3 X4))))
(LIST X3 X1))
(APPEND (REV (REV L2)) (LIST X1)))).
Name the formula above *1.1.1.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/2'
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV3, the
:executablecounterpart of CONSP and the :rewrite rule CDRCONS, to
Subgoal *1.1/2''
(IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
The destructor terms (CAR X2) and (CDR X2) can be eliminated by using
CARCDRELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2)
by X4. This produces the following goal.
Subgoal *1.1/2'''
(IMPLIES (AND (CONSP (CONS X3 X4))
(NOT (CONSP X4)))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1/2'4'
(IMPLIES (NOT (CONSP X4))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
We suspect that the term (NOT (CONSP X4)) is irrelevant to the truth
of this conjecture and throw it out. We will thus try to prove
Subgoal *1.1/2'5'
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1))).
Name the formula above *1.1.2.
Subgoal *1.1/1
(IMPLIES (AND (ENDP X2) (CONSP X2))
(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1))
(APPEND (REV (REV L2)) (LIST X1)))).
But we reduce the conjecture to T, by case analysis.
So we now return to *1.1.2, which is
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1))).
Perhaps we can prove *1.1.2 by induction. One induction scheme is
suggested by this conjecture.
We will induct according to a scheme suggested by (REV L2). This suggestion
was produced using the :induction rule REV. If we let (:P L2 X1)
denote *1.1.2 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1))
(:P L2 X1))
(IMPLIES (ENDP L2) (:P L2 X1))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1.2/2
(IMPLIES (AND (NOT (ENDP L2))
(EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2/2'
(IMPLIES (AND (CONSP L2)
(EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
This simplifies, using the :definitions BINARYAPPEND and REV, the
:executablecounterparts of CONSP and REV, primitive type reasoning
and the :rewrite rules CARCONS, CDRCONS and REVAPPEND, to
Subgoal *1.1.2/2''
(IMPLIES (CONSP L2)
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV (CDR L2)))
(LIST X1))))).
The destructor terms (CAR L2) and (CDR L2) can be eliminated by using
CARCDRELIM to replace L2 by (CONS L3 L4), (CAR L2) by L3 and (CDR L2)
by L4. This produces the following goal.
Subgoal *1.1.2/2'''
(IMPLIES (CONSP (CONS L3 L4))
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))).
This simplifies, using primitive type reasoning, to
Subgoal *1.1.2/2'4'
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1)))).
Name the formula above *1.1.2.1.
Subgoal *1.1.2/1
(IMPLIES (ENDP L2)
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2/1'
(IMPLIES (NOT (CONSP L2))
(EQUAL (LIST X1)
(APPEND (REV (REV L2)) (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterparts of CONSP and REV and primitive
type reasoning.
So we now return to *1.1.2.1, which is
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1)))).
Perhaps we can prove *1.1.2.1 by induction. One induction scheme is
suggested by this conjecture.
We will induct according to a scheme suggested by (REV L4). This suggestion
was produced using the :induction rule REV. If we let (:P L4 X1)
denote *1.1.2.1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP L4)) (:P (CDR L4) X1))
(:P L4 X1))
(IMPLIES (ENDP L4) (:P L4 X1))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1.1.2.1/2
(IMPLIES (AND (NOT (ENDP L4))
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV (CDR L4)))
(LIST X1)))))
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2.1/2'
(IMPLIES (AND (CONSP L4)
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV (CDR L4)))
(LIST X1)))))
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterparts of CONSP and REV, primitive
type reasoning, the :rewrite rules CARCONS, CDRCONS and REVAPPEND
and the :typeprescription rule BINARYAPPEND.
Subgoal *1.1.2.1/1
(IMPLIES (ENDP L4)
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1.2.1/1'
(IMPLIES (NOT (CONSP L4))
(NOT (EQUAL (LIST X1)
(APPEND (REV (REV L4)) (LIST X1))))).
This simplifies, using the :definitions BINARYAPPEND and REV, the
:executablecounterparts of CONSP and REV and primitive type reasoning,
to
Subgoal *1.1.2.1/1''
(CONSP L4).
We suspect that this conjecture is not a theorem. We might as well
be trying to prove
Subgoal *1.1.2.1/1'''
NIL.
Obviously, the proof attempt has failed.
Summary
Form: ( DEFTHM REVISREV3 ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION REV3)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CAR)
(:EXECUTABLECOUNTERPART CDR)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:EXECUTABLECOUNTERPART REV)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV)
(:INDUCTION REV3)
(:REWRITE APPENDASSOC)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE CONSEQUAL)
(:REWRITE REVAPPEND)
(:TYPEPRESCRIPTION BINARYAPPEND)
(:TYPEPRESCRIPTION REV))
Warnings: Subsume
Time: 1.30 seconds (prove: 0.17, print: 0.30, proof tree: 0.83, other: 0.01)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(verify (IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(CONSP (REV (CDR X))))
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X))))))
>: promote
>: th
*** Toplevel hypotheses:
1. (CONSP X)
2. (CONSP (CDR X))
3. (EQUAL (REV (CDR X)) (REV3 (CDR X)))
4. (CONSP (REV (CDR X)))
The current subterm is:
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (REV (REV (CDR (REV (CDR X)))))
(LIST (CAR X))))
>: (dv 2 1 0)
>: p
(REV (REV (CDR (REV (CDR X)))))
>: sr
1. REVREV
New term: (CDR (REV (CDR X)))
Hypotheses: ((TRUELISTP (CDR (REV (CDR X)))))
Equiv: EQUAL
2. REV
New term: (AND (CONSP (REV (CDR (REV (CDR X)))))
(APPEND (REV (CDR (REV (CDR (REV (CDR X))))))
(LIST (CAR (REV (CDR (REV (CDR X))))))))
Hypotheses:
Equiv: EQUAL
>: (r 1)
Rewriting with REVREV.
Creating one new goal: (MAIN . 1).
>: top
>: p
(EQUAL (APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))
>: prove
***** Now entering the theorem prover *****
<< Starting proof tree logging >>
But we reduce the conjecture to T, by primitive type reasoning.
Q.E.D.
The proof of the current goal, MAIN, has been completed. However,
the following subgoals remain to be proved:
(MAIN . 1).
Now proving (MAIN . 1).
>: th
*** Toplevel hypotheses:
1. (CONSP X)
2. (CONSP (CDR X))
3. (EQUAL (REV (CDR X)) (REV3 (CDR X)))
4. (CONSP (REV (CDR X)))
The current subterm is:
(TRUELISTP (CDR (REV (CDR X))))
>: exitt
*** NO CHANGE ***  Undefined instruction, :EXITT.
>: exit
Exiting....
NIL
ACL2 !>(defthm truelistpcdrrev
(truelistp (cdr (rev x))))
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. One induction scheme is suggested
by this conjecture.
We will induct according to a scheme suggested by (REV X). This suggestion
was produced using the :induction rule REV. If we let (:P X) denote
*1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X))
(TRUELISTP (CDR (REV (CDR X)))))
(TRUELISTP (CDR (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X)
(TRUELISTP (CDR (REV (CDR X)))))
(TRUELISTP (CDR (REV X)))).
This simplifies, using the :definition REV, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X)
(TRUELISTP (CDR (REV (CDR X)))))
(TRUELISTP (CDR (APPEND (REV (CDR X))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, to the following
two conjectures.
Subgoal *1/2.2
(IMPLIES (AND (CONSP X)
(TRUELISTP (CDR (REV (CDR X))))
(CONSP (REV (CDR X))))
(TRUELISTP (CDR (CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))))).
By the simple :rewrite rule CDRCONS we reduce the conjecture to
Subgoal *1/2.2'
(IMPLIES (AND (CONSP X)
(TRUELISTP (CDR (REV (CDR X))))
(CONSP (REV (CDR X))))
(TRUELISTP (APPEND (CDR (REV (CDR X)))
(LIST (CAR X))))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/2.2''
(IMPLIES (AND (CONSP (CONS X1 X2))
(TRUELISTP (CDR (REV X2)))
(CONSP (REV X2)))
(TRUELISTP (APPEND (CDR (REV X2)) (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2.2'''
(IMPLIES (AND (TRUELISTP (CDR (REV X2)))
(CONSP (REV X2)))
(TRUELISTP (APPEND (CDR (REV X2)) (LIST X1)))).
We generalize this conjecture, replacing (REV X2) by L. This produces
Subgoal *1/2.2'4'
(IMPLIES (AND (TRUELISTP (CDR L)) (CONSP L))
(TRUELISTP (APPEND (CDR L) (LIST X1)))).
The destructor terms (CAR L) and (CDR L) can be eliminated by using
CARCDRELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L)
by L2. This produces the following goal.
Subgoal *1/2.2'5'
(IMPLIES (AND (CONSP (CONS L1 L2))
(TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
This simplifies, using primitive type reasoning, to
Subgoal *1/2.2'6'
(IMPLIES (TRUELISTP L2)
(TRUELISTP (APPEND L2 (LIST X1)))).
Name the formula above *1.1.
Subgoal *1/2.1
(IMPLIES (AND (CONSP X)
(TRUELISTP (CDR (REV (CDR X))))
(NOT (CONSP (REV (CDR X)))))
(TRUELISTP (CDR (LIST (CAR X))))).
But we reduce the conjecture to T, by the :executablecounterpart of
TRUELISTP and the simple :rewrite rule CDRCONS.
Subgoal *1/1
(IMPLIES (ENDP X)
(TRUELISTP (CDR (REV X)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(TRUELISTP (CDR (REV X)))).
But simplification reduces this to T, using the :definition REV and
the :executablecounterparts of CDR and TRUELISTP.
So we now return to *1.1, which is
(IMPLIES (TRUELISTP L2)
(TRUELISTP (APPEND L2 (LIST X1)))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. These merge into one derived induction
scheme.
We will induct according to a scheme suggested by
(BINARYAPPEND L2 (CONS X1 'NIL)). This suggestion was produced using
the :induction rules BINARYAPPEND and TRUELISTP. If we let (:P L2 X1)
denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1))
(:P L2 X1))
(IMPLIES (ENDP L2) (:P L2 X1))).
This induction is justified by the same argument used to admit BINARY
APPEND. When applied to the goal at hand the above induction scheme
produces the following three nontautological subgoals.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP L2))
(TRUELISTP (APPEND (CDR L2) (LIST X1)))
(TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/3'
(IMPLIES (AND (CONSP L2)
(TRUELISTP (APPEND (CDR L2) (LIST X1)))
(TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and TRUELISTP, primitive type reasoning and the :typeprescription
rule BINARYAPPEND.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP L2))
(NOT (TRUELISTP (CDR L2)))
(TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
But we reduce the conjecture to T, by primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (ENDP L2) (TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/1'
(IMPLIES (AND (NOT (CONSP L2)) (TRUELISTP L2))
(TRUELISTP (APPEND L2 (LIST X1)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and TRUELISTP, the :executablecounterpart of CONSP and primitive
type reasoning.
That completes the proofs of *1.1 and *1.
Q.E.D.
The storage of TRUELISTPCDRREV depends upon the :typeprescription
rule TRUELISTP.
Summary
Form: ( DEFTHM TRUELISTPCDRREV ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION TRUELISTP)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CDR)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART TRUELISTP)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION BINARYAPPEND)
(:INDUCTION REV)
(:INDUCTION TRUELISTP)
(:REWRITE CDRCONS)
(:TYPEPRESCRIPTION BINARYAPPEND)
(:TYPEPRESCRIPTION TRUELISTP))
Warnings: None
Time: 0.28 seconds (prove: 0.03, print: 0.14, proof tree: 0.10, other: 0.01)
TRUELISTPCDRREV
ACL2 !>(defthm revisrev3 ; succeeds
(equal (rev x)
(rev3 x)))
ACL2 Warning [Subsume] in ( DEFTHM REVISREV3 ...): A newly proposed
:REWRITE rule generated from REVISREV3 probably subsumes the previously
added :REWRITE rules REVREV and REVAPPEND, in the sense that the
new rule will now probably be applied whenever the old rules would
have been.
<< Starting proof tree logging >>
Name the formula above *1.
Perhaps we can prove *1 by induction. Two induction schemes are suggested
by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X). This suggestion
was produced using the :induction rules REV and REV3. If we let (:P X)
denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(:P (CDR X)))
(:P X))
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(:P X))
(IMPLIES (ENDP X) (:P X))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following three nontautological subgoals.
Subgoal *1/3
(IMPLIES (AND (NOT (ENDP X))
(NOT (ENDP (CDR X)))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/3'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, primitive type
reasoning and the :rewrite rules CARCONS, CDRCONS, REVREV and TRUE
LISTPCDRREV, to
Subgoal *1/3''
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, to
Subgoal *1/3'''
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(EQUAL (REV (CDR X)) (REV3 (CDR X)))
(NOT (CONSP (REV (CDR X)))))
(EQUAL (LIST (CAR X))
(CONS (CAR (REV (CDR X)))
(APPEND (CDR (REV (CDR X)))
(LIST (CAR X)))))).
This simplifies, using the :definition BINARYAPPEND, the :executable
counterparts of CAR, CDR and CONSP, primitive type reasoning, the :rewrite
rule CDRCONS and the :typeprescription rule REV, to
Subgoal *1/3'4'
(IMPLIES (AND (CONSP X)
(CONSP (CDR X))
(NOT (REV3 (CDR X))))
(CONSP (REV (CDR X)))).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/3'5'
(IMPLIES (AND (CONSP (CONS X1 X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
This simplifies, using primitive type reasoning, to
Subgoal *1/3'6'
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Name the formula above *1.1.
Subgoal *1/2
(IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X)))
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/2'
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (REV X) (REV3 X))).
This simplifies, using the :definitions REV and REV3, to
Subgoal *1/2''
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (APPEND (REV (CDR X)) (LIST (CAR X)))
(LIST (CAR X)))).
But simplification reduces this to T, using the :definitions BINARY
APPEND and REV, the :executablecounterpart of CONSP and primitive
type reasoning.
Subgoal *1/1
(IMPLIES (ENDP X)
(EQUAL (REV X) (REV3 X))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1/1'
(IMPLIES (NOT (CONSP X))
(EQUAL (REV X) (REV3 X))).
But simplification reduces this to T, using the :definitions REV and
REV3 and the :executablecounterpart of EQUAL.
So we now return to *1.1, which is
(IMPLIES (AND (CONSP X2) (NOT (REV3 X2)))
(CONSP (REV X2))).
Perhaps we can prove *1.1 by induction. Two induction schemes are
suggested by this conjecture. Subsumption reduces that number to one.
We will induct according to a scheme suggested by (REV3 X2). This
suggestion was produced using the :induction rules REV and REV3. If
we let (:P X2) denote *1.1 above then the induction scheme we'll use
is
(AND (IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(:P (CDR X2)))
(:P X2))
(IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)))
(:P X2))
(IMPLIES (ENDP X2) (:P X2))).
This induction is justified by the same argument used to admit REV3.
When applied to the goal at hand the above induction scheme produces
the following five nontautological subgoals.
Subgoal *1.1/5
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(CONSP (REV (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/5'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(CONSP (REV (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.1/4
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(REV3 (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/4'
(IMPLIES (AND (CONSP X2)
(CONSP (CDR X2))
(REV3 (CDR X2))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definitions REV and
REV3, primitive type reasoning and the :rewrite rules CARCONS and
CDRCONS.
Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP X2))
(NOT (ENDP (CDR X2)))
(NOT (CONSP (CDR X2)))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP X2))
(ENDP (CDR X2))
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
By the simple :definition ENDP we reduce the conjecture to
Subgoal *1.1/2'
(IMPLIES (AND (CONSP X2)
(NOT (CONSP (CDR X2)))
(NOT (REV3 X2)))
(CONSP (REV X2))).
But simplification reduces this to T, using the :definition REV3 and
primitive type reasoning.
Subgoal *1.1/1
(IMPLIES (AND (ENDP X2)
(CONSP X2)
(NOT (REV3 X2)))
(CONSP (REV X2))).
But we reduce the conjecture to T, by case analysis.
That completes the proofs of *1.1 and *1.
Q.E.D.
Summary
Form: ( DEFTHM REVISREV3 ...)
Rules: ((:DEFINITION BINARYAPPEND)
(:DEFINITION ENDP)
(:DEFINITION NOT)
(:DEFINITION REV)
(:DEFINITION REV3)
(:ELIM CARCDRELIM)
(:EXECUTABLECOUNTERPART CAR)
(:EXECUTABLECOUNTERPART CDR)
(:EXECUTABLECOUNTERPART CONSP)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION REV)
(:INDUCTION REV3)
(:REWRITE CARCONS)
(:REWRITE CDRCONS)
(:REWRITE REVREV)
(:REWRITE TRUELISTPCDRREV)
(:TYPEPRESCRIPTION REV))
Warnings: Subsume
Time: 0.27 seconds (prove: 0.05, print: 0.10, proof tree: 0.11, other: 0.01)
REVISREV3
ACL2 !>(encapsulate
; Signature: triplerev takes one argument and returns one value.
(((triplerev *) => *))
; Local definition: Properties below are to be proved using this definition of
; triplerev.
(local (defun triplerev (x)
(rev3 x)))
; Here is the definition we wanted to make when we defined rev3. Notice that
; triplerev does not call rev or any other function other than itself and
; a few builtins (endp, list, car, cdr, cons).
(defthm triplerevdef
(equal (triplerev x)
(cond
((endp x)
nil)
((endp (cdr x))
(list (car x)))
(t
;; Think of x as a@b@c where a and c are single elements.
(let* ((b@c (cdr x))
(c@revb (triplerev b@c)) ; recursive call
(revb (cdr c@revb))
(b (triplerev revb)) ; recursive call
(a (car x))
(a@b (cons a b))
(revb@a (triplerev a@b)) ; recursive call
(c (car c@revb))
(c@revb@a (cons c revb@a)))
c@revb@a))))
; Here we specify that the formula above be used like a definition. Details
; may be found on the ACL2 documentation page RULECLASSES.
:ruleclasses ((:definition :clique (triplerev)
:controlleralist ((triplerev t)))))
)
To verify that the two encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 !>>(LOCAL (DEFUN TRIPLEREV (X) (REV3 X)))
Since TRIPLEREV is nonrecursive, its admission is trivial. We observe
that the type of TRIPLEREV is described by the theorem
(OR (CONSP (TRIPLEREV X)) (EQUAL (TRIPLEREV X) NIL)). We used the
:typeprescription rule REV3.
Summary
Form: ( DEFUN TRIPLEREV ...)
Rules: ((:TYPEPRESCRIPTION REV3))
Warnings: None
Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00)
TRIPLEREV
ACL2 !>>(DEFTHM
TRIPLEREVDEF
(EQUAL (TRIPLEREV X)
(COND ((ENDP X) NIL)
((ENDP (CDR X)) (LIST (CAR X)))
(T (LET* ((B@C (CDR X))
(C@REVB (TRIPLEREV B@C))
(REVB (CDR C@REVB))
(B (TRIPLEREV REVB))
(A (CAR X))
(A@B (CONS A B))
(REVB@A (TRIPLEREV A@B))
(C (CAR C@REVB))
(C@REVB@A (CONS C REVB@A)))
C@REVB@A))))
:RULECLASSES ((:DEFINITION :CLIQUE (TRIPLEREV)
:CONTROLLERALIST ((TRIPLEREV T)))))
ACL2 Warning [Nonrec] in ( DEFTHM TRIPLEREVDEF ...): A :DEFINITION
rule generated from TRIPLEREVDEF will be triggered only by terms
containing the nonrecursive function symbol TRIPLEREV. Unless this
function is disabled, this rule is unlikely ever to be used.
ACL2 Warning [Subsume] in ( DEFTHM TRIPLEREVDEF ...): A newly proposed
:DEFINITION rule generated from TRIPLEREVDEF probably subsumes the
previously added :REWRITE rule TRIPLEREV, in the sense that the new
rule will now probably be applied whenever the old rule would have
been.
ACL2 Warning [Subsume] in ( DEFTHM TRIPLEREVDEF ...): The previously
added rule TRIPLEREV subsumes a newly proposed :DEFINITION rule generated
from TRIPLEREVDEF, in the sense that the old rule rewrites a more
general target. Because the new rule will be tried first, it may nonetheless
find application.
<< Starting proof tree logging >>
By the simple :definition TRIPLEREV we reduce the conjecture to
Goal'
(EQUAL (REV3 X)
(AND (NOT (ENDP X))
(IF (ENDP (CDR X))
(LIST (CAR X))
(LET ((C@REVB (REV3 (CDR X))))
(CONS (CAR C@REVB)
(REV3 (CONS (CAR X)
(REV3 (CDR C@REVB))))))))).
This simplifies, using the :definition ENDP, to the following three
conjectures.
Subgoal 3
(IMPLIES (NOT (CONSP X))
(EQUAL (REV3 X) NIL)).
But simplification reduces this to T, using the :definition REV3 and
the :executablecounterpart of EQUAL.
Subgoal 2
(IMPLIES (AND (CONSP X) (CONSP (CDR X)))
(EQUAL (REV3 X)
(CONS (CAR (REV3 (CDR X)))
(REV3 (CONS (CAR X)
(REV3 (CDR (REV3 (CDR X))))))))).
But simplification reduces this to T, using the :definition REV3, primitive
type reasoning and the :rewrite rule REVISREV3.
Subgoal 1
(IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X))))
(EQUAL (REV3 X) (LIST (CAR X)))).
But simplification reduces this to T, using the :definition REV3 and
primitive type reasoning.
Q.E.D.
Summary
Form: ( DEFTHM TRIPLEREVDEF ...)
Rules: ((:DEFINITION ENDP)
(:DEFINITION REV3)
(:DEFINITION TRIPLEREV)
(:EXECUTABLECOUNTERPART EQUAL)
(:FAKERUNEFORTYPESET NIL)
(:REWRITE REVISREV3))
Warnings: Subsume and Nonrec
Time: 0.06 seconds (prove: 0.01, print: 0.02, proof tree: 0.00, other: 0.03)
TRIPLEREVDEF
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
The following constraint is associated with the function TRIPLEREV:
(EQUAL
(TRIPLEREV X)
(AND
(NOT (ENDP X))
(IF
(ENDP (CDR X))
(LIST (CAR X))
(LET
((B@C (CDR X)))
(LET ((C@REVB (TRIPLEREV B@C)))
(LET ((REVB (CDR C@REVB)))
(LET ((B (TRIPLEREV REVB)))
(LET ((A (CAR X)))
(LET ((A@B (CONS A B)))
(LET ((REVB@A (TRIPLEREV A@B)))
(LET ((C (CAR C@REVB)))
(LET ((C@REVB@A (CONS C REVB@A)))
C@REVB@A))))))))))))
Summary
Form: ( ENCAPSULATE (((TRIPLEREV * ...) ...) ...) ...)
Rules: NIL
Warnings: Subsume and Nonrec
Time: 0.08 seconds (prove: 0.01, print: 0.02, proof tree: 0.00, other: 0.04)
T
ACL2 !>
........
All of the above was on my Mac laptop. On UT CS linux:
sundance:~/class/march2007> acl2
GCL (GNU Common Lisp) 2.6.7 CLtL1 Sep 15 2005 12:36:56
Source License: LGPL(gcl,gmp), GPL(unexec,bfd)
Binary License: GPL due to GPL'ed components: (BFD UNEXEC)
Modifications of this banner must retain notice of a compatible license
Dedicated to the memory of W. Schelter
Use (help) to get some basic information on how to use GCL.
ACL2 Version 3.1 built November 30, 2006 07:45:55.
Copyright (C) 2006 University of Texas at Austin
ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you
are welcome to redistribute it under certain conditions. For details,
see the GNU General Public License.
Initialized with (INITIALIZEACL2 'INCLUDEBOOK *ACL2PASS2FILES*).
See the documentation topic note31 for recent changes.
Note: We have modified the prompt in some underlying Lisps to further
distinguish it from the ACL2 prompt.
NOTE!! Proof trees are disabled in ACL2. To enable them in emacs,
look under the ACL2 source directory in interface/emacs/README.doc;
and, to turn on proof trees, execute :STARTPROOFTREE in the ACL2
command loop. Look in the ACL2 documentation under PROOFTREE.
ACL2 Version 3.1. Level 1. Cbd "/v/filer4b/kaufmann/class/march2007/".
Type :help for help.
Type (goodbye) to quit completely out of ACL2.
ACL2 !>(defun fooinduction (x y)
(if (consp x)
(fooinduction (cdr x) (g x y))
(list x y)))
ACL2 Error in ( DEFUN FOOINDUCTION ...): The symbol G (in package
"ACL2") has neither a function nor macro definition in ACL2. Please
define it.
Summary
Form: ( DEFUN FOOINDUCTION ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>(defstub g (x y) t)
To verify that the two encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 !>>(LOGIC)
This event is redundant. See :DOC redundantevents.
:INVISIBLE
ACL2 !>>(LOCAL (DEFUN G (X Y)
(DECLARE (IGNORE X Y))
T))
Since G is nonrecursive, its admission is trivial. We observe that
the type of G is described by the theorem (G X Y).
Summary
Form: ( DEFUN G ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
G
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
Summary
Form: ( ENCAPSULATE ((G ...) ...) ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
T
ACL2 !>(defun fooinduction (x y)
(if (consp x)
(fooinduction (cdr x) (g x y))
(list x y)))
The admission of FOOINDUCTION is trivial, using the relation O< (which
is known to be wellfounded on the domain recognized by OP) and the
measure (ACL2COUNT X). We observe that the type of FOOINDUCTION
is described by the theorem
(AND (CONSP (FOOINDUCTION X Y)) (TRUELISTP (FOOINDUCTION X Y))).
We used primitive type reasoning.
Summary
Form: ( DEFUN FOOINDUCTION ...)
Rules: ((:FAKERUNEFORTYPESET NIL))
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
FOOINDUCTION
ACL2 !>(defstub foo (x y) t)
To verify that the two encapsulated events correctly extend the current
theory we will evaluate them. The theory thus constructed is only
ephemeral.
Encapsulated Events:
ACL2 !>>(LOGIC)
This event is redundant. See :DOC redundantevents.
:INVISIBLE
ACL2 !>>(LOCAL (DEFUN FOO (X Y)
(DECLARE (IGNORE X Y))
T))
Since FOO is nonrecursive, its admission is trivial. We observe that
the type of FOO is described by the theorem (FOO X Y).
Summary
Form: ( DEFUN FOO ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
FOO
End of Encapsulated Events.
Having verified that the encapsulated events validate the signatures
of the ENCAPSULATE event, we discard the ephemeral theory and extend
the original theory as directed by the signatures and the nonLOCAL
events.
Summary
Form: ( ENCAPSULATE ((FOO ...) ...) ...)
Rules: NIL
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
T
ACL2 !>(thm (foo x y)
:hints (("Goal" :induct (fooinduction x y))))
[Note: A hint was supplied for our processing of the goal above.
Thanks!]
Name the formula above *1.
We have been told to use induction. One induction scheme is suggested
by the induction hint.
We will induct according to a scheme suggested by (FOOINDUCTION X Y).
This suggestion was produced using the :induction rule FOOINDUCTION.
If we let (:P X Y) denote *1 above then the induction scheme we'll
use is
(AND (IMPLIES (NOT (CONSP X)) (:P X Y))
(IMPLIES (AND (CONSP X) (:P (CDR X) (G X Y)))
(:P X Y))).
This induction is justified by the same argument used to admit FOO
INDUCTION. Note, however, that the unmeasured variable Y is being
instantiated. When applied to the goal at hand the above induction
scheme produces the following two nontautological subgoals.
Subgoal *1/2
(IMPLIES (NOT (CONSP X)) (FOO X Y)).
Name the formula above *1.1.
Subgoal *1/1
(IMPLIES (AND (CONSP X) (FOO (CDR X) (G X Y)))
(FOO X Y)).
The destructor terms (CAR X) and (CDR X) can be eliminated by using
CARCDRELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2. This produces the following goal.
Subgoal *1/1'
(IMPLIES (AND (CONSP (CONS X1 X2))
(FOO X2 (G (CONS X1 X2) Y)))
(FOO (CONS X1 X2) Y)).
This simplifies, using primitive type reasoning, to
Subgoal *1/1''
(IMPLIES (FOO X2 (G (CONS X1 X2) Y))
(FOO (CONS X1 X2) Y)).
Name the formula above *1.2.
This formula is subsumed by one of its parents, *1, which we're in
the process of trying to prove by induction. When an inductive proof
gives rise to a subgoal that is less general than the original goal
it is a sign that either an inappropriate induction was chosen or that
the original goal is insufficiently general. In any case, our proof
attempt has failed.
Summary
Form: ( THM ...)
Rules: ((:ELIM CARCDRELIM)
(:FAKERUNEFORTYPESET NIL)
(:INDUCTION FOOINDUCTION))
Warnings: None
Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
******** FAILED ******** See :DOC failure ******** FAILED ********
ACL2 !>Bye.
Attempting to exit Lisp. If this fails to work, type :q and then try again.
sundance:~/class/march2007>