w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ ls 101-ordinals-make-ord.lisp notes.txt 101-ordinals.lisp rev3.lisp 101.lisp simple-demo.lisp w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>3 3 ACL2 !>(+ 3 4) 7 ACL2 !>(thm (equal (car (cons x y)) x)) But we reduce the conjecture to T, by the simple :rewrite rule CAR- CONS. Q.E.D. Summary Form: ( THM ...) Rules: ((:REWRITE CAR-CONS)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) Proof succeeded. ACL2 !>(defun app (x y) (if (consp x) (cons (car x) (app (cdr x) y)) y)) The admission of APP is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of APP is described by the theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive type reasoning. Summary Form: ( DEFUN APP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.03 seconds (prove: 0.00, print: 0.01, other: 0.03) APP ACL2 !>:pbt 1 L 1:x(DEFUN APP (X Y) ...) ACL2 !>:pbt 0 0 (EXIT-BOOT-STRAP-MODE) L 1:x(DEFUN APP (X Y) ...) ACL2 !>:u 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>:pbt 0 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>:oops Installing the requested world. Note that functions being re-defined during this procedure will not have compiled definitions, even if they had compiled definitions before the last :ubt or :u. L 1:x(DEFUN APP (X Y) ...) ACL2 !>:pbt 0 0 (EXIT-BOOT-STRAP-MODE) L 1:x(DEFUN APP (X Y) ...) ACL2 !>(app '(3 4 5) '(a b)) (3 4 5 A B) ACL2 !>(defun rev (x) (if (consp x) (app (rev (cdr x)) (list (car x))) nil)) The admission of REV is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV is described by the theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive type reasoning and the :type-prescription rule APP. Summary Form: ( DEFUN REV ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION APP)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01) REV ACL2 !>(defthm rev-app (equal (rev (app x y)) (app (rev y) (rev x)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, to Subgoal *1/2' (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL))). We generalize this conjecture, replacing (REV Y) by RV. This produces Subgoal *1/2'' (IMPLIES (NOT (CONSP X)) (EQUAL RV (APP RV NIL))). We suspect that the term (NOT (CONSP X)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1/2''' (EQUAL RV (APP RV NIL)). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.2. Perhaps we can prove *1.2 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.2/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (EQUAL RV (APP RV NIL)). Perhaps we can prove *1.1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (APP RV 'NIL). This suggestion was produced using the :induction rule APP. If we let (:P RV) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV)) (IMPLIES (AND (CONSP RV) (:P (CDR RV))) (:P RV))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV)) (EQUAL RV (APP RV NIL))). This simplifies, using the :definition APP and primitive type reasoning, to Subgoal *1.1/2' (IMPLIES (NOT (CONSP RV)) (NOT RV)). Name the formula above *1.1.1. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (EQUAL (CDR RV) (APP (CDR RV) NIL))) (EQUAL RV (APP RV NIL))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. So we now return to *1.1.1, which is (IMPLIES (NOT (CONSP RV)) (NOT RV)). No induction schemes are suggested by *1.1.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.14 seconds (prove: 0.06, print: 0.07, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm app-nil (implies (true-listp x) (equal (app x nil) x))) Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP X 'NIL). This suggestion was produced using the :induction rules APP and TRUE-LISTP. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definition TRUE-LISTP, the :executable-counterparts of APP, CONSP and EQUAL and primitive type reasoning. Subgoal *1/2 (IMPLIES (AND (CONSP X) (EQUAL (APP (CDR X) NIL) (CDR X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :rewrite rule CONS-CAR- CDR. Subgoal *1/1 (IMPLIES (AND (CONSP X) (NOT (TRUE-LISTP (CDR X))) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But we reduce the conjecture to T, by primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM APP-NIL ...) Rules: ((:DEFINITION APP) (:DEFINITION TRUE-LISTP) (:EXECUTABLE-COUNTERPART APP) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION TRUE-LISTP) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.04 seconds (prove: 0.01, print: 0.03, other: 0.00) APP-NIL ACL2 !>(defthm rev-app (equal (rev (app x y)) (app (rev y) (rev x)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, to Subgoal *1/2' (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL))). We generalize this conjecture, replacing (REV Y) by RV. This produces Subgoal *1/2'' (IMPLIES (NOT (CONSP X)) (EQUAL RV (APP RV NIL))). We suspect that the term (NOT (CONSP X)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1/2''' (EQUAL RV (APP RV NIL)). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.2. Perhaps we can prove *1.2 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.2/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (EQUAL RV (APP RV NIL)). Perhaps we can prove *1.1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (APP RV 'NIL). This suggestion was produced using the :induction rule APP. If we let (:P RV) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV)) (IMPLIES (AND (CONSP RV) (:P (CDR RV))) (:P RV))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV)) (EQUAL RV (APP RV NIL))). This simplifies, using the :definition APP and primitive type reasoning, to Subgoal *1.1/2' (IMPLIES (NOT (CONSP RV)) (NOT RV)). Name the formula above *1.1.1. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (EQUAL (CDR RV) (APP (CDR RV) NIL))) (EQUAL RV (APP RV NIL))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. So we now return to *1.1.1, which is (IMPLIES (NOT (CONSP RV)) (NOT RV)). No induction schemes are suggested by *1.1.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.19 seconds (prove: 0.05, print: 0.14, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm true-listp-rev (true-listp (rev x))) Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (TRUE-LISTP (REV X))). But simplification reduces this to T, using the :definition REV and the :executable-counterpart of TRUE-LISTP. Subgoal *1/1 (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (REV X))). This simplifies, using the :definition REV, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (APP (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (TRUE-LISTP (REV X2))) (TRUE-LISTP (APP (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (TRUE-LISTP (REV X2)) (TRUE-LISTP (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/1'4' (IMPLIES (TRUE-LISTP RV) (TRUE-LISTP (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)). This suggestion was produced using the :induction rules APP and TRUE- LISTP. If we let (:P RV X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV X1)) (IMPLIES (AND (CONSP RV) (:P (CDR RV) X1)) (:P RV X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1/3 (IMPLIES (AND (NOT (CONSP RV)) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1.1/2 (IMPLIES (AND (CONSP RV) (TRUE-LISTP (APP (CDR RV) (LIST X1))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :type-prescription rule APP. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (NOT (TRUE-LISTP (CDR RV))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But we reduce the conjecture to T, by primitive type reasoning. That completes the proofs of *1.1 and *1. Q.E.D. The storage of TRUE-LISTP-REV depends upon the :type-prescription rule TRUE-LISTP. Summary Form: ( DEFTHM TRUE-LISTP-REV ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART TRUE-LISTP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:TYPE-PRESCRIPTION APP) (:TYPE-PRESCRIPTION TRUE-LISTP)) Warnings: None Time: 0.10 seconds (prove: 0.02, print: 0.08, other: 0.00) TRUE-LISTP-REV ACL2 !>(defthm rev-app (equal (rev (app x y)) (app (rev y) (rev x)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). But simplification reduces this to T, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules APP-NIL and TRUE- LISTP-REV. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proofs of *1.1 and *1. Q.E.D. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE APP-NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE TRUE-LISTP-REV)) Warnings: None Time: 0.13 seconds (prove: 0.04, print: 0.09, other: 0.00) REV-APP ACL2 !>:u 4:x(DEFTHM TRUE-LISTP-REV ...) ACL2 !>:u 3:x(DEFTHM APP-NIL ...) ACL2 !>(defthm rev-app (equal (rev (app x y)) (app (rev y) (rev x)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, to Subgoal *1/2' (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL))). We generalize this conjecture, replacing (REV Y) by RV. This produces Subgoal *1/2'' (IMPLIES (NOT (CONSP X)) (EQUAL RV (APP RV NIL))). We suspect that the term (NOT (CONSP X)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1/2''' (EQUAL RV (APP RV NIL)). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.2. Perhaps we can prove *1.2 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.2/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (EQUAL RV (APP RV NIL)). Perhaps we can prove *1.1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (APP RV 'NIL). This suggestion was produced using the :induction rule APP. If we let (:P RV) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV)) (IMPLIES (AND (CONSP RV) (:P (CDR RV))) (:P RV))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV)) (EQUAL RV (APP RV NIL))). This simplifies, using the :definition APP and primitive type reasoning, to Subgoal *1.1/2' (IMPLIES (NOT (CONSP RV)) (NOT RV)). Name the formula above *1.1.1. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (EQUAL (CDR RV) (APP (CDR RV) NIL))) (EQUAL RV (APP RV NIL))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. So we now return to *1.1.1, which is (IMPLIES (NOT (CONSP RV)) (NOT RV)). No induction schemes are suggested by *1.1.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.12 seconds (prove: 0.04, print: 0.08, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(verify (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL)))) ->: p (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL))) ->: th *** Top-level hypotheses: There are no top-level hypotheses. The current subterm is: (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APP (REV Y) NIL))) ->: promote ->: th *** Top-level hypotheses: 1. (NOT (CONSP X)) The current subterm is: (EQUAL (REV Y) (APP (REV Y) NIL)) ->: 2 ->: p (APP (REV Y) NIL) ->: undo Undoing: (:DV 2) ->: p (EQUAL (REV Y) (APP (REV Y) NIL)) ->: (dv 2 0) ->: p (APP (REV Y) NIL) ->: p-top (EQUAL (REV Y) (*** (APP (REV Y) NIL) ***)) ->: p (APP (REV Y) NIL) ->: th *** Top-level hypotheses: 1. (NOT (CONSP X)) The current subterm is: (APP (REV Y) NIL) ->: show-rewrites 1. APP-NIL New term: (REV Y) Hypotheses: ((TRUE-LISTP (REV Y))) Equiv: EQUAL 2. APP New term: (AND (CONSP (REV Y)) (CONS (CAR (REV Y)) (APP (CDR (REV Y)) NIL))) Hypotheses: Equiv: EQUAL ->: sr 1. APP-NIL New term: (REV Y) Hypotheses: ((TRUE-LISTP (REV Y))) Equiv: EQUAL 2. APP New term: (AND (CONSP (REV Y)) (CONS (CAR (REV Y)) (APP (CDR (REV Y)) NIL))) Hypotheses: Equiv: EQUAL ->: (r 1) Rewriting with APP-NIL. Creating one new goal: (MAIN . 1). ->: goals MAIN (MAIN . 1) ->: p (REV Y) ->: p-top (EQUAL (REV Y) (*** (REV Y) ***)) ->: top ->: p (EQUAL (REV Y) (REV Y)) ->: s The proof of the current goal, MAIN, has been completed. However, the following subgoals remain to be proved: (MAIN . 1). Now proving (MAIN . 1). ->: goals (MAIN . 1) ->: th *** Top-level hypotheses: 1. (NOT (CONSP X)) The current subterm is: (TRUE-LISTP (REV Y)) ->: exit Exiting.... NIL ACL2 !>(good-bye) Quitting ACL2 and lisp; this may take a moment. For faster response time, exit the ACL2 loop with :q and then: type (GOOD-BYE) or (CCL:QUIT), then . ACL2 !>ACL2 !>w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>(certify-book "simple-demo") CERTIFICATION ATTEMPT FOR "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 Version 3.1 * Step 1: Read "/Users/kaufmann/class/march-2007/simple-demo.lisp" and compute its check sum. * Step 2: There were six forms in the file. We now attempt to establish that each form, whether local or non-local, is indeed an admissible embedded event form in the context of the previously admitted ones. Note that proof-tree output is inhibited during this check; see :DOC proof-tree. ACL2 >>(DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) The admission of APP is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of APP is described by the theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive type reasoning. Summary Form: ( DEFUN APP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02) APP ACL2 >>(DEFUN REV (X) (IF (CONSP X) (APP (REV (CDR X)) (LIST (CAR X))) NIL)) The admission of REV is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV is described by the theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive type reasoning and the :type-prescription rule APP. Summary Form: ( DEFUN REV ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION APP)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01) REV ACL2 >>(DEFTHM APP-NIL (IMPLIES (TRUE-LISTP X) (EQUAL (APP X NIL) X))) Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP X 'NIL). This suggestion was produced using the :induction rules APP and TRUE-LISTP. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definition TRUE-LISTP, the :executable-counterparts of APP, CONSP and EQUAL and primitive type reasoning. Subgoal *1/2 (IMPLIES (AND (CONSP X) (EQUAL (APP (CDR X) NIL) (CDR X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :rewrite rule CONS-CAR- CDR. Subgoal *1/1 (IMPLIES (AND (CONSP X) (NOT (TRUE-LISTP (CDR X))) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But we reduce the conjecture to T, by primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM APP-NIL ...) Rules: ((:DEFINITION APP) (:DEFINITION TRUE-LISTP) (:EXECUTABLE-COUNTERPART APP) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION TRUE-LISTP) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.02, other: 0.00) APP-NIL ACL2 >>(DEFTHM TRUE-LISTP-REV (TRUE-LISTP (REV X))) Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (TRUE-LISTP (REV X))). But simplification reduces this to T, using the :definition REV and the :executable-counterpart of TRUE-LISTP. Subgoal *1/1 (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (REV X))). This simplifies, using the :definition REV, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (APP (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (TRUE-LISTP (REV X2))) (TRUE-LISTP (APP (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (TRUE-LISTP (REV X2)) (TRUE-LISTP (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/1'4' (IMPLIES (TRUE-LISTP RV) (TRUE-LISTP (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)). This suggestion was produced using the :induction rules APP and TRUE- LISTP. If we let (:P RV X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV X1)) (IMPLIES (AND (CONSP RV) (:P (CDR RV) X1)) (:P RV X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1/3 (IMPLIES (AND (NOT (CONSP RV)) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1.1/2 (IMPLIES (AND (CONSP RV) (TRUE-LISTP (APP (CDR RV) (LIST X1))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :type-prescription rule APP. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (NOT (TRUE-LISTP (CDR RV))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But we reduce the conjecture to T, by primitive type reasoning. That completes the proofs of *1.1 and *1. Q.E.D. The storage of TRUE-LISTP-REV depends upon the :type-prescription rule TRUE-LISTP. Summary Form: ( DEFTHM TRUE-LISTP-REV ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART TRUE-LISTP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:TYPE-PRESCRIPTION APP) (:TYPE-PRESCRIPTION TRUE-LISTP)) Warnings: None Time: 0.05 seconds (prove: 0.01, print: 0.03, other: 0.00) TRUE-LISTP-REV ACL2 >>(DEFTHM REV-APP (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). But simplification reduces this to T, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules APP-NIL and TRUE- LISTP-REV. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proofs of *1.1 and *1. Q.E.D. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE APP-NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE TRUE-LISTP-REV)) Warnings: None Time: 0.09 seconds (prove: 0.03, print: 0.06, other: 0.00) REV-APP * Step 3: That completes the admissibility check. Each form read was an embedded event form and was admissible. We now retract back to the initial world and try to include the book. This may expose local incompatibilities. Summary Form: ( INCLUDE-BOOK "simple-demo" ...) Rules: NIL Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02) ACL2 Warning [Guards] in (CERTIFY-BOOK "simple-demo" ...): The book "/Users/kaufmann/class/march-2007/simple-demo.lisp" defines the functions APP and REV, which have not had their guards verified. See :DOC guards. * Step 4: Write the certificate for "/Users/kaufmann/class/march-2007/simple-demo.lisp" in "/Users/kaufmann/class/march-2007/simple-demo.cert". The final check sum alist is (("/Users/kaufmann/class/march-2007/simple-demo.lisp" "simple-demo" "simple-demo" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 112006708)). * Step 5: Compile the functions defined in "/Users/kaufmann/class/march-2007/simple-demo.lisp". "/Users/kaufmann/class/march-2007/simple-demo.dfsl" Summary Form: (CERTIFY-BOOK "simple-demo" ...) Rules: NIL Warnings: Guards Time: 0.25 seconds (prove: 0.05, print: 0.12, other: 0.09) "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 !>:pbt 0 0 (EXIT-BOOT-STRAP-MODE) 1:x(CERTIFY-BOOK "simple-demo") ACL2 !>:u 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(include-book "simple-demo") Summary Form: ( INCLUDE-BOOK "simple-demo" ...) Rules: NIL Warnings: None Time: 0.03 seconds (prove: 0.00, print: 0.00, other: 0.03) "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 !>:pbt 0 0 (EXIT-BOOT-STRAP-MODE) 1:x(INCLUDE-BOOK "simple-demo") ACL2 !>:pcb! :x 1:x(INCLUDE-BOOK "simple-demo") (INCLUDE-BOOK "/Users/kaufmann/class/march-2007/simple-demo.lisp") L (DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) L (DEFUN REV (X) (IF (CONSP X) (APP (REV (CDR X)) (LIST (CAR X))) NIL)) (DEFTHM APP-NIL (IMPLIES (TRUE-LISTP X) (EQUAL (APP X NIL) X))) (DEFTHM TRUE-LISTP-REV (TRUE-LISTP (REV X))) (DEFTHM REV-APP (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))) ACL2 !>(good-bye) Quitting ACL2 and lisp; this may take a moment. For faster response time, exit the ACL2 loop with :q and then: type (GOOD-BYE) or (CCL:QUIT), then . ACL2 !>ACL2 !>w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>(certify-book "simple-demo") CERTIFICATION ATTEMPT FOR "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 Version 3.1 * Step 1: Read "/Users/kaufmann/class/march-2007/simple-demo.lisp" and compute its check sum. * Step 2: There were six forms in the file. We now attempt to establish that each form, whether local or non-local, is indeed an admissible embedded event form in the context of the previously admitted ones. Note that proof-tree output is inhibited during this check; see :DOC proof-tree. ACL2 >>(DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) The admission of APP is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of APP is described by the theorem (OR (CONSP (APP X Y)) (EQUAL (APP X Y) Y)). We used primitive type reasoning. Summary Form: ( DEFUN APP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02) APP ACL2 >>(DEFUN REV (X) (IF (CONSP X) (APP (REV (CDR X)) (LIST (CAR X))) NIL)) The admission of REV is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV is described by the theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive type reasoning and the :type-prescription rule APP. Summary Form: ( DEFUN REV ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION APP)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01) REV ACL2 >>(LOCAL (DEFTHM APP-NIL (IMPLIES (TRUE-LISTP X) (EQUAL (APP X NIL) X)))) Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP X 'NIL). This suggestion was produced using the :induction rules APP and TRUE-LISTP. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definition TRUE-LISTP, the :executable-counterparts of APP, CONSP and EQUAL and primitive type reasoning. Subgoal *1/2 (IMPLIES (AND (CONSP X) (EQUAL (APP (CDR X) NIL) (CDR X)) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :rewrite rule CONS-CAR- CDR. Subgoal *1/1 (IMPLIES (AND (CONSP X) (NOT (TRUE-LISTP (CDR X))) (TRUE-LISTP X)) (EQUAL (APP X NIL) X)). But we reduce the conjecture to T, by primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM APP-NIL ...) Rules: ((:DEFINITION APP) (:DEFINITION TRUE-LISTP) (:EXECUTABLE-COUNTERPART APP) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION TRUE-LISTP) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.02, other: 0.00) APP-NIL ACL2 >>(LOCAL (DEFTHM TRUE-LISTP-REV (TRUE-LISTP (REV X)))) Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X)) (IMPLIES (AND (CONSP X) (:P (CDR X))) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (TRUE-LISTP (REV X))). But simplification reduces this to T, using the :definition REV and the :executable-counterpart of TRUE-LISTP. Subgoal *1/1 (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (REV X))). This simplifies, using the :definition REV, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (APP (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (TRUE-LISTP (REV X2))) (TRUE-LISTP (APP (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (TRUE-LISTP (REV X2)) (TRUE-LISTP (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/1'4' (IMPLIES (TRUE-LISTP RV) (TRUE-LISTP (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (APP RV (CONS X1 'NIL)). This suggestion was produced using the :induction rules APP and TRUE- LISTP. If we let (:P RV X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV)) (:P RV X1)) (IMPLIES (AND (CONSP RV) (:P (CDR RV) X1)) (:P RV X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1/3 (IMPLIES (AND (NOT (CONSP RV)) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1.1/2 (IMPLIES (AND (CONSP RV) (TRUE-LISTP (APP (CDR RV) (LIST X1))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But simplification reduces this to T, using the :definitions APP and TRUE-LISTP, primitive type reasoning and the :type-prescription rule APP. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV) (NOT (TRUE-LISTP (CDR RV))) (TRUE-LISTP RV)) (TRUE-LISTP (APP RV (LIST X1)))). But we reduce the conjecture to T, by primitive type reasoning. That completes the proofs of *1.1 and *1. Q.E.D. The storage of TRUE-LISTP-REV depends upon the :type-prescription rule TRUE-LISTP. Summary Form: ( DEFTHM TRUE-LISTP-REV ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART TRUE-LISTP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:TYPE-PRESCRIPTION APP) (:TYPE-PRESCRIPTION TRUE-LISTP)) Warnings: None Time: 0.07 seconds (prove: 0.01, print: 0.06, other: 0.00) TRUE-LISTP-REV ACL2 >>(DEFTHM REV-APP (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))) Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP X Y). This suggestion was produced using the :induction rules APP and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) Y)) (:P X Y))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). But simplification reduces this to T, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules APP-NIL and TRUE- LISTP-REV. Subgoal *1/1 (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))). This simplifies, using the :definitions APP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/1' (IMPLIES (AND (CONSP X) (EQUAL (REV (APP (CDR X) Y)) (APP (REV Y) (REV (CDR X))))) (EQUAL (APP (REV (APP (CDR X) Y)) (LIST (CAR X))) (APP (REV Y) (APP (REV (CDR X)) (LIST (CAR X)))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2)))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1/1''' (IMPLIES (EQUAL (REV (APP X2 Y)) (APP (REV Y) (REV X2))) (EQUAL (APP (REV (APP X2 Y)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1))))). We now use the hypothesis by substituting (APP (REV Y) (REV X2)) for (REV (APP X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/1'4' (EQUAL (APP (APP (REV Y) (REV X2)) (LIST X1)) (APP (REV Y) (APP (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/1'5' (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1)))). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (APP RV0 RV). This suggestion was produced using the :induction rule APP. If we let (:P RV RV0 X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP RV0)) (:P RV RV0 X1)) (IMPLIES (AND (CONSP RV0) (:P RV (CDR RV0) X1)) (:P RV RV0 X1))). This induction is justified by the same argument used to admit APP. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (NOT (CONSP RV0)) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP and primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (CONSP RV0) (EQUAL (APP (APP (CDR RV0) RV) (LIST X1)) (APP (CDR RV0) (APP RV (LIST X1))))) (EQUAL (APP (APP RV0 RV) (LIST X1)) (APP RV0 (APP RV (LIST X1))))). But simplification reduces this to T, using the :definition APP, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. That completes the proofs of *1.1 and *1. Q.E.D. Summary Form: ( DEFTHM REV-APP ...) Rules: ((:DEFINITION APP) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION APP) (:INDUCTION REV) (:REWRITE APP-NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE TRUE-LISTP-REV)) Warnings: None Time: 0.09 seconds (prove: 0.03, print: 0.06, other: 0.00) REV-APP * Step 3: That completes the admissibility check. Each form read was an embedded event form and was admissible. We now retract back to the initial world and try to include the book. This may expose local incompatibilities. Summary Form: ( INCLUDE-BOOK "simple-demo" ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) ACL2 Warning [Guards] in (CERTIFY-BOOK "simple-demo" ...): The book "/Users/kaufmann/class/march-2007/simple-demo.lisp" defines the functions APP and REV, which have not had their guards verified. See :DOC guards. * Step 4: Write the certificate for "/Users/kaufmann/class/march-2007/simple-demo.lisp" in "/Users/kaufmann/class/march-2007/simple-demo.cert". The final check sum alist is (("/Users/kaufmann/class/march-2007/simple-demo.lisp" "simple-demo" "simple-demo" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 111692738)). * Step 5: Compile the functions defined in "/Users/kaufmann/class/march-2007/simple-demo.lisp". "/Users/kaufmann/class/march-2007/simple-demo.dfsl" Summary Form: (CERTIFY-BOOK "simple-demo" ...) Rules: NIL Warnings: Guards Time: 0.28 seconds (prove: 0.05, print: 0.15, other: 0.08) "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 !>:pcb! :x 1:x(CERTIFY-BOOK "simple-demo") (INCLUDE-BOOK "/Users/kaufmann/class/march-2007/simple-demo.lisp" :LOAD-COMPILED-FILE NIL :UNCERTIFIED-OKP NIL :DEFAXIOMS-OKP NIL :SKIP-PROOFS-OKP NIL) L (DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) L (DEFUN REV (X) (IF (CONSP X) (APP (REV (CDR X)) (LIST (CAR X))) NIL)) (DEFTHM REV-APP (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))) ACL2 !>:pe app 1:x(CERTIFY-BOOK "simple-demo") \ [Included books, outermost to innermost: "/Users/kaufmann/class/march-2007/simple-demo.lisp" ] \ >L (DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) ACL2 !>:pe app-nil ACL2 Error in :PE: The object APP-NIL is not a logical name. See :DOC logical-name. ACL2 !>:u 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(include-book "simple-demo") Summary Form: ( INCLUDE-BOOK "simple-demo" ...) Rules: NIL Warnings: None Time: 0.03 seconds (prove: 0.00, print: 0.00, other: 0.03) "/Users/kaufmann/class/march-2007/simple-demo.lisp" ACL2 !>:pe app-nil ACL2 Error in :PE: The object APP-NIL is not a logical name. See :DOC logical-name. ACL2 !>:pcb! :x 1:x(INCLUDE-BOOK "simple-demo") (INCLUDE-BOOK "/Users/kaufmann/class/march-2007/simple-demo.lisp") L (DEFUN APP (X Y) (IF (CONSP X) (CONS (CAR X) (APP (CDR X) Y)) Y)) L (DEFUN REV (X) (IF (CONSP X) (APP (REV (CDR X)) (LIST (CAR X))) NIL)) (DEFTHM REV-APP (EQUAL (REV (APP X Y)) (APP (REV Y) (REV X)))) ACL2 !>:u 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>:pbt 0 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (if (p y) (cons (m y) 2) 1)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) ACL2 Error in ( DEFUN F4 ...): The symbol P (in package "ACL2") has neither a function nor macro definition in ACL2. Please define it. Summary Form: ( DEFUN F4 ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(encapsulate ((p (x) t) (m (x) t) (up (x) t) (dn (x) t)) (local (defun p (x) (posp x))) ; or, (not (zp x)) (local (defun m (x) (nfix x))) ; or, (acl2-count x) (defthm o-p-m (o-p (m x))) (local (defun dn (x) (1- x))) ; or, (- x 1) (defthm dn-goes-down (implies (p x) (o< (m (dn x)) (m x)))) (local (defun up (x) (1+ x))) ; or, x ) To verify that the six encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 !>>(LOCAL (DEFUN P (X) (POSP X))) Since P is non-recursive, its admission is trivial. We observe that the type of P is described by the theorem (OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compound-recognizer rule POSP-COMPOUND-RECOGNIZER. Summary Form: ( DEFUN P ...) Rules: ((:COMPOUND-RECOGNIZER POSP-COMPOUND-RECOGNIZER)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) P ACL2 !>>(LOCAL (DEFUN M (X) (NFIX X))) Since M is non-recursive, its admission is trivial. We observe that the type of M is described by the theorem (AND (INTEGERP (M X)) (<= 0 (M X))). We used the :type-prescription rule NFIX. Summary Form: ( DEFUN M ...) Rules: ((:TYPE-PRESCRIPTION NFIX)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) M ACL2 !>>(DEFTHM O-P-M (O-P (M X))) ACL2 Warning [Non-rec] in ( DEFTHM O-P-M ...): A :REWRITE rule generated from O-P-M will be triggered only by terms containing the non-recursive function symbol M. Unless this function is disabled, this rule is unlikely ever to be used. By the simple :definition M we reduce the conjecture to Goal' (O-P (NFIX X)). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NFIX, O-FINP and O-P. Q.E.D. The storage of O-P-M depends upon the :type-prescription rule O-P. Summary Form: ( DEFTHM O-P-M ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O-P) (:TYPE-PRESCRIPTION O-P)) Warnings: Non-rec Time: 0.06 seconds (prove: 0.00, print: 0.00, other: 0.05) O-P-M ACL2 !>>(LOCAL (DEFUN DN (X) (1- X))) Since DN is non-recursive, its admission is trivial. We observe that the type of DN is described by the theorem (ACL2-NUMBERP (DN X)). We used primitive type reasoning. Summary Form: ( DEFUN DN ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) DN ACL2 !>>(DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) ACL2 Warning [Non-rec] in ( DEFTHM DN-GOES-DOWN ...): A :REWRITE rule generated from DN-GOES-DOWN will be triggered only by terms containing the non-recursive function symbols DN and M. Unless these functions are disabled, this rule is unlikely ever to be used. By the simple :definitions DN, M, P and POSP we reduce the conjecture to Goal' (IMPLIES (AND (INTEGERP X) (< 0 X)) (O< (NFIX (+ -1 X)) (NFIX X))). This simplifies, using the :definitions NFIX, O-FINP and O< and primitive type reasoning, to Goal'' (IMPLIES (AND (INTEGERP X) (< 0 X)) (< (+ -1 X) X)). But simplification reduces this to T, using linear arithmetic and primitive type reasoning. Q.E.D. The storage of DN-GOES-DOWN depends upon the :type-prescription rule O<. Summary Form: ( DEFTHM DN-GOES-DOWN ...) Rules: ((:DEFINITION DN) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O<) (:DEFINITION P) (:DEFINITION POSP) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION O<)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) DN-GOES-DOWN ACL2 !>>(LOCAL (DEFUN UP (X) (1+ X))) Since UP is non-recursive, its admission is trivial. We observe that the type of UP is described by the theorem (ACL2-NUMBERP (UP X)). We used primitive type reasoning. Summary Form: ( DEFUN UP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) UP End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. The following constraint is associated with every one of the functions P, M, UP and DN: (AND (O-P (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X)))) Summary Form: ( ENCAPSULATE ((P ...) ...) ...) Rules: NIL Warnings: Non-rec Time: 0.11 seconds (prove: 0.00, print: 0.02, other: 0.09) T ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (if (p y) (cons (m y) 2) 1)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)))). By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and O-P-M, to the following two conjectures. Subgoal 3.3.2 (IMPLIES (P X) (NOT (EQUAL 0 (M X)))). Name the formula above *1. Subgoal 3.3.1 (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *2. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P '(1 . 0))). By the :executable-counterpart of O-P we reduce the conjecture to Subgoal 3.2' (IMPLIES (AND (P X) (NOT Q)) (P Y)). This simplifies, using trivial observations, to Subgoal 3.2'' (IMPLIES (P X) (P Y)). Name the formula above *3. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and O-P-M, to the following two conjectures. Subgoal 3.1.2 (IMPLIES (AND (P X) (P Y)) (NOT (EQUAL 0 (M Y)))). Name the formula above *4. Subgoal 3.1.1 (IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y)))) (< 0 (M Y))). Name the formula above *5. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 '(1 . 0))). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *6. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< '(1 . 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of <, EQUAL, O-FINP, O-FIRST- COEFF and O-FIRST-EXPT, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DEFAULT-<-1, to Subgoal 1.1' (IMPLIES (AND (P X) (P Y) (NOT (P (DN X))) (M X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *7. But this formula is subsumed by *5, which we'll try to prove later. We therefore regard *7 as proved (pending the proof of the more general *5). We next consider *6, which is (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *6. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-COEFF) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DEFAULT-<-1) (:REWRITE DN-GOES-DOWN) (:REWRITE O-P-M)) Warnings: None Time: 0.12 seconds (prove: 0.03, print: 0.08, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>:start-proof-tree Proof tree output is now enabled. Note that :START-PROOF-TREE works by removing 'proof-tree from the inhibit-output-lst; see :DOC set- inhibit-output-lst. ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (if (p y) (cons (m y) 2) 1)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and O-P-M, to the following two conjectures. Subgoal 3.3.2 (IMPLIES (P X) (NOT (EQUAL 0 (M X)))). Name the formula above *1. Subgoal 3.3.1 (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *2. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P '(1 . 0))). By the :executable-counterpart of O-P we reduce the conjecture to Subgoal 3.2' (IMPLIES (AND (P X) (NOT Q)) (P Y)). This simplifies, using trivial observations, to Subgoal 3.2'' (IMPLIES (P X) (P Y)). Name the formula above *3. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and O-P-M, to the following two conjectures. Subgoal 3.1.2 (IMPLIES (AND (P X) (P Y)) (NOT (EQUAL 0 (M Y)))). Name the formula above *4. Subgoal 3.1.1 (IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y)))) (< 0 (M Y))). Name the formula above *5. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 '(1 . 0))). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *6. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< '(1 . 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of <, EQUAL, O-FINP, O-FIRST- COEFF and O-FIRST-EXPT, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DEFAULT-<-1, to Subgoal 1.1' (IMPLIES (AND (P X) (P Y) (NOT (P (DN X))) (M X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *7. But this formula is subsumed by *5, which we'll try to prove later. We therefore regard *7 as proved (pending the proof of the more general *5). We next consider *6, which is (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *6. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-COEFF) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DEFAULT-<-1) (:REWRITE DN-GOES-DOWN) (:REWRITE O-P-M)) Warnings: None Time: 0.26 seconds (prove: 0.04, print: 0.08, proof tree: 0.14, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-1 (implies (p x) (not (equal 0 (m x)))) ; (equal (equal 0 (m x)) nil) :hints (("Goal" :in-theory (disable dn-goes-down) :use dn-goes-down))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL 0 (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL 0 (M X)))). This simplifies, using the :definitions O-FINP and O< and the :executable- counterpart of O-FINP, to Goal''' (IMPLIES (AND (NOT (CONSP (M (DN X)))) (< (M (DN X)) 0) (P X)) (NOT (EQUAL 0 (M X)))). This simplifies, using trivial observations, to Goal'4' (IMPLIES (AND (< (M (DN X)) 0) (P X)) (NOT (EQUAL 0 (M X)))). Normally we would attempt to prove this formula by induction. However, we prefer in this instance to focus on the original input conjecture rather than this simplified special case. We therefore abandon our previous work on this conjecture and reassign the name *1 to the original conjecture. (See :DOC otf-flg.) [Note: Thanks again for the hint.] No induction schemes are suggested by *1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM LEMMA-1 ...) Rules: ((:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART O-FINP)) Warnings: None Time: 0.07 seconds (prove: 0.02, print: 0.02, proof tree: 0.01, other: 0.01) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-1-1 (not (< (m x) 0))) << Starting proof tree logging >> Name the formula above *1. No induction schemes are suggested by *1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM LEMMA-1-1 ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-1-1 (not (< (m x) 0)) :hints (("Goal" :use o-p-m :in-theory (disable o-p-m)))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from O-P-M. We are left with the following subgoal. Goal' (IMPLIES (O-P (M X)) (<= 0 (M X))). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions O-FINP and O-P. Q.E.D. Summary Form: ( DEFTHM LEMMA-1-1 ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION O-FINP) (:DEFINITION O-P)) Warnings: None Time: 0.03 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.01) LEMMA-1-1 ACL2 !>(defthm lemma-1 (implies (p x) (not (equal 0 (m x)))) :hints (("Goal" :in-theory (disable dn-goes-down) :use dn-goes-down))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL 0 (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL 0 (M X)))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and the :rewrite rule LEMMA-1-1. Q.E.D. Summary Form: ( DEFTHM LEMMA-1 ...) Rules: ((:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART O-FINP) (:REWRITE LEMMA-1-1)) Warnings: None Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02) LEMMA-1 ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (if (p y) (cons (m y) 2) 1)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1 and O-P-M, to Subgoal 3.3' (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *1. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P '(1 . 0))). By the :executable-counterpart of O-P we reduce the conjecture to Subgoal 3.2' (IMPLIES (AND (P X) (NOT Q)) (P Y)). This simplifies, using trivial observations, to Subgoal 3.2'' (IMPLIES (P X) (P Y)). Name the formula above *2. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1 and O-P-M, to Subgoal 3.1' (IMPLIES (AND (P X) (P Y) (NOT (CONSP (M Y)))) (< 0 (M Y))). Name the formula above *3. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 '(1 . 0))). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *4. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< '(1 . 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of <, EQUAL, O-FINP, O-FIRST- COEFF and O-FIRST-EXPT, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DEFAULT-<-1, to Subgoal 1.1' (IMPLIES (AND (P X) (P Y) (NOT (P (DN X))) (M X) (NOT (CONSP (M X)))) (< 0 (M X))). Name the formula above *5. But this formula is subsumed by *3, which we'll try to prove later. We therefore regard *5 as proved (pending the proof of the more general *3). We next consider *4, which is (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *4. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-COEFF) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DEFAULT-<-1) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE O-P-M)) Warnings: None Time: 0.17 seconds (prove: 0.04, print: 0.07, proof tree: 0.06, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-2 (implies (and (p x) (not (consp (m x)))) (< 0 (m x))) :hints (("Goal" :use (lemma-1 o-p-m) :in-theory (disable lemma-1 o-p-m)))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypotheses provided by the :USE hint. These hypotheses can be obtained from LEMMA-1 and O-P-M. We are left with the following subgoal. Goal' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (O-P (M X))) (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X)))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (O-P (M X)) (P X) (NOT (CONSP (M X)))) (< 0 (M X))). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NOT, O-FINP and O-P. Q.E.D. Summary Form: ( DEFTHM LEMMA-2 ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-P)) Warnings: None Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.01) LEMMA-2 ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (if (p y) (cons (m y) 2) 1)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P '(1 . 0))). By the :executable-counterpart of O-P we reduce the conjecture to Subgoal 3.2' (IMPLIES (AND (P X) (NOT Q)) (P Y)). This simplifies, using trivial observations, to Subgoal 3.2'' (IMPLIES (P X) (P Y)). Name the formula above *1. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (UP X)) (CONS (M (UP X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 '(1 . 0))). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (COND ((NOT Q) (CONS (M Y) 1)) ((P (DN X)) (CONS (M (DN X)) 2)) (T 1)) 0) 0) (IF (P X) (CONS (COND (Q (CONS (M X) 1)) ((P Y) (CONS (M Y) 2)) (T 1)) 0) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *2. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< '(1 . 0) (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of <, EQUAL, O-FINP, O-FIRST-COEFF and O-FIRST-EXPT, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, DEFAULT-<-1 and LEMMA-2. So we now return to *2, which is (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *2. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-COEFF) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DEFAULT-<-1) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE LEMMA-2) (:REWRITE O-P-M)) Warnings: None Time: 0.13 seconds (prove: 0.02, print: 0.07, proof tree: 0.04, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (cons (if q (cons (m x) 1) (cons (m y) 2)) 0) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0). The non- trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (IF (NOT Q) (CONS (M Y) 1) (CONS (M (UP X)) 2)) 0) 0) (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (IF (NOT Q) (CONS (M Y) 1) (CONS (M (DN X)) 2)) 0) 0) (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0)). This simplifies, using trivial observations, to the following three conjectures. Subgoal 3.3 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.2 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q)) (O-P (CONS (CONS (M Y) 2) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O- FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and O-P-M, to the following two conjectures. Subgoal 3.1.2 (IMPLIES (P X) (NOT (EQUAL 0 (M Y)))). Name the formula above *1. Subgoal 3.1.1 (IMPLIES (AND (P X) (NOT (CONSP (M Y)))) (< 0 (M Y))). Name the formula above *2. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (CONS (IF (NOT Q) (CONS (M Y) 1) (CONS (M (UP X)) 2)) 0) 0) (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (CONS (IF (NOT Q) (CONS (M Y) 1) (CONS (M (DN X)) 2)) 0) 0) (IF (P X) (CONS (IF Q (CONS (M X) 1) (CONS (M Y) 2)) 0) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following two conjectures. Subgoal 1.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y)) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *3. Subgoal 1.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. So we now return to *3, which is (IMPLIES (AND (P X) (P Y)) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *3. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE LEMMA-2) (:REWRITE O-P-M)) Warnings: None Time: 0.27 seconds (prove: 0.02, print: 0.09, proof tree: 0.15, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (if q (cons (cons (m x) 1) 0) ; (make-ord (m x) 1 0) (if (p y) (cons (cons (m y) 2) 0) ; (make-ord (m y) 2 0) 1)) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and DN-GOES- DOWN, to Subgoal 1.2' (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). Name the formula above *1. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. So we now return to *1, which is (IMPLIES (AND (P X) (P Y) (P (DN X))) (NOT (EQUAL (M (DN X)) (M X)))). No induction schemes are suggested by *1. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE LEMMA-2) (:REWRITE O-P-M)) Warnings: None Time: 0.14 seconds (prove: 0.02, print: 0.10, proof tree: 0.02, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-3 (implies (p x) (not (equal (m (dn x)) (m x)))) :hints (("Goal" :in-theory (disable dn-goes-down) :use dn-goes-down))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL (M (DN X)) (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). This simplifies, using trivial observations, to Goal''' (IMPLIES (AND (O< (M X) (M X)) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). We now use the conclusion by substituting (M (DN X)) for (M X) and hiding the conclusion. This produces Goal'4' (IMPLIES (AND (O< (M (DN X)) (M (DN X))) (P X)) (NOT (HIDE (EQUAL (M (DN X)) (M X))))). We remove HIDE from the conclusion, which was used heuristically to transform Goal''' by substituting into the rest of that goal. This produces Goal'5' (IMPLIES (AND (O< (M (DN X)) (M (DN X))) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). This simplifies, using trivial observations, to Goal'6' (IMPLIES (AND (O< (M X) (M X)) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). Normally we would attempt to prove this formula by induction. However, we prefer in this instance to focus on the original input conjecture rather than this simplified special case. We therefore abandon our previous work on this conjecture and reassign the name *1 to the original conjecture. (See :DOC otf-flg.) [Note: Thanks again for the hint.] No induction schemes are suggested by *1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM LEMMA-3 ...) Rules: ((:DEFINITION HIDE) (:DEFINITION NOT)) Warnings: None Time: 0.09 seconds (prove: 0.03, print: 0.03, proof tree: 0.02, other: 0.02) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-3-1 (not (o< x x))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (O< X X). This suggestion was produced using the :induction rule O<. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)) (:P (O-RST X))) (:P X)) (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (NOT (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)))) (:P X)) (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (NOT (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (:P (O-FIRST-EXPT X))) (:P X)) (IMPLIES (AND (O-FINP X) (O-FINP X)) (:P X))). This induction is justified by the same argument used to admit O<. When applied to the goal at hand the above induction scheme produces the following four nontautological subgoals. Subgoal *1/4 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)) (O<= (O-RST X) (O-RST X))) (O<= X X)). By the simple :definitions =, O-FINP and O-RST we reduce the conjecture to Subgoal *1/4' (IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X))) (O<= X X)). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O< and primitive type reasoning, to Subgoal *1/4'' (IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X))) (O<= (O-RST X) (O-RST X))). But we reduce the conjecture to T, by the simple :definition O-RST. Subgoal *1/3 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (NOT (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)))) (O<= X X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/2 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (NOT (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (O<= (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (O<= X X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/1 (IMPLIES (AND (O-FINP X) (O-FINP X)) (O<= X X)). By the simple :definition O-FINP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (O<= X X)). This simplifies, using the :definitions O-FINP and O<, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (<= X X)). But simplification reduces this to T, using linear arithmetic. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM LEMMA-3-1 ...) Rules: ((:DEFINITION =) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART NOT) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION O<)) Warnings: None Time: 0.06 seconds (prove: 0.01, print: 0.04, proof tree: 0.02, other: 0.00) LEMMA-3-1 ACL2 !>(defthm lemma-3 (implies (p x) (not (equal (m (dn x)) (m x)))) :hints (("Goal" :in-theory (disable dn-goes-down) :use dn-goes-down))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL (M (DN X)) (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). But simplification reduces this to T, using the :rewrite rule LEMMA- 3-1. Q.E.D. Summary Form: ( DEFTHM LEMMA-3 ...) Rules: ((:DEFINITION NOT) (:REWRITE LEMMA-3-1)) Warnings: None Time: 0.04 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02) LEMMA-3 ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (if q (cons (cons (m x) 1) 0) ; (make-ord (m x) 1 0) (if (p y) (cons (cons (m y) 2) 0) ; (make-ord (m y) 2 0) 1)) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-EXPT and O<, primitive type reasoning and the :rewrite rules CAR-CONS, DN-GOES-DOWN and LEMMA-3. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Q.E.D. That completes the proof of the measure theorem for F4. Thus, we admit this function under the principle of definition.We observe that the type of F4 is described by the theorem (AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))). Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE LEMMA-2) (:REWRITE LEMMA-3) (:REWRITE O-P-M)) Warnings: None Time: 0.10 seconds (prove: 0.02, print: 0.06, proof tree: 0.02, other: 0.01) F4 ACL2 !>Bye. Quitting ACL2 and lisp; this may take a moment. For faster response time, exit the ACL2 loop with :q and then: type (GOOD-BYE) or (CCL:QUIT), then . ACL2 !>ACL2 !>w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>(certify-book "101") CERTIFICATION ATTEMPT FOR "/Users/kaufmann/class/march-2007/101.lisp" ACL2 Version 3.1 * Step 1: Read "/Users/kaufmann/class/march-2007/101.lisp" and compute its check sum. * Step 2: There were eight forms in the file. We now attempt to establish that each form, whether local or non-local, is indeed an admissible embedded event form in the context of the previously admitted ones. Note that proof-tree output is inhibited during this check; see :DOC proof-tree. ACL2 >>(ENCAPSULATE ((P (X) T) (M (X) T) (UP (X) T) (DN (X) T)) (LOCAL (DEFUN P (X) (POSP X))) (LOCAL (DEFUN M (X) (NFIX X))) (DEFTHM O-P-M (O-P (M X))) (LOCAL (DEFUN DN (X) (1- X))) (DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) (LOCAL (DEFUN UP (X) (1+ X)))) To verify that the six encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 >>(LOCAL (DEFUN P (X) (POSP X))) Since P is non-recursive, its admission is trivial. We observe that the type of P is described by the theorem (OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compound-recognizer rule POSP-COMPOUND-RECOGNIZER. Summary Form: ( DEFUN P ...) Rules: ((:COMPOUND-RECOGNIZER POSP-COMPOUND-RECOGNIZER)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) P ACL2 >>(LOCAL (DEFUN M (X) (NFIX X))) Since M is non-recursive, its admission is trivial. We observe that the type of M is described by the theorem (AND (INTEGERP (M X)) (<= 0 (M X))). We used the :type-prescription rule NFIX. Summary Form: ( DEFUN M ...) Rules: ((:TYPE-PRESCRIPTION NFIX)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) M ACL2 >>(DEFTHM O-P-M (O-P (M X))) ACL2 Warning [Non-rec] in ( DEFTHM O-P-M ...): A :REWRITE rule generated from O-P-M will be triggered only by terms containing the non-recursive function symbol M. Unless this function is disabled, this rule is unlikely ever to be used. By the simple :definition M we reduce the conjecture to Goal' (O-P (NFIX X)). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NFIX, O-FINP and O-P. Q.E.D. The storage of O-P-M depends upon the :type-prescription rule O-P. Summary Form: ( DEFTHM O-P-M ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O-P) (:TYPE-PRESCRIPTION O-P)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) O-P-M ACL2 >>(LOCAL (DEFUN DN (X) (1- X))) Since DN is non-recursive, its admission is trivial. We observe that the type of DN is described by the theorem (ACL2-NUMBERP (DN X)). We used primitive type reasoning. Summary Form: ( DEFUN DN ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) DN ACL2 >>(DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) ACL2 Warning [Non-rec] in ( DEFTHM DN-GOES-DOWN ...): A :REWRITE rule generated from DN-GOES-DOWN will be triggered only by terms containing the non-recursive function symbols DN and M. Unless these functions are disabled, this rule is unlikely ever to be used. By the simple :definitions DN, M, P and POSP we reduce the conjecture to Goal' (IMPLIES (AND (INTEGERP X) (< 0 X)) (O< (NFIX (+ -1 X)) (NFIX X))). This simplifies, using the :definitions NFIX, O-FINP and O< and primitive type reasoning, to Goal'' (IMPLIES (AND (INTEGERP X) (< 0 X)) (< (+ -1 X) X)). But simplification reduces this to T, using linear arithmetic and primitive type reasoning. Q.E.D. The storage of DN-GOES-DOWN depends upon the :type-prescription rule O<. Summary Form: ( DEFTHM DN-GOES-DOWN ...) Rules: ((:DEFINITION DN) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O<) (:DEFINITION P) (:DEFINITION POSP) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION O<)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) DN-GOES-DOWN ACL2 >>(LOCAL (DEFUN UP (X) (1+ X))) Since UP is non-recursive, its admission is trivial. We observe that the type of UP is described by the theorem (ACL2-NUMBERP (UP X)). We used primitive type reasoning. Summary Form: ( DEFUN UP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) UP End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. The following constraint is associated with every one of the functions P, M, UP and DN: (AND (O-P (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X)))) Summary Form: ( ENCAPSULATE ((P ...) ...) ...) Rules: NIL Warnings: Non-rec Time: 0.05 seconds (prove: 0.00, print: 0.02, other: 0.03) T ACL2 >>(DEFTHM LEMMA-1-1 (NOT (< (M X) 0)) :HINTS (("Goal" :USE O-P-M :IN-THEORY (DISABLE O-P-M)))) [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from O-P-M. We are left with the following subgoal. Goal' (IMPLIES (O-P (M X)) (<= 0 (M X))). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions O-FINP and O-P. Q.E.D. Summary Form: ( DEFTHM LEMMA-1-1 ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION O-FINP) (:DEFINITION O-P)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.01) LEMMA-1-1 ACL2 >>(DEFTHM LEMMA-1 (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) :HINTS (("Goal" :IN-THEORY (DISABLE DN-GOES-DOWN) :USE DN-GOES-DOWN))) [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL 0 (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL 0 (M X)))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and the :rewrite rule LEMMA-1-1. Q.E.D. Summary Form: ( DEFTHM LEMMA-1 ...) Rules: ((:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART O-FINP) (:REWRITE LEMMA-1-1)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01) LEMMA-1 ACL2 >>(DEFTHM LEMMA-2 (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X))) :HINTS (("Goal" :USE (LEMMA-1 O-P-M) :IN-THEORY (DISABLE LEMMA-1 O-P-M)))) [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypotheses provided by the :USE hint. These hypotheses can be obtained from LEMMA-1 and O-P-M. We are left with the following subgoal. Goal' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (O-P (M X))) (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X)))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (O-P (M X)) (P X) (NOT (CONSP (M X)))) (< 0 (M X))). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NOT, O-FINP and O-P. Q.E.D. Summary Form: ( DEFTHM LEMMA-2 ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-P)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01) LEMMA-2 ACL2 >>(DEFTHM LEMMA-3-1 (NOT (O< X X))) Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (O< X X). This suggestion was produced using the :induction rule O<. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)) (:P (O-RST X))) (:P X)) (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (NOT (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)))) (:P X)) (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (NOT (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (:P (O-FIRST-EXPT X))) (:P X)) (IMPLIES (AND (O-FINP X) (O-FINP X)) (:P X))). This induction is justified by the same argument used to admit O<. When applied to the goal at hand the above induction scheme produces the following four nontautological subgoals. Subgoal *1/4 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)) (O<= (O-RST X) (O-RST X))) (O<= X X)). By the simple :definitions =, O-FINP and O-RST we reduce the conjecture to Subgoal *1/4' (IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X))) (O<= X X)). This simplifies, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST- EXPT and O< and primitive type reasoning, to Subgoal *1/4'' (IMPLIES (AND (CONSP X) (O<= (CDR X) (CDR X))) (O<= (O-RST X) (O-RST X))). But we reduce the conjecture to T, by the simple :definition O-RST. Subgoal *1/3 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X)) (NOT (= (O-FIRST-COEFF X) (O-FIRST-COEFF X)))) (O<= X X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/2 (IMPLIES (AND (NOT (O-FINP X)) (NOT (O-FINP X)) (NOT (EQUAL (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (O<= (O-FIRST-EXPT X) (O-FIRST-EXPT X))) (O<= X X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/1 (IMPLIES (AND (O-FINP X) (O-FINP X)) (O<= X X)). By the simple :definition O-FINP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (O<= X X)). This simplifies, using the :definitions O-FINP and O<, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (<= X X)). But simplification reduces this to T, using linear arithmetic. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM LEMMA-3-1 ...) Rules: ((:DEFINITION =) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART NOT) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION O<)) Warnings: None Time: 0.03 seconds (prove: 0.01, print: 0.03, other: 0.00) LEMMA-3-1 ACL2 >>(DEFTHM LEMMA-3 (IMPLIES (P X) (NOT (EQUAL (M (DN X)) (M X)))) :HINTS (("Goal" :IN-THEORY (DISABLE DN-GOES-DOWN) :USE DN-GOES-DOWN))) [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL (M (DN X)) (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL (M (DN X)) (M X)))). But simplification reduces this to T, using the :rewrite rule LEMMA- 3-1. Q.E.D. Summary Form: ( DEFTHM LEMMA-3 ...) Rules: ((:DEFINITION NOT) (:REWRITE LEMMA-3-1)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.01) LEMMA-3 ACL2 >>(DEFUN F4 (X Y Q) (DECLARE (XARGS :MEASURE (IF (P X) (IF Q (CONS (CONS (M X) 1) 0) (IF (P Y) (CONS (CONS (M Y) 2) 0) 1)) 0))) (IF (P X) (IF Q (F4 Y (DN X) (NOT Q)) (F4 Y (UP X) (NOT Q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)))). By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT, O-P, O-RST and O<, the :executable-counterparts of O-FINP, O-FIRST-EXPT, O-P and POSP, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, LEMMA-1, LEMMA-2 and O-P-M. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (UP X)) (CONS (CONS (M (UP X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (CONS (CONS (M Y) 1) 0) (CONS (CONS (M Y) 2) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-COEFF, O-FIRST-EXPT and O<, the :executable-counterparts of < and EQUAL, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (CONS (CONS (M Y) 1) 0)) ((P (DN X)) (CONS (CONS (M (DN X)) 2) 0)) (T 1)) 0) (IF (P X) (COND (Q (CONS (CONS (M X) 1) 0)) ((P Y) (CONS (CONS (M Y) 2) 0)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (CONS (CONS (M (DN X)) 2) 0) (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP, O-FIRST-EXPT and O<, primitive type reasoning and the :rewrite rules CAR-CONS, DN-GOES-DOWN and LEMMA-3. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (CONS (CONS (M X) 1) 0))). But simplification reduces this to T, using the :definitions O-FINP and O<, the :executable-counterpart of O-FINP and primitive type reasoning. Q.E.D. That completes the proof of the measure theorem for F4. Thus, we admit this function under the principle of definition.We observe that the type of F4 is described by the theorem (AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))). Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:DEFINITION O-FINP) (:DEFINITION O-FIRST-COEFF) (:DEFINITION O-FIRST-EXPT) (:DEFINITION O-P) (:DEFINITION O-RST) (:DEFINITION O<) (:EXECUTABLE-COUNTERPART <) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FINP) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:EXECUTABLE-COUNTERPART POSP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE LEMMA-2) (:REWRITE LEMMA-3) (:REWRITE O-P-M)) Warnings: None Time: 0.08 seconds (prove: 0.02, print: 0.05, other: 0.01) F4 * Step 3: That completes the admissibility check. Each form read was an embedded event form and was admissible. We now retract back to the initial world and try to include the book. This may expose local incompatibilities. Summary Form: ( INCLUDE-BOOK "101" ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) ACL2 Warning [Guards] in (CERTIFY-BOOK "101" ...): The book "/Users/kaufmann/class/march-2007/101.lisp" defines the function F4, which has not had its guards verified. See :DOC guards. * Step 4: Write the certificate for "/Users/kaufmann/class/march-2007/101.lisp" in "/Users/kaufmann/class/march-2007/101.cert". The final check sum alist is (("/Users/kaufmann/class/march-2007/101.lisp" "101" "101" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 142813943)). * Step 5: Compile the functions defined in "/Users/kaufmann/class/march-2007/101.lisp". "/Users/kaufmann/class/march-2007/101.dfsl" Summary Form: (CERTIFY-BOOK "101" ...) Rules: NIL Warnings: Guards and Non-rec Time: 0.29 seconds (prove: 0.04, print: 0.12, other: 0.13) "/Users/kaufmann/class/march-2007/101.lisp" ACL2 !>:u 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(encapsulate ((p (x) t) (m (x) t) (up (x) t) (dn (x) t)) (local (defun p (x) (posp x))) ; or, (not (zp x)) (local (defun m (x) (nfix x))) ; or, (acl2-count x) (defthm o-p-m (o-p (m x))) (local (defun dn (x) (1- x))) ; or, (- x 1) (defthm dn-goes-down (implies (p x) (o< (m (dn x)) (m x)))) (local (defun up (x) (1+ x))) ; or, x ) To verify that the six encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 !>>(LOCAL (DEFUN P (X) (POSP X))) Since P is non-recursive, its admission is trivial. We observe that the type of P is described by the theorem (OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compound-recognizer rule POSP-COMPOUND-RECOGNIZER. Summary Form: ( DEFUN P ...) Rules: ((:COMPOUND-RECOGNIZER POSP-COMPOUND-RECOGNIZER)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.01, other: 0.01) P ACL2 !>>(LOCAL (DEFUN M (X) (NFIX X))) Since M is non-recursive, its admission is trivial. We observe that the type of M is described by the theorem (AND (INTEGERP (M X)) (<= 0 (M X))). We used the :type-prescription rule NFIX. Summary Form: ( DEFUN M ...) Rules: ((:TYPE-PRESCRIPTION NFIX)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) M ACL2 !>>(DEFTHM O-P-M (O-P (M X))) ACL2 Warning [Non-rec] in ( DEFTHM O-P-M ...): A :REWRITE rule generated from O-P-M will be triggered only by terms containing the non-recursive function symbol M. Unless this function is disabled, this rule is unlikely ever to be used. By the simple :definition M we reduce the conjecture to Goal' (O-P (NFIX X)). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NFIX, O-FINP and O-P. Q.E.D. The storage of O-P-M depends upon the :type-prescription rule O-P. Summary Form: ( DEFTHM O-P-M ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O-P) (:TYPE-PRESCRIPTION O-P)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.01) O-P-M ACL2 !>>(LOCAL (DEFUN DN (X) (1- X))) Since DN is non-recursive, its admission is trivial. We observe that the type of DN is described by the theorem (ACL2-NUMBERP (DN X)). We used primitive type reasoning. Summary Form: ( DEFUN DN ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) DN ACL2 !>>(DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) ACL2 Warning [Non-rec] in ( DEFTHM DN-GOES-DOWN ...): A :REWRITE rule generated from DN-GOES-DOWN will be triggered only by terms containing the non-recursive function symbols DN and M. Unless these functions are disabled, this rule is unlikely ever to be used. By the simple :definitions DN, M, P and POSP we reduce the conjecture to Goal' (IMPLIES (AND (INTEGERP X) (< 0 X)) (O< (NFIX (+ -1 X)) (NFIX X))). This simplifies, using the :definitions NFIX, O-FINP and O< and primitive type reasoning, to Goal'' (IMPLIES (AND (INTEGERP X) (< 0 X)) (< (+ -1 X) X)). But simplification reduces this to T, using linear arithmetic and primitive type reasoning. Q.E.D. The storage of DN-GOES-DOWN depends upon the :type-prescription rule O<. Summary Form: ( DEFTHM DN-GOES-DOWN ...) Rules: ((:DEFINITION DN) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O<) (:DEFINITION P) (:DEFINITION POSP) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION O<)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.01, other: 0.00) DN-GOES-DOWN ACL2 !>>(LOCAL (DEFUN UP (X) (1+ X))) Since UP is non-recursive, its admission is trivial. We observe that the type of UP is described by the theorem (ACL2-NUMBERP (UP X)). We used primitive type reasoning. Summary Form: ( DEFUN UP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) UP End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. The following constraint is associated with every one of the functions P, M, UP and DN: (AND (O-P (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X)))) Summary Form: ( ENCAPSULATE ((P ...) ...) ...) Rules: NIL Warnings: Non-rec Time: 0.06 seconds (prove: 0.00, print: 0.02, other: 0.04) T ACL2 !>(include-book "ordinals/ordinals" :dir :system) Summary Form: ( INCLUDE-BOOK "ordinals/ordinals" ...) Rules: NIL Warnings: None Time: 1.56 seconds (prove: 0.00, print: 0.00, other: 1.56) "/Users/kaufmann/acl2/v3-1/books/ordinals/ordinals.lisp" ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (if q (o^ (omega) (m x)) (if (p y) (o* (o^ (omega) (m y)) 2) 1)) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)))). By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M, O-P-O^ and OMEGA-O-P. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterpart of O-P and the :rewrite rules O-P-M, O-P-O*, O-P-O^ and OMEGA-O-P. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (O^ (OMEGA) (M Y)) (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterparts of EQUAL, NOT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, O-P-M, O-P-O^, OMEGA-O-P and |~(a=0) & b>1 <=> a < ab| and the :type-prescription rule OMEGA. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules |0 < w^a| and O-P-M. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (O* (O^ (OMEGA) (M (DN X))) 2) (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :executable-counterparts of O-FIRST-EXPT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, DN-GOES-DOWN, O*-O-FIRST-EXPT, O-FIRST-EXPT-<, O-P-M, O-P-O*, O-P-O^, OMEGA-O-P, O^-OMEGA-O-FIRST- EXPT and |a+0 = a| and the :type-prescription rule OMEGA. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (O^ (OMEGA) (M X)))). Name the formula above *1. No induction schemes are suggested by *1. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE |(a = 0) & ~(b = 0) <=> (a^b = 0)|) (:REWRITE |0 < w^a|) (:REWRITE DN-GOES-DOWN) (:REWRITE O*-O-FIRST-EXPT) (:REWRITE O-FIRST-EXPT-<) (:REWRITE O-P-M) (:REWRITE O-P-O*) (:REWRITE O-P-O^) (:REWRITE OMEGA-O-P) (:REWRITE O^-OMEGA-O-FIRST-EXPT) (:REWRITE |a+0 = a|) (:REWRITE |~(a=0) & b>1 <=> a < ab|) (:TYPE-PRESCRIPTION OMEGA)) Warnings: None Time: 0.11 seconds (prove: 0.05, print: 0.06, other: 0.01) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>:start-proof-tree Proof tree output is now enabled. Note that :START-PROOF-TREE works by removing 'proof-tree from the inhibit-output-lst; see :DOC set- inhibit-output-lst. ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (if q (o^ (omega) (m x)) (if (p y) (o* (o^ (omega) (m y)) 2) 1)) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M, O-P-O^ and OMEGA-O-P. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterpart of O-P and the :rewrite rules O-P-M, O-P-O*, O-P-O^ and OMEGA-O-P. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (O^ (OMEGA) (M Y)) (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterparts of EQUAL, NOT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, O-P-M, O-P-O^, OMEGA-O-P and |~(a=0) & b>1 <=> a < ab| and the :type-prescription rule OMEGA. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules |0 < w^a| and O-P-M. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (O* (O^ (OMEGA) (M (DN X))) 2) (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :executable-counterparts of O-FIRST-EXPT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, DN-GOES-DOWN, O*-O-FIRST-EXPT, O-FIRST-EXPT-<, O-P-M, O-P-O*, O-P-O^, OMEGA-O-P, O^-OMEGA-O-FIRST- EXPT and |a+0 = a| and the :type-prescription rule OMEGA. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (O^ (OMEGA) (M X)))). Name the formula above *1. No induction schemes are suggested by *1. Consequently, the proof attempt has failed. ACL2 Error in ( DEFUN F4 ...): The proof of the measure conjecture for F4 has failed. Summary Form: ( DEFUN F4 ...) Rules: ((:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE |(a = 0) & ~(b = 0) <=> (a^b = 0)|) (:REWRITE |0 < w^a|) (:REWRITE DN-GOES-DOWN) (:REWRITE O*-O-FIRST-EXPT) (:REWRITE O-FIRST-EXPT-<) (:REWRITE O-P-M) (:REWRITE O-P-O*) (:REWRITE O-P-O^) (:REWRITE OMEGA-O-P) (:REWRITE O^-OMEGA-O-FIRST-EXPT) (:REWRITE |a+0 = a|) (:REWRITE |~(a=0) & b>1 <=> a < ab|) (:TYPE-PRESCRIPTION OMEGA)) Warnings: None Time: 0.21 seconds (prove: 0.04, print: 0.15, proof tree: 0.02, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm lemma-1 (implies (p x) (not (equal 0 (m x)))) :hints (("Goal" :in-theory (disable dn-goes-down) :use dn-goes-down))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL 0 (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL 0 (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M and |~(a<0)|. Q.E.D. Summary Form: ( DEFTHM LEMMA-1 ...) Rules: ((:DEFINITION NOT) (:REWRITE O-P-M) (:REWRITE |~(a<0)|)) Warnings: None Time: 0.05 seconds (prove: 0.01, print: 0.01, proof tree: 0.00, other: 0.02) LEMMA-1 ACL2 !>(defun f4 (x y q) (declare (xargs :measure (if (p x) (if q (o^ (omega) (m x)) (if (p y) (o* (o^ (omega) (m y)) 2) 1)) 0))) (if (p x) (if q (f4 y (dn x) (not q)) (f4 y (up x) (not q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)))). << Starting proof tree logging >> By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M, O-P-O^ and OMEGA-O-P. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterpart of O-P and the :rewrite rules O-P-M, O-P-O*, O-P-O^ and OMEGA-O-P. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (O^ (OMEGA) (M Y)) (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterparts of EQUAL, NOT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, O-P-M, O-P-O^, OMEGA-O-P and |~(a=0) & b>1 <=> a < ab| and the :type-prescription rule OMEGA. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules |0 < w^a| and O-P-M. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (O* (O^ (OMEGA) (M (DN X))) 2) (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :executable-counterparts of O-FIRST-EXPT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, DN-GOES-DOWN, O*-O-FIRST-EXPT, O-FIRST-EXPT-<, O-P-M, O-P-O*, O-P-O^, OMEGA-O-P, O^-OMEGA-O-FIRST- EXPT and |a+0 = a| and the :type-prescription rule OMEGA. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :compound-recognizer rule O-FINP-CR, primitive type reasoning, the :rewrite rules AC-<, LEMMA-1, O-INFP-O^-1, O-P-M and OMEGA-O-P and the :type-prescription rule OMEGA. Q.E.D. That completes the proof of the measure theorem for F4. Thus, we admit this function under the principle of definition.We observe that the type of F4 is described by the theorem (AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))). Summary Form: ( DEFUN F4 ...) Rules: ((:COMPOUND-RECOGNIZER O-FINP-CR) (:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE |(a = 0) & ~(b = 0) <=> (a^b = 0)|) (:REWRITE |0 < w^a|) (:REWRITE AC-<) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE O*-O-FIRST-EXPT) (:REWRITE O-FIRST-EXPT-<) (:REWRITE O-INFP-O^-1) (:REWRITE O-P-M) (:REWRITE O-P-O*) (:REWRITE O-P-O^) (:REWRITE OMEGA-O-P) (:REWRITE O^-OMEGA-O-FIRST-EXPT) (:REWRITE |a+0 = a|) (:REWRITE |~(a=0) & b>1 <=> a < ab|) (:TYPE-PRESCRIPTION OMEGA)) Warnings: None Time: 0.15 seconds (prove: 0.06, print: 0.07, proof tree: 0.01, other: 0.01) F4 ACL2 !>:u 3:x(DEFTHM LEMMA-1 ...) 3 3 ACL2 !>:pbt 1 1 (ENCAPSULATE ((P ...) (M ...) (UP ...) (DN ...)) ...) d 2 (INCLUDE-BOOK "ordinals/ordinals" :DIR ...) 3:x(DEFTHM LEMMA-1 ...) ACL2 !>:ubt! 1 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(certify-book "101-ordinals") CERTIFICATION ATTEMPT FOR "/Users/kaufmann/class/march-2007/101-ordinals.lisp" ACL2 Version 3.1 * Step 1: Read "/Users/kaufmann/class/march-2007/101-ordinals.lisp" and compute its check sum. * Step 2: There were five forms in the file. We now attempt to establish that each form, whether local or non-local, is indeed an admissible embedded event form in the context of the previously admitted ones. Note that proof-tree output is inhibited during this check; see :DOC proof-tree. ACL2 >>(ENCAPSULATE ((P (X) T) (M (X) T) (UP (X) T) (DN (X) T)) (LOCAL (DEFUN P (X) (POSP X))) (LOCAL (DEFUN M (X) (NFIX X))) (DEFTHM O-P-M (O-P (M X))) (LOCAL (DEFUN DN (X) (1- X))) (DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) (LOCAL (DEFUN UP (X) (1+ X)))) To verify that the six encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 >>(LOCAL (DEFUN P (X) (POSP X))) Since P is non-recursive, its admission is trivial. We observe that the type of P is described by the theorem (OR (EQUAL (P X) T) (EQUAL (P X) NIL)). We used the :compound-recognizer rule POSP-COMPOUND-RECOGNIZER. Summary Form: ( DEFUN P ...) Rules: ((:COMPOUND-RECOGNIZER POSP-COMPOUND-RECOGNIZER)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) P ACL2 >>(LOCAL (DEFUN M (X) (NFIX X))) Since M is non-recursive, its admission is trivial. We observe that the type of M is described by the theorem (AND (INTEGERP (M X)) (<= 0 (M X))). We used the :type-prescription rule NFIX. Summary Form: ( DEFUN M ...) Rules: ((:TYPE-PRESCRIPTION NFIX)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) M ACL2 >>(DEFTHM O-P-M (O-P (M X))) ACL2 Warning [Non-rec] in ( DEFTHM O-P-M ...): A :REWRITE rule generated from O-P-M will be triggered only by terms containing the non-recursive function symbol M. Unless this function is disabled, this rule is unlikely ever to be used. By the simple :definition M we reduce the conjecture to Goal' (O-P (NFIX X)). But simplification reduces this to T, using the :compound-recognizer rule NATP-COMPOUND-RECOGNIZER and the :definitions NFIX, O-FINP and O-P. Q.E.D. The storage of O-P-M depends upon the :type-prescription rule O-P. Summary Form: ( DEFTHM O-P-M ...) Rules: ((:COMPOUND-RECOGNIZER NATP-COMPOUND-RECOGNIZER) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O-P) (:TYPE-PRESCRIPTION O-P)) Warnings: Non-rec Time: 0.01 seconds (prove: 0.00, print: 0.00, other: 0.00) O-P-M ACL2 >>(LOCAL (DEFUN DN (X) (1- X))) Since DN is non-recursive, its admission is trivial. We observe that the type of DN is described by the theorem (ACL2-NUMBERP (DN X)). We used primitive type reasoning. Summary Form: ( DEFUN DN ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) DN ACL2 >>(DEFTHM DN-GOES-DOWN (IMPLIES (P X) (O< (M (DN X)) (M X)))) ACL2 Warning [Non-rec] in ( DEFTHM DN-GOES-DOWN ...): A :REWRITE rule generated from DN-GOES-DOWN will be triggered only by terms containing the non-recursive function symbols DN and M. Unless these functions are disabled, this rule is unlikely ever to be used. By the simple :definitions DN, M, P and POSP we reduce the conjecture to Goal' (IMPLIES (AND (INTEGERP X) (< 0 X)) (O< (NFIX (+ -1 X)) (NFIX X))). This simplifies, using the :definitions NFIX, O-FINP and O< and primitive type reasoning, to Goal'' (IMPLIES (AND (INTEGERP X) (< 0 X)) (< (+ -1 X) X)). But simplification reduces this to T, using linear arithmetic and primitive type reasoning. Q.E.D. The storage of DN-GOES-DOWN depends upon the :type-prescription rule O<. Summary Form: ( DEFTHM DN-GOES-DOWN ...) Rules: ((:DEFINITION DN) (:DEFINITION M) (:DEFINITION NFIX) (:DEFINITION O-FINP) (:DEFINITION O<) (:DEFINITION P) (:DEFINITION POSP) (:FAKE-RUNE-FOR-LINEAR NIL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION O<)) Warnings: Non-rec Time: 0.09 seconds (prove: 0.00, print: 0.00, other: 0.09) DN-GOES-DOWN ACL2 >>(LOCAL (DEFUN UP (X) (1+ X))) Since UP is non-recursive, its admission is trivial. We observe that the type of UP is described by the theorem (ACL2-NUMBERP (UP X)). We used primitive type reasoning. Summary Form: ( DEFUN UP ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) UP End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. The following constraint is associated with every one of the functions P, M, UP and DN: (AND (O-P (M X)) (IMPLIES (P X) (O< (M (DN X)) (M X)))) Summary Form: ( ENCAPSULATE ((P ...) ...) ...) Rules: NIL Warnings: Non-rec Time: 0.13 seconds (prove: 0.00, print: 0.02, other: 0.11) T ACL2 >>(INCLUDE-BOOK "ordinals/ordinals" :DIR :SYSTEM) Summary Form: ( INCLUDE-BOOK "ordinals/ordinals" ...) Rules: NIL Warnings: None Time: 1.49 seconds (prove: 0.00, print: 0.00, other: 1.49) "/Users/kaufmann/acl2/v3-1/books/ordinals/ordinals.lisp" ACL2 >>(DEFTHM LEMMA-1 (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) :HINTS (("Goal" :IN-THEORY (DISABLE DN-GOES-DOWN) :USE DN-GOES-DOWN))) [Note: A hint was supplied for our processing of the goal above. Thanks!] We augment the goal with the hypothesis provided by the :USE hint. The hypothesis can be obtained from DN-GOES-DOWN. We are left with the following subgoal. Goal' (IMPLIES (IMPLIES (P X) (O< (M (DN X)) (M X))) (IMPLIES (P X) (NOT (EQUAL 0 (M X))))). By case analysis we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (O< (M (DN X)) (M X))) (P X)) (NOT (EQUAL 0 (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M and |~(a<0)|. Q.E.D. Summary Form: ( DEFTHM LEMMA-1 ...) Rules: ((:DEFINITION NOT) (:REWRITE O-P-M) (:REWRITE |~(a<0)|)) Warnings: None Time: 0.02 seconds (prove: 0.01, print: 0.00, other: 0.01) LEMMA-1 ACL2 >>(DEFUN F4 (X Y Q) (DECLARE (XARGS :MEASURE (IF (P X) (IF Q (O^ (OMEGA) (M X)) (IF (P Y) (O* (O^ (OMEGA) (M Y)) 2) 1)) 0))) (IF (P X) (IF Q (F4 Y (DN X) (NOT Q)) (F4 Y (UP X) (NOT Q))) 4)) For the admission of F4 we will use the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0). The non-trivial part of the measure conjecture is Goal (AND (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)) (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))) (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)))). By case analysis we reduce the conjecture to the following three conjectures. Subgoal 3 (O-P (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0)). This simplifies, using trivial observations, to the following four conjectures. Subgoal 3.4 (IMPLIES (NOT (P X)) (O-P 0)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.3 (IMPLIES (AND (P X) Q) (O-P (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules O-P- M, O-P-O^ and OMEGA-O-P. Subgoal 3.2 (IMPLIES (AND (P X) (NOT Q) (NOT (P Y))) (O-P 1)). But we reduce the conjecture to T, by the :executable-counterpart of O-P. Subgoal 3.1 (IMPLIES (AND (P X) (NOT Q) (P Y)) (O-P (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterpart of O-P and the :rewrite rules O-P-M, O-P-O*, O-P-O^ and OMEGA-O-P. Subgoal 2 (IMPLIES (AND (P X) (NOT Q)) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (UP X)) (O* (O^ (OMEGA) (M (UP X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :executable-counterpart of NOT, to the following two conjectures. Subgoal 2.2 (IMPLIES (AND (P X) (P Y)) (O< (O^ (OMEGA) (M Y)) (O* (O^ (OMEGA) (M Y)) 2))). But simplification reduces this to T, using the :executable-counterparts of EQUAL, NOT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, O-P-M, O-P-O^, OMEGA-O-P and |~(a=0) & b>1 <=> a < ab| and the :type-prescription rule OMEGA. Subgoal 2.1 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 1)). But we reduce the conjecture to T, by the :executable-counterpart of O<. Subgoal 1 (IMPLIES (AND (P X) Q) (O< (IF (P Y) (COND ((NOT Q) (O^ (OMEGA) (M Y))) ((P (DN X)) (O* (O^ (OMEGA) (M (DN X))) 2)) (T 1)) 0) (IF (P X) (COND (Q (O^ (OMEGA) (M X))) ((P Y) (O* (O^ (OMEGA) (M Y)) 2)) (T 1)) 0))). This simplifies, using the :congruence rule IFF-IMPLIES-EQUAL-NOT and the :executable-counterpart of NOT, to the following three conjectures. Subgoal 1.3 (IMPLIES (AND (P X) (NOT (P Y))) (O< 0 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :rewrite rules |0 < w^a| and O-P-M. Subgoal 1.2 (IMPLIES (AND (P X) (P Y) (P (DN X))) (O< (O* (O^ (OMEGA) (M (DN X))) 2) (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :executable-counterparts of O-FIRST-EXPT and O-P, primitive type reasoning, the :rewrite rules |(a = 0) & ~(b = 0) <=> (a^b = 0)|, DN-GOES-DOWN, O*-O-FIRST-EXPT, O-FIRST-EXPT-<, O-P-M, O-P-O*, O-P-O^, OMEGA-O-P, O^-OMEGA-O-FIRST- EXPT and |a+0 = a| and the :type-prescription rule OMEGA. Subgoal 1.1 (IMPLIES (AND (P X) (P Y) (NOT (P (DN X)))) (O< 1 (O^ (OMEGA) (M X)))). But simplification reduces this to T, using the :compound-recognizer rule O-FINP-CR, primitive type reasoning, the :rewrite rules AC-<, LEMMA-1, O-INFP-O^-1, O-P-M and OMEGA-O-P and the :type-prescription rule OMEGA. Q.E.D. That completes the proof of the measure theorem for F4. Thus, we admit this function under the principle of definition.We observe that the type of F4 is described by the theorem (AND (INTEGERP (F4 X Y Q)) (< 0 (F4 X Y Q))). Summary Form: ( DEFUN F4 ...) Rules: ((:COMPOUND-RECOGNIZER O-FINP-CR) (:CONGRUENCE IFF-IMPLIES-EQUAL-NOT) (:DEFINITION NOT) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART NOT) (:EXECUTABLE-COUNTERPART O-FIRST-EXPT) (:EXECUTABLE-COUNTERPART O-P) (:EXECUTABLE-COUNTERPART O<) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE |(a = 0) & ~(b = 0) <=> (a^b = 0)|) (:REWRITE |0 < w^a|) (:REWRITE AC-<) (:REWRITE DN-GOES-DOWN) (:REWRITE LEMMA-1) (:REWRITE O*-O-FIRST-EXPT) (:REWRITE O-FIRST-EXPT-<) (:REWRITE O-INFP-O^-1) (:REWRITE O-P-M) (:REWRITE O-P-O*) (:REWRITE O-P-O^) (:REWRITE OMEGA-O-P) (:REWRITE O^-OMEGA-O-FIRST-EXPT) (:REWRITE |a+0 = a|) (:REWRITE |~(a=0) & b>1 <=> a < ab|) (:TYPE-PRESCRIPTION OMEGA)) Warnings: None Time: 0.09 seconds (prove: 0.04, print: 0.05, other: 0.01) F4 * Step 3: That completes the admissibility check. Each form read was an embedded event form and was admissible. We now retract back to the initial world and try to include the book. This may expose local incompatibilities. Summary Form: ( INCLUDE-BOOK "101-ordinals" ...) Rules: NIL Warnings: None Time: 1.50 seconds (prove: 0.00, print: 0.00, other: 1.50) ACL2 Warning [Guards] in (CERTIFY-BOOK "101-ordinals" ...): The book "/Users/kaufmann/class/march-2007/101-ordinals.lisp" defines the function F4, which has not had its guards verified. Moreover, this book's included sub-books define function OMEGA, which has not had its guards verified. See :DOC guards. * Step 4: Write the certificate for "/Users/kaufmann/class/march-2007/101-ordinals.lisp" in "/Users/kaufmann/class/march-2007/101-ordinals.cert". The final check sum alist is (("/Users/kaufmann/class/march-2007/101-ordinals.lisp" "101-ordinals" "101-ordinals" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 259302823) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinals.lisp" "ordinals/ordinals" "ordinals" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 238631597) ("/Users/kaufmann/acl2/v3-1/books/ordinals/limits.lisp" "limits" "limits" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 66388984) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-exponentiation.lisp" "ordinal-exponentiation" "ordinal-exponentiation" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 3368885) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-multiplication.lisp" "ordinal-multiplication" "ordinal-multiplication" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 65294701) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-addition.lisp" "ordinal-addition" "ordinal-addition" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 42533600) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-basic-thms.lisp" "ordinal-basic-thms" "ordinal-basic-thms" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 193499191) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/ordinals/top-with-meta.lisp" "top-with-meta" "top-with-meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 142395086)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/top-with-meta.lisp" "../arithmetic/top-with-meta" "top-with-meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 175638983)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/meta.lisp" "../meta/meta" "meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 146179060)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/meta-times-equal.lisp" "meta-times-equal" "meta-times-equal" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 69450866)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/meta-plus-lessp.lisp" "meta-plus-lessp" "meta-plus-lessp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 113270299)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/meta-plus-equal.lisp" "meta-plus-equal" "meta-plus-equal" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 220828626)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/term-defuns.lisp" "term-defuns" "term-defuns" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 99009733)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/top.lisp" "top" "top" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 51353441)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/rationals.lisp" "rationals" "rationals" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 192778911)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/natp-posp.lisp" "natp-posp" "natp-posp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 77763855)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/rational-listp.lisp" "rational-listp" "rational-listp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 64148425)) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-total-order.lisp" "ordinal-total-order" "ordinal-total-order" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 134357633) ("/Users/kaufmann/acl2/v3-1/books/ordinals/ordinal-definitions.lisp" "ordinal-definitions" "ordinal-definitions" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 21541141) ("/Users/kaufmann/acl2/v3-1/books/ordinals/top-with-meta.lisp" "top-with-meta" "top-with-meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 142395086) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/top-with-meta.lisp" "../arithmetic/top-with-meta" "top-with-meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 175638983) ("/Users/kaufmann/acl2/v3-1/books/meta/meta.lisp" "../meta/meta" "meta" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 146179060) ("/Users/kaufmann/acl2/v3-1/books/meta/meta-times-equal.lisp" "meta-times-equal" "meta-times-equal" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 69450866) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/equalities.lisp" "../arithmetic/equalities" "equalities" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 103475026)) ("/Users/kaufmann/acl2/v3-1/books/meta/meta-plus-lessp.lisp" "meta-plus-lessp" "meta-plus-lessp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 113270299) ("/Users/kaufmann/acl2/v3-1/books/meta/meta-plus-equal.lisp" "meta-plus-equal" "meta-plus-equal" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 220828626) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/meta/term-lemmas.lisp" "term-lemmas" "term-lemmas" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 185835692)) ("/Users/kaufmann/acl2/v3-1/books/meta/term-defuns.lisp" "term-defuns" "term-defuns" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 99009733) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/top.lisp" "top" "top" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 51353441) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/rationals.lisp" "rationals" "rationals" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 192778911) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/mod-gcd.lisp" "mod-gcd" "mod-gcd" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 49344105)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/inequalities.lisp" "inequalities" "inequalities" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 130234613)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/arithmetic/equalities.lisp" "equalities" "equalities" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 103475026)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-crg.lisp" "../cowles/acl2-crg" "acl2-crg" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 260688904)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-agp.lisp" "acl2-agp" "acl2-agp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 106260818)) (LOCAL ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-asg.lisp" "acl2-asg" "acl2-asg" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 44566077)) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/natp-posp.lisp" "natp-posp" "natp-posp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 77763855) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/inequalities.lisp" "inequalities" "inequalities" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 130234613) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/rational-listp.lisp" "rational-listp" "rational-listp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 64148425) ("/Users/kaufmann/acl2/v3-1/books/arithmetic/equalities.lisp" "equalities" "equalities" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 103475026) ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-crg.lisp" "../cowles/acl2-crg" "acl2-crg" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 260688904) ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-agp.lisp" "acl2-agp" "acl2-agp" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 106260818) ("/Users/kaufmann/acl2/v3-1/books/cowles/acl2-asg.lisp" "acl2-asg" "acl2-asg" ((:SKIPPED-PROOFSP) (:AXIOMSP) (:TTAGS)) . 44566077)). * Step 5: Compile the functions defined in "/Users/kaufmann/class/march-2007/101-ordinals.lisp". "/Users/kaufmann/class/march-2007/101-ordinals.dfsl" Summary Form: (CERTIFY-BOOK "101-ordinals" ...) Rules: NIL Warnings: Guards and Non-rec Time: 3.38 seconds (prove: 0.04, print: 0.07, proof tree: 0.00, other: 3.26) "/Users/kaufmann/class/march-2007/101-ordinals.lisp" ACL2 !>:doc books | BOOKS files of ACL2 event forms | | This documentation topic is about ACL2 input files. However, there are two | traditional (paper) books published about ACL2: a textbook and a case | studies book. Further information is available by following links from the | ACL2 home page, http://www.cs.utexas.edu/users/moore/acl2/. Now, on to | the real content of this topic: | | A ``book'' is a file of ACL2 events that have been certified as | admissible. Using include-book you can construct a new logical | world by assuming the events in any number of mutually compatible | books. Relevant documented topics are listed below. Following this list | is a ``guided tour'' through the topics. | You may start guided tour by typing :more. | BOOK-CONTENTS | restrictions on the forms inside books | BOOK-EXAMPLE | how to create, certify, and use a simple book | BOOK-MAKEFILES | makefile support provided with the ACL2 distribution | BOOK-NAME conventions associated with book names | CBD connected book directory string | CERTIFICATE how a book is known to be admissible and where its defpkgs reside | CERTIFY-BOOK | how to produce a certificate for a book | FULL-BOOK-NAME | book naming conventions assumed by ACL2 | INCLUDE-BOOK | load the events in a file | KEEP how we know if include-book read the correct files | MAKEFILES See :DOC BOOK-MAKEFILES. | PATHNAME introduction to filename conventions in ACL2 | PORTCULLIS the gate guarding the entrance to a certified book | SET-CBD to set the connected book directory | UNCERTIFIED-BOOKS | invalid certificates and uncertified books (type :more for more, :more! for the rest) ACL2 !>:more! | Introduction. | | A ``book'' is a file of ACL2 forms. Books are prepared entirely by | the user of the system, i.e., they are ``source'' files not | ``object'' files. Some of the forms in a book are marked local | and the others are considered ``non-local.'' | | Include-book lets you load a book into any ACL2 world. If | completed without error, the inclusion of a book extends the logic | of the host world by the addition of just the non-local events in | the book. You may extend the world by successively including a | variety of books to obtain the desired collection of definitions and | rules. Unless name conflicts occur (which are detected and | signalled) inclusion of a book is consistency preserving provided | the book itself is consistent as discussed later. However, | include-book merely assumes the validity of the events in a book; | if you include a book that contains an inconsistency (e.g., an | inadmissible definition) then the resulting theory is inconsistent. | | It is possible to ``certify'' a book, with certify-book, | guaranteeing that the error-free inclusion of the certified forms | will produce a consistent extension of a consistent logic. | Certification processes both the local and non-local forms, so | you can mark as local those events you need for certification | that you want to hide from users of the book (e.g., hacks, crocks, | and kludges on the way to a good set of :rewrite rules). | Certification can also ``compile'' a book, thereby speeding up the | execution of the functions defined within it. The desire to compile | books is largely responsible for the restrictions we put on the | forms allowed in books. | | Extensive documentation is available on the various aspects of | books. We recommend that you read it all before using books. It | has been written so as to make sense when read in a certain linear | sequence, called the ``guided tour'', though in general you may | browse through it randomly. If you are on the guided tour, you | should next read the documentation on book-example | (see :DOC BOOK-EXAMPLE and use :more to read through it). *- ACL2 !>:program ACL2 p!>(defun fact (n) (if (equal n 0) 1 (* n (fact (- n 1))))) Summary Form: ( DEFUN FACT ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.01) FACT ACL2 p!>(fact 8) 40320 ACL2 p!>(trace$ fact) NIL ACL2 p!>(fact 8) 1> (ACL2_*1*_ACL2::FACT 8) 2> (FACT 8) <2 (FACT 40320) <1 (ACL2_*1*_ACL2::FACT 40320) 40320 ACL2 p!>(untrace$) NIL ACL2 p!>(fact -1) > Error in process listener(3): Stack overflow on control stack. > While executing: FACT > Type :GO to continue, :POP to abort. > If continued: Skip evaluation of (acl2::acl2-default-restart) Type :? for other options. 1 > [RAW LISP] :popo :POPO 1 > [RAW LISP] :pop ACL2 p!>:logic ACL2 !>(thm (equal (fact n) 0)) ACL2 Error in ( THM ...): Function symbols of mode :program are not allowed in the present context. Yet, the function symbol FACT occurs in the translation of the form (EQUAL (FACT N) 0), which is (EQUAL (FACT N) '0). Summary Form: ( THM ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defun foo (x) t) ACL2 Error in ( DEFUN FOO ...): The formal variable X is not used in the definition of FOO but is not DECLAREd IGNOREd or IGNORABLE. Any formal variable not used in the body of a definition must be so declared. To remove this requirement, see :DOC set-ignore-ok. Summary Form: ( DEFUN FOO ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.01) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defun foo (x) (declare (ignore x)) t) Since FOO is non-recursive, its admission is trivial. We observe that the type of FOO is described by the theorem (FOO X). Summary Form: ( DEFUN FOO ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) FOO ACL2 !>(foo 3) T ACL2 !>:u 4:x(LOGIC) ACL2 !>(set-ignore-ok t) T ACL2 !>(defun foo (x) t) ACL2 Error in ( DEFUN FOO ...): The first formal of FOO, X, is irrelevant. See :DOC irrelevant-formals. Summary Form: ( DEFUN FOO ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(set-irrelevant-formals-ok t) T ACL2 !>(defun foo (x) t) Since FOO is non-recursive, its admission is trivial. We observe that the type of FOO is described by the theorem (FOO X). Summary Form: ( DEFUN FOO ...) Rules: NIL Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) FOO ACL2 !>:ubt! 1 0:x(EXIT-BOOT-STRAP-MODE) ACL2 !>(rebuild "101.lisp" t) ACL2 loading "101.lisp". "ACL2" ACL2 Warning [Non-rec] in ( DEFTHM O-P-M ...): A :REWRITE rule generated from O-P-M will be triggered only by terms containing the non-recursive function symbol M. Unless this function is disabled, this rule is unlikely ever to be used. ACL2 Warning [Non-rec] in ( DEFTHM DN-GOES-DOWN ...): A :REWRITE rule generated from DN-GOES-DOWN will be triggered only by terms containing the non-recursive function symbols DN and M. Unless these functions are disabled, this rule is unlikely ever to be used. T LEMMA-1-1 LEMMA-1 LEMMA-2 LEMMA-3-1 LEMMA-3 F4 Finished loading "101.lisp". T ACL2 !>:ubt! lemma-2 3:x(DEFTHM LEMMA-1 ...) ACL2 !>(defthm lemma-2 (implies (and (p x) (not (consp (m x)))) (< 0 (m x))) :hints (("Goal" :use (lemma-1 o-p-m) ;; :in-theory (disable lemma-1 o-p-m) ))) << Starting proof tree logging >> [Note: A hint was supplied for our processing of the goal above. Thanks!] ACL2 Warning [Use] in ( DEFTHM LEMMA-2 ...): It is unusual to :USE an enabled :REWRITE or :DEFINITION rule, so you may want to consider disabling (:REWRITE LEMMA-1) and (:REWRITE O-P-M). We augment the goal with the hypotheses provided by the :USE hint. These hypotheses can be obtained from LEMMA-1 and O-P-M. We are left with the following subgoal. Goal' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (O-P (M X))) (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X)))). By the simple :rewrite rule O-P-M we reduce the conjecture to Goal'' (IMPLIES (AND (IMPLIES (P X) (NOT (EQUAL 0 (M X)))) (P X) (NOT (CONSP (M X)))) (< 0 (M X))). This simplifies, using the :executable-counterpart of NOT and the :rewrite rule LEMMA-1, to Goal''' (IMPLIES (AND (P X) (NOT (CONSP (M X)))) (< 0 (M X))). Normally we would attempt to prove this formula by induction. However, we prefer in this instance to focus on the original input conjecture rather than this simplified special case. We therefore abandon our previous work on this conjecture and reassign the name *1 to the original conjecture. (See :DOC otf-flg.) No induction schemes are suggested by *1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM LEMMA-2 ...) Rules: ((:DEFINITION NOT) (:EXECUTABLE-COUNTERPART NOT) (:REWRITE LEMMA-1) (:REWRITE O-P-M)) Warnings: Use Time: 0.04 seconds (prove: 0.01, print: 0.02, proof tree: 0.01, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>:q Exiting the ACL2 read-eval-print loop. To re-enter, execute (LP). ? [RAW LISP] (good-bye) w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>(defun rev (x) (if (endp x) nil (append (rev (cdr x)) (list (car x))))) The admission of REV is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV is described by the theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive type reasoning and the :type-prescription rule BINARY-APPEND. Summary Form: ( DEFUN REV ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION BINARY-APPEND)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02) REV ACL2 !>(defun rev3 (x) (cond ((endp x) nil) ((endp (cdr x)) (list (car x))) ; or x, but then (rev3 x) may not equal (rev x) [see below] (t ; Think of x as a@b@c where a and c are single elements. Let* sequentially ; binds variables. For example, we assign ; b@c to (cdr x), ; c@rev-b to to the concatenation of c with the reverse of b, ; and so on. (let* ((b@c (cdr x)) (c@rev-b (rev3 b@c)) ; note recursive call of rev3 (rev-b (cdr c@rev-b)) (b (rev rev-b)) ; note call of rev rather than recursive call (a (car x)) (a@b (cons a b)) (rev-b@a (rev a@b)) ; note call of rev rather than recursive call (c (car c@rev-b)) (c@rev-b@a (cons c rev-b@a))) c@rev-b@a)))) The admission of REV3 is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV3 is described by the theorem (OR (CONSP (REV3 X)) (EQUAL (REV3 X) NIL)). We used primitive type reasoning. Summary Form: ( DEFUN REV3 ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.00, other: 0.02) REV3 ACL2 !>(defthm rev-is-rev3 ; proof fails (equal (rev x) (rev3 x))) Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (:P (CDR X))) (:P X)) (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/3'' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, to the following two conjectures. Subgoal *1/3.2 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using primitive type reasoning and the :rewrite rule CONS-EQUAL, to Subgoal *1/3.2' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.2'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2''' (IMPLIES (AND (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We now use the second hypothesis by cross-fertilizing (REV3 X2) for (REV X2) and throwing away the hypothesis. This produces Subgoal *1/3.2'4' (IMPLIES (AND (CONSP X2) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by L. This produces Subgoal *1/3.2'5' (IMPLIES (AND (CONSP X2) (CONSP L)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR L))) (LIST X1)))). The destructor terms (CAR L) and (CDR L) can be eliminated by using CAR-CDR-ELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L) by L2. This produces the following goal. Subgoal *1/3.2'6' (IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2'7' (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1. Subgoal *1/3.1 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (NOT (CONSP (REV (CDR X))))) (EQUAL (LIST (CAR X)) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, the :executable- counterparts of CAR, CDR, CONSP and REV, primitive type reasoning, the :rewrite rule CDR-CONS and the :type-prescription rule REV, to Subgoal *1/3.1' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (NOT (REV3 (CDR X)))) (CONSP (REV (CDR X)))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). This simplifies, using primitive type reasoning, to Subgoal *1/3.1''' (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Name the formula above *1.2. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (LIST (CAR X)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV X) (REV3 X))). But simplification reduces this to T, using the :definitions REV and REV3 and the :executable-counterpart of EQUAL. So we now return to *1.2, which is (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Perhaps we can prove *1.2 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X2) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P (CDR X2))) (:P X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P X2)) (IMPLIES (ENDP X2) (:P X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following five nontautological subgoals. Subgoal *1.2/5 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (CONSP (REV (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/5' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (CONSP (REV (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (REV3 (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (REV3 (CDR X2)) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. Subgoal *1.2/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definition REV3 and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (ENDP X2) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. We will choose arbitrarily among these. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rule REV3. If we let (:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P L2 X1 (CDR X2))) (:P L2 X1 X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P L2 X1 X2)) (IMPLIES (ENDP X2) (:P L2 X1 X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following four nontautological subgoals. Subgoal *1.1/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1.1/4'' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 (CDR X2))))) (LIST (CAR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2) by X4. This produces the following goal. Subgoal *1.1/4''' (IMPLIES (AND (CONSP (CONS X3 X4)) (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1/4'4' (IMPLIES (AND (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (CDR (REV3 X4)) (LIST X1)))). We now use the second hypothesis by substituting (APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1)) and throwing away the hypothesis. This produces Subgoal *1.1/4'5' (IMPLIES (CONSP X4) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1.1. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). But we reduce the conjecture to T, by case analysis. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV3, the :executable-counterpart of CONSP and the :rewrite rule CDR-CONS, to Subgoal *1.1/2'' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2) by X4. This produces the following goal. Subgoal *1.1/2''' (IMPLIES (AND (CONSP (CONS X3 X4)) (NOT (CONSP X4))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1/2'4' (IMPLIES (NOT (CONSP X4)) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). We suspect that the term (NOT (CONSP X4)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1.1/2'5' (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1))). Name the formula above *1.1.2. Subgoal *1.1/1 (IMPLIES (AND (ENDP X2) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). But we reduce the conjecture to T, by case analysis. So we now return to *1.1.2, which is (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1))). Perhaps we can prove *1.1.2 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV L2). This suggestion was produced using the :induction rule REV. If we let (:P L2 X1) denote *1.1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1)) (:P L2 X1)) (IMPLIES (ENDP L2) (:P L2 X1))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1.2/2 (IMPLIES (AND (NOT (ENDP L2)) (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2/2' (IMPLIES (AND (CONSP L2) (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definition REV, to Subgoal *1.1.2/2'' (IMPLIES (AND (CONSP L2) (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND (REV (CDR L2)) (LIST (CAR L2)))) (LIST X1)))). The destructor terms (CAR L2) and (CDR L2) can be eliminated by using CAR-CDR-ELIM to replace L2 by (CONS L3 L4), (CAR L2) by L3 and (CDR L2) by L4. This produces the following goal. Subgoal *1.1.2/2''' (IMPLIES (AND (CONSP (CONS L3 L4)) (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND (REV L4) (LIST L3))) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1.2/2'4' (IMPLIES (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))) (EQUAL (LIST X1) (APPEND (REV (APPEND (REV L4) (LIST L3))) (LIST X1)))). We generalize this conjecture, replacing (REV L4) by RV. This produces Subgoal *1.1.2/2'5' (IMPLIES (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). Name the formula above *1.1.2.1. Subgoal *1.1.2/1 (IMPLIES (ENDP L2) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2/1' (IMPLIES (NOT (CONSP L2)) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterparts of CONSP and REV and primitive type reasoning. So we now return to *1.1.2.1, which is (IMPLIES (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). Perhaps we can prove *1.1.2.1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (BINARY-APPEND RV (CONS L3 'NIL)). This suggestion was produced using the :induction rules BINARY-APPEND and REV. If we let (:P L3 RV X1) denote *1.1.2.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP RV)) (:P L3 (CDR RV) X1)) (:P L3 RV X1)) (IMPLIES (ENDP RV) (:P L3 RV X1))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1.2.1/3 (IMPLIES (AND (NOT (ENDP RV)) (EQUAL (LIST X1) (APPEND (REV (APPEND (CDR RV) (LIST L3))) (LIST X1))) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2.1/3' (IMPLIES (AND (CONSP RV) (EQUAL (LIST X1) (APPEND (REV (APPEND (CDR RV) (LIST L3))) (LIST X1))) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1.1.2.1/3'' (IMPLIES (AND (CONSP RV) (EQUAL (LIST X1) (APPEND (REV (APPEND (CDR RV) (LIST L3))) (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV (CDR RV)) (LIST (CAR RV))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND (CDR RV) (LIST L3))) (LIST (CAR RV))) (LIST X1)))). The destructor terms (CAR RV) and (CDR RV) can be eliminated by using CAR-CDR-ELIM to replace RV by (CONS RV1 RV2), (CAR RV) by RV1 and (CDR RV) by RV2. This produces the following goal. Subgoal *1.1.2.1/3''' (IMPLIES (AND (CONSP (CONS RV1 RV2)) (EQUAL (LIST X1) (APPEND (REV (APPEND RV2 (LIST L3))) (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND RV2 (LIST L3))) (LIST RV1)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1.2.1/3'4' (IMPLIES (AND (EQUAL (LIST X1) (APPEND (REV (APPEND RV2 (LIST L3))) (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND RV2 (LIST L3))) (LIST RV1)) (LIST X1)))). We generalize this conjecture, replacing (APPEND RV2 (LIST L3)) by L and restricting the type of the new variable L to be that of the term it replaces, as established by primitive type reasoning and BINARY- APPEND. This produces Subgoal *1.1.2.1/3'5' (IMPLIES (AND (CONSP L) (EQUAL (LIST X1) (APPEND (REV L) (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV L) (LIST RV1)) (LIST X1)))). We generalize this conjecture, replacing (REV L) by RV. This produces Subgoal *1.1.2.1/3'6' (IMPLIES (AND (CONSP L) (EQUAL (LIST X1) (APPEND RV (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND RV (LIST RV1)) (LIST X1)))). We suspect that the term (CONSP L) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1.1.2.1/3'7' (IMPLIES (AND (EQUAL (LIST X1) (APPEND RV (LIST X1))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND RV (LIST RV1)) (LIST X1)))). Name the formula above *1.1.2.1.1. Subgoal *1.1.2.1/2 (IMPLIES (AND (NOT (ENDP RV)) (NOT (EQUAL (LIST X1) (APPEND (REV (CDR RV)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2.1/2' (IMPLIES (AND (CONSP RV) (NOT (EQUAL (LIST X1) (APPEND (REV (CDR RV)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1.1.2.1/2'' (IMPLIES (AND (CONSP RV) (NOT (EQUAL (LIST X1) (APPEND (REV (CDR RV)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (CDR RV)) (LIST (CAR RV))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND (CDR RV) (LIST L3))) (LIST (CAR RV))) (LIST X1)))). The destructor terms (CAR RV) and (CDR RV) can be eliminated by using CAR-CDR-ELIM to replace RV by (CONS RV1 RV2), (CAR RV) by RV1 and (CDR RV) by RV2. This produces the following goal. Subgoal *1.1.2.1/2''' (IMPLIES (AND (CONSP (CONS RV1 RV2)) (NOT (EQUAL (LIST X1) (APPEND (REV RV2) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND RV2 (LIST L3))) (LIST RV1)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1.2.1/2'4' (IMPLIES (AND (NOT (EQUAL (LIST X1) (APPEND (REV RV2) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV RV2) (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND RV2 (LIST L3))) (LIST RV1)) (LIST X1)))). We generalize this conjecture, replacing (REV RV2) by RV. This produces Subgoal *1.1.2.1/2'5' (IMPLIES (AND (NOT (EQUAL (LIST X1) (APPEND RV (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND RV (LIST RV1)) (LIST X1)))) (EQUAL (LIST X1) (APPEND (APPEND (REV (APPEND RV2 (LIST L3))) (LIST RV1)) (LIST X1)))). Name the formula above *1.1.2.1.2. Subgoal *1.1.2.1/1 (IMPLIES (AND (ENDP RV) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2.1/1' (IMPLIES (AND (NOT (CONSP RV)) (EQUAL (LIST X1) (APPEND (REV RV) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (APPEND RV (LIST L3))) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV, the :executable-counterparts of CONSP and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1.1.2.1/1'' (CONSP RV). We suspect that this conjecture is not a theorem. We might as well be trying to prove Subgoal *1.1.2.1/1''' NIL. Obviously, the proof attempt has failed. Summary Form: ( DEFTHM REV-IS-REV3 ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION REV3) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CAR) (:EXECUTABLE-COUNTERPART CDR) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:INDUCTION REV3) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-EQUAL) (:TYPE-PRESCRIPTION BINARY-APPEND) (:TYPE-PRESCRIPTION REV)) Warnings: None Time: 0.53 seconds (prove: 0.21, print: 0.32, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>Bye. Quitting ACL2 and lisp; this may take a moment. For faster response time, exit the ACL2 loop with :q and then: type (GOOD-BYE) or (CCL:QUIT), then . ACL2 !>ACL2 !> w-mob101-128-62-89-117:~/class/march-2007 kaufmann$ acl2 Welcome to OpenMCL Version 1.0 (DarwinPPC32)! ACL2 Version 3.1 built November 28, 2006 23:08:33. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>;; Ready to execute ACL2-LOAD -- hit when ready (acl2::ld "/Users/kaufmann/class/march-2007/temp-emacs-file.lisp" :LD-PRE-EVAL-PRINT acl2::t :ld-error-action :return) ACL2 Version 3.1. Level 2. Cbd "/Users/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>>(DEFUN REV (X) (IF (ENDP X) NIL (APPEND (REV (CDR X)) (LIST (CAR X))))) The admission of REV is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV is described by the theorem (OR (CONSP (REV X)) (EQUAL (REV X) NIL)). We used primitive type reasoning and the :type-prescription rule BINARY-APPEND. Summary Form: ( DEFUN REV ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL) (:TYPE-PRESCRIPTION BINARY-APPEND)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02) REV ACL2 !>>(DEFUN REV3 (X) (COND ((ENDP X) NIL) ((ENDP (CDR X)) (LIST (CAR X))) (T (LET* ((B@C (CDR X)) (C@REV-B (REV3 B@C)) (REV-B (CDR C@REV-B)) (B (REV REV-B)) (A (CAR X)) (A@B (CONS A B)) (REV-B@A (REV A@B)) (C (CAR C@REV-B)) (C@REV-B@A (CONS C REV-B@A))) C@REV-B@A)))) The admission of REV3 is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of REV3 is described by the theorem (OR (CONSP (REV3 X)) (EQUAL (REV3 X) NIL)). We used primitive type reasoning. Summary Form: ( DEFUN REV3 ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.02 seconds (prove: 0.00, print: 0.01, other: 0.02) REV3 ACL2 !>>Bye. :EOF ACL2 !>(defthm rev-is-rev3 ; proof fails (equal (rev x) (rev3 x))) Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (:P (CDR X))) (:P X)) (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/3'' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, to the following two conjectures. Subgoal *1/3.2 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using primitive type reasoning and the :rewrite rule CONS-EQUAL, to Subgoal *1/3.2' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.2'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2''' (IMPLIES (AND (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We now use the second hypothesis by cross-fertilizing (REV3 X2) for (REV X2) and throwing away the hypothesis. This produces Subgoal *1/3.2'4' (IMPLIES (AND (CONSP X2) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by L. This produces Subgoal *1/3.2'5' (IMPLIES (AND (CONSP X2) (CONSP L)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR L))) (LIST X1)))). The destructor terms (CAR L) and (CDR L) can be eliminated by using CAR-CDR-ELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L) by L2. This produces the following goal. Subgoal *1/3.2'6' (IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2'7' (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1. Subgoal *1/3.1 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (NOT (CONSP (REV (CDR X))))) (EQUAL (LIST (CAR X)) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, the :executable- counterparts of CAR, CDR, CONSP and REV, primitive type reasoning, the :rewrite rule CDR-CONS and the :type-prescription rule REV, to Subgoal *1/3.1' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (NOT (REV3 (CDR X)))) (CONSP (REV (CDR X)))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). This simplifies, using primitive type reasoning, to Subgoal *1/3.1''' (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Name the formula above *1.2. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (LIST (CAR X)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV X) (REV3 X))). But simplification reduces this to T, using the :definitions REV and REV3 and the :executable-counterpart of EQUAL. So we now return to *1.2, which is (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Perhaps we can prove *1.2 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X2) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P (CDR X2))) (:P X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P X2)) (IMPLIES (ENDP X2) (:P X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following five nontautological subgoals. Subgoal *1.2/5 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (CONSP (REV (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/5' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (CONSP (REV (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (REV3 (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (REV3 (CDR X2)) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. Subgoal *1.2/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definition REV3 and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (ENDP X2) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. We will choose arbitrarily among these. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rule REV3. If we let (:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P L2 X1 (CDR X2))) (:P L2 X1 X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P L2 X1 X2)) (IMPLIES (ENDP X2) (:P L2 X1 X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following four nontautological subgoals. Subgoal *1.1/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1.1/4'' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 (CDR X2))))) (LIST (CAR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2) by X4. This produces the following goal. Subgoal *1.1/4''' (IMPLIES (AND (CONSP (CONS X3 X4)) (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1/4'4' (IMPLIES (AND (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (CDR (REV3 X4)) (LIST X1)))). We now use the second hypothesis by substituting (APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1)) and throwing away the hypothesis. This produces Subgoal *1.1/4'5' (IMPLIES (CONSP X4) (EQUAL (APPEND (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1.1. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). But we reduce the conjecture to T, by case analysis. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) C-c C-c(EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV3, the :executable-counterpart of CONSP and the :rewrite rule CDR-CONS, to Subgoal *1.1/2'' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR > Break in process listener(3): > While executing: # > Type :GO to continue, :POP to abort. > If continued: Return from BREAK. Type :? for other options. 1 > [RAW LISP] :pop Here is the current pstack [see :DOC pstack]: (WATERFALL) ACL2 !>(defthm rev-rev ; fails -> to do list: (rev-rev rev-is-rev3) (equal (rev (rev x)) x)) Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). This simplifies, using the :definition REV, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X)))) X)). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (REV X2)) X2)) (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 X2))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (EQUAL (REV (REV X2)) X2) (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 X2))). We now use the hypothesis by cross-fertilizing (REV (REV X2)) for X2 and throwing away the hypothesis. This produces Subgoal *1/2'5' (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 (REV (REV X2)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/2'6' (EQUAL (REV (APPEND RV (LIST X1))) (CONS X1 (REV RV))). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (REV X)) X)). This simplifies, using the :definition REV, the :executable-counterpart of REV and primitive type reasoning, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (NOT X)). Name the formula above *1.2. No induction schemes are suggested by *1.2. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-REV ...) Rules: ((:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV)) Warnings: None Time: 0.06 seconds (prove: 0.02, print: 0.04, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>:start-proof-tree Proof tree output is now enabled. Note that :START-PROOF-TREE works by removing 'proof-tree from the inhibit-output-lst; see :DOC set- inhibit-output-lst. ACL2 !>(defthm rev-rev ; fails -> to do list: (rev-rev rev-is-rev3) (equal (rev (rev x)) x)) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). This simplifies, using the :definition REV, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X)))) X)). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (REV X2)) X2)) (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 X2))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (EQUAL (REV (REV X2)) X2) (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 X2))). We now use the hypothesis by cross-fertilizing (REV (REV X2)) for X2 and throwing away the hypothesis. This produces Subgoal *1/2'5' (EQUAL (REV (APPEND (REV X2) (LIST X1))) (CONS X1 (REV (REV X2)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/2'6' (EQUAL (REV (APPEND RV (LIST X1))) (CONS X1 (REV RV))). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (REV X)) X)). This simplifies, using the :definition REV, the :executable-counterpart of REV and primitive type reasoning, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (NOT X)). Name the formula above *1.2. No induction schemes are suggested by *1.2. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-REV ...) Rules: ((:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV)) Warnings: None Time: 0.10 seconds (prove: 0.02, print: 0.04, proof tree: 0.04, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm rev-append ; fails -> to do list: (rev-append rev-rev rev-is-rev3) (equal (rev (append x y)) (append (rev y) (rev x)))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (BINARY-APPEND X Y). This suggestion was produced using the :induction rules BINARY-APPEND and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y)) (:P X Y)) (IMPLIES (ENDP X) (:P X Y))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). This simplifies, using the :definitions BINARY-APPEND and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (APPEND (REV (APPEND (CDR X) Y)) (LIST (CAR X))) (APPEND (REV Y) (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2)))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). We now use the hypothesis by substituting (APPEND (REV Y) (REV X2)) for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/2'5' (EQUAL (APPEND (APPEND (REV Y) (REV X2)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1))). We generalize this conjecture, replacing (REV X2) by RV and (REV Y) by RV0. This produces Subgoal *1/2'6' (EQUAL (APPEND (APPEND RV0 RV) (LIST X1)) (APPEND RV0 RV (LIST X1))). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). This simplifies, using the :definitions BINARY-APPEND and REV, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APPEND (REV Y) NIL))). We generalize this conjecture, replacing (REV Y) by RV. This produces Subgoal *1/1''' (IMPLIES (NOT (CONSP X)) (EQUAL RV (APPEND RV NIL))). We suspect that the term (NOT (CONSP X)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1/1'4' (EQUAL RV (APPEND RV NIL)). Name the formula above *1.2. Perhaps we can prove *1.2 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (BINARY-APPEND RV 'NIL). This suggestion was produced using the :induction rule BINARY-APPEND. If we let (:P RV) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV))) (:P RV)) (IMPLIES (ENDP RV) (:P RV))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.2/2 (IMPLIES (AND (NOT (ENDP RV)) (EQUAL (CDR RV) (APPEND (CDR RV) NIL))) (EQUAL RV (APPEND RV NIL))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/2' (IMPLIES (AND (CONSP RV) (EQUAL (CDR RV) (APPEND (CDR RV) NIL))) (EQUAL RV (APPEND RV NIL))). But simplification reduces this to T, using the :definition BINARY- APPEND, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. Subgoal *1.2/1 (IMPLIES (ENDP RV) (EQUAL RV (APPEND RV NIL))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/1' (IMPLIES (NOT (CONSP RV)) (EQUAL RV (APPEND RV NIL))). This simplifies, using the :definition BINARY-APPEND and primitive type reasoning, to Subgoal *1.2/1'' (IMPLIES (NOT (CONSP RV)) (NOT RV)). Name the formula above *1.2.1. No induction schemes are suggested by *1.2.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-APPEND ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.34 seconds (prove: 0.04, print: 0.12, proof tree: 0.18, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm append-assoc (equal (append (append x y) z) (append x (append y z)))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (BINARY-APPEND X Y). This suggestion was produced using the :induction rule BINARY-APPEND. If we let (:P X Y Z) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y Z)) (:P X Y Z)) (IMPLIES (ENDP X) (:P X Y Z))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (APPEND (APPEND (CDR X) Y) Z) (APPEND (CDR X) Y Z))) (EQUAL (APPEND (APPEND X Y) Z) (APPEND X Y Z))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (APPEND (APPEND (CDR X) Y) Z) (APPEND (CDR X) Y Z))) (EQUAL (APPEND (APPEND X Y) Z) (APPEND X Y Z))). But simplification reduces this to T, using the :definition BINARY- APPEND, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (APPEND (APPEND X Y) Z) (APPEND X Y Z))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (APPEND (APPEND X Y) Z) (APPEND X Y Z))). But simplification reduces this to T, using the :definition BINARY- APPEND and primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM APPEND-ASSOC ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS)) Warnings: None Time: 0.05 seconds (prove: 0.01, print: 0.03, proof tree: 0.01, other: 0.00) APPEND-ASSOC ACL2 !>(defthm rev-append ; fails -> to do list: (rev-append rev-rev rev-is-rev3) (equal (rev (append x y)) (append (rev y) (rev x)))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (BINARY-APPEND X Y). This suggestion was produced using the :induction rules BINARY-APPEND and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y)) (:P X Y)) (IMPLIES (ENDP X) (:P X Y))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). This simplifies, using the :definitions BINARY-APPEND and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (APPEND (REV (APPEND (CDR X) Y)) (LIST (CAR X))) (APPEND (REV Y) (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2)))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). We now use the hypothesis by substituting (APPEND (REV Y) (REV X2)) for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/2'5' (EQUAL (APPEND (APPEND (REV Y) (REV X2)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1))). But we reduce the conjecture to T, by the simple :rewrite rule APPEND- ASSOC. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). This simplifies, using the :definitions BINARY-APPEND and REV, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (EQUAL (REV Y) (APPEND (REV Y) NIL))). We generalize this conjecture, replacing (REV Y) by RV. This produces Subgoal *1/1''' (IMPLIES (NOT (CONSP X)) (EQUAL RV (APPEND RV NIL))). We suspect that the term (NOT (CONSP X)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1/1'4' (EQUAL RV (APPEND RV NIL)). Name the formula above *1.1. Perhaps we can prove *1.1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (BINARY-APPEND RV 'NIL). This suggestion was produced using the :induction rule BINARY-APPEND. If we let (:P RV) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV))) (:P RV)) (IMPLIES (ENDP RV) (:P RV))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP RV)) (EQUAL (CDR RV) (APPEND (CDR RV) NIL))) (EQUAL RV (APPEND RV NIL))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/2' (IMPLIES (AND (CONSP RV) (EQUAL (CDR RV) (APPEND (CDR RV) NIL))) (EQUAL RV (APPEND RV NIL))). But simplification reduces this to T, using the :definition BINARY- APPEND, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. Subgoal *1.1/1 (IMPLIES (ENDP RV) (EQUAL RV (APPEND RV NIL))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/1' (IMPLIES (NOT (CONSP RV)) (EQUAL RV (APPEND RV NIL))). This simplifies, using the :definition BINARY-APPEND and primitive type reasoning, to Subgoal *1.1/1'' (IMPLIES (NOT (CONSP RV)) (NOT RV)). Name the formula above *1.1.1. No induction schemes are suggested by *1.1.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-APPEND ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:REWRITE APPEND-ASSOC) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.19 seconds (prove: 0.03, print: 0.10, proof tree: 0.05, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm append-nil (implies (true-listp x) (equal (append x nil) x))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. These merge into one derived induction scheme. We will induct according to a scheme suggested by (BINARY-APPEND X 'NIL). This suggestion was produced using the :induction rules BINARY-APPEND and TRUE-LISTP. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (APPEND (CDR X) NIL) (CDR X)) (TRUE-LISTP X)) (EQUAL (APPEND X NIL) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (EQUAL (APPEND (CDR X) NIL) (CDR X)) (TRUE-LISTP X)) (EQUAL (APPEND X NIL) X)). But simplification reduces this to T, using the :definitions BINARY- APPEND and TRUE-LISTP, primitive type reasoning and the :rewrite rule CONS-CAR-CDR. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (NOT (TRUE-LISTP (CDR X))) (TRUE-LISTP X)) (EQUAL (APPEND X NIL) X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/1 (IMPLIES (AND (ENDP X) (TRUE-LISTP X)) (EQUAL (APPEND X NIL) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X)) (EQUAL (APPEND X NIL) X)). But simplification reduces this to T, using the :definition TRUE-LISTP, the :executable-counterparts of BINARY-APPEND, CONSP and EQUAL and primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM APPEND-NIL ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION TRUE-LISTP) (:EXECUTABLE-COUNTERPART BINARY-APPEND) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION TRUE-LISTP) (:REWRITE CONS-CAR-CDR)) Warnings: None Time: 0.09 seconds (prove: 0.01, print: 0.04, proof tree: 0.04, other: 0.00) APPEND-NIL ACL2 !>(defthm true-listp-rev (true-listp (rev x))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (REV X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (REV X))). This simplifies, using the :definition REV, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (TRUE-LISTP (REV (CDR X)))) (TRUE-LISTP (APPEND (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (TRUE-LISTP (REV X2))) (TRUE-LISTP (APPEND (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (TRUE-LISTP (REV X2)) (TRUE-LISTP (APPEND (REV X2) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by RV. This produces Subgoal *1/2'5' (IMPLIES (TRUE-LISTP RV) (TRUE-LISTP (APPEND RV (LIST X1)))). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (ENDP X) (TRUE-LISTP (REV X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (TRUE-LISTP (REV X))). But simplification reduces this to T, using the :definition REV and the :executable-counterpart of TRUE-LISTP. So we now return to *1.1, which is (IMPLIES (TRUE-LISTP RV) (TRUE-LISTP (APPEND RV (LIST X1)))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. These merge into one derived induction scheme. We will induct according to a scheme suggested by (BINARY-APPEND RV (CONS X1 'NIL)). This suggestion was produced using the :induction rules BINARY-APPEND and TRUE-LISTP. If we let (:P RV X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV) X1)) (:P RV X1)) (IMPLIES (ENDP RV) (:P RV X1))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP RV)) (TRUE-LISTP (APPEND (CDR RV) (LIST X1))) (TRUE-LISTP RV)) (TRUE-LISTP (APPEND RV (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/3' (IMPLIES (AND (CONSP RV) (TRUE-LISTP (APPEND (CDR RV) (LIST X1))) (TRUE-LISTP RV)) (TRUE-LISTP (APPEND RV (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and TRUE-LISTP, primitive type reasoning and the :type-prescription rule BINARY-APPEND. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP RV)) (NOT (TRUE-LISTP (CDR RV))) (TRUE-LISTP RV)) (TRUE-LISTP (APPEND RV (LIST X1)))). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (ENDP RV) (TRUE-LISTP RV)) (TRUE-LISTP (APPEND RV (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/1' (IMPLIES (AND (NOT (CONSP RV)) (TRUE-LISTP RV)) (TRUE-LISTP (APPEND RV (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and TRUE-LISTP, the :executable-counterpart of CONSP and primitive type reasoning. That completes the proofs of *1.1 and *1. Q.E.D. The storage of TRUE-LISTP-REV depends upon the :type-prescription rule TRUE-LISTP. Summary Form: ( DEFTHM TRUE-LISTP-REV ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART TRUE-LISTP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:TYPE-PRESCRIPTION BINARY-APPEND) (:TYPE-PRESCRIPTION TRUE-LISTP)) Warnings: None Time: 0.13 seconds (prove: 0.02, print: 0.05, proof tree: 0.05, other: 0.00) TRUE-LISTP-REV ACL2 !>(defthm rev-append (equal (rev (append x y)) (append (rev y) (rev x)))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Three induction schemes are suggested by this conjecture. Subsumption reduces that number to two. However, one of these is flawed and so we are left with one viable candidate. We will induct according to a scheme suggested by (BINARY-APPEND X Y). This suggestion was produced using the :induction rules BINARY-APPEND and REV. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X) Y)) (:P X Y)) (IMPLIES (ENDP X) (:P X Y))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). This simplifies, using the :definitions BINARY-APPEND and REV, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (EQUAL (REV (APPEND (CDR X) Y)) (APPEND (REV Y) (REV (CDR X))))) (EQUAL (APPEND (REV (APPEND (CDR X) Y)) (LIST (CAR X))) (APPEND (REV Y) (REV (CDR X)) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2''' (IMPLIES (AND (CONSP (CONS X1 X2)) (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2)))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2'4' (IMPLIES (EQUAL (REV (APPEND X2 Y)) (APPEND (REV Y) (REV X2))) (EQUAL (APPEND (REV (APPEND X2 Y)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1)))). We now use the hypothesis by substituting (APPEND (REV Y) (REV X2)) for (REV (APPEND X2 Y)) and throwing away the hypothesis. This produces Subgoal *1/2'5' (EQUAL (APPEND (APPEND (REV Y) (REV X2)) (LIST X1)) (APPEND (REV Y) (REV X2) (LIST X1))). But we reduce the conjecture to T, by the simple :rewrite rule APPEND- ASSOC. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (APPEND X Y)) (APPEND (REV Y) (REV X)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, primitive type reasoning and the :rewrite rules APPEND- NIL and TRUE-LISTP-REV. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM REV-APPEND ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:REWRITE APPEND-ASSOC) (:REWRITE APPEND-NIL) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE TRUE-LISTP-REV)) Warnings: None Time: 0.10 seconds (prove: 0.03, print: 0.05, proof tree: 0.02, other: 0.00) REV-APPEND ACL2 !>(defthm rev-rev ; fails -> to do list: (rev-rev rev-is-rev3) (equal (rev (rev x)) x)) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X))) (EQUAL (REV (REV X)) X)). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterparts of CONSP and REV, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, CONS-CAR- CDR and REV-APPEND. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV (REV X)) X)). This simplifies, using the :definition REV, the :executable-counterpart of REV and primitive type reasoning, to Subgoal *1/1'' (IMPLIES (NOT (CONSP X)) (NOT X)). Name the formula above *1.1. No induction schemes are suggested by *1.1. Consequently, the proof attempt has failed. Summary Form: ( DEFTHM REV-REV ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR) (:REWRITE REV-APPEND)) Warnings: None Time: 0.08 seconds (prove: 0.01, print: 0.03, proof tree: 0.04, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defthm rev-rev ; succeeds -> to do list: (rev-is-rev3) (implies (true-listp x) (equal (rev (rev x)) x))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. These merge into one derived induction scheme. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rules REV and TRUE-LISTP. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (EQUAL (REV (REV (CDR X))) (CDR X)) (TRUE-LISTP X)) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (EQUAL (REV (REV (CDR X))) (CDR X)) (TRUE-LISTP X)) (EQUAL (REV (REV X)) X)). But simplification reduces this to T, using the :definitions BINARY- APPEND, REV and TRUE-LISTP, the :executable-counterparts of CONSP and REV, primitive type reasoning and the :rewrite rules CAR-CONS, CDR- CONS, CONS-CAR-CDR and REV-APPEND. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (NOT (TRUE-LISTP (CDR X))) (TRUE-LISTP X)) (EQUAL (REV (REV X)) X)). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1/1 (IMPLIES (AND (ENDP X) (TRUE-LISTP X)) (EQUAL (REV (REV X)) X)). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X)) (EQUAL (REV (REV X)) X)). But simplification reduces this to T, using the :definition TRUE-LISTP, the :executable-counterparts of CONSP, EQUAL and REV and primitive type reasoning. That completes the proof of *1. Q.E.D. Summary Form: ( DEFTHM REV-REV ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-CAR-CDR) (:REWRITE REV-APPEND)) Warnings: None Time: 0.06 seconds (prove: 0.01, print: 0.03, proof tree: 0.01, other: 0.00) REV-REV ACL2 !>(defthm rev-is-rev3 ; proof fails -> why didn't rev-rev apply? (equal (rev x) (rev3 x))) ACL2 Warning [Subsume] in ( DEFTHM REV-IS-REV3 ...): A newly proposed :REWRITE rule generated from REV-IS-REV3 probably subsumes the previously added :REWRITE rules REV-REV and REV-APPEND, in the sense that the new rule will now probably be applied whenever the old rules would have been. << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (:P (CDR X))) (:P X)) (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS, to Subgoal *1/3'' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, to the following two conjectures. Subgoal *1/3.2 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using primitive type reasoning and the :rewrite rule CONS-EQUAL, to Subgoal *1/3.2' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.2'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2''' (IMPLIES (AND (CONSP X2) (EQUAL (REV X2) (REV3 X2)) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We now use the second hypothesis by cross-fertilizing (REV3 X2) for (REV X2) and throwing away the hypothesis. This produces Subgoal *1/3.2'4' (IMPLIES (AND (CONSP X2) (CONSP (REV X2))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR (REV X2)))) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by L. This produces Subgoal *1/3.2'5' (IMPLIES (AND (CONSP X2) (CONSP L)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV (CDR L))) (LIST X1)))). The destructor terms (CAR L) and (CDR L) can be eliminated by using CAR-CDR-ELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L) by L2. This produces the following goal. Subgoal *1/3.2'6' (IMPLIES (AND (CONSP (CONS L1 L2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/3.2'7' (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1. Subgoal *1/3.1 (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (NOT (CONSP (REV (CDR X))))) (EQUAL (LIST (CAR X)) (CONS (CAR (REV (CDR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, the :executable- counterparts of CAR, CDR, CONSP and REV, primitive type reasoning, the :rewrite rule CDR-CONS and the :type-prescription rule REV, to Subgoal *1/3.1' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (NOT (REV3 (CDR X)))) (CONSP (REV (CDR X)))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3.1'' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). This simplifies, using primitive type reasoning, to Subgoal *1/3.1''' (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Name the formula above *1.2. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (LIST (CAR X)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV X) (REV3 X))). But simplification reduces this to T, using the :definitions REV and REV3 and the :executable-counterpart of EQUAL. So we now return to *1.2, which is (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Perhaps we can prove *1.2 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X2) denote *1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P (CDR X2))) (:P X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P X2)) (IMPLIES (ENDP X2) (:P X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following five nontautological subgoals. Subgoal *1.2/5 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (CONSP (REV (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/5' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (CONSP (REV (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (REV3 (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (REV3 (CDR X2)) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.2/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. Subgoal *1.2/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.2/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definition REV3 and primitive type reasoning. Subgoal *1.2/1 (IMPLIES (AND (ENDP X2) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. That completes the proof of *1.2. We therefore turn our attention to *1.1, which is (IMPLIES (CONSP X2) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. We will choose arbitrarily among these. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rule REV3. If we let (:P L2 X1 X2) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P L2 X1 (CDR X2))) (:P L2 X1 X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P L2 X1 X2)) (IMPLIES (ENDP X2) (:P L2 X1 X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following four nontautological subgoals. Subgoal *1.1/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND, REV and REV3, the :executable-counterpart of CONSP, primitive type reasoning and the :rewrite rules APPEND-ASSOC, CAR-CONS and CDR-CONS, to Subgoal *1.1/4'' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (EQUAL (APPEND (CDR (REV3 (CDR X2))) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (REV (REV (CDR (REV3 (CDR X2))))) (LIST (CAR X2) X1)) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2) by X4. This produces the following goal. Subgoal *1.1/4''' (IMPLIES (AND (CONSP (CONS X3 X4)) (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3 X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1/4'4' (IMPLIES (AND (CONSP X4) (EQUAL (APPEND (CDR (REV3 X4)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))) (EQUAL (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3 X1)) (APPEND (CDR (REV3 X4)) (LIST X1)))). We now use the second hypothesis by substituting (APPEND (REV (REV L2)) (LIST X1)) for (APPEND (CDR (REV3 X4)) (LIST X1)) and throwing away the hypothesis. This produces Subgoal *1.1/4'5' (IMPLIES (CONSP X4) (EQUAL (APPEND (REV (REV (CDR (REV3 X4)))) (LIST X3 X1)) (APPEND (REV (REV L2)) (LIST X1)))). Name the formula above *1.1.1. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). But we reduce the conjecture to T, by case analysis. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV3, the :executable-counterpart of CONSP and the :rewrite rule CDR-CONS, to Subgoal *1.1/2'' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). The destructor terms (CAR X2) and (CDR X2) can be eliminated by using CAR-CDR-ELIM to replace X2 by (CONS X3 X4), (CAR X2) by X3 and (CDR X2) by X4. This produces the following goal. Subgoal *1.1/2''' (IMPLIES (AND (CONSP (CONS X3 X4)) (NOT (CONSP X4))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1.1/2'4' (IMPLIES (NOT (CONSP X4)) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). We suspect that the term (NOT (CONSP X4)) is irrelevant to the truth of this conjecture and throw it out. We will thus try to prove Subgoal *1.1/2'5' (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1))). Name the formula above *1.1.2. Subgoal *1.1/1 (IMPLIES (AND (ENDP X2) (CONSP X2)) (EQUAL (APPEND (CDR (REV3 X2)) (LIST X1)) (APPEND (REV (REV L2)) (LIST X1)))). But we reduce the conjecture to T, by case analysis. So we now return to *1.1.2, which is (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1))). Perhaps we can prove *1.1.2 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV L2). This suggestion was produced using the :induction rule REV. If we let (:P L2 X1) denote *1.1.2 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1)) (:P L2 X1)) (IMPLIES (ENDP L2) (:P L2 X1))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1.2/2 (IMPLIES (AND (NOT (ENDP L2)) (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2/2' (IMPLIES (AND (CONSP L2) (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1)))) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). This simplifies, using the :definitions BINARY-APPEND and REV, the :executable-counterparts of CONSP and REV, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS and REV-APPEND, to Subgoal *1.1.2/2'' (IMPLIES (CONSP L2) (NOT (EQUAL (LIST X1) (APPEND (REV (REV (CDR L2))) (LIST X1))))). The destructor terms (CAR L2) and (CDR L2) can be eliminated by using CAR-CDR-ELIM to replace L2 by (CONS L3 L4), (CAR L2) by L3 and (CDR L2) by L4. This produces the following goal. Subgoal *1.1.2/2''' (IMPLIES (CONSP (CONS L3 L4)) (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))))). This simplifies, using primitive type reasoning, to Subgoal *1.1.2/2'4' (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1)))). Name the formula above *1.1.2.1. Subgoal *1.1.2/1 (IMPLIES (ENDP L2) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2/1' (IMPLIES (NOT (CONSP L2)) (EQUAL (LIST X1) (APPEND (REV (REV L2)) (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterparts of CONSP and REV and primitive type reasoning. So we now return to *1.1.2.1, which is (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1)))). Perhaps we can prove *1.1.2.1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV L4). This suggestion was produced using the :induction rule REV. If we let (:P L4 X1) denote *1.1.2.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP L4)) (:P (CDR L4) X1)) (:P L4 X1)) (IMPLIES (ENDP L4) (:P L4 X1))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1.1.2.1/2 (IMPLIES (AND (NOT (ENDP L4)) (NOT (EQUAL (LIST X1) (APPEND (REV (REV (CDR L4))) (LIST X1))))) (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2.1/2' (IMPLIES (AND (CONSP L4) (NOT (EQUAL (LIST X1) (APPEND (REV (REV (CDR L4))) (LIST X1))))) (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterparts of CONSP and REV, primitive type reasoning, the :rewrite rules CAR-CONS, CDR-CONS and REV-APPEND and the :type-prescription rule BINARY-APPEND. Subgoal *1.1.2.1/1 (IMPLIES (ENDP L4) (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1.2.1/1' (IMPLIES (NOT (CONSP L4)) (NOT (EQUAL (LIST X1) (APPEND (REV (REV L4)) (LIST X1))))). This simplifies, using the :definitions BINARY-APPEND and REV, the :executable-counterparts of CONSP and REV and primitive type reasoning, to Subgoal *1.1.2.1/1'' (CONSP L4). We suspect that this conjecture is not a theorem. We might as well be trying to prove Subgoal *1.1.2.1/1''' NIL. Obviously, the proof attempt has failed. Summary Form: ( DEFTHM REV-IS-REV3 ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION REV3) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CAR) (:EXECUTABLE-COUNTERPART CDR) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:EXECUTABLE-COUNTERPART REV) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV) (:INDUCTION REV3) (:REWRITE APPEND-ASSOC) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE CONS-EQUAL) (:REWRITE REV-APPEND) (:TYPE-PRESCRIPTION BINARY-APPEND) (:TYPE-PRESCRIPTION REV)) Warnings: Subsume Time: 1.30 seconds (prove: 0.17, print: 0.30, proof tree: 0.83, other: 0.01) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(verify (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (CONSP (REV (CDR X)))) (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))))) ->: promote ->: th *** Top-level hypotheses: 1. (CONSP X) 2. (CONSP (CDR X)) 3. (EQUAL (REV (CDR X)) (REV3 (CDR X))) 4. (CONSP (REV (CDR X))) The current subterm is: (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (REV (REV (CDR (REV (CDR X))))) (LIST (CAR X)))) ->: (dv 2 1 0) ->: p (REV (REV (CDR (REV (CDR X))))) ->: sr 1. REV-REV New term: (CDR (REV (CDR X))) Hypotheses: ((TRUE-LISTP (CDR (REV (CDR X))))) Equiv: EQUAL 2. REV New term: (AND (CONSP (REV (CDR (REV (CDR X))))) (APPEND (REV (CDR (REV (CDR (REV (CDR X)))))) (LIST (CAR (REV (CDR (REV (CDR X)))))))) Hypotheses: Equiv: EQUAL ->: (r 1) Rewriting with REV-REV. Creating one new goal: (MAIN . 1). ->: top ->: p (EQUAL (APPEND (CDR (REV (CDR X))) (LIST (CAR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))) ->: prove ***** Now entering the theorem prover ***** << Starting proof tree logging >> But we reduce the conjecture to T, by primitive type reasoning. Q.E.D. The proof of the current goal, MAIN, has been completed. However, the following subgoals remain to be proved: (MAIN . 1). Now proving (MAIN . 1). ->: th *** Top-level hypotheses: 1. (CONSP X) 2. (CONSP (CDR X)) 3. (EQUAL (REV (CDR X)) (REV3 (CDR X))) 4. (CONSP (REV (CDR X))) The current subterm is: (TRUE-LISTP (CDR (REV (CDR X)))) ->: exitt *** NO CHANGE *** -- Undefined instruction, :EXITT. ->: exit Exiting.... NIL ACL2 !>(defthm true-listp-cdr-rev (true-listp (cdr (rev x)))) << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. One induction scheme is suggested by this conjecture. We will induct according to a scheme suggested by (REV X). This suggestion was produced using the :induction rule REV. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (:P (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (TRUE-LISTP (CDR (REV (CDR X))))) (TRUE-LISTP (CDR (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (TRUE-LISTP (CDR (REV (CDR X))))) (TRUE-LISTP (CDR (REV X)))). This simplifies, using the :definition REV, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (TRUE-LISTP (CDR (REV (CDR X))))) (TRUE-LISTP (CDR (APPEND (REV (CDR X)) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, to the following two conjectures. Subgoal *1/2.2 (IMPLIES (AND (CONSP X) (TRUE-LISTP (CDR (REV (CDR X)))) (CONSP (REV (CDR X)))) (TRUE-LISTP (CDR (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X))))))). By the simple :rewrite rule CDR-CONS we reduce the conjecture to Subgoal *1/2.2' (IMPLIES (AND (CONSP X) (TRUE-LISTP (CDR (REV (CDR X)))) (CONSP (REV (CDR X)))) (TRUE-LISTP (APPEND (CDR (REV (CDR X))) (LIST (CAR X))))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/2.2'' (IMPLIES (AND (CONSP (CONS X1 X2)) (TRUE-LISTP (CDR (REV X2))) (CONSP (REV X2))) (TRUE-LISTP (APPEND (CDR (REV X2)) (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2.2''' (IMPLIES (AND (TRUE-LISTP (CDR (REV X2))) (CONSP (REV X2))) (TRUE-LISTP (APPEND (CDR (REV X2)) (LIST X1)))). We generalize this conjecture, replacing (REV X2) by L. This produces Subgoal *1/2.2'4' (IMPLIES (AND (TRUE-LISTP (CDR L)) (CONSP L)) (TRUE-LISTP (APPEND (CDR L) (LIST X1)))). The destructor terms (CAR L) and (CDR L) can be eliminated by using CAR-CDR-ELIM to replace L by (CONS L1 L2), (CAR L) by L1 and (CDR L) by L2. This produces the following goal. Subgoal *1/2.2'5' (IMPLIES (AND (CONSP (CONS L1 L2)) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). This simplifies, using primitive type reasoning, to Subgoal *1/2.2'6' (IMPLIES (TRUE-LISTP L2) (TRUE-LISTP (APPEND L2 (LIST X1)))). Name the formula above *1.1. Subgoal *1/2.1 (IMPLIES (AND (CONSP X) (TRUE-LISTP (CDR (REV (CDR X)))) (NOT (CONSP (REV (CDR X))))) (TRUE-LISTP (CDR (LIST (CAR X))))). But we reduce the conjecture to T, by the :executable-counterpart of TRUE-LISTP and the simple :rewrite rule CDR-CONS. Subgoal *1/1 (IMPLIES (ENDP X) (TRUE-LISTP (CDR (REV X)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (TRUE-LISTP (CDR (REV X)))). But simplification reduces this to T, using the :definition REV and the :executable-counterparts of CDR and TRUE-LISTP. So we now return to *1.1, which is (IMPLIES (TRUE-LISTP L2) (TRUE-LISTP (APPEND L2 (LIST X1)))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. These merge into one derived induction scheme. We will induct according to a scheme suggested by (BINARY-APPEND L2 (CONS X1 'NIL)). This suggestion was produced using the :induction rules BINARY-APPEND and TRUE-LISTP. If we let (:P L2 X1) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP L2)) (:P (CDR L2) X1)) (:P L2 X1)) (IMPLIES (ENDP L2) (:P L2 X1))). This induction is justified by the same argument used to admit BINARY- APPEND. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP L2)) (TRUE-LISTP (APPEND (CDR L2) (LIST X1))) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/3' (IMPLIES (AND (CONSP L2) (TRUE-LISTP (APPEND (CDR L2) (LIST X1))) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and TRUE-LISTP, primitive type reasoning and the :type-prescription rule BINARY-APPEND. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP L2)) (NOT (TRUE-LISTP (CDR L2))) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). But we reduce the conjecture to T, by primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (ENDP L2) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/1' (IMPLIES (AND (NOT (CONSP L2)) (TRUE-LISTP L2)) (TRUE-LISTP (APPEND L2 (LIST X1)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and TRUE-LISTP, the :executable-counterpart of CONSP and primitive type reasoning. That completes the proofs of *1.1 and *1. Q.E.D. The storage of TRUE-LISTP-CDR-REV depends upon the :type-prescription rule TRUE-LISTP. Summary Form: ( DEFTHM TRUE-LISTP-CDR-REV ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION TRUE-LISTP) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CDR) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART TRUE-LISTP) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION BINARY-APPEND) (:INDUCTION REV) (:INDUCTION TRUE-LISTP) (:REWRITE CDR-CONS) (:TYPE-PRESCRIPTION BINARY-APPEND) (:TYPE-PRESCRIPTION TRUE-LISTP)) Warnings: None Time: 0.28 seconds (prove: 0.03, print: 0.14, proof tree: 0.10, other: 0.01) TRUE-LISTP-CDR-REV ACL2 !>(defthm rev-is-rev3 ; succeeds (equal (rev x) (rev3 x))) ACL2 Warning [Subsume] in ( DEFTHM REV-IS-REV3 ...): A newly proposed :REWRITE rule generated from REV-IS-REV3 probably subsumes the previously added :REWRITE rules REV-REV and REV-APPEND, in the sense that the new rule will now probably be applied whenever the old rules would have been. << Starting proof tree logging >> Name the formula above *1. Perhaps we can prove *1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (:P (CDR X))) (:P X)) (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (:P X)) (IMPLIES (ENDP X) (:P X))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following three nontautological subgoals. Subgoal *1/3 (IMPLIES (AND (NOT (ENDP X)) (NOT (ENDP (CDR X))) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/3' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS, CDR-CONS, REV-REV and TRUE- LISTP-CDR-REV, to Subgoal *1/3'' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, to Subgoal *1/3''' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (EQUAL (REV (CDR X)) (REV3 (CDR X))) (NOT (CONSP (REV (CDR X))))) (EQUAL (LIST (CAR X)) (CONS (CAR (REV (CDR X))) (APPEND (CDR (REV (CDR X))) (LIST (CAR X)))))). This simplifies, using the :definition BINARY-APPEND, the :executable- counterparts of CAR, CDR and CONSP, primitive type reasoning, the :rewrite rule CDR-CONS and the :type-prescription rule REV, to Subgoal *1/3'4' (IMPLIES (AND (CONSP X) (CONSP (CDR X)) (NOT (REV3 (CDR X)))) (CONSP (REV (CDR X)))). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/3'5' (IMPLIES (AND (CONSP (CONS X1 X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). This simplifies, using primitive type reasoning, to Subgoal *1/3'6' (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Name the formula above *1.1. Subgoal *1/2 (IMPLIES (AND (NOT (ENDP X)) (ENDP (CDR X))) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/2' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (REV X) (REV3 X))). This simplifies, using the :definitions REV and REV3, to Subgoal *1/2'' (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (APPEND (REV (CDR X)) (LIST (CAR X))) (LIST (CAR X)))). But simplification reduces this to T, using the :definitions BINARY- APPEND and REV, the :executable-counterpart of CONSP and primitive type reasoning. Subgoal *1/1 (IMPLIES (ENDP X) (EQUAL (REV X) (REV3 X))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1/1' (IMPLIES (NOT (CONSP X)) (EQUAL (REV X) (REV3 X))). But simplification reduces this to T, using the :definitions REV and REV3 and the :executable-counterpart of EQUAL. So we now return to *1.1, which is (IMPLIES (AND (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). Perhaps we can prove *1.1 by induction. Two induction schemes are suggested by this conjecture. Subsumption reduces that number to one. We will induct according to a scheme suggested by (REV3 X2). This suggestion was produced using the :induction rules REV and REV3. If we let (:P X2) denote *1.1 above then the induction scheme we'll use is (AND (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (:P (CDR X2))) (:P X2)) (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2))) (:P X2)) (IMPLIES (ENDP X2) (:P X2))). This induction is justified by the same argument used to admit REV3. When applied to the goal at hand the above induction scheme produces the following five nontautological subgoals. Subgoal *1.1/5 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (CONSP (REV (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/5' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (CONSP (REV (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.1/4 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (REV3 (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/4' (IMPLIES (AND (CONSP X2) (CONSP (CDR X2)) (REV3 (CDR X2)) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definitions REV and REV3, primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS. Subgoal *1.1/3 (IMPLIES (AND (NOT (ENDP X2)) (NOT (ENDP (CDR X2))) (NOT (CONSP (CDR X2))) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. Subgoal *1.1/2 (IMPLIES (AND (NOT (ENDP X2)) (ENDP (CDR X2)) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). By the simple :definition ENDP we reduce the conjecture to Subgoal *1.1/2' (IMPLIES (AND (CONSP X2) (NOT (CONSP (CDR X2))) (NOT (REV3 X2))) (CONSP (REV X2))). But simplification reduces this to T, using the :definition REV3 and primitive type reasoning. Subgoal *1.1/1 (IMPLIES (AND (ENDP X2) (CONSP X2) (NOT (REV3 X2))) (CONSP (REV X2))). But we reduce the conjecture to T, by case analysis. That completes the proofs of *1.1 and *1. Q.E.D. Summary Form: ( DEFTHM REV-IS-REV3 ...) Rules: ((:DEFINITION BINARY-APPEND) (:DEFINITION ENDP) (:DEFINITION NOT) (:DEFINITION REV) (:DEFINITION REV3) (:ELIM CAR-CDR-ELIM) (:EXECUTABLE-COUNTERPART CAR) (:EXECUTABLE-COUNTERPART CDR) (:EXECUTABLE-COUNTERPART CONSP) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION REV) (:INDUCTION REV3) (:REWRITE CAR-CONS) (:REWRITE CDR-CONS) (:REWRITE REV-REV) (:REWRITE TRUE-LISTP-CDR-REV) (:TYPE-PRESCRIPTION REV)) Warnings: Subsume Time: 0.27 seconds (prove: 0.05, print: 0.10, proof tree: 0.11, other: 0.01) REV-IS-REV3 ACL2 !>(encapsulate ; Signature: triple-rev takes one argument and returns one value. (((triple-rev *) => *)) ; Local definition: Properties below are to be proved using this definition of ; triple-rev. (local (defun triple-rev (x) (rev3 x))) ; Here is the definition we wanted to make when we defined rev3. Notice that ; triple-rev does not call rev or any other function other than itself and ; a few built-ins (endp, list, car, cdr, cons). (defthm triple-rev-def (equal (triple-rev x) (cond ((endp x) nil) ((endp (cdr x)) (list (car x))) (t ;; Think of x as a@b@c where a and c are single elements. (let* ((b@c (cdr x)) (c@rev-b (triple-rev b@c)) ; recursive call (rev-b (cdr c@rev-b)) (b (triple-rev rev-b)) ; recursive call (a (car x)) (a@b (cons a b)) (rev-b@a (triple-rev a@b)) ; recursive call (c (car c@rev-b)) (c@rev-b@a (cons c rev-b@a))) c@rev-b@a)))) ; Here we specify that the formula above be used like a definition. Details ; may be found on the ACL2 documentation page RULE-CLASSES. :rule-classes ((:definition :clique (triple-rev) :controller-alist ((triple-rev t))))) ) To verify that the two encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 !>>(LOCAL (DEFUN TRIPLE-REV (X) (REV3 X))) Since TRIPLE-REV is non-recursive, its admission is trivial. We observe that the type of TRIPLE-REV is described by the theorem (OR (CONSP (TRIPLE-REV X)) (EQUAL (TRIPLE-REV X) NIL)). We used the :type-prescription rule REV3. Summary Form: ( DEFUN TRIPLE-REV ...) Rules: ((:TYPE-PRESCRIPTION REV3)) Warnings: None Time: 0.01 seconds (prove: 0.00, print: 0.00, proof tree: 0.00, other: 0.00) TRIPLE-REV ACL2 !>>(DEFTHM TRIPLE-REV-DEF (EQUAL (TRIPLE-REV X) (COND ((ENDP X) NIL) ((ENDP (CDR X)) (LIST (CAR X))) (T (LET* ((B@C (CDR X)) (C@REV-B (TRIPLE-REV B@C)) (REV-B (CDR C@REV-B)) (B (TRIPLE-REV REV-B)) (A (CAR X)) (A@B (CONS A B)) (REV-B@A (TRIPLE-REV A@B)) (C (CAR C@REV-B)) (C@REV-B@A (CONS C REV-B@A))) C@REV-B@A)))) :RULE-CLASSES ((:DEFINITION :CLIQUE (TRIPLE-REV) :CONTROLLER-ALIST ((TRIPLE-REV T))))) ACL2 Warning [Non-rec] in ( DEFTHM TRIPLE-REV-DEF ...): A :DEFINITION rule generated from TRIPLE-REV-DEF will be triggered only by terms containing the non-recursive function symbol TRIPLE-REV. Unless this function is disabled, this rule is unlikely ever to be used. ACL2 Warning [Subsume] in ( DEFTHM TRIPLE-REV-DEF ...): A newly proposed :DEFINITION rule generated from TRIPLE-REV-DEF probably subsumes the previously added :REWRITE rule TRIPLE-REV, in the sense that the new rule will now probably be applied whenever the old rule would have been. ACL2 Warning [Subsume] in ( DEFTHM TRIPLE-REV-DEF ...): The previously added rule TRIPLE-REV subsumes a newly proposed :DEFINITION rule generated from TRIPLE-REV-DEF, in the sense that the old rule rewrites a more general target. Because the new rule will be tried first, it may nonetheless find application. << Starting proof tree logging >> By the simple :definition TRIPLE-REV we reduce the conjecture to Goal' (EQUAL (REV3 X) (AND (NOT (ENDP X)) (IF (ENDP (CDR X)) (LIST (CAR X)) (LET ((C@REV-B (REV3 (CDR X)))) (CONS (CAR C@REV-B) (REV3 (CONS (CAR X) (REV3 (CDR C@REV-B))))))))). This simplifies, using the :definition ENDP, to the following three conjectures. Subgoal 3 (IMPLIES (NOT (CONSP X)) (EQUAL (REV3 X) NIL)). But simplification reduces this to T, using the :definition REV3 and the :executable-counterpart of EQUAL. Subgoal 2 (IMPLIES (AND (CONSP X) (CONSP (CDR X))) (EQUAL (REV3 X) (CONS (CAR (REV3 (CDR X))) (REV3 (CONS (CAR X) (REV3 (CDR (REV3 (CDR X))))))))). But simplification reduces this to T, using the :definition REV3, primitive type reasoning and the :rewrite rule REV-IS-REV3. Subgoal 1 (IMPLIES (AND (CONSP X) (NOT (CONSP (CDR X)))) (EQUAL (REV3 X) (LIST (CAR X)))). But simplification reduces this to T, using the :definition REV3 and primitive type reasoning. Q.E.D. Summary Form: ( DEFTHM TRIPLE-REV-DEF ...) Rules: ((:DEFINITION ENDP) (:DEFINITION REV3) (:DEFINITION TRIPLE-REV) (:EXECUTABLE-COUNTERPART EQUAL) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:REWRITE REV-IS-REV3)) Warnings: Subsume and Non-rec Time: 0.06 seconds (prove: 0.01, print: 0.02, proof tree: 0.00, other: 0.03) TRIPLE-REV-DEF End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. The following constraint is associated with the function TRIPLE-REV: (EQUAL (TRIPLE-REV X) (AND (NOT (ENDP X)) (IF (ENDP (CDR X)) (LIST (CAR X)) (LET ((B@C (CDR X))) (LET ((C@REV-B (TRIPLE-REV B@C))) (LET ((REV-B (CDR C@REV-B))) (LET ((B (TRIPLE-REV REV-B))) (LET ((A (CAR X))) (LET ((A@B (CONS A B))) (LET ((REV-B@A (TRIPLE-REV A@B))) (LET ((C (CAR C@REV-B))) (LET ((C@REV-B@A (CONS C REV-B@A))) C@REV-B@A)))))))))))) Summary Form: ( ENCAPSULATE (((TRIPLE-REV * ...) ...) ...) ...) Rules: NIL Warnings: Subsume and Non-rec Time: 0.08 seconds (prove: 0.01, print: 0.02, proof tree: 0.00, other: 0.04) T ACL2 !> ........ All of the above was on my Mac laptop. On UT CS linux: sundance:~/class/march-2007> acl2 GCL (GNU Common Lisp) 2.6.7 CLtL1 Sep 15 2005 12:36:56 Source License: LGPL(gcl,gmp), GPL(unexec,bfd) Binary License: GPL due to GPL'ed components: (BFD UNEXEC) Modifications of this banner must retain notice of a compatible license Dedicated to the memory of W. Schelter Use (help) to get some basic information on how to use GCL. ACL2 Version 3.1 built November 30, 2006 07:45:55. Copyright (C) 2006 University of Texas at Austin ACL2 comes with ABSOLUTELY NO WARRANTY. This is free software and you are welcome to redistribute it under certain conditions. For details, see the GNU General Public License. Initialized with (INITIALIZE-ACL2 'INCLUDE-BOOK *ACL2-PASS-2-FILES*). See the documentation topic note-3-1 for recent changes. Note: We have modified the prompt in some underlying Lisps to further distinguish it from the ACL2 prompt. NOTE!! Proof trees are disabled in ACL2. To enable them in emacs, look under the ACL2 source directory in interface/emacs/README.doc; and, to turn on proof trees, execute :START-PROOF-TREE in the ACL2 command loop. Look in the ACL2 documentation under PROOF-TREE. ACL2 Version 3.1. Level 1. Cbd "/v/filer4b/kaufmann/class/march-2007/". Type :help for help. Type (good-bye) to quit completely out of ACL2. ACL2 !>(defun foo-induction (x y) (if (consp x) (foo-induction (cdr x) (g x y)) (list x y))) ACL2 Error in ( DEFUN FOO-INDUCTION ...): The symbol G (in package "ACL2") has neither a function nor macro definition in ACL2. Please define it. Summary Form: ( DEFUN FOO-INDUCTION ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>(defstub g (x y) t) To verify that the two encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 !>>(LOGIC) This event is redundant. See :DOC redundant-events. :INVISIBLE ACL2 !>>(LOCAL (DEFUN G (X Y) (DECLARE (IGNORE X Y)) T)) Since G is non-recursive, its admission is trivial. We observe that the type of G is described by the theorem (G X Y). Summary Form: ( DEFUN G ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) G End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. Summary Form: ( ENCAPSULATE ((G ...) ...) ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) T ACL2 !>(defun foo-induction (x y) (if (consp x) (foo-induction (cdr x) (g x y)) (list x y))) The admission of FOO-INDUCTION is trivial, using the relation O< (which is known to be well-founded on the domain recognized by O-P) and the measure (ACL2-COUNT X). We observe that the type of FOO-INDUCTION is described by the theorem (AND (CONSP (FOO-INDUCTION X Y)) (TRUE-LISTP (FOO-INDUCTION X Y))). We used primitive type reasoning. Summary Form: ( DEFUN FOO-INDUCTION ...) Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)) Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) FOO-INDUCTION ACL2 !>(defstub foo (x y) t) To verify that the two encapsulated events correctly extend the current theory we will evaluate them. The theory thus constructed is only ephemeral. Encapsulated Events: ACL2 !>>(LOGIC) This event is redundant. See :DOC redundant-events. :INVISIBLE ACL2 !>>(LOCAL (DEFUN FOO (X Y) (DECLARE (IGNORE X Y)) T)) Since FOO is non-recursive, its admission is trivial. We observe that the type of FOO is described by the theorem (FOO X Y). Summary Form: ( DEFUN FOO ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) FOO End of Encapsulated Events. Having verified that the encapsulated events validate the signatures of the ENCAPSULATE event, we discard the ephemeral theory and extend the original theory as directed by the signatures and the non-LOCAL events. Summary Form: ( ENCAPSULATE ((FOO ...) ...) ...) Rules: NIL Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) T ACL2 !>(thm (foo x y) :hints (("Goal" :induct (foo-induction x y)))) [Note: A hint was supplied for our processing of the goal above. Thanks!] Name the formula above *1. We have been told to use induction. One induction scheme is suggested by the induction hint. We will induct according to a scheme suggested by (FOO-INDUCTION X Y). This suggestion was produced using the :induction rule FOO-INDUCTION. If we let (:P X Y) denote *1 above then the induction scheme we'll use is (AND (IMPLIES (NOT (CONSP X)) (:P X Y)) (IMPLIES (AND (CONSP X) (:P (CDR X) (G X Y))) (:P X Y))). This induction is justified by the same argument used to admit FOO- INDUCTION. Note, however, that the unmeasured variable Y is being instantiated. When applied to the goal at hand the above induction scheme produces the following two nontautological subgoals. Subgoal *1/2 (IMPLIES (NOT (CONSP X)) (FOO X Y)). Name the formula above *1.1. Subgoal *1/1 (IMPLIES (AND (CONSP X) (FOO (CDR X) (G X Y))) (FOO X Y)). The destructor terms (CAR X) and (CDR X) can be eliminated by using CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X) by X2. This produces the following goal. Subgoal *1/1' (IMPLIES (AND (CONSP (CONS X1 X2)) (FOO X2 (G (CONS X1 X2) Y))) (FOO (CONS X1 X2) Y)). This simplifies, using primitive type reasoning, to Subgoal *1/1'' (IMPLIES (FOO X2 (G (CONS X1 X2) Y)) (FOO (CONS X1 X2) Y)). Name the formula above *1.2. This formula is subsumed by one of its parents, *1, which we're in the process of trying to prove by induction. When an inductive proof gives rise to a subgoal that is less general than the original goal it is a sign that either an inappropriate induction was chosen or that the original goal is insufficiently general. In any case, our proof attempt has failed. Summary Form: ( THM ...) Rules: ((:ELIM CAR-CDR-ELIM) (:FAKE-RUNE-FOR-TYPE-SET NIL) (:INDUCTION FOO-INDUCTION)) Warnings: None Time: 0.00 seconds (prove: 0.00, print: 0.00, other: 0.00) ******** FAILED ******** See :DOC failure ******** FAILED ******** ACL2 !>Bye. Attempting to exit Lisp. If this fails to work, type :q and then try again. sundance:~/class/march-2007>