ACL2 !>(defun sortedp (lst)
	 (if (or (endp lst)
		 (endp (cdr lst)))
	     t
	   (and (<= (first lst)
		    (second lst))
		(sortedp (cdr lst)))))

For the admission of SORTEDP we will use the relation O< (which is
known to be well-founded on the domain recognized by O-P) and the measure
(ACL2-COUNT LST).  The non-trivial part of the measure conjecture is

Goal
(IMPLIES (AND (NOT (OR (ENDP LST) (ENDP (CDR LST))))
              (<= (CAR LST) (CADR LST)))
         (O< (ACL2-COUNT (CDR LST))
             (ACL2-COUNT LST))).
Goal'

Q.E.D.

That completes the proof of the measure theorem for SORTEDP.  Thus,
we admit this function under the principle of definition.  We observe
that the type of SORTEDP is described by the theorem 
(OR (EQUAL (SORTEDP LST) T) (EQUAL (SORTEDP LST) NIL)).  

Summary
Form:  ( DEFUN SORTEDP ...)
Rules: ((:DEFINITION ACL2-COUNT)
        (:DEFINITION ENDP)
        (:DEFINITION NOT)
        (:DEFINITION O-FINP)
        (:DEFINITION O<)
        (:EXECUTABLE-COUNTERPART TAU-SYSTEM)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:TYPE-PRESCRIPTION ACL2-COUNT))
Time:  0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
Prover steps counted:  281
 SORTEDP
ACL2 !>(defun insert (n lst)
	 (if (endp lst)
	     (list n)
	   (if (< n (car lst))
	       (cons n lst)
	     (cons (car lst)
		   (insert n (cdr lst))))))

The admission of INSERT is trivial, using the relation O< (which is
known to be well-founded on the domain recognized by O-P) and the measure
(ACL2-COUNT LST).  We observe that the type of INSERT is described
by the theorem (CONSP (INSERT N LST)).  We used primitive type reasoning.

Summary
Form:  ( DEFUN INSERT ...)
Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL))
Time:  0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
 INSERT
ACL2 !>(defun insertion-sort (lst)
	 (if (endp lst)
	     nil
	   (insert (car lst)
		   (insertion-sort (cdr lst)))))

The admission of INSERTION-SORT is trivial, using the relation O< (which
is known to be well-founded on the domain recognized by O-P) and the
measure (ACL2-COUNT LST).  We observe that the type of INSERTION-SORT
is described by the theorem 
(OR (CONSP (INSERTION-SORT LST)) (EQUAL (INSERTION-SORT LST) NIL)).
We used the :type-prescription rule INSERT.

Summary
Form:  ( DEFUN INSERTION-SORT ...)
Rules: ((:TYPE-PRESCRIPTION INSERT))
Time:  0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
 INSERTION-SORT
ACL2 !>(thm (sortedp (insertion-sort lst)))

*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  One induction scheme is suggested
by this conjecture.  

We will induct according to a scheme suggested by (INSERTION-SORT LST).
This suggestion was produced using the :induction rule INSERTION-SORT.
If we let (:P LST) denote *1 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ENDP LST)) (:P (CDR LST)))
              (:P LST))
     (IMPLIES (ENDP LST) (:P LST))).
This induction is justified by the same argument used to admit 
INSERTION-SORT.  When applied to the goal at hand the above induction
scheme produces two nontautological subgoals.
Subgoal *1/2
Subgoal *1/2'
Subgoal *1/2''
Subgoal *1/2'''
Subgoal *1/2'4'
Subgoal *1/2'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2''
(IMPLIES (AND (CONSP LST)
              (SORTEDP (INSERTION-SORT (CDR LST))))
         (SORTEDP (INSERT (CAR LST)
                          (INSERTION-SORT (CDR LST)))))

*1.1 (Subgoal *1/2'5') is pushed for proof by induction.

])
Subgoal *1/1
Subgoal *1/1'

So we now return to *1.1, which is

(IMPLIES (SORTEDP IST)
         (SORTEDP (INSERT LST1 IST))).
Subgoal *1.1/4
Subgoal *1.1/4'

Splitter note (see :DOC splitter) for Subgoal *1.1/4' (2 subgoals).
  if-intro: ((:DEFINITION SORTEDP))

Subgoal *1.1/4.2
Subgoal *1.1/4.1
Subgoal *1.1/4.1.2
Subgoal *1.1/4.1.1
Subgoal *1.1/3
Subgoal *1.1/3'

Splitter note (see :DOC splitter) for Subgoal *1.1/3' (2 subgoals).
  if-intro: ((:DEFINITION SORTEDP))

Subgoal *1.1/3.2
Subgoal *1.1/3.1
Subgoal *1.1/2
Subgoal *1.1/2'

Splitter note (see :DOC splitter) for Subgoal *1.1/2' (2 subgoals).
  if-intro: ((:DEFINITION SORTEDP))

Subgoal *1.1/2.2
Subgoal *1.1/2.1
Subgoal *1.1/1
Subgoal *1.1/1'

*1.1 and *1 are COMPLETED!
Thus key checkpoints Subgoal *1/2'' and Goal are COMPLETED!

Q.E.D.

Summary
Form:  ( THM ...)
Rules: ((:DEFINITION ENDP)
        (:DEFINITION INSERT)
        (:DEFINITION INSERTION-SORT)
        (:DEFINITION NOT)
        (:DEFINITION SORTEDP)
        (:ELIM CAR-CDR-ELIM)
        (:EXECUTABLE-COUNTERPART CONSP)
        (:EXECUTABLE-COUNTERPART SORTEDP)
        (:EXECUTABLE-COUNTERPART TAU-SYSTEM)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION INSERT)
        (:INDUCTION INSERTION-SORT)
        (:INDUCTION SORTEDP)
        (:REWRITE CAR-CONS)
        (:REWRITE CDR-CONS)
        (:REWRITE DEFAULT-<-1)
        (:REWRITE DEFAULT-CAR)
        (:TYPE-PRESCRIPTION INSERT)
        (:TYPE-PRESCRIPTION SORTEDP))
Splitter rules (see :DOC splitter):
  if-intro: ((:DEFINITION SORTEDP))
Time:  0.02 seconds (prove: 0.02, print: 0.00, other: 0.00)
Prover steps counted:  3644

Proof succeeded.
ACL2 !>
