ACL2 !>(defun rev (x) ; Append (built-in) does list concatenation (like app, earlier)
	 (if (consp x)
	     (append (rev (cdr x))
		     (list (car x)))
	   nil))

The admission of REV is trivial, using the relation O< (which is known
to be well-founded on the domain recognized by O-P) and the measure
(ACL2-COUNT X).  We observe that the type of REV is described by the
theorem (TRUE-LISTP (REV X)).  We used primitive type reasoning and
the :type-prescription rules BINARY-APPEND and TRUE-LISTP-APPEND.

Summary
Form:  ( DEFUN REV ...)
Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:TYPE-PRESCRIPTION BINARY-APPEND)
        (:TYPE-PRESCRIPTION TRUE-LISTP-APPEND))
Time:  0.01 seconds (prove: 0.00, print: 0.00, other: 0.00)
 REV
ACL2 !>(thm (implies (true-listp x)
		     (equal (rev (rev x))
			    x)))

*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  Two induction schemes are suggested
by this conjecture.  Subsumption reduces that number to one.  

We will induct according to a scheme suggested by (REV X).  This suggestion
was produced using the :induction rules REV and TRUE-LISTP.  If we
let (:P X) denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
     (IMPLIES (AND (CONSP X) (:P (CDR X)))
              (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
three nontautological subgoals.
Subgoal *1/3
Subgoal *1/2
Subgoal *1/2'
Subgoal *1/2''
Subgoal *1/2'''
Subgoal *1/2'4'
Subgoal *1/2'5'
Subgoal *1/2'6'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2'
(IMPLIES (AND (CONSP X)
              (EQUAL (REV (REV (CDR X))) (CDR X))
              (TRUE-LISTP (CDR X)))
         (EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X))))
                X))

*1.1 (Subgoal *1/2'6') is pushed for proof by induction.

])
Subgoal *1/1

So we now return to *1.1, which is

(IMPLIES (TRUE-LISTP RV)
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).
Subgoal *1.1/3
Subgoal *1.1/3'
Subgoal *1.1/2
Subgoal *1.1/1
Subgoal *1.1/1'

*1.1 and *1 are COMPLETED!
Thus key checkpoints Subgoal *1/2' and Goal are COMPLETED!

Q.E.D.

Summary
Form:  ( THM ...)
Rules: ((:DEFINITION BINARY-APPEND)
        (:DEFINITION ENDP)
        (:DEFINITION NOT)
        (:DEFINITION REV)
        (:DEFINITION TRUE-LISTP)
        (:ELIM CAR-CDR-ELIM)
        (:EXECUTABLE-COUNTERPART CONSP)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:EXECUTABLE-COUNTERPART REV)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION BINARY-APPEND)
        (:INDUCTION REV)
        (:INDUCTION TRUE-LISTP)
        (:REWRITE CAR-CONS)
        (:REWRITE CDR-CONS)
        (:TYPE-PRESCRIPTION BINARY-APPEND)
        (:TYPE-PRESCRIPTION REV)
        (:TYPE-PRESCRIPTION TRUE-LISTP-APPEND))
Time:  0.02 seconds (prove: 0.01, print: 0.01, other: 0.00)
Prover steps counted:  1724

Proof succeeded.
ACL2 !>:pso ; print saved output

Output replay for: ( THM ...)

Name the formula above *1.

Perhaps we can prove *1 by induction.  Two induction schemes are suggested
by this conjecture.  Subsumption reduces that number to one.  

We will induct according to a scheme suggested by (REV X).  This suggestion
was produced using the :induction rules REV and TRUE-LISTP.  If we
let (:P X) denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
     (IMPLIES (AND (CONSP X) (:P (CDR X)))
              (:P X))).
This induction is justified by the same argument used to admit REV.
When applied to the goal at hand the above induction scheme produces
three nontautological subgoals.

Subgoal *1/3
(IMPLIES (AND (NOT (CONSP X)) (TRUE-LISTP X))
         (EQUAL (REV (REV X)) X)).

But simplification reduces this to T, using the :definition TRUE-LISTP,
the :executable-counterparts of CONSP, EQUAL and REV and primitive
type reasoning.

Subgoal *1/2
(IMPLIES (AND (CONSP X)
              (EQUAL (REV (REV (CDR X))) (CDR X))
              (TRUE-LISTP X))
         (EQUAL (REV (REV X)) X)).

This simplifies, using the :definitions REV and TRUE-LISTP, to

Subgoal *1/2'
(IMPLIES (AND (CONSP X)
              (EQUAL (REV (REV (CDR X))) (CDR X))
              (TRUE-LISTP (CDR X)))
         (EQUAL (REV (APPEND (REV (CDR X)) (LIST (CAR X))))
                X)).

The destructor terms (CAR X) and (CDR X) can be eliminated by using
CAR-CDR-ELIM to replace X by (CONS X1 X2), (CAR X) by X1 and (CDR X)
by X2.  This produces the following goal.

Subgoal *1/2''
(IMPLIES (AND (CONSP (CONS X1 X2))
              (EQUAL (REV (REV X2)) X2)
              (TRUE-LISTP X2))
         (EQUAL (REV (APPEND (REV X2) (LIST X1)))
                (CONS X1 X2))).

This simplifies, using primitive type reasoning, to

Subgoal *1/2'''
(IMPLIES (AND (EQUAL (REV (REV X2)) X2)
              (TRUE-LISTP X2))
         (EQUAL (REV (APPEND (REV X2) (LIST X1)))
                (CONS X1 X2))).

We now use the first hypothesis by cross-fertilizing (REV (REV X2))
for X2 and throwing away the hypothesis.  This produces

Subgoal *1/2'4'
(IMPLIES (TRUE-LISTP X2)
         (EQUAL (REV (APPEND (REV X2) (LIST X1)))
                (CONS X1 (REV (REV X2))))).

We generalize this conjecture, replacing (REV X2) by RV and restricting
the type of the new variable RV to be that of the term it replaces,
as established by REV.  This produces

Subgoal *1/2'5'
(IMPLIES (AND (TRUE-LISTP RV) (TRUE-LISTP X2))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

We suspect that the term (TRUE-LISTP X2) is irrelevant to the truth
of this conjecture and throw it out.  We will thus try to prove

Subgoal *1/2'6'
(IMPLIES (TRUE-LISTP RV)
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

Name the formula above *1.1.

Subgoal *1/1
(IMPLIES (AND (CONSP X)
              (NOT (TRUE-LISTP (CDR X)))
              (TRUE-LISTP X))
         (EQUAL (REV (REV X)) X)).

But we reduce the conjecture to T, by primitive type reasoning.

So we now return to *1.1, which is

(IMPLIES (TRUE-LISTP RV)
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

Perhaps we can prove *1.1 by induction.  Three induction schemes are
suggested by this conjecture.  Subsumption reduces that number to two.
These merge into one derived induction scheme.  

We will induct according to a scheme suggested by 
(BINARY-APPEND RV (CONS X1 'NIL)).  This suggestion was produced using
the :induction rules BINARY-APPEND, REV and TRUE-LISTP.  If we let
(:P RV X1) denote *1.1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ENDP RV)) (:P (CDR RV) X1))
              (:P RV X1))
     (IMPLIES (ENDP RV) (:P RV X1))).
This induction is justified by the same argument used to admit BINARY-APPEND.
When applied to the goal at hand the above induction scheme produces
three nontautological subgoals.

Subgoal *1.1/3
(IMPLIES (AND (NOT (ENDP RV))
              (EQUAL (REV (APPEND (CDR RV) (LIST X1)))
                     (CONS X1 (REV (CDR RV))))
              (TRUE-LISTP RV))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

By the simple :definition ENDP we reduce the conjecture to

Subgoal *1.1/3'
(IMPLIES (AND (CONSP RV)
              (EQUAL (REV (APPEND (CDR RV) (LIST X1)))
                     (CONS X1 (REV (CDR RV))))
              (TRUE-LISTP RV))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

But simplification reduces this to T, using the :definitions BINARY-APPEND,
REV and TRUE-LISTP, primitive type reasoning, the :rewrite rules CAR-CONS
and CDR-CONS and the :type-prescription rules BINARY-APPEND, REV and
TRUE-LISTP-APPEND.

Subgoal *1.1/2
(IMPLIES (AND (NOT (ENDP RV))
              (NOT (TRUE-LISTP (CDR RV)))
              (TRUE-LISTP RV))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

But we reduce the conjecture to T, by primitive type reasoning.

Subgoal *1.1/1
(IMPLIES (AND (ENDP RV) (TRUE-LISTP RV))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

By the simple :definition ENDP we reduce the conjecture to

Subgoal *1.1/1'
(IMPLIES (AND (NOT (CONSP RV)) (TRUE-LISTP RV))
         (EQUAL (REV (APPEND RV (LIST X1)))
                (CONS X1 (REV RV)))).

But simplification reduces this to T, using the :definitions BINARY-APPEND,
REV and TRUE-LISTP, the :executable-counterparts of CONSP and REV,
primitive type reasoning and the :rewrite rules CAR-CONS and CDR-CONS.

That completes the proofs of *1.1 and *1.

Q.E.D.

Summary
Form:  ( THM ...)
Rules: ((:DEFINITION BINARY-APPEND)
        (:DEFINITION ENDP)
        (:DEFINITION NOT)
        (:DEFINITION REV)
        (:DEFINITION TRUE-LISTP)
        (:ELIM CAR-CDR-ELIM)
        (:EXECUTABLE-COUNTERPART CONSP)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:EXECUTABLE-COUNTERPART REV)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION BINARY-APPEND)
        (:INDUCTION REV)
        (:INDUCTION TRUE-LISTP)
        (:REWRITE CAR-CONS)
        (:REWRITE CDR-CONS)
        (:TYPE-PRESCRIPTION BINARY-APPEND)
        (:TYPE-PRESCRIPTION REV)
        (:TYPE-PRESCRIPTION TRUE-LISTP-APPEND))
Time:  0.04 seconds (prove: 0.02, print: 0.01, other: 0.00)
Prover steps counted:  1724
ACL2 !>
