(UNSET-WATERFALL-PARALLELISM)
(ASSIGN SCRIPT-MODE T)
 T
(SET-LD-PROMPT T STATE)
 T
ACL2 !>>(SET-INHIBITED-SUMMARY-TYPES '(TIME STEPS))
 (TIME STEPS)
ACL2 !>>(SET-INHIBIT-OUTPUT-LST '(PROOF-TREE))
 (PROOF-TREE)
ACL2 !>>(IN-PACKAGE "ACL2")
 "ACL2"
ACL2 !>>(DEFCONST *OLD-STANDARD-OI*
          *STANDARD-OI*)

Summary
Form:  ( DEFCONST *OLD-STANDARD-OI* ...)
Rules: NIL
 *OLD-STANDARD-OI*
ACL2 !>>(REDEF+)
 T
ACL2 p!>>(MAKE-EVENT (CONS 'DEFCONST
                           (CONS '*STANDARD-OI*
                                 (CONS (CONS 'QUOTE
                                             (CONS (STANDARD-OI STATE) 'NIL))
                                       'NIL))))

ACL2 Warning [Redef] in ( DEFCONST *STANDARD-OI* ...):  *STANDARD-OI*
redefined.



Summary
Form:  ( DEFCONST *STANDARD-OI* ...)
Rules: NIL
Warnings:  Redef

ACL2 Warning [Redef] in ( MAKE-EVENT (CONS ...)):  *STANDARD-OI* redefined.



Summary
Form:  ( MAKE-EVENT (CONS ...))
Rules: NIL
Warnings:  Redef
 *STANDARD-OI*
ACL2 p!>>(MAKE-EVENT (CONS 'DEFCONST
                           (CONS '*STANDARD-CO*
                                 (CONS (CONS 'QUOTE
                                             (CONS (STANDARD-CO STATE) 'NIL))
                                       'NIL))))

ACL2 Warning [Redef] in ( DEFCONST *STANDARD-CO* ...):  *STANDARD-CO*
redefined.



Summary
Form:  ( DEFCONST *STANDARD-CO* ...)
Rules: NIL
Warnings:  Redef

ACL2 Warning [Redef] in ( MAKE-EVENT (CONS ...)):  *STANDARD-CO* redefined.



Summary
Form:  ( MAKE-EVENT (CONS ...))
Rules: NIL
Warnings:  Redef
 *STANDARD-CO*
ACL2 p!>>(F-PUT-GLOBAL 'TRACE-CO
                       (STANDARD-CO STATE)
                       STATE)
<state>
ACL2 p!>>(DEFUN SET-LD-PROMPT (VAL STATE)
           (ER-PROGN (CHK-LD-PROMPT VAL 'SET-LD-PROMPT STATE)
                     (IF (EQ VAL 'BRR-PROMPT)
                         (SET-LD-PRE-EVAL-PRINT T STATE)
                       (VALUE NIL))
                     (PPROGN (F-PUT-GLOBAL 'LD-PROMPT VAL STATE)
                             (VALUE VAL))))

ACL2 Warning [Redef] in ( DEFUN SET-LD-PROMPT ...):  SET-LD-PROMPT
redefined.



Summary
Form:  ( DEFUN SET-LD-PROMPT ...)
Rules: NIL
Warnings:  Redef
 SET-LD-PROMPT
ACL2 p!>>(REDEF-)
 NIL
ACL2 !>>(INCLUDE-BOOK "sorting/isort"
                      :DIR :SYSTEM)

Summary
Form:  ( INCLUDE-BOOK "sorting/isort" ...)
Rules: NIL
 (:SYSTEM . "sorting/isort.lisp")
ACL2 !>>(DEFEQUIV PERM)

The event ( DEFTHM PERM-IS-AN-EQUIVALENCE ...) is redundant.  See :DOC
redundant-events.

Summary
Form:  ( DEFTHM PERM-IS-AN-EQUIVALENCE ...)
Rules: NIL

Summary
Form:  ( MAKE-EVENT (DEFEQUIV-FORM ...))
Rules: NIL
 :REDUNDANT
ACL2 !>>(DEFCONG PERM EQUAL
          (LEN X)
          1
          :HINTS (("Goal" :IN-THEORY (DISABLE CONVERT-PERM-TO-HOW-MANY))))

*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  Three induction schemes are
suggested by this conjecture.  Subsumption reduces that number to two.
However, one of these is flawed and so we are left with one viable
candidate.  

We will induct according to a scheme suggested by (PERM X X-EQUIV).

This suggestion was produced using the :induction rules LEN and PERM.
If we let (:P X X-EQUIV) denote *1 above then the induction scheme
we'll use is
(AND (IMPLIES (NOT (CONSP X)) (:P X X-EQUIV))
     (IMPLIES (AND (CONSP X)
                   (NOT (MEMB (CAR X) X-EQUIV)))
              (:P X X-EQUIV))
     (IMPLIES (AND (CONSP X)
                   (MEMB (CAR X) X-EQUIV)
                   (:P (CDR X) (RM (CAR X) X-EQUIV)))
              (:P X X-EQUIV))).
This induction is justified by the same argument used to admit PERM.
Note, however, that the unmeasured variable X-EQUIV is being instantiated.
When applied to the goal at hand the above induction scheme produces
four nontautological subgoals.
Subgoal *1/4
Subgoal *1/3
Subgoal *1/2
Subgoal *1/2'
Subgoal *1/2''
Subgoal *1/2'''
Subgoal *1/2'4'
Subgoal *1/2'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2'
(IMPLIES (AND (CONSP X)
              (MEMB (CAR X) X-EQUIV)
              (EQUAL (LEN (CDR X))
                     (LEN (RM (CAR X) X-EQUIV)))
              (PERM (CDR X) (RM (CAR X) X-EQUIV)))
         (EQUAL (+ 1 (LEN (CDR X)))
                (LEN X-EQUIV)))

*1.1 (Subgoal *1/2'5') is pushed for proof by induction.

])
Subgoal *1/1

So we now return to *1.1, which is

(IMPLIES (MEMB X1 X-EQUIV)
         (EQUAL (+ 1 (LEN (RM X1 X-EQUIV)))
                (LEN X-EQUIV))).
Subgoal *1.1/4
Subgoal *1.1/3
Subgoal *1.1/2
Subgoal *1.1/1

*1.1 and *1 are COMPLETED!
Thus key checkpoints Subgoal *1/2' and Goal are COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM PERM-IMPLIES-EQUAL-LEN-1 ...)
Rules: ((:DEFINITION LEN)
        (:DEFINITION MEMB)
        (:DEFINITION PERM)
        (:DEFINITION RM)
        (:ELIM CAR-CDR-ELIM)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION LEN)
        (:INDUCTION MEMB)
        (:INDUCTION PERM)
        (:INDUCTION RM)
        (:REWRITE CDR-CONS)
        (:TYPE-PRESCRIPTION MEMB))

Summary
Form:  ( MAKE-EVENT (DEFCONG-FORM ...))
Rules: NIL
 PERM-IMPLIES-EQUAL-LEN-1
ACL2 !>>(DEFTHM PERM-ISORT (PERM (ISORT X) X))

ACL2 Warning [Double-rewrite] in ( DEFTHM PERM-ISORT ...):  In a :REWRITE
rule generated from PERM-ISORT, equivalence relation PERM is maintained
at one problematic occurrence of variable X in the right-hand side,
but not at any binding occurrence of X.  Consider replacing that occurrence
of X in the right-hand side with (DOUBLE-REWRITE X).  See :doc double-
rewrite for more information on this issue.


Q.E.D.

Summary
Form:  ( DEFTHM PERM-ISORT ...)
Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:REWRITE CONVERT-PERM-TO-HOW-MANY)
        (:REWRITE HOW-MANY-ISORT))
Warnings:  Double-rewrite
 PERM-ISORT
ACL2 !>>(DEFUN PAIRWISE-IFF (X Y)
          (COND ((ATOM X) (ATOM Y))
                ((ATOM Y) NIL)
                (T (AND (IFF (CAR X) (CAR Y))
                        (PAIRWISE-IFF (CDR X) (CDR Y))))))

The admission of PAIRWISE-IFF is trivial, using the relation O< (which
is known to be well-founded on the domain recognized by O-P) and the
measure (ACL2-COUNT X).  We observe that the type of PAIRWISE-IFF is
described by the theorem 
(OR (EQUAL (PAIRWISE-IFF X Y) T) (EQUAL (PAIRWISE-IFF X Y) NIL)). 

Summary
Form:  ( DEFUN PAIRWISE-IFF ...)
Rules: NIL
 PAIRWISE-IFF
ACL2 !>>(DEFEQUIV PAIRWISE-IFF)
Subgoal 3

([ A key checkpoint:

Subgoal 3
(PAIRWISE-IFF X X)

*1 (Subgoal 3) is pushed for proof by induction.

])
Subgoal 2

([ A key checkpoint:

Subgoal 2
(IMPLIES (PAIRWISE-IFF X Y)
         (PAIRWISE-IFF Y X))

Normally we would attempt to prove Subgoal 2 by induction.  However,
we prefer in this instance to focus on the original input conjecture
rather than this simplified special case.  We therefore abandon our
previous work on this conjecture and reassign the name *1 to the original
conjecture.  (See :DOC otf-flg.)

])

Perhaps we can prove *1 by induction.  Seven induction schemes are
suggested by this conjecture.  Subsumption reduces that number to five.
These merge into one derived induction scheme.  

We will induct according to a scheme suggested by (PAIRWISE-IFF X Z),
but modified to accommodate (PAIRWISE-IFF Y Z) and (PAIRWISE-IFF Y X).

These suggestions were produced using the :induction rule PAIRWISE-IFF.
If we let (:P X Y Z) denote *1 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ATOM X))
                   (NOT (ATOM Z))
                   (NOT (IFF (CAR X) (CAR Z))))
              (:P X Y Z))
     (IMPLIES (AND (NOT (ATOM X))
                   (NOT (ATOM Z))
                   (IFF (CAR X) (CAR Z))
                   (:P (CDR X) (CDR Y) (CDR Z)))
              (:P X Y Z))
     (IMPLIES (AND (NOT (ATOM X)) (ATOM Z))
              (:P X Y Z))
     (IMPLIES (ATOM X) (:P X Y Z))).
This induction is justified by the same argument used to admit PAIRWISE-IFF.
Note, however, that the unmeasured variables Y and Z are being instantiated.
When applied to the goal at hand the above induction scheme produces
four nontautological subgoals.
Subgoal *1/4
Subgoal *1/4'

Splitter note (see :DOC splitter) for Subgoal *1/4' (4 subgoals).
  if-intro: ((:DEFINITION IFF)
             (:DEFINITION PAIRWISE-IFF))

Subgoal *1/4.4
Subgoal *1/4.4'
Subgoal *1/4.4''
Subgoal *1/4.4'''
Subgoal *1/4.4'4'
Subgoal *1/4.4'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.4
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (CAR X))
              (CAR Z))
         (PAIRWISE-IFF (CDR X) (CDR X)))

*1.1 (Subgoal *1/4.4'5') is pushed for proof by induction.

])
Subgoal *1/4.3
Subgoal *1/4.3'
Subgoal *1/4.3''
Subgoal *1/4.3'''
Subgoal *1/4.3'4'
Subgoal *1/4.3'5'
Subgoal *1/4.3'6'
Subgoal *1/4.3'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.3
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (CAR X))
              (CAR Z)
              (CONSP Y)
              (NOT (CAR Y))
              (PAIRWISE-IFF (CDR X) (CDR Y)))
         (PAIRWISE-IFF (CDR Y) (CDR X)))

*1.2 (Subgoal *1/4.3'7') is pushed for proof by induction.

])
Subgoal *1/4.2
Subgoal *1/4.2'
Subgoal *1/4.2''
Subgoal *1/4.2'''
Subgoal *1/4.2'4'
Subgoal *1/4.2'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.2
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (CAR X)
              (NOT (CAR Z)))
         (PAIRWISE-IFF (CDR X) (CDR X)))

*1.3 (Subgoal *1/4.2'5') is pushed for proof by induction.

])
Subgoal *1/4.1
Subgoal *1/4.1'
Subgoal *1/4.1''
Subgoal *1/4.1'''
Subgoal *1/4.1'4'
Subgoal *1/4.1'5'
Subgoal *1/4.1'6'
Subgoal *1/4.1'7'
Subgoal *1/4.1'8'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.1
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (CAR X)
              (NOT (CAR Z))
              (CONSP Y)
              (CAR Y)
              (PAIRWISE-IFF (CDR X) (CDR Y)))
         (PAIRWISE-IFF (CDR Y) (CDR X)))

*1.4 (Subgoal *1/4.1'8') is pushed for proof by induction.

])
Subgoal *1/3
Subgoal *1/3'
Subgoal *1/2
Subgoal *1/2'

Splitter note (see :DOC splitter) for Subgoal *1/2' (3 subgoals).
  if-intro: ((:DEFINITION IFF)
             (:DEFINITION PAIRWISE-IFF))

Subgoal *1/2.3
Subgoal *1/2.3'
Subgoal *1/2.3''
Subgoal *1/2.3'''

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2.3
(IMPLIES (AND (CONSP X) (NOT (CONSP Z)))
         (PAIRWISE-IFF (CDR X) (CDR X)))

*1.5 (Subgoal *1/2.3''') is pushed for proof by induction.

])
Subgoal *1/2.2
Subgoal *1/2.2'
Subgoal *1/2.2''
Subgoal *1/2.2'''
Subgoal *1/2.2'4'
Subgoal *1/2.2'5'
Subgoal *1/2.2'6'
Subgoal *1/2.2'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2.2
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (CAR X)
              (CAR Y)
              (PAIRWISE-IFF (CDR X) (CDR Y)))
         (PAIRWISE-IFF (CDR Y) (CDR X)))

*1.6 (Subgoal *1/2.2'7') is pushed for proof by induction.

])
Subgoal *1/2.1
Subgoal *1/2.1'
Subgoal *1/2.1''
Subgoal *1/2.1'''
Subgoal *1/2.1'4'
Subgoal *1/2.1'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/2.1
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (NOT (CAR X))
              (NOT (CAR Y))
              (PAIRWISE-IFF (CDR X) (CDR Y)))
         (PAIRWISE-IFF (CDR Y) (CDR X)))

*1.7 (Subgoal *1/2.1'5') is pushed for proof by induction.

])
Subgoal *1/1
Subgoal *1/1'

So we now return to *1.7, which is

(IMPLIES (PAIRWISE-IFF X2 Y2)
         (PAIRWISE-IFF Y2 X2)).

But the formula above is subsumed by *1.6, which we'll try to prove
later.  We therefore regard *1.7 as proved (pending the proof of the
more general *1.6).

Subgoal *1/2.1 COMPLETED!

We next consider *1.6, which is

(IMPLIES (PAIRWISE-IFF X2 Y2)
         (PAIRWISE-IFF Y2 X2)).

But the formula above is subsumed by *1.4, which we'll try to prove
later.  We therefore regard *1.6 as proved (pending the proof of the
more general *1.4).

Subgoal *1/2.2 COMPLETED!

We next consider *1.5, which is

(PAIRWISE-IFF X2 X2).

But the formula above is subsumed by *1.3, which we'll try to prove
later.  We therefore regard *1.5 as proved (pending the proof of the
more general *1.3).

Subgoal *1/2.3 COMPLETED!

We next consider *1.4, which is

(IMPLIES (PAIRWISE-IFF X2 Y2)
         (PAIRWISE-IFF Y2 X2)).

But the formula above is subsumed by *1.2, which we'll try to prove
later.  We therefore regard *1.4 as proved (pending the proof of the
more general *1.2).

Subgoal *1/4.1 COMPLETED!

We next consider *1.3, which is

(PAIRWISE-IFF X2 X2).

But the formula above is subsumed by *1.1, which we'll try to prove
later.  We therefore regard *1.3 as proved (pending the proof of the
more general *1.1).

Subgoal *1/4.2 COMPLETED!

We next consider *1.2, which is

(IMPLIES (PAIRWISE-IFF X2 Y2)
         (PAIRWISE-IFF Y2 X2)).
Subgoal *1.2/5
Subgoal *1.2/5'
Subgoal *1.2/4
Subgoal *1.2/4'
Subgoal *1.2/3
Subgoal *1.2/3'
Subgoal *1.2/2
Subgoal *1.2/2'
Subgoal *1.2/1
Subgoal *1.2/1'

*1.2 is COMPLETED!
Thus key checkpoint Subgoal *1/4.3 is COMPLETED!

We therefore turn our attention to *1.1, which is

(PAIRWISE-IFF X2 X2).
Subgoal *1.1/2
Subgoal *1.1/2'
Subgoal *1.1/1
Subgoal *1.1/1'

*1.1 and *1 are COMPLETED!
Thus key checkpoints Subgoal *1/4.4 and Goal are COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM PAIRWISE-IFF-IS-AN-EQUIVALENCE ...)
Rules: ((:COMPOUND-RECOGNIZER BOOLEANP-COMPOUND-RECOGNIZER)
        (:DEFINITION ATOM)
        (:DEFINITION IFF)
        (:DEFINITION NOT)
        (:DEFINITION PAIRWISE-IFF)
        (:ELIM CAR-CDR-ELIM)
        (:EQUIVALENCE IFF-IS-AN-EQUIVALENCE)
        (:EXECUTABLE-COUNTERPART BOOLEANP)
        (:EXECUTABLE-COUNTERPART IFF)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION PAIRWISE-IFF)
        (:TYPE-PRESCRIPTION PAIRWISE-IFF))
Splitter rules (see :DOC splitter):
  if-intro: ((:DEFINITION IFF)
             (:DEFINITION PAIRWISE-IFF))

Summary
Form:  ( MAKE-EVENT (DEFEQUIV-FORM ...))
Rules: NIL
 PAIRWISE-IFF-IS-AN-EQUIVALENCE
ACL2 !>>(DEFCONG PAIRWISE-IFF EQUAL (LEN X) 1)

*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  Three induction schemes are
suggested by this conjecture.  These merge into one derived induction
scheme.  

We will induct according to a scheme suggested by (LEN X-EQUIV), but
modified to accommodate (LEN X) and (PAIRWISE-IFF X X-EQUIV).

These suggestions were produced using the :induction rules LEN and
PAIRWISE-IFF.  If we let (:P X X-EQUIV) denote *1 above then the induction
scheme we'll use is
(AND (IMPLIES (NOT (CONSP X-EQUIV))
              (:P X X-EQUIV))
     (IMPLIES (AND (CONSP X-EQUIV)
                   (:P (CDR X) (CDR X-EQUIV)))
              (:P X X-EQUIV))).
This induction is justified by the same argument used to admit LEN.
Note, however, that the unmeasured variable X is being instantiated.
When applied to the goal at hand the above induction scheme produces
three nontautological subgoals.
Subgoal *1/3
Subgoal *1/2
Subgoal *1/1

*1 is COMPLETED!
Thus key checkpoint Goal is COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1 ...)
Rules: ((:DEFINITION IFF)
        (:DEFINITION LEN)
        (:DEFINITION PAIRWISE-IFF)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION LEN)
        (:INDUCTION PAIRWISE-IFF))

Summary
Form:  ( MAKE-EVENT (DEFCONG-FORM ...))
Rules: NIL
 PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1
ACL2 !>>(DEFUN NORML (X)
          (COND ((ATOM X) NIL)
                (T (CONS (IF (CAR X) T NIL)
                         (NORML (CDR X))))))

The admission of NORML is trivial, using the relation O< (which is
known to be well-founded on the domain recognized by O-P) and the measure
(ACL2-COUNT X).  We observe that the type of NORML is described by
the theorem (TRUE-LISTP (NORML X)).  We used primitive type reasoning.

Summary
Form:  ( DEFUN NORML ...)
Rules: ((:FAKE-RUNE-FOR-TYPE-SET NIL))
 NORML
ACL2 !>>(DEFTHM PAIRWISE-IFF-NORML
          (PAIRWISE-IFF (NORML X) X))

ACL2 Warning [Double-rewrite] in ( DEFTHM PAIRWISE-IFF-NORML ...):
In a :REWRITE rule generated from PAIRWISE-IFF-NORML, equivalence relation
PAIRWISE-IFF is maintained at one problematic occurrence of variable
X in the right-hand side, but not at any binding occurrence of X. 
Consider replacing that occurrence of X in the right-hand side with
(DOUBLE-REWRITE X).  See :doc double-rewrite for more information on
this issue.


*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  One induction scheme is suggested
by this conjecture.  

We will induct according to a scheme suggested by (NORML X).

This suggestion was produced using the :induction rule NORML.  If we
let (:P X) denote *1 above then the induction scheme we'll use is
(AND (IMPLIES (AND (NOT (ATOM X)) (:P (CDR X)))
              (:P X))
     (IMPLIES (ATOM X) (:P X))).
This induction is justified by the same argument used to admit NORML.
When applied to the goal at hand the above induction scheme produces
two nontautological subgoals.
Subgoal *1/2
Subgoal *1/2'

Splitter note (see :DOC splitter) for Subgoal *1/2' (2 subgoals).
  if-intro: ((:DEFINITION NORML))

Subgoal *1/2.2
Subgoal *1/2.1
Subgoal *1/1
Subgoal *1/1'

*1 is COMPLETED!
Thus key checkpoint Goal is COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM PAIRWISE-IFF-NORML ...)
Rules: ((:DEFINITION ATOM)
        (:DEFINITION NORML)
        (:DEFINITION NOT)
        (:DEFINITION PAIRWISE-IFF)
        (:EQUIVALENCE IFF-IS-AN-EQUIVALENCE)
        (:EQUIVALENCE PAIRWISE-IFF-IS-AN-EQUIVALENCE)
        (:EXECUTABLE-COUNTERPART CONSP)
        (:EXECUTABLE-COUNTERPART IFF)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION NORML)
        (:REWRITE CAR-CONS)
        (:REWRITE CDR-CONS)
        (:TYPE-PRESCRIPTION NORML))
Splitter rules (see :DOC splitter):
  if-intro: ((:DEFINITION NORML))
Warnings:  Double-rewrite
 PAIRWISE-IFF-NORML
ACL2 !>>(BRR T)
Use :a! to exit break-rewrite.
See :DOC set-brr-evisc-tuple and :DOC iprint to control suppression
of details when printing.

The monitored runes are:
NIL
 T
ACL2 !>>(MONITOR 'PERM-ISORT '(:RF T))

ACL2 Warning [Monitor] in MONITOR:  The rune (:REWRITE PERM-ISORT)
names only a simple abbreviation rule.  Monitors can be installed on
abbreviation rules, but will not fire during preprocessing, so you
may want to supply the hint :DO-NOT '(PREPROCESS); see :DOC hints.
For an explanation of what a simple abbreviation rule is, see :DOC
simple.  Also, see :DOC monitor.

(((:REWRITE PERM-ISORT)
  (:CONDITION QUOTE T)
  (:RF . T)))
ACL2 !>>(DEFTHM EXAMPLE-THM-1
          (EQUAL (LEN (ISORT (NORML X))) (LEN X))
          :HINTS (("Goal" :DO-NOT '(PREPROCESS)))
          :RULE-CLASSES NIL)

(1 Breaking (:REWRITE PERM-ISORT) on (ISORT (NORML X)):
1 ACL2 >:GENEQV

Geneqv:
((PAIRWISE-IFF PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
 (PERM PERM-IMPLIES-EQUAL-LEN-1))

==========
Use (GET-BRR-LOCAL 'GENEQV STATE) to see actual geneqv data structure.
1 ACL2 >(GET-BRR-LOCAL 'GENEQV STATE)
((5750 PAIRWISE-IFF
       :CONGRUENCE PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
 (5743 PERM
       :CONGRUENCE PERM-IMPLIES-EQUAL-LEN-1))
1 ACL2 >:OK
1)
Goal'

Q.E.D.

Summary
Form:  ( DEFTHM EXAMPLE-THM-1 ...)
Rules: ((:CONGRUENCE PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
        (:CONGRUENCE PERM-IMPLIES-EQUAL-LEN-1)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:REWRITE PAIRWISE-IFF-NORML)
        (:REWRITE PERM-ISORT))
 EXAMPLE-THM-1
ACL2 !>>(DEFUN EQUAL-NAT-LIST (X Y)
          (COND ((ATOM X) (ATOM Y))
                (T (AND (NOT (ATOM Y))
                        (EQUAL (NFIX (CAR X)) (NFIX (CAR Y)))
                        (EQUAL-NAT-LIST (CDR X) (CDR Y))))))

The admission of EQUAL-NAT-LIST is trivial, using the relation O< (which
is known to be well-founded on the domain recognized by O-P) and the
measure (ACL2-COUNT X).  We observe that the type of EQUAL-NAT-LIST
is described by the theorem 
(OR (EQUAL (EQUAL-NAT-LIST X Y) T) (EQUAL (EQUAL-NAT-LIST X Y) NIL)).

Summary
Form:  ( DEFUN EQUAL-NAT-LIST ...)
Rules: NIL
 EQUAL-NAT-LIST
ACL2 !>>(DEFEQUIV EQUAL-NAT-LIST)
Subgoal 3

([ A key checkpoint:

Subgoal 3
(EQUAL-NAT-LIST X X)

*1 (Subgoal 3) is pushed for proof by induction.

])
Subgoal 2

([ A key checkpoint:

Subgoal 2
(IMPLIES (EQUAL-NAT-LIST X Y)
         (EQUAL-NAT-LIST Y X))

Normally we would attempt to prove Subgoal 2 by induction.  However,
we prefer in this instance to focus on the original input conjecture
rather than this simplified special case.  We therefore abandon our
previous work on this conjecture and reassign the name *1 to the original
conjecture.  (See :DOC otf-flg.)

])

Perhaps we can prove *1 by induction.  Seven induction schemes are
suggested by this conjecture.  Subsumption reduces that number to five.
These merge into one derived induction scheme.  

We will induct according to a scheme suggested by (EQUAL-NAT-LIST X Z),
but modified to accommodate (EQUAL-NAT-LIST Y Z) and (EQUAL-NAT-LIST Y X).

These suggestions were produced using the :induction rule EQUAL-NAT-LIST.
If we let (:P X Y Z) denote *1 above then the induction scheme we'll
use is
(AND (IMPLIES (AND (NOT (ATOM X)) (ATOM Z))
              (:P X Y Z))
     (IMPLIES (AND (NOT (ATOM X))
                   (NOT (ATOM Z))
                   (NOT (EQUAL (NFIX (CAR X)) (NFIX (CAR Z)))))
              (:P X Y Z))
     (IMPLIES (AND (NOT (ATOM X))
                   (NOT (ATOM Z))
                   (EQUAL (NFIX (CAR X)) (NFIX (CAR Z)))
                   (:P (CDR X) (CDR Y) (CDR Z)))
              (:P X Y Z))
     (IMPLIES (ATOM X) (:P X Y Z))).
This induction is justified by the same argument used to admit 
EQUAL-NAT-LIST.  Note, however, that the unmeasured variables Y and
Z are being instantiated.  When applied to the goal at hand the above
induction scheme produces four nontautological subgoals.
Subgoal *1/4
Subgoal *1/4'

Splitter note (see :DOC splitter) for Subgoal *1/4' (10 subgoals).
  if-intro: ((:DEFINITION EQUAL-NAT-LIST)
             (:DEFINITION NFIX))

Subgoal *1/4.10
Subgoal *1/4.10'
Subgoal *1/4.10''
Subgoal *1/4.10'''

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.10
(IMPLIES (AND (CONSP X) (NOT (CONSP Z)))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.1 (Subgoal *1/4.10''') is pushed for proof by induction.

])
Subgoal *1/4.9
Subgoal *1/4.9'
Subgoal *1/4.9''
Subgoal *1/4.9'''
Subgoal *1/4.9'4'
Subgoal *1/4.9'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.9
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (< (CAR X) 0)
              (EQUAL 0 (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.2 (Subgoal *1/4.9'5') is pushed for proof by induction.

])
Subgoal *1/4.8
Subgoal *1/4.8'
Subgoal *1/4.8''
Subgoal *1/4.8'''
Subgoal *1/4.8'4'
Subgoal *1/4.8'5'
Subgoal *1/4.8'6'
Subgoal *1/4.8'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.8
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (INTEGERP (CAR Y))
              (<= 0 (CAR Y))
              (EQUAL (CAR X) (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.3 (Subgoal *1/4.8'7') is pushed for proof by induction.

])
Subgoal *1/4.7
Subgoal *1/4.7'
Subgoal *1/4.7''
Subgoal *1/4.7'''
Subgoal *1/4.7'4'
Subgoal *1/4.7'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.7
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (< (CAR X) 0)
              (NOT (INTEGERP (CAR Y)))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.4 (Subgoal *1/4.7'5') is pushed for proof by induction.

])
Subgoal *1/4.6
Subgoal *1/4.6'
Subgoal *1/4.6''
Subgoal *1/4.6'''
Subgoal *1/4.6'4'
Subgoal *1/4.6'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.6
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (< (CAR X) 0)
              (< (CAR Y) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.5 (Subgoal *1/4.6'5') is pushed for proof by induction.

])
Subgoal *1/4.5
Subgoal *1/4.5'
Subgoal *1/4.5''
Subgoal *1/4.5'''
Subgoal *1/4.5'4'
Subgoal *1/4.5'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.5
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (NOT (INTEGERP (CAR X)))
              (EQUAL 0 (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.6 (Subgoal *1/4.5'5') is pushed for proof by induction.

])
Subgoal *1/4.4
Subgoal *1/4.4'
Subgoal *1/4.4''
Subgoal *1/4.4'''
Subgoal *1/4.4'4'
Subgoal *1/4.4'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.4
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (NOT (INTEGERP (CAR X)))
              (< (CAR Y) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.7 (Subgoal *1/4.4'5') is pushed for proof by induction.

])
Subgoal *1/4.3
Subgoal *1/4.3'
Subgoal *1/4.3''
Subgoal *1/4.3'''
Subgoal *1/4.3'4'
Subgoal *1/4.3'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.3
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (NOT (INTEGERP (CAR X)))
              (NOT (INTEGERP (CAR Y)))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.8 (Subgoal *1/4.3'5') is pushed for proof by induction.

])
Subgoal *1/4.2
Subgoal *1/4.2'
Subgoal *1/4.2''
Subgoal *1/4.2'''
Subgoal *1/4.2'4'
Subgoal *1/4.2'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.2
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (< (CAR Y) 0)
              (EQUAL (CAR X) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.9 (Subgoal *1/4.2'5') is pushed for proof by induction.

])
Subgoal *1/4.1
Subgoal *1/4.1'
Subgoal *1/4.1''
Subgoal *1/4.1'''
Subgoal *1/4.1'4'
Subgoal *1/4.1'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/4.1
(IMPLIES (AND (CONSP X)
              (NOT (CONSP Z))
              (CONSP Y)
              (NOT (INTEGERP (CAR Y)))
              (EQUAL (CAR X) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.10 (Subgoal *1/4.1'5') is pushed for proof by induction.

])
Subgoal *1/3
Subgoal *1/3'

Splitter note (see :DOC splitter) for Subgoal *1/3' (16 subgoals).
  if-intro: ((:DEFINITION EQUAL-NAT-LIST)
             (:DEFINITION NFIX))

Subgoal *1/3.16
Subgoal *1/3.16'
Subgoal *1/3.16''
Subgoal *1/3.16'''
Subgoal *1/3.16'4'
Subgoal *1/3.16'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.16
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (INTEGERP (CAR X)))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z))))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.11 (Subgoal *1/3.16'5') is pushed for proof by induction.

])
Subgoal *1/3.15
Subgoal *1/3.15'
Subgoal *1/3.15''
Subgoal *1/3.15'''
Subgoal *1/3.15'4'
Subgoal *1/3.15'5'
Subgoal *1/3.15'6'
Subgoal *1/3.15'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.15
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (INTEGERP (CAR X)))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (EQUAL 0 (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.12 (Subgoal *1/3.15'7') is pushed for proof by induction.

])
Subgoal *1/3.14
Subgoal *1/3.14'
Subgoal *1/3.14''
Subgoal *1/3.14'''
Subgoal *1/3.14'4'
Subgoal *1/3.14'5'
Subgoal *1/3.14'6'
Subgoal *1/3.14'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.14
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (INTEGERP (CAR X)))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (NOT (INTEGERP (CAR Y)))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.13 (Subgoal *1/3.14'7') is pushed for proof by induction.

])
Subgoal *1/3.13
Subgoal *1/3.13'
Subgoal *1/3.13''
Subgoal *1/3.13'''
Subgoal *1/3.13'4'
Subgoal *1/3.13'5'
Subgoal *1/3.13'6'
Subgoal *1/3.13'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.13
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (NOT (INTEGERP (CAR X)))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (< (CAR Y) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.14 (Subgoal *1/3.13'7') is pushed for proof by induction.

])
Subgoal *1/3.12
Subgoal *1/3.12'
Subgoal *1/3.12''
Subgoal *1/3.12'''
Subgoal *1/3.12'4'
Subgoal *1/3.12'5'
Subgoal *1/3.12'6'
Subgoal *1/3.12'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.12
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL (CAR X) (CAR Z))))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.15 (Subgoal *1/3.12'7') is pushed for proof by induction.

])
Subgoal *1/3.11
Subgoal *1/3.11'
Subgoal *1/3.11''
Subgoal *1/3.11'''
Subgoal *1/3.11'4'
Subgoal *1/3.11'5'
Subgoal *1/3.11'6'
Subgoal *1/3.11'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.11
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (NOT (INTEGERP (CAR Y)))
              (EQUAL (CAR X) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.16 (Subgoal *1/3.11'7') is pushed for proof by induction.

])
Subgoal *1/3.10
Subgoal *1/3.10'
Subgoal *1/3.10''
Subgoal *1/3.10'''
Subgoal *1/3.10'4'
Subgoal *1/3.10'5'
Subgoal *1/3.10'6'
Subgoal *1/3.10'7'
Subgoal *1/3.10'8'
Subgoal *1/3.10'9'
Subgoal *1/3.10'10'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.10
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL (CAR X) (CAR Z)))
              (CONSP Y)
              (INTEGERP (CAR Y))
              (<= 0 (CAR Y))
              (EQUAL (CAR X) (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.17 (Subgoal *1/3.10'10') is pushed for proof by induction.

])
Subgoal *1/3.9
Subgoal *1/3.9'
Subgoal *1/3.9''
Subgoal *1/3.9'''
Subgoal *1/3.9'4'
Subgoal *1/3.9'5'
Subgoal *1/3.9'6'
Subgoal *1/3.9'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.9
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (< (CAR Y) 0)
              (EQUAL (CAR X) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.18 (Subgoal *1/3.9'7') is pushed for proof by induction.

])
Subgoal *1/3.8
Subgoal *1/3.8'
Subgoal *1/3.8''
Subgoal *1/3.8'''
Subgoal *1/3.8'4'
Subgoal *1/3.8'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.8
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (NOT (INTEGERP (CAR Z)))
              (NOT (EQUAL (CAR X) 0)))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.19 (Subgoal *1/3.8'5') is pushed for proof by induction.

])
Subgoal *1/3.7
Subgoal *1/3.7'
Subgoal *1/3.7''
Subgoal *1/3.7'''
Subgoal *1/3.7'4'
Subgoal *1/3.7'5'
Subgoal *1/3.7'6'
Subgoal *1/3.7'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.7
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (NOT (INTEGERP (CAR Z)))
              (NOT (EQUAL (CAR X) 0))
              (CONSP Y)
              (INTEGERP (CAR Y))
              (<= 0 (CAR Y))
              (EQUAL (CAR X) (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.20 (Subgoal *1/3.7'7') is pushed for proof by induction.

])
Subgoal *1/3.6
Subgoal *1/3.6'
Subgoal *1/3.6''
Subgoal *1/3.6'''
Subgoal *1/3.6'4'
Subgoal *1/3.6'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.6
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (< (CAR Z) 0)
              (NOT (EQUAL (CAR X) 0)))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.21 (Subgoal *1/3.6'5') is pushed for proof by induction.

])
Subgoal *1/3.5
Subgoal *1/3.5'
Subgoal *1/3.5''
Subgoal *1/3.5'''
Subgoal *1/3.5'4'
Subgoal *1/3.5'5'
Subgoal *1/3.5'6'
Subgoal *1/3.5'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.5
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (INTEGERP (CAR X))
              (<= 0 (CAR X))
              (< (CAR Z) 0)
              (NOT (EQUAL (CAR X) 0))
              (CONSP Y)
              (INTEGERP (CAR Y))
              (<= 0 (CAR Y))
              (EQUAL (CAR X) (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.22 (Subgoal *1/3.5'7') is pushed for proof by induction.

])
Subgoal *1/3.4
Subgoal *1/3.4'
Subgoal *1/3.4''
Subgoal *1/3.4'''
Subgoal *1/3.4'4'
Subgoal *1/3.4'5'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.4
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (< (CAR X) 0)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z))))
         (EQUAL-NAT-LIST (CDR X) (CDR X)))

*1.23 (Subgoal *1/3.4'5') is pushed for proof by induction.

])
Subgoal *1/3.3
Subgoal *1/3.3'
Subgoal *1/3.3''
Subgoal *1/3.3'''
Subgoal *1/3.3'4'
Subgoal *1/3.3'5'
Subgoal *1/3.3'6'
Subgoal *1/3.3'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.3
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (< (CAR X) 0)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (EQUAL 0 (CAR Y))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.24 (Subgoal *1/3.3'7') is pushed for proof by induction.

])
Subgoal *1/3.2
Subgoal *1/3.2'
Subgoal *1/3.2''
Subgoal *1/3.2'''
Subgoal *1/3.2'4'
Subgoal *1/3.2'5'
Subgoal *1/3.2'6'
Subgoal *1/3.2'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.2
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (< (CAR X) 0)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (NOT (INTEGERP (CAR Y)))
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.25 (Subgoal *1/3.2'7') is pushed for proof by induction.

])
Subgoal *1/3.1
Subgoal *1/3.1'
Subgoal *1/3.1''
Subgoal *1/3.1'''
Subgoal *1/3.1'4'
Subgoal *1/3.1'5'
Subgoal *1/3.1'6'
Subgoal *1/3.1'7'

([ A key checkpoint while proving *1 (descended from Goal):

Subgoal *1/3.1
(IMPLIES (AND (CONSP X)
              (CONSP Z)
              (< (CAR X) 0)
              (INTEGERP (CAR Z))
              (<= 0 (CAR Z))
              (NOT (EQUAL 0 (CAR Z)))
              (CONSP Y)
              (< (CAR Y) 0)
              (EQUAL-NAT-LIST (CDR X) (CDR Y)))
         (EQUAL-NAT-LIST (CDR Y) (CDR X)))

*1.26 (Subgoal *1/3.1'7') is pushed for proof by induction.

])
Subgoal *1/2
Subgoal *1/2'
Subgoal *1/1
Subgoal *1/1'

So we now return to *1.26, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.25, which we'll try to prove
later.  We therefore regard *1.26 as proved (pending the proof of the
more general *1.25).

Subgoal *1/3.1 COMPLETED!

We next consider *1.25, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.24, which we'll try to prove
later.  We therefore regard *1.25 as proved (pending the proof of the
more general *1.24).

Subgoal *1/3.2 COMPLETED!

We next consider *1.24, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.22, which we'll try to prove
later.  We therefore regard *1.24 as proved (pending the proof of the
more general *1.22).

Subgoal *1/3.3 COMPLETED!

We next consider *1.23, which is

(EQUAL-NAT-LIST X2 X2).

But the formula above is subsumed by *1.21, which we'll try to prove
later.  We therefore regard *1.23 as proved (pending the proof of the
more general *1.21).

Subgoal *1/3.4 COMPLETED!

We next consider *1.22, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.20, which we'll try to prove
later.  We therefore regard *1.22 as proved (pending the proof of the
more general *1.20).

Subgoal *1/3.5 COMPLETED!

We next consider *1.21, which is

(EQUAL-NAT-LIST X2 X2).

But the formula above is subsumed by *1.19, which we'll try to prove
later.  We therefore regard *1.21 as proved (pending the proof of the
more general *1.19).

Subgoal *1/3.6 COMPLETED!

We next consider *1.20, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.18, which we'll try to prove
later.  We therefore regard *1.20 as proved (pending the proof of the
more general *1.18).

Subgoal *1/3.7 COMPLETED!

We next consider *1.19, which is

(EQUAL-NAT-LIST X2 X2).

But the formula above is subsumed by *1.15, which we'll try to prove
later.  We therefore regard *1.19 as proved (pending the proof of the
more general *1.15).

Subgoal *1/3.8 COMPLETED!

We next consider *1.18, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.17, which we'll try to prove
later.  We therefore regard *1.18 as proved (pending the proof of the
more general *1.17).

Subgoal *1/3.9 COMPLETED!

We next consider *1.17, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.16, which we'll try to prove
later.  We therefore regard *1.17 as proved (pending the proof of the
more general *1.16).

Subgoal *1/3.10 COMPLETED!

We next consider *1.16, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.14, which we'll try to prove
later.  We therefore regard *1.16 as proved (pending the proof of the
more general *1.14).

Subgoal *1/3.11 COMPLETED!

We next consider *1.15, which is

(EQUAL-NAT-LIST X2 X2).

But the formula above is subsumed by *1.11, which we'll try to prove
later.  We therefore regard *1.15 as proved (pending the proof of the
more general *1.11).

Subgoal *1/3.12 COMPLETED!

We next consider *1.14, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.13, which we'll try to prove
later.  We therefore regard *1.14 as proved (pending the proof of the
more general *1.13).

Subgoal *1/3.13 COMPLETED!

We next consider *1.13, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.12, which we'll try to prove
later.  We therefore regard *1.13 as proved (pending the proof of the
more general *1.12).

Subgoal *1/3.14 COMPLETED!

We next consider *1.12, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.10, which we'll try to prove
later.  We therefore regard *1.12 as proved (pending the proof of the
more general *1.10).

Subgoal *1/3.15 COMPLETED!

We next consider *1.11, which is

(EQUAL-NAT-LIST X2 X2).

But the formula above is subsumed by *1.1, which we'll try to prove
later.  We therefore regard *1.11 as proved (pending the proof of the
more general *1.1).

Subgoal *1/3.16 COMPLETED!

We next consider *1.10, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.9, which we'll try to prove
later.  We therefore regard *1.10 as proved (pending the proof of the
more general *1.9).

Subgoal *1/4.1 COMPLETED!

We next consider *1.9, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.8, which we'll try to prove
later.  We therefore regard *1.9 as proved (pending the proof of the
more general *1.8).

Subgoal *1/4.2 COMPLETED!

We next consider *1.8, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.7, which we'll try to prove
later.  We therefore regard *1.8 as proved (pending the proof of the
more general *1.7).

Subgoal *1/4.3 COMPLETED!

We next consider *1.7, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.6, which we'll try to prove
later.  We therefore regard *1.7 as proved (pending the proof of the
more general *1.6).

Subgoal *1/4.4 COMPLETED!

We next consider *1.6, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.5, which we'll try to prove
later.  We therefore regard *1.6 as proved (pending the proof of the
more general *1.5).

Subgoal *1/4.5 COMPLETED!

We next consider *1.5, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.4, which we'll try to prove
later.  We therefore regard *1.5 as proved (pending the proof of the
more general *1.4).

Subgoal *1/4.6 COMPLETED!

We next consider *1.4, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.3, which we'll try to prove
later.  We therefore regard *1.4 as proved (pending the proof of the
more general *1.3).

Subgoal *1/4.7 COMPLETED!

We next consider *1.3, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).

But the formula above is subsumed by *1.2, which we'll try to prove
later.  We therefore regard *1.3 as proved (pending the proof of the
more general *1.2).

Subgoal *1/4.8 COMPLETED!

We next consider *1.2, which is

(IMPLIES (EQUAL-NAT-LIST X2 Y2)
         (EQUAL-NAT-LIST Y2 X2)).
Subgoal *1.2/5
Subgoal *1.2/5'
Subgoal *1.2/4
Subgoal *1.2/4'
Subgoal *1.2/3
Subgoal *1.2/3'
Subgoal *1.2/2
Subgoal *1.2/2'
Subgoal *1.2/1
Subgoal *1.2/1'

*1.2 is COMPLETED!
Thus key checkpoint Subgoal *1/4.9 is COMPLETED!

We therefore turn our attention to *1.1, which is

(EQUAL-NAT-LIST X2 X2).
Subgoal *1.1/3
Subgoal *1.1/2
Subgoal *1.1/2'
Subgoal *1.1/1
Subgoal *1.1/1'

*1.1 and *1 are COMPLETED!
Thus key checkpoints Subgoal *1/4.10 and Goal are COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM EQUAL-NAT-LIST-IS-AN-EQUIVALENCE ...)
Rules: ((:COMPOUND-RECOGNIZER BOOLEANP-COMPOUND-RECOGNIZER)
        (:DEFINITION ATOM)
        (:DEFINITION EQUAL-NAT-LIST)
        (:DEFINITION NFIX)
        (:DEFINITION NOT)
        (:ELIM CAR-CDR-ELIM)
        (:EXECUTABLE-COUNTERPART <)
        (:EXECUTABLE-COUNTERPART BOOLEANP)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:EXECUTABLE-COUNTERPART INTEGERP)
        (:EXECUTABLE-COUNTERPART NFIX)
        (:EXECUTABLE-COUNTERPART NOT)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION EQUAL-NAT-LIST)
        (:TYPE-PRESCRIPTION EQUAL-NAT-LIST))
Splitter rules (see :DOC splitter):
  if-intro: ((:DEFINITION EQUAL-NAT-LIST)
             (:DEFINITION NFIX))

Summary
Form:  ( MAKE-EVENT (DEFEQUIV-FORM ...))
Rules: NIL
 EQUAL-NAT-LIST-IS-AN-EQUIVALENCE
ACL2 !>>(DEFTHM EQUAL-NAT-LIST-NFIX-LIST
          (EQUAL-NAT-LIST (NFIX-LIST X) X))

ACL2 Warning [Double-rewrite] in ( DEFTHM EQUAL-NAT-LIST-NFIX-LIST
...):  In a :REWRITE rule generated from EQUAL-NAT-LIST-NFIX-LIST,
equivalence relation EQUAL-NAT-LIST is maintained at one problematic
occurrence of variable X in the right-hand side, but not at any binding
occurrence of X.  Consider replacing that occurrence of X in the right-
hand side with (DOUBLE-REWRITE X).  See :doc double-rewrite for more
information on this issue.


*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  One induction scheme is suggested
by this conjecture.  

We will induct according to a scheme suggested by (NFIX-LIST X).

This suggestion was produced using the :induction rule NFIX-LIST. 
If we let (:P X) denote *1 above then the induction scheme we'll use
is
(AND (IMPLIES (NOT (CONSP X)) (:P X))
     (IMPLIES (AND (CONSP X) (:P (CDR X)))
              (:P X))).
This induction is justified by the same argument used to admit NFIX-LIST.
When applied to the goal at hand the above induction scheme produces
two nontautological subgoals.
Subgoal *1/2
Subgoal *1/1

*1 is COMPLETED!
Thus key checkpoint Goal is COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM EQUAL-NAT-LIST-NFIX-LIST ...)
Rules: ((:DEFINITION EQUAL-NAT-LIST)
        (:DEFINITION NFIX)
        (:DEFINITION NFIX-LIST)
        (:EQUIVALENCE EQUAL-NAT-LIST-IS-AN-EQUIVALENCE)
        (:EXECUTABLE-COUNTERPART CONSP)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION NFIX-LIST)
        (:REWRITE CAR-CONS)
        (:REWRITE CDR-CONS)
        (:TYPE-PRESCRIPTION NFIX-LIST))
Warnings:  Double-rewrite
 EQUAL-NAT-LIST-NFIX-LIST
ACL2 !>>(DEFTHM EXAMPLE-THM-2
          (EQUAL (LEN (ISORT (NORML (NFIX-LIST X))))
                 (LEN X))
          :HINTS (("Goal" :DO-NOT '(PREPROCESS)
                          :DO-NOT-INDUCT T))
          :RULE-CLASSES NIL)

(1 Breaking (:REWRITE PERM-ISORT) on (ISORT (NORML (NFIX-LIST X))):
1 ACL2 >:GENEQV

Geneqv:
((PAIRWISE-IFF PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
 (PERM PERM-IMPLIES-EQUAL-LEN-1))

==========
Use (GET-BRR-LOCAL 'GENEQV STATE) to see actual geneqv data structure.
1 ACL2 >:PATH+
1. Simplifying the clause
     ((EQUAL (LEN (ISORT (NORML (NFIX-LIST X))))
             (LEN X)))
2. Rewriting (to simplify) the atom of the first literal,
     (EQUAL (LEN (ISORT (NORML (NFIX-LIST X))))
            (LEN X)),
   Geneqv: (IFF)
3. Rewriting (to simplify) the first argument,
     (LEN (ISORT (NORML (NFIX-LIST X)))),
4. Rewriting (to simplify) the first argument,
     (ISORT (NORML (NFIX-LIST X))),
   Geneqv: ((PAIRWISE-IFF PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
            (PERM PERM-IMPLIES-EQUAL-LEN-1))
5. Attempting to apply (:REWRITE PERM-ISORT) to
     (ISORT (NORML (NFIX-LIST X)))
   Preserving: PERM
   Geneqv: ((PAIRWISE-IFF PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
            (PERM PERM-IMPLIES-EQUAL-LEN-1))
1 ACL2 >:GO

1 (:REWRITE PERM-ISORT) produced (NORML (NFIX-LIST X)).
1)
Goal'
Goal''

([ A key checkpoint:

Goal''
(EQUAL (LEN (NFIX-LIST X)) (LEN X))

Normally we would attempt to prove Goal'' by induction.  However, a
:DO-NOT-INDUCT hint was supplied to abort the proof attempt.

])

Summary
Form:  ( DEFTHM EXAMPLE-THM-2 ...)
Rules: ((:CONGRUENCE PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
        (:CONGRUENCE PERM-IMPLIES-EQUAL-LEN-1)
        (:REWRITE PAIRWISE-IFF-NORML)
        (:REWRITE PERM-ISORT))

---
The key checkpoint goal, below, may help you to debug this failure.
See :DOC failure and see :DOC set-checkpoint-summary-limit.
---

*** Key checkpoint at the top level
    before a :DO-NOT-INDUCT hint stopped the proof attempt: ***

Goal''
(EQUAL (LEN (NFIX-LIST X)) (LEN X))

ACL2 Error [Failure] in ( DEFTHM EXAMPLE-THM-2 ...):  See :DOC failure.

******** FAILED ********
ACL2 !>>(DEFCONG EQUAL-NAT-LIST EQUAL (LEN X) 1)

*1 (the initial Goal, a key checkpoint) is pushed for proof by induction.

Perhaps we can prove *1 by induction.  Three induction schemes are
suggested by this conjecture.  These merge into one derived induction
scheme.  

We will induct according to a scheme suggested by (LEN X-EQUIV), but
modified to accommodate (LEN X) and (EQUAL-NAT-LIST X X-EQUIV).

These suggestions were produced using the :induction rules EQUAL-NAT-LIST
and LEN.  If we let (:P X X-EQUIV) denote *1 above then the induction
scheme we'll use is
(AND (IMPLIES (NOT (CONSP X-EQUIV))
              (:P X X-EQUIV))
     (IMPLIES (AND (CONSP X-EQUIV)
                   (:P (CDR X) (CDR X-EQUIV)))
              (:P X X-EQUIV))).
This induction is justified by the same argument used to admit LEN.
Note, however, that the unmeasured variable X is being instantiated.
When applied to the goal at hand the above induction scheme produces
three nontautological subgoals.
Subgoal *1/3
Subgoal *1/2
Subgoal *1/1

*1 is COMPLETED!
Thus key checkpoint Goal is COMPLETED!

Q.E.D.

Summary
Form:  ( DEFTHM EQUAL-NAT-LIST-IMPLIES-EQUAL-LEN-1 ...)
Rules: ((:DEFINITION EQUAL-NAT-LIST)
        (:DEFINITION LEN)
        (:DEFINITION NFIX)
        (:EXECUTABLE-COUNTERPART EQUAL)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:INDUCTION EQUAL-NAT-LIST)
        (:INDUCTION LEN))

Summary
Form:  ( MAKE-EVENT (DEFCONG-FORM ...))
Rules: NIL
 EQUAL-NAT-LIST-IMPLIES-EQUAL-LEN-1
ACL2 !>>(DEFTHM EXAMPLE-THM-2
          (EQUAL (LEN (ISORT (NORML (NFIX-LIST X))))
                 (LEN X))
          :HINTS (("Goal" :DO-NOT '(PREPROCESS)
                          :DO-NOT-INDUCT T))
          :RULE-CLASSES NIL)

(1 Breaking (:REWRITE PERM-ISORT) on (ISORT (NORML (NFIX-LIST X))):
1 ACL2 >:GENEQV

Geneqv:
((EQUAL-NAT-LIST EQUAL-NAT-LIST-IMPLIES-EQUAL-LEN-1)
 (PAIRWISE-IFF PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
 (PERM PERM-IMPLIES-EQUAL-LEN-1))

==========
Use (GET-BRR-LOCAL 'GENEQV STATE) to see actual geneqv data structure.
1 ACL2 >:GO

1 (:REWRITE PERM-ISORT) produced (NORML (NFIX-LIST X)).
1)
Goal'
Goal''

Q.E.D.

Summary
Form:  ( DEFTHM EXAMPLE-THM-2 ...)
Rules: ((:CONGRUENCE EQUAL-NAT-LIST-IMPLIES-EQUAL-LEN-1)
        (:CONGRUENCE PAIRWISE-IFF-IMPLIES-EQUAL-LEN-1)
        (:CONGRUENCE PERM-IMPLIES-EQUAL-LEN-1)
        (:FAKE-RUNE-FOR-TYPE-SET NIL)
        (:REWRITE EQUAL-NAT-LIST-NFIX-LIST)
        (:REWRITE PAIRWISE-IFF-NORML)
        (:REWRITE PERM-ISORT))
 EXAMPLE-THM-2
ACL2 !>>(REDEF+)

TTAG NOTE: Adding ttag :REDEF+ from the top level loop.
 T
ACL2 p!>>(DEFCONST *STANDARD-OI*
           *OLD-STANDARD-OI*)

ACL2 Warning [Redef] in ( DEFCONST *STANDARD-OI* ...):  *STANDARD-OI*
redefined.



Summary
Form:  ( DEFCONST *STANDARD-OI* ...)
Rules: NIL
Warnings:  Redef
 *STANDARD-OI*
ACL2 p!>>(REDEF-)
 NIL
ACL2 !>>(UBT 2)
   d       1:x(INCLUDE-BOOK "tools/run-script"
                            :DIR ...)
ACL2 !>>Bye.
