--> ==========================================================
-->  Proof scores for verifications of properties of
-->      \forall L:List.(rev1(rev1(L)) = L) .
-->      \forall L:List.(rev1(L) = rev2(L)) 
-->  and others about generic list.
-->  using named properties
-->                                    kf151027
--> ==========================================================

--> ==========================================================
--> elements with equality predicate
mod* TRIV= {
  [Elt]
  op _=_ : Elt Elt -> Bool {comm} .
}

--> ==========================================================
--> parametrized list (i.e. generic list)
mod! LIST (X :: TRIV=) {
  [List]
  op nil : -> List {constr} .
  op _|_ : Elt.X List -> List {constr} .
  -- variables declaration
  vars L L1 L2 : List .
  vars E1 E2 : Elt .
  -- equality on the sort List
  eq (nil = (E2 | L2)) = false .
  eq ((E1 | L1) = (E2 | L2))
      = (E1 =.X E2) and (L1 = L2) .
}

--> ==========================================================
--> append _@_ over List
mod! LIST@(X :: TRIV=) {
  pr(LIST(X))
  -- append operation over List
  op _@_ : List List -> List .
  var E : Elt .
  vars L1 L2 : List .
  eq [@1]: nil @ L2 = L2 .                   
  eq [@2]: (E | L1) @ L2 = E | (L1 @ L2) .   
}

--> ==========================================================
--> properties about _@_
mod PRED-LIST@(X :: TRIV=) {
  pr(LIST@(X))

  -- variable declaration
  vars L1 L2 L3 : List .

  -- nil is right identity of _@_
  pred @ri : List .
  eq @ri(L1) = ((L1 @ nil) = L1) .

  -- _@_ is associative
  pred @assoc : List List List .
  eq @assoc(L1,L2,L3) = ((L1 @ L2) @ L3 = L1 @ (L2 @ L3)) .
}

--> ==========================================================
--> Property of PRED-LIST@:
-->      \forall L1,L2,L3:List.
-->             ((L1 @ L2) @ L3 = L1 @ (L2 @ L3)) 
-->      (i.e.  @assoc(L1:List,L2:List,L3:List) = true)
--> ==========================================================
-- Proof: By induction on L1.
--> I induction base
select PRED-LIST@ .
red @assoc(nil,`l2:List,`l3:List) .
--> II Induction case
red @assoc(`l1:List,`l2:List,`l3:List) 
    implies @assoc(`e:Elt | `l1,`l2,`l3) .
--> QED
--> ==========================================================

--> ==========================================================
--> Property of PRED-LIST@:
-->      \forall L1:List.((L1 @ nil) = L1) 
-->      (i.e. @ri(L:Nat) = true)
--> ==========================================================
-- Proof: By induction on L1.
select PRED-LIST@ .
--> I induction base
red @ri(nil) .
--> II induction step
red @ri(`l1:List) implies @ri(`e:Elt | `l1) .
--> QED
-- ==========================================================

--> ==========================================================
--> LIST with associative append _@_
mod! LIST@a(X :: TRIV=) {
  pr(LIST(X))

  -- notice that associativity {assoc} 
  -- and right identity [@3] is already proved
  op _@_ : List List -> List {assoc} .
  vars L1 L2 : List
  var E : Elt.X
  eq [@1]: nil @ L2 = L2 .
  eq [@2]: (E | L1) @ L2 = E | (L1 @ L2) .
  -- nil is right identity w.r.t. _@_;  already proved
  eq [@3]: L1 @ nil = L1 .  
}

--> ==========================================================
--> LIST with reverse operations
mod! LISTrev(X :: TRIV=) {
  pr(LIST@a(X))

  vars L L1 L2 : List
  var E : Elt.X

  -- one argument reverse operation
  op rev1 : List -> List .
  eq rev1(nil) = nil .
  eq rev1(E | L) = rev1(L) @ (E | nil) .

  -- two arguments reverse operation
  op rev2 : List -> List .
  -- auxiliary function for rev2
  op sr2 : List List -> List .
  eq rev2(L) = sr2(L,nil) .
  eq sr2(nil,L2) = L2 .
  eq sr2(E | L1,L2) = sr2(L1,E | L2) .
}

--> ==========================================================
--> properties about LISTrev
mod PRED-LISTrev(X :: TRIV=) {
  pr(LISTrev(X))

  -- variables declaration
  vars L L1 L2 L3 : List

  -- rev1 distributes over _@_ reversely
  pred rev1@ : List List .
  eq rev1@(L1,L2) = 
             (rev1(L1 @ L2) = rev1(L2) @ rev1(L1)) .

  -- rev1rev1 is identity function
  pred rev1rev1 : List .
  eq rev1rev1(L) = (rev1(rev1(L)) = L) .

  -- sr2 with _@_ 
  pred sr2@ : List List List .
  eq sr2@(L1,L2,L3)
     = (sr2(L1,L2) @ L3 = sr2(L1,L2 @ L3)) .

  -- rev1=rev2
  pred rev1=rev2 : List .
  eq rev1=rev2(L) = (rev1(L) = rev2(L)) .
}

--> ==========================================================
--> Property of PRED-LISTrev:
-->      \forall L1,L2:List.
-->          (rev1(L1 @ L2) = rev1(L2) @ rev1(L1))
-->       (i.e. rev1(L1:List,L2:List) = true)
--> ==========================================================
-- Proof: By induction on L1.
--> I induction base
select PRED-LISTrev .
red rev1@(nil,`l2:List) .
--> II Induction case
open PRED-LISTrev .
-- induction hypothesis
op l1 : -> List .
eq rev1(l1 @ L2:List) = rev1(L2) @ rev1(l1) .
-- check
red rev1@(`e:Elt | l1,`l2:List) .
close
--> QED
-- ==========================================================

--> ==========================================================
--> Property of PRED-LISTrev:
-->    \forall L:List.(rev1(rev1(L)) = L) .
-->    (i.e. rev1rev1(L:List) = true)
--> ==========================================================
-- Proof: By induction on L.
--> I induction base
select PRED-LISTrev .
red rev1rev1(nil) .
--> II induction step
open PRED-LISTrev .
-- rev1@(L1:List,L2:List) is already proved
eq rev1(L1:List @ L2:List) = rev1(L2) @ rev1(L1) .
-- check
red rev1rev1(`l:List) implies rev1rev1(`e:Elt | `l) .
close
--> QED
-- ==========================================================

--> ==========================================================
--> Property of PRED-LISTrev:
-->    \forall L:List.(sr2(L1,L2) @ L3 = sr2(L1,L2 @ L3))
-->    (i.e. sr2@(L1:List,L2:List,L3:List) = true)
--> ==========================================================
-- Proof: By induction on L1.
--> I induction base
select PRED-LISTrev .
-- check
red sr2@(nil,`l2:List,`l3:List) .
--> II induction step
open PRED-LISTrev .
-- induction hypothesis sr2@(l1,L2:List,L3:List) 
op l1 : -> List .
eq sr2(l1,L2:List) @ L3:List = sr2(l1,L2 @ L3) .
-- check
red sr2@(`e:Elt | l1,`l2:List,`l3:List) .
close
--> QED
-- ==========================================================

--> ==========================================================
--> Property of PRED-LISTrev:
-->        \forall L:List.(rev1(L) = rev2(L)) 
-->        (i.e. rev1=rev2(L:List) = true)
--> ==========================================================
-- Proof: By induction on L.
-- (1)
--> I induction base
select PRED-LISTrev .
red rev1=rev2(nil) .
--> II Induction case
open PRED-LISTrev .
-- sr2@(L1:List,L2:List,L3:List) = true) is already proved
eq sr2(L1:List,L2:List) @ L3:List = sr2(L1,L2 @ L3) .
-- induction hypothesis
op l : -> List . eq rev1(l) = rev2(l) .
-- check
red rev1=rev2(`e:Elt | l) .
close
--> QED
--> ==========================================================

-- ==========================================================
--> end
-- ==========================================================