Verifying Merge Sort in Imandra¶

Merge sort is a widely used efficient general purpose sorting algorithm invented by John von Neumann in 1945. It is a prototypical divide and conquer algorithm and forms the basis of standard library sorting functions in languages like OCaml, Java and Python.

Let's verify it in Imandra!

The main idea¶

The main idea of merge sort is as follows:

Divide the input list into sublists
Sort the sublists
Merge the sorted sublists to obtain a sorted version of the original list

Merging two lists¶

We'll start by defining a function to merge two lists in a "sorted" way. Note that our termination proof involves both arguments l and m, using a lexicographic product (via the [@@adm l,m] admission annotation).

Try this!

In [1]:

let rec merge (l : int list) (m : int list) =
 match l, m with
  | [], _ -> m
  | _, [] -> l
  | a :: ls, b :: ms ->
    if a < b then
     a :: (merge ls m)
    else
     b :: (merge l ms)
[@@adm l, m]

Out[1]:

val merge : int list -> int list -> int list = <fun>

termination proof

Termination proof

call `merge (List.tl l) m` from `merge l m`

original

merge l m

sub

merge (List.tl l) m

original ordinal

Ordinal.of_list [Ordinal.Int (_cnt l); Ordinal.Int (_cnt m)]

sub ordinal

Ordinal.of_list [Ordinal.Int (_cnt (List.tl l)); Ordinal.Int (_cnt m)]

path

[List.hd l < List.hd m && not Is_a([], m) && not Is_a([], l)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.024s

details

Expand

smt_stats

num checks	18
arith-assume-eqs	5
arith-make-feasible	122
arith-max-columns	39
arith-conflicts	7
rlimit count	33341
arith-cheap-eqs	4
mk clause	180
datatype occurs check	175
mk bool var	397
arith-lower	86
arith-diseq	36
datatype splits	21
decisions	165
arith-propagations	25
propagations	275
interface eqs	4
arith-bound-propagations-cheap	25
arith-max-rows	16
conflicts	27
datatype accessor ax	50
minimized lits	6
arith-bound-propagations-lp	6
datatype constructor ax	44
num allocs	2855216
final checks	21
added eqs	462
del clause	96
arith eq adapter	76
arith-upper	137
time	0.001000
memory	8.580000
max memory	8.580000

Expand

start[0.024s]
  let (_x_0 : int) = List.hd m in
  let (_x_1 : bool) = not Is_a([], m) in
  let (_x_2 : bool) = count.list mk_nat m >= 0 in
  let (_x_3 : int list) = List.tl l in
  let (_x_4 : bool) = List.hd _x_3 < _x_0 in
  let (_x_5 : bool) = _x_1 && not Is_a([], _x_3) in
  List.hd l < _x_0
  && _x_1
     && not Is_a([], l)
        && count.list mk_nat l >= 0
           && _x_2 && count.list mk_nat _x_3 >= 0 && _x_2
  ==> not (_x_4 && _x_5) && not (not _x_4 && _x_5)
      || Ordinal.( << ) (if Is_a([], …) then … else …)
         (if Is_a([], …) then … else …)

simplify

into	let (_x_0 : int) = List.hd m in let (_x_1 : int list) = List.tl l in let (_x_2 : bool) = _x_0 <= List.hd _x_1 in let (_x_3 : bool) = not Is_a([], m) in let (_x_4 : bool) = not Is_a([], _x_1) in let (_x_5 : int) = count.list mk_nat _x_1 in let (_x_6 : Ordinal.t) = Ordinal.Int 1 in let (_x_7 : int) = count.list mk_nat m in let (_x_8 : Ordinal.t) = Ordinal.Int _x_7 in let (_x_9 : int) = count.list mk_nat l in (not ((not _x_2 && _x_3) && _x_4) && not ((_x_2 && _x_3) && _x_4) \|\| Ordinal.( << ) (Ordinal.plus (Ordinal.shift (Ordinal.Int _x_5) _x_6) _x_8) (Ordinal.plus (Ordinal.shift (Ordinal.Int _x_9) _x_6) _x_8)) \|\| not (((((not (_x_0 <= List.hd l) && _x_3) && not Is_a([], l)) && _x_9 >= 0) && _x_7 >= 0) && _x_5 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|`count.list mk_nat[0]`_1694| l_1679)
expansions

unroll

expr	(\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| l_1679)) (\|Ordinal.Int_11…
expansions

unroll

expr	(\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| l_1…
expansions

unroll
expr
(|`count.list mk_nat[0]`_1694| m_1680)
expansions

unroll

expr	(\|`count.list mk_nat[0]`_1694\| (\|get.::.1_1678\| l_1679))
expansions

unroll

expr	(\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| (\|get.::.1_1678\| l_1679))) …
expansions

unroll

expr	(let ((a!1 (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[…
expansions

unroll

expr	(let ((a!1 (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[…
expansions

Unsat

call `merge l (List.tl m)` from `merge l m`

original

merge l m

sub

merge l (List.tl m)

original ordinal

Ordinal.of_list [Ordinal.Int (_cnt l); Ordinal.Int (_cnt m)]

sub ordinal

Ordinal.of_list [Ordinal.Int (_cnt l); Ordinal.Int (_cnt (List.tl m))]

path

[not (List.hd l < List.hd m) && not Is_a([], m) && not Is_a([], l)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.040s

details

Expand

smt_stats

num checks	27
arith-assume-eqs	15
arith-make-feasible	340
arith-max-columns	81
arith-conflicts	12
rlimit count	23399
arith-cheap-eqs	140
mk clause	487
datatype occurs check	613
mk bool var	1077
arith-lower	283
arith-diseq	61
datatype splits	81
decisions	519
arith-propagations	61
propagations	818
interface eqs	15
arith-bound-propagations-cheap	61
arith-max-rows	42
conflicts	49
datatype accessor ax	123
minimized lits	4
arith-bound-propagations-lp	41
datatype constructor ax	152
num allocs	950500
final checks	56
added eqs	1227
del clause	255
arith eq adapter	222
arith-upper	372
memory	5.770000
max memory	5.770000

Expand

start[0.040s]
  let (_x_0 : int) = List.hd l in
  let (_x_1 : bool) = not Is_a([], l) in
  let (_x_2 : bool) = count.list mk_nat l >= 0 in
  let (_x_3 : int list) = List.tl m in
  let (_x_4 : bool) = _x_0 < List.hd _x_3 in
  let (_x_5 : bool) = not Is_a([], _x_3) && _x_1 in
  not (_x_0 < List.hd m)
  && not Is_a([], m)
     && _x_1
        && _x_2
           && count.list mk_nat m >= 0 && _x_2 && count.list mk_nat _x_3 >= 0
  ==> not (_x_4 && _x_5) && not (not _x_4 && _x_5)
      || Ordinal.( << ) (if Is_a([], …) then … else …)
         (if Is_a([], …) then … else …)

simplify

into	let (_x_0 : int list) = List.tl m in let (_x_1 : int) = List.hd l in let (_x_2 : bool) = List.hd _x_0 <= _x_1 in let (_x_3 : bool) = not Is_a([], _x_0) in let (_x_4 : bool) = not Is_a([], l) in let (_x_5 : int) = count.list mk_nat l in let (_x_6 : Ordinal.t) = Ordinal.shift (Ordinal.Int _x_5) (Ordinal.Int 1) in let (_x_7 : int) = count.list mk_nat _x_0 in let (_x_8 : int) = count.list mk_nat m in (not ((not _x_2 && _x_3) && _x_4) && not ((_x_2 && _x_3) && _x_4) \|\| Ordinal.( << ) (Ordinal.plus _x_6 (Ordinal.Int _x_7)) (Ordinal.plus _x_6 (Ordinal.Int _x_8))) \|\| not (((((List.hd m <= _x_1 && not Is_a([], m)) && _x_4) && _x_5 >= 0) && _x_8 >= 0) && _x_7 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|`count.list mk_nat[0]`_1694| m_1680)
expansions

unroll

expr	(\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| l_1…
expansions

unroll

expr	(\|`count.list mk_nat[0]`_1694\| (\|get.::.1_1678\| m_1680))
expansions

unroll
expr
(|`count.list mk_nat[0]`_1694| l_1679)
expansions

unroll

expr	(\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| l_1679)) (\|Ordinal.Int_11…
expansions

unroll

expr	(\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (\|`count.list mk_nat[0]`_1694\| l_1…
expansions

unroll

expr	(let ((a!1 (\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (…
expansions

unroll

expr	(\|`count.list mk_nat[0]`_1694\| (\|get.::.1_1678\| (\|get.::.1_1678\| m_1680)))
expansions

unroll

expr	(\|`count.list mk_nat[0]`_1694\| (\|get.::.1_1678\| l_1679))
expansions

unroll

expr	(let ((a!1 (\|get.Ordinal.Cons.2_1685\| (\|Ordinal.shift_205\| (\|Ordinal.Int…
expansions

unroll

expr	(let ((a!1 (\|get.Ordinal.Cons.2_1685\| (\|Ordinal.shift_205\| (\|Ordinal.Int…
expansions

unroll

expr	(let ((a!1 (\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (…
expansions

unroll

expr	(let ((a!1 (\|Ordinal.plus_167\| (\|Ordinal.shift_205\| (\|Ordinal.Int_111\| (…
expansions

Unsat

Let's experiment a bit with merge.

Try this!

In [2]:

merge [1;2;3] [4;5;6]

Out[2]:

- : int list = [1;2;3;4;5;6]

Try this!

In [3]:

merge [1;4;5] [2;3;4]

Out[3]:

- : int list = [1;2;3;4;4;5]

Try this!

In [4]:

merge [1;5;2] [2;3]

Out[4]:

- : int list = [1;2;3;5;2]

Observe that merge will merge sorted lists in a manner that respects their sortedness. But, if the lists given to merge aren't sorted, the output of merge need not be sorted.

Dividing into sublists¶

In merge sort, we need to divide a list into sublists. We'll do this in a simple way using the function odds which computes "every other" element of a list. We'll then be able to split a list x into sublists by taking odds x and odds (List.tl x).

Try this!

In [5]:

let rec odds l =
 match l with
  | []  -> []
  | [x] -> [x]
  | x :: y :: rst -> x :: odds rst

Out[5]:

val odds : 'a list -> 'a list = <fun>

termination proof

Termination proof

call `odds (List.tl (List.tl l))` from `odds l`

original

odds l

sub

odds (List.tl (List.tl l))

original ordinal

Ordinal.Int (_cnt l)

sub ordinal

Ordinal.Int (_cnt (List.tl (List.tl l)))

path

[not Is_a([], List.tl l) && not Is_a([], l)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.015s

details

Expand

smt_stats

num checks	10
arith-assume-eqs	2
arith-make-feasible	26
arith-max-columns	16
arith-conflicts	2
rlimit count	2526
arith-cheap-eqs	10
mk clause	32
datatype occurs check	13
mk bool var	80
arith-lower	20
arith-diseq	1
datatype splits	1
decisions	17
propagations	26
interface eqs	2
arith-max-rows	5
conflicts	8
datatype accessor ax	10
arith-bound-propagations-lp	1
datatype constructor ax	8
num allocs	8241621
final checks	7
added eqs	63
del clause	26
arith eq adapter	16
arith-upper	16
memory	8.740000
max memory	8.740000

Expand

start[0.015s]
  let (_x_0 : ty_0 list) = List.tl l in
  let (_x_1 : int) = count.list (const 0) l in
  let (_x_2 : ty_0 list) = List.tl _x_0 in
  let (_x_3 : int) = count.list (const 0) _x_2 in
  not Is_a([], _x_0) && not Is_a([], l) && _x_1 >= 0 && _x_3 >= 0
  ==> not (not Is_a([], List.tl _x_2) && not Is_a([], _x_2))
      || Ordinal.( << ) (Ordinal.Int _x_3) (Ordinal.Int _x_1)

simplify

into	let (_x_0 : ty_0 list) = List.tl l in let (_x_1 : ty_0 list) = List.tl _x_0 in let (_x_2 : int) = count.list (const 0) _x_1 in let (_x_3 : int) = count.list (const 0) l in (not (not Is_a([], List.tl _x_1) && not Is_a([], _x_1)) \|\| Ordinal.( << ) (Ordinal.Int _x_2) (Ordinal.Int _x_3)) \|\| not (((not Is_a([], _x_0) && not Is_a([], l)) && _x_3 >= 0) && _x_2 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll

expr	(\|`count.list (const 0)[0]`_1866\| l_1855)
expansions

unroll

expr	(\|`count.list (const 0)[0]`_1866\| (\|get.::.1_1848\| (\|get.::.1_1848\| l_1855)))
expansions

unroll

expr	(let ((a!1 (\|Ordinal.Int_111\| (\|`count.list (const 0)[0]`_1866\| (\|get.::…
expansions

unroll

expr	(\|`count.list (const 0)[0]`_1866\| (\|get.::.1_1848\| l_1855))
expansions

Unsat

Let's compute a bit with odds to better understand how it works.

Try this!

In [6]:

odds [1;2;3;4;5;6]

Out[6]:

- : int list = [1;3;5]

Try this!

In [7]:

odds (List.tl [1;2;3;4;5;6])

Out[7]:

- : int list = [2;4;6]

Defining Merge Sort¶

We can now put the pieces together and define our main merge_sort function, as follows:

Try this!

In [8]:

let rec merge_sort l =
 match l with
  | []  -> []
  | [_] -> l
  | _ :: ls -> merge (merge_sort (odds l)) (merge_sort (odds ls))

Out[8]:

val merge_sort : int list -> int list = <fun>
File "jupyter cell 8", line 1, characters 0-129Error: rejected definition for function merge_sort,
Imandra could not prove termination. 
hint: problematic sub-call from `merge_sort l`
to `merge_sort (odds (List.tl l))`  under path
not Is_a([], List.tl l) and not Is_a([], l) could not be proved to decrease
(measured subset: (l))
See https://docs.imandra.ai/imandra-docs/notebooks/proving-program-termination/

To admit merge_sort into Imandra, we must prove it terminating. We can do this with a custom measure function which we'll call merge_sort_measure. We'll prove a lemma about odds (by functional induction) to make it clear why the measure is decreasing in every recursive call. We'll install the lemma as a forward_chaining rule, which is a good strategy for making it effective during termination analysis.

Try this!

In [9]:

let merge_sort_measure x =
 Ordinal.of_int (List.length x)

Out[9]:

val merge_sort_measure : 'a list -> Ordinal.t = <fun>

Try this!

In [10]:

theorem odds_len_1 x =
 x <> [] && List.tl x <> []
 ==>
 (List.length (odds x) [@trigger]) < List.length x
[@@induct functional odds] [@@forward_chaining]

Out[10]:

val odds_len_1 : 'a list -> bool = <fun>
Goal:

x <> [] && List.tl x <> [] ==> List.length (odds x) < List.length x.

1 nontautological subgoal.

We shall induct according to a scheme derived from odds.

Induction scheme:

 (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ x)
 && (not Is_a([], x) && not Is_a([], List.tl x) && φ (List.tl (List.tl x))
     ==> φ x).

2 nontautological subgoals.

Subgoal 2:

 H0. List.length x <= List.length (odds x)
 H1. not (x = [])
 H2. not (List.tl x = [])
|---------------------------------------------------------------------------
 not Is_a([], List.tl x) && not Is_a([], x)

But simplification reduces this to true, using the forward-chaining rule
List.len_nonnegative.

Subgoal 1:

 H0. List.length x <= List.length (odds x)
 H1. not (x = [])
 H2. not (List.tl x = [])
 H3. not Is_a([], x)
 H4. not Is_a([], List.tl x)
 H5. not
     (List.length (List.tl (List.tl x)) <=
      List.length (odds (List.tl (List.tl x))))
     || not
        (not (List.tl (List.tl x) = [])
         && not (List.tl (List.tl (List.tl x)) = []))
|---------------------------------------------------------------------------
 false

This simplifies, using the definitions of List.length and odds to the
following 3 subgoals:

Subgoal 1.3:

 H0. List.length (List.tl (List.tl x)) <=
     List.length (odds (List.tl (List.tl x)))
 H1. List.tl (List.tl x) = []
 H2. List.length (List.tl x) <= List.length (odds (List.tl (List.tl x)))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)

But simplification reduces this to true, using the definitions of List.length
and odds.

Subgoal 1.2:

 H0. List.length (List.tl (List.tl x)) <=
     List.length (odds (List.tl (List.tl x)))
 H1. (List.tl (List.tl x)) <> []
 H2. List.tl (List.tl (List.tl x)) = []
 H3. List.length (List.tl x) <= List.length (odds (List.tl (List.tl x)))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)

This simplifies, using the definitions of List.length and odds to:

Subgoal 1.2':

 H0. List.tl (List.tl (List.tl x)) = []
 H1. List.length (List.tl (List.tl (List.tl x))) <= 0
 H2. List.length (List.tl (List.tl x)) <= 0
 H3. (List.tl (List.tl x)) <> []
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)

But simplification reduces this to true, using the definition of List.length.

Subgoal 1.1:

 H0. List.length (List.tl x) <= List.length (odds (List.tl (List.tl x)))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)
 C2. List.length (List.tl (List.tl x)) <=
     List.length (odds (List.tl (List.tl x)))

But simplification reduces this to true, using the definition of List.length.

 ⓘ  Rules:
    (:def List.length)
    (:def odds)
    (:fc List.len_nonnegative)
    (:induct odds)

Proved

proof

ground_instances	0
definitions	22
inductions	1
search_time	0.563s

Expand

start[0.563s, "Goal"]
  not (( :var_0: ) = []) && not (List.tl ( :var_0: ) = [])
  ==> List.length (odds ( :var_0: )) < List.length ( :var_0: )

subproof

(not (List.length x <= List.length (odds x)) || x = []) || List.tl x = []

start[0.563s, "1"]
  (not (List.length x <= List.length (odds x)) || x = []) || List.tl x = []

induction on (functional odds)
:scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ x)
        && (not Is_a([], x)
            && not Is_a([], List.tl x) && φ (List.tl (List.tl x)) ==> 
            φ x)

Split (let (_x_0 : sko_ty_0 list) = List.tl x in
       let (_x_1 : bool) = not Is_a([], _x_0) in
       let (_x_2 : bool) = not Is_a([], x) in
       let (_x_3 : bool) = not (List.length x <= List.length (odds x)) in
       let (_x_4 : bool) = not (not (x = []) && not (_x_0 = [])) in
       let (_x_5 : sko_ty_0 list) = List.tl _x_0 in
       ((_x_1 && _x_2 || _x_3) || _x_4)
       && ((_x_3 || _x_4)
           || not
              ((_x_2 && _x_1)
               && (not (List.length _x_5 <= List.length (odds _x_5))
                   || not (not (_x_5 = []) && not (List.tl _x_5 = [])))))
       :cases [let (_x_0 : sko_ty_0 list) = List.tl x in
               ((not (List.length x <= List.length (odds x)) || x = [])
                || _x_0 = [])
               || not Is_a([], _x_0) && not Is_a([], x);
               let (_x_0 : sko_ty_0 list) = List.tl x in
               let (_x_1 : sko_ty_0 list) = List.tl _x_0 in
               ((((not (List.length x <= List.length (odds x)) || x = [])
                  || _x_0 = [])
                 || Is_a([], x))
                || Is_a([], _x_0))
               || not
                  (not (List.length _x_1 <= List.length (odds _x_1))
                   || not (not (_x_1 = []) && not (List.tl _x_1 = [])))])

subproof

let (_x_0 : sko_ty_0 list) = List.tl x in let (_x_1 : sko_ty_0 list) = List.tl _x_0 in ((((not (List.length x <= List.length (odds x)) || x = []) || _x_0 = []) || Is_a([], x)) || Is_a([], _x_0)) || not (not (List.length _x_1 <= List.length (odds _x_1)) || not (not (_x_1 = []) && not (List.tl _x_1 = [])))

start[0.562s, "1"]
  let (_x_0 : sko_ty_0 list) = List.tl x in
  let (_x_1 : sko_ty_0 list) = List.tl _x_0 in
  ((((not (List.length x <= List.length (odds x)) || x = []) || _x_0 = [])
    || Is_a([], x))
   || Is_a([], _x_0))
  || not
     (not (List.length _x_1 <= List.length (odds _x_1))
      || not (not (_x_1 = []) && not (List.tl _x_1 = [])))

simplify

into	let (_x_0 : sko_ty_0 list) = List.tl x in let (_x_1 : bool) = Is_a([], _x_0) \|\| Is_a([], x) in let (_x_2 : sko_ty_0 list) = List.tl _x_0 in let (_x_3 : int) = List.length (odds _x_2) in let (_x_4 : bool) = List.length _x_2 <= _x_3 in let (_x_5 : bool) = _x_1 \|\| not _x_4 in let (_x_6 : bool) = _x_2 = [] in let (_x_7 : bool) = not (List.length _x_0 <= _x_3) in (((_x_5 \|\| not _x_6) \|\| _x_7) && (((_x_5 \|\| _x_6) \|\| not (List.tl _x_2 = [])) \|\| _x_7)) && ((_x_1 \|\| _x_4) \|\| _x_7)
expansions	[List.length, odds, List.length, List.length, odds, List.length, List.length, odds, List.length]
rewrite_steps
forward_chaining	List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative List.len_nonnegative

```
Subproof
```
```
Subproof
```
```
Subproof
```

subproof
let (_x_0 : sko_ty_0 list) = List.tl x in ((not (List.length x <= List.length (odds x)) || x = []) || _x_0 = []) || not Is_a([], _x_0) && not Is_a([], x)
- start[0.562s, "2"] let (_x_0 : sko_ty_0 list) = List.tl x in ((not (List.length x <= List.length (odds x)) || x = []) || _x_0 = []) || not Is_a([], _x_0) && not Is_a([], x)
- simplify
  into
  true
  expansions
  []
  rewrite_steps
  forward_chaining
  List.len_nonnegative
  List.len_nonnegative

digraph "proof" {
p_156 [label="Start (not (( :var_0: ) = []) && not (List.tl ( :var_0: ) = [])\l       ==\> List.length (odds ( :var_0: )) \< List.length ( :var_0: )\l       :name \"Goal\" :time 0.563s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_156 -> p_154 [label=""];
subgraph cluster_155 {
  color=blue;
p_154 [label="Start ((not (List.length x \<= List.length (odds x)) \|\| x = [])\l       \|\| List.tl x = [] :name \"1\" :time 0.563s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_154 -> p_153 [label=""];
p_153 [label="Induct ((functional odds),\l        :scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==\> φ x)\l                && (not Is_a([], x)\l                    && not Is_a([], List.tl x) && φ (List.tl (List.tl x))\l                    ==\> φ x))",shape=box,style=filled,fontname="courier",fontsize=14];
p_153 -> p_152 [label=""];
p_152 [label="Split (let (_x_0 : sko_ty_0 list) = List.tl x in\l       let (_x_1 : bool) = not Is_a([], _x_0) in\l       let (_x_2 : bool) = not Is_a([], x) in\l       let (_x_3 : bool) = not (List.length x \<= List.length (odds x)) in\l       let (_x_4 : bool) = not (not (x = []) && not (_x_0 = [])) in\l       let (_x_5 : sko_ty_0 list) = List.tl _x_0 in\l       ((_x_1 && _x_2 \|\| _x_3) \|\| _x_4)\l       && ((_x_3 \|\| _x_4)\l           \|\| not\l              ((_x_2 && _x_1)\l               && (not (List.length _x_5 \<= List.length (odds _x_5))\l                   \|\| not (not (_x_5 = []) && not (List.tl _x_5 = [])))))\l       :cases [let (_x_0 : sko_ty_0 list) = List.tl x in\l               ((not (List.length x \<= List.length (odds x)) \|\| x = [])\l                \|\| _x_0 = [])\l               \|\| not Is_a([], _x_0) && not Is_a([], x);\l               let (_x_0 : sko_ty_0 list) = List.tl x in\l               let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l               ((((not (List.length x \<= List.length (odds x)) \|\| x = [])\l                  \|\| _x_0 = [])\l                 \|\| Is_a([], x))\l                \|\| Is_a([], _x_0))\l               \|\| not\l                  (not (List.length _x_1 \<= List.length (odds _x_1))\l                   \|\| not (not (_x_1 = []) && not (List.tl _x_1 = [])))])",shape=box,style=filled,fontname="courier",fontsize=14];
p_152 -> p_147 [label=""];
subgraph cluster_148 {
  color=blue;
p_147 [label="Start (let (_x_0 : sko_ty_0 list) = List.tl x in\l       let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l       ((((not (List.length x \<= List.length (odds x)) \|\| x = [])\l          \|\| _x_0 = [])\l         \|\| Is_a([], x))\l        \|\| Is_a([], _x_0))\l       \|\| not\l          (not (List.length _x_1 \<= List.length (odds _x_1))\l           \|\| not (not (_x_1 = []) && not (List.tl _x_1 = [])))\l       :name \"1\" :time 0.562s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_147 -> p_146 [label=""];
p_146 [label="Simplify (let (_x_0 : sko_ty_0 list) = List.tl x in\l          let (_x_1 : bool) = Is_a([], _x_0) \|\| Is_a([], x) in\l          let (_x_2 : sko_ty_0 list) = List.tl _x_0 in\l          let (_x_3 : int) = List.length (odds _x_2) in\l          let (_x_4 : bool) = List.length _x_2 \<= _x_3 in\l          let (_x_5 : bool) = _x_1 \|\| not _x_4 in\l          let (_x_6 : bool) = _x_2 = [] in\l          let (_x_7 : bool) = not (List.length _x_0 \<= _x_3) in\l          (((_x_5 \|\| not _x_6) \|\| _x_7)\l           && (((_x_5 \|\| _x_6) \|\| not (List.tl _x_2 = [])) \|\| _x_7))\l          && ((_x_1 \|\| _x_4) \|\| _x_7)\l          :expansions [List.length;\l                       odds;\l                       List.length;\l                       List.length;\l                       odds;\l                       List.length;\l                       List.length;\l                       odds;\l                       List.length]\l          :rw []\l          :fc [List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
p_146 -> p_137 [label=""];
subgraph cluster_138 {
  color=blue;
p_137 [label="Start (let (_x_0 : sko_ty_0 list) = List.tl x in\l       let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l       let (_x_2 : int) = List.length (odds _x_1) in\l       ((Is_a([], _x_0) \|\| Is_a([], x)) \|\| List.length _x_1 \<= _x_2)\l       \|\| not (List.length _x_0 \<= _x_2) :name \"1.1\" :time 0.154s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_137 -> p_136 [label=""];
p_136 [label="Simplify (true :expansions [List.length] :rw []\l          :fc [List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_146 -> p_141 [label=""];
subgraph cluster_142 {
  color=blue;
p_141 [label="Start (let (_x_0 : sko_ty_0 list) = List.tl x in\l       let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l       let (_x_2 : int) = List.length (odds _x_1) in\l       ((((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (List.length _x_1 \<= _x_2))\l         \|\| _x_1 = [])\l        \|\| not (List.tl _x_1 = []))\l       \|\| not (List.length _x_0 \<= _x_2) :name \"1.2\" :time 0.154s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_141 -> p_140 [label=""];
p_140 [label="Simplify (let (_x_0 : sko_ty_0 list) = List.tl x in\l          let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l          let (_x_2 : sko_ty_0 list) = List.tl _x_1 in\l          ((((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (_x_2 = []))\l            \|\| not (List.length _x_2 \<= 0))\l           \|\| not (List.length _x_1 \<= 0))\l          \|\| not (_x_1 \<\> [])\l          :expansions [List.length;\l                       List.length;\l                       odds;\l                       List.length;\l                       List.length;\l                       List.length;\l                       odds;\l                       List.length]\l          :rw []\l          :fc [List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
p_140 -> p_139 [label=""];
p_139 [label="Simplify (true :expansions [List.length] :rw []\l          :fc [List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_146 -> p_144 [label=""];
subgraph cluster_145 {
  color=blue;
p_144 [label="Start (let (_x_0 : sko_ty_0 list) = List.tl x in\l       let (_x_1 : sko_ty_0 list) = List.tl _x_0 in\l       let (_x_2 : int) = List.length (odds _x_1) in\l       (((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (List.length _x_1 \<= _x_2))\l        \|\| not (_x_1 = []))\l       \|\| not (List.length _x_0 \<= _x_2) :name \"1.3\" :time 0.154s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_144 -> p_143 [label=""];
p_143 [label="Simplify (true :expansions [List.length; odds; List.length] :rw []\l          :fc [List.len_nonnegative;\l               List.len_nonnegative;\l               List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_152 -> p_150 [label=""];
subgraph cluster_151 {
  color=blue;
p_150 [label="Start (let (_x_0 : sko_ty_0 list) = List.tl x in\l       ((not (List.length x \<= List.length (odds x)) \|\| x = []) \|\| _x_0 = [])\l       \|\| not Is_a([], _x_0) && not Is_a([], x) :name \"2\" :time 0.562s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_150 -> p_149 [label=""];
p_149 [label="Simplify (true :expansions [] :rw []\l          :fc [List.len_nonnegative; List.len_nonnegative])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}

Now we're ready to define merge_sort. Imandra is able prove it terminating using our custom measure (and lemma!).

Try this!

In [11]:

let rec merge_sort l =
 match l with
  | []  -> []
  | [_] -> l
  | _ :: ls -> merge (merge_sort (odds l)) (merge_sort (odds ls))
[@@measure merge_sort_measure l]

Out[11]:

val merge_sort : int list -> int list = <fun>

termination proof

Termination proof

call `merge_sort (odds l)` from `merge_sort l`

original

merge_sort l

sub

merge_sort (odds l)

original ordinal

merge_sort_measure l

sub ordinal

merge_sort_measure (odds l)

path

[not Is_a([], List.tl l) && not Is_a([], l)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.013s

details

Expand

smt_stats

num checks	8
arith-make-feasible	9
arith-max-columns	11
rlimit count	5232
mk clause	9
datatype occurs check	30
mk bool var	56
arith-lower	3
datatype splits	6
decisions	15
propagations	7
arith-max-rows	3
conflicts	6
datatype accessor ax	7
datatype constructor ax	10
num allocs	2628724096
final checks	6
added eqs	42
del clause	8
arith eq adapter	2
arith-upper	9
memory	38.520000
max memory	53.760000

Expand

start[0.013s]
  let (_x_0 : int) = List.length l in
  let (_x_1 : int) = if _x_0 >= 0 then _x_0 else 0 in
  let (_x_2 : int list) = odds l in
  let (_x_3 : int) = List.length _x_2 in
  let (_x_4 : int) = if _x_3 >= 0 then _x_3 else 0 in
  let (_x_5 : bool) = not (not Is_a([], List.tl _x_2) && not Is_a([], _x_2))
  in
  not Is_a([], List.tl l) && not Is_a([], l) && _x_1 >= 0 && _x_4 >= 0
  ==> _x_5 && _x_5 || Ordinal.( << ) (Ordinal.Int _x_4) (Ordinal.Int _x_1)

simplify

into	let (_x_0 : int list) = odds l in let (_x_1 : int) = List.length _x_0 in let (_x_2 : int) = List.length l in (not (not Is_a([], List.tl l) && not Is_a([], l)) \|\| not (not Is_a([], List.tl _x_0) && not Is_a([], _x_0))) \|\| Ordinal.( << ) (Ordinal.Int (if _x_1 >= 0 then _x_1 else 0)) (Ordinal.Int (if _x_2 >= 0 then _x_2 else 0))
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|List.length_2276| l_2287)
expansions
unroll
expr
(|List.length_2276| (odds_2281 l_2287))
expansions

unroll

expr	(let ((a!1 (ite (>= (\|List.length_2276\| (odds_2281 l_2287)) 0) (\|List.length_2276\| (…
expansions

Unsat

call `merge_sort (odds (List.tl l))` from `merge_sort l`

original

merge_sort l

sub

merge_sort (odds (List.tl l))

original ordinal

merge_sort_measure l

sub ordinal

merge_sort_measure (odds (List.tl l))

path

[not Is_a([], List.tl l) && not Is_a([], l)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.014s

details

Expand

smt_stats

num checks	9
arith-assume-eqs	2
arith-make-feasible	14
arith-max-columns	12
rlimit count	2941
arith-cheap-eqs	4
mk clause	15
datatype occurs check	58
mk bool var	89
arith-lower	6
datatype splits	12
decisions	22
propagations	12
interface eqs	2
arith-max-rows	4
conflicts	8
datatype accessor ax	12
arith-bound-propagations-lp	1
datatype constructor ax	16
num allocs	2582209399
final checks	14
added eqs	82
del clause	13
arith eq adapter	4
arith-upper	8
memory	35.970000
max memory	53.760000

Expand

start[0.014s]
  let (_x_0 : int list) = List.tl l in
  let (_x_1 : int) = List.length l in
  let (_x_2 : int) = if _x_1 >= 0 then _x_1 else 0 in
  let (_x_3 : int list) = odds _x_0 in
  let (_x_4 : int) = List.length _x_3 in
  let (_x_5 : int) = if _x_4 >= 0 then _x_4 else 0 in
  let (_x_6 : bool) = not (not Is_a([], List.tl _x_3) && not Is_a([], _x_3))
  in
  not Is_a([], _x_0) && not Is_a([], l) && _x_2 >= 0 && _x_5 >= 0
  ==> _x_6 && _x_6 || Ordinal.( << ) (Ordinal.Int _x_5) (Ordinal.Int _x_2)

simplify

into	let (_x_0 : int list) = List.tl l in let (_x_1 : int list) = odds _x_0 in let (_x_2 : int) = List.length _x_1 in let (_x_3 : int) = List.length l in (not (not Is_a([], List.tl _x_1) && not Is_a([], _x_1)) \|\| Ordinal.( << ) (Ordinal.Int (if _x_2 >= 0 then _x_2 else 0)) (Ordinal.Int (if _x_3 >= 0 then _x_3 else 0))) \|\| not (not Is_a([], _x_0) && not Is_a([], l))
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|List.length_2276| l_2287)
expansions

unroll

expr	(\|List.length_2276\| (odds_2281 (\|get.::.1_2269\| l_2287)))
expansions

unroll

expr	(let ((a!1 (>= (\|List.length_2276\| (odds_2281 (\|get.::.1_2269\| l_2287))) 0)) (a!3 (\|Ordinal.In…
expansions

unroll
expr
(odds_2281 (|get.::.1_2269| l_2287))
expansions
Unsat

Let's experiment a bit with merge_sort to gain confidence we've defined it correctly.

Try this!

In [12]:

merge_sort [1;2;3]

Out[12]:

- : int list = [1;2;3]

Try this!

In [13]:

merge_sort [9;100;6;2;34;19;3;4;7;6]

Out[13]:

- : int list = [2;3;4;6;6;7;9;19;34;100]

This looks pretty good! Let's now use Imandra to prove it correct.

Proving Merge Sort correct¶

What does it mean for a sorting algorithm to be correct? There are two main components:

The result is sorted
The result has the same elements as the original

Let's start by defining what it means for a list to be sorted.

Try this!

In [14]:

let rec is_sorted (x : int list) =
 match x with
  | []  -> true
  | [_] -> true
  | x :: x' :: xs -> x <= x' && is_sorted (x' :: xs)

Out[14]:

val is_sorted : int list -> bool = <fun>

termination proof

Termination proof

call `let (_x_0 : int list) = List.tl x in is_sorted ((List.hd _x_0) :: (List.tl _x_0))` from `is_sorted x`

original

is_sorted x

sub

let (_x_0 : int list) = List.tl x in is_sorted ((List.hd _x_0) :: (List.tl _x_0))

original ordinal

Ordinal.Int (_cnt x)

sub ordinal

let (_x_0 : int list) = List.tl x in Ordinal.Int (_cnt ((List.hd _x_0) :: (List.tl _x_0)))

path

[List.hd x <= List.hd (List.tl x) && not Is_a([], List.tl x) && not Is_a([], x)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.012s

details

Expand

smt_stats

num checks	8
arith-assume-eqs	2
arith-make-feasible	24
arith-max-columns	24
arith-conflicts	2
rlimit count	2742
mk clause	39
datatype occurs check	13
mk bool var	90
arith-lower	24
arith-diseq	2
datatype splits	1
decisions	20
arith-propagations	1
propagations	28
interface eqs	2
arith-bound-propagations-cheap	1
arith-max-rows	9
conflicts	8
datatype accessor ax	9
minimized lits	2
arith-bound-propagations-lp	2
datatype constructor ax	7
num allocs	2774934557
final checks	6
added eqs	61
del clause	27
arith eq adapter	20
arith-upper	22
memory	36.270000
max memory	53.760000

Expand

start[0.012s]
  let (_x_0 : int list) = List.tl x in
  let (_x_1 : int) = List.hd _x_0 in
  let (_x_2 : int) = count.list mk_nat x in
  let (_x_3 : int) = count.list mk_nat (_x_1 :: …) in
  List.hd x <= _x_1
  && not Is_a([], _x_0) && not Is_a([], x) && _x_2 >= 0 && _x_3 >= 0
  ==> not (_x_1 <= List.hd … && not Is_a([], …))
      || Ordinal.( << ) (Ordinal.Int _x_3) (Ordinal.Int _x_2)

simplify

into	let (_x_0 : int list) = List.tl x in let (_x_1 : int) = List.hd _x_0 in let (_x_2 : int list) = List.tl _x_0 in let (_x_3 : int) = count.list mk_nat (_x_1 :: _x_2) in let (_x_4 : int) = count.list mk_nat x in (not (_x_1 <= List.hd _x_2 && not Is_a([], _x_2)) \|\| Ordinal.( << ) (Ordinal.Int _x_3) (Ordinal.Int _x_4)) \|\| not ((((List.hd x <= _x_1 && not Is_a([], _x_0)) && not Is_a([], x)) && _x_4 >= 0) && _x_3 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|`count.list mk_nat[0]`_2379| x_2368)
expansions

unroll

expr	(\|`count.list mk_nat[0]`_2379\| (\|::_3\| (\|get.::.0_2366\| (\|get.::.1_2367\| x_2368)) (\|get.…
expansions

unroll

expr	(let ((a!1 (\|`count.list mk_nat[0]`_2379\| (\|::_3\| (\|get.::.0_2366\| (\|get.::.1_2367\| x_2…
expansions

Unsat

As usual, let's experiment a bit with this definition.

Try this!

In [15]:

is_sorted [1;2;3;4;5]

Out[15]:

- : bool = true

Try this!

In [16]:

is_sorted [1;4;2]

Out[16]:

- : bool = false

Try this!

In [17]:

is_sorted [1]

Out[17]:

- : bool = true

Try this!

In [18]:

instance (fun x -> List.length x >= 5 && is_sorted x)

Out[18]:

- : int list -> bool = <fun>
module CX : sig val x : int list end

Instance (after 11 steps, 0.022s):
 let (x : int list) = [133758; 133758; 133758; 133758; 133758]

Instance

call graph
proof

digraph "call graph" {
goal [label="List.length x \>= 5 && is_sorted x",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
goal -> call_12 [label="calls"];
goal -> call_14 [label="calls"];
call_12 [label="List.length x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_12 -> call_196 [label="calls"];
call_14 [label="is_sorted x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_14 -> call_94 [label="calls"];
call_196 [label="List.length (List.tl x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_196 -> call_259 [label="calls"];
call_94 [label="let (_x_0 : int list) = List.tl x in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_94 -> call_445 [label="calls"];
call_259 [label="List.length (List.tl (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_259 -> call_355 [label="calls"];
call_445 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_445 -> call_671 [label="calls"];
call_355 [label="List.length (List.tl (List.tl (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_355 -> call_87 [label="calls"];
call_671 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_671 -> call_855 [label="calls"];
call_87 [label="List.length (List.tl (List.tl (List.tl (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_87 -> call_773 [label="calls"];
call_855 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_855 -> call_1073 [label="calls"];
call_773 [label="List.length (List.tl (List.tl (List.tl (List.tl (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_773 -> call_964 [label="calls"];
call_1073 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (List.tl x)))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_964 [label="List.length (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
}

proof attempt

ground_instances

definitions

inductions

search_time

0.022s

details

Expand

smt_stats

num checks	23
arith-assume-eqs	19
arith-make-feasible	83
arith-max-columns	37
arith-conflicts	8
rlimit count	6429
arith-cheap-eqs	27
mk clause	144
datatype occurs check	42
mk bool var	322
arith-lower	46
arith-diseq	16
datatype splits	12
decisions	69
arith-propagations	3
propagations	196
interface eqs	19
arith-bound-propagations-cheap	3
arith-max-rows	20
conflicts	21
datatype accessor ax	39
arith-bound-propagations-lp	3
datatype constructor ax	51
num allocs	2877487270
final checks	41
added eqs	279
del clause	109
arith eq adapter	62
arith-upper	73
memory	36.720000
max memory	53.760000

Expand

start[0.022s] List.length ( :var_0: ) >= 5 && is_sorted ( :var_0: )

unroll
expr
(is_sorted_64 x_75)
expansions
unroll
expr
(|List.length_2426| x_75)
expansions

unroll

expr	(\|List.length_2426\| (\|get.::.1_2425\| x_75))
expansions

unroll

expr	(\|List.length_2426\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75)))
expansions

unroll

expr	(is_sorted_64 (\|::_3\| (\|get.::.0_2424\| (\|get.::.1_2425\| x_75)) (\|get.::.1_2425…
expansions

unroll

expr	(\|List.length_2426\| (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75))))
expansions

unroll

expr	(let ((a!1 (\|::_3\| (\|get.::.0_2424\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75))) (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75)))))) (\|List.l…
expansions

unroll

expr	(let ((a!1 (\|get.::.0_2424\| (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75)))))) (\|List.l…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| (\|get.::.1_2425\| x_75)))))) (is_sort…
expansions

Sat (Some let (x : int list) = [133758; 133758; 133758; 133758; 133758] )

digraph "proof" {
p_188 [label="Start (List.length ( :var_0: ) \>= 5 && is_sorted ( :var_0: ) :time 0.022s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_188 -> p_187 [label=""];
p_187 [label="Unroll ([is_sorted x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_187 -> p_186 [label=""];
p_186 [label="Unroll ([List.length x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_186 -> p_185 [label=""];
p_185 [label="Unroll ([List.length (List.tl x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_185 -> p_184 [label=""];
p_184 [label="Unroll ([List.length (List.tl (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_184 -> p_183 [label=""];
p_183 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_183 -> p_182 [label=""];
p_182 [label="Unroll ([List.length (List.tl (List.tl (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_182 -> p_181 [label=""];
p_181 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_181 -> p_180 [label=""];
p_180 [label="Unroll ([List.length (List.tl (List.tl (List.tl (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_180 -> p_179 [label=""];
p_179 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_179 -> p_178 [label=""];
p_178 [label="Unroll ([List.length (List.tl (List.tl (List.tl (List.tl (List.tl x)))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_178 -> p_177 [label=""];
p_177 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_177 -> p_176 [label=""];
p_176 [label="Sat (Some  let (x : int list) = [133758; 133758; 133758; 133758; 133758]\l)",shape=box,style=filled,fontname="courier",fontsize=14];
}

Try this!

In [19]:

instance (fun x -> List.length x >= 5 && is_sorted x && is_sorted (List.rev x))

Out[19]:

- : int list -> bool = <fun>
module CX : sig val x : int list end

Instance (after 47 steps, 0.115s):
 let (x : int list) = [427723; 427723; 427723; 427723; 427723]

Instance

call graph
proof

digraph "call graph" {
goal [label="(List.length x \>= 5 && is_sorted x) && is_sorted (List.rev x)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
goal -> call_19 [label="calls"];
goal -> call_20 [label="calls"];
goal -> call_18 [label="calls"];
goal -> call_16 [label="calls"];
call_19 [label="List.rev x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_19 -> call_109 [label="calls"];
call_19 -> call_106 [label="calls"];
call_20 [label="is_sorted (List.rev x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_20 -> call_211 [label="calls"];
call_18 [label="is_sorted x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_18 -> call_341 [label="calls"];
call_16 [label="List.length x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_16 -> call_445 [label="calls"];
call_109 [label="List.append (List.rev (List.tl x)) [List.hd x]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_109 -> call_595 [label="calls"];
call_106 [label="List.rev (List.tl x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_106 -> call_505 [label="calls"];
call_106 -> call_507 [label="calls"];
call_211 [label="let (_x_0 : int list) = List.tl (List.rev x) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_211 -> call_1024 [label="calls"];
call_341 [label="let (_x_0 : int list) = List.tl x in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_341 -> call_1263 [label="calls"];
call_445 [label="List.length (List.tl x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_445 -> call_645 [label="calls"];
call_595 [label="List.append (List.tl (List.rev (List.tl x))) [List.hd x]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_595 -> call_1408 [label="calls"];
call_505 [label="List.rev (List.tl (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_505 -> call_733 [label="calls"];
call_505 -> call_730 [label="calls"];
call_507 [label="let (_x_0 : int list) = List.tl x in\lList.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_507 -> call_839 [label="calls"];
call_1024 [label="let (_x_0 : int list) = List.tl (List.tl (List.rev x)) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1024 -> call_2272 [label="calls"];
call_1263 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1263 -> call_1903 [label="calls"];
call_645 [label="List.length (List.tl (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_645 -> call_1163 [label="calls"];
call_1408 [label="List.append (List.tl (List.tl (List.rev (List.tl x)))) [List.hd x]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1408 -> call_726 [label="calls"];
call_733 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lList.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_733 -> call_1593 [label="calls"];
call_730 [label="List.rev (List.tl (List.tl (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_730 -> call_1448 [label="calls"];
call_730 -> call_1159 [label="calls"];
call_839 [label="let (_x_0 : int list) = List.tl x in\lList.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_839 -> call_2116 [label="calls"];
call_2272 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.rev x))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2272 -> call_2644 [label="calls"];
call_1903 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1903 -> call_2580 [label="calls"];
call_1163 [label="List.length (List.tl (List.tl (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1163 -> call_1736 [label="calls"];
call_726 [label="List.append (List.tl (List.tl (List.tl (List.rev (List.tl x))))) [List.hd x]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_726 -> call_3280 [label="calls"];
call_1593 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lList.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1593 -> call_1160 [label="calls"];
call_1448 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lList.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1448 -> call_2376 [label="calls"];
call_1159 [label="List.rev (List.tl (List.tl (List.tl (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1159 -> call_2147 [label="calls"];
call_1159 -> call_2150 [label="calls"];
call_2116 [label="let (_x_0 : int list) = List.tl x in\lList.append (List.tl (List.tl (List.rev (List.tl _x_0)))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2116 -> call_3604 [label="calls"];
call_2644 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (List.rev x)))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2644 -> call_4092 [label="calls"];
call_2580 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2580 -> call_3435 [label="calls"];
call_1736 [label="List.length (List.tl (List.tl (List.tl (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1736 -> call_1586 [label="calls"];
call_3280 [label="List.append (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl x))))))\l[List.hd x]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3280 -> call_6959 [label="calls"];
call_1160 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lList.append (List.tl (List.tl (List.rev (List.tl _x_0)))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1160 -> call_3937 [label="calls"];
call_2376 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lList.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2376 -> call_95 [label="calls"];
call_2147 [label="List.rev (List.tl (List.tl (List.tl (List.tl (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2147 -> call_2948 [label="calls"];
call_2147 -> call_1881 [label="calls"];
call_2150 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\lList.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2150 -> call_3029 [label="calls"];
call_3604 [label="let (_x_0 : int list) = List.tl x in\lList.append (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))\l[List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3604 -> call_4873 [label="calls"];
call_4092 [label="let (_x_0 : int list)\l    = List.tl (List.tl (List.tl (List.tl (List.tl (List.rev x)))))\lin is_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_3435 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (List.tl x)))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3435 -> call_4818 [label="calls"];
call_1586 [label="List.length (List.tl (List.tl (List.tl (List.tl (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1586 -> call_3282 [label="calls"];
call_6959 [label="List.append\l(List.tl (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl x)))))))\l[List.hd x]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_3937 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lList.append (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))\l[List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3937 -> call_4797 [label="calls"];
call_95 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lList.append (List.tl (List.tl (List.rev (List.tl _x_0)))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_95 -> call_5245 [label="calls"];
call_2948 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (List.tl x)))) in\lList.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2948 -> call_1204 [label="calls"];
call_1881 [label="List.rev (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1881 -> call_4403 [label="calls"];
call_1881 -> call_4400 [label="calls"];
call_3029 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\lList.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3029 -> call_4531 [label="calls"];
call_4873 [label="let (_x_0 : int list) = List.tl x in\lList.append (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl _x_0))))))\l[List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4873 -> call_6286 [label="calls"];
call_4818 [label="let (_x_0 : int list)\l    = List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))\lin is_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_3282 [label="List.length (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3282 -> call_1588 [label="calls"];
call_4797 [label="let (_x_0 : int list) = List.tl (List.tl x) in\lList.append (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl _x_0))))))\l[List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_5245 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\lList.append (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))\l[List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_1204 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (List.tl x)))) in\lList.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_4403 [label="let (_x_0 : int list)\l    = List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))\lin List.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4403 -> call_5235 [label="calls"];
call_4400 [label="List.rev\l(List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4400 -> call_4546 [label="calls"];
call_4400 -> call_3414 [label="calls"];
call_4531 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\lList.append (List.tl (List.tl (List.rev (List.tl _x_0)))) [List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_6286 [label="let (_x_0 : int list) = List.tl x in\lList.append\l(List.tl (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))))\l[List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_1588 [label="List.length\l(List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_5235 [label="let (_x_0 : int list)\l    = List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))\lin List.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_4546 [label="List.rev\l(List.tl\l (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_3414 [label="let (_x_0 : int list)\l    = List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))\lin List.append (List.rev (List.tl _x_0)) [List.hd _x_0]",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
}

proof attempt

ground_instances

definitions

inductions

search_time

0.115s

details

Expand

smt_stats

num checks	95
arith-assume-eqs	138
arith-make-feasible	1014
arith-max-columns	80
arith-conflicts	45
rlimit count	97873
arith-cheap-eqs	734
mk clause	1585
datatype occurs check	2518
mk bool var	4940
arith-lower	1070
arith-diseq	321
datatype splits	472
decisions	3307
arith-propagations	268
propagations	7177
interface eqs	138
arith-bound-propagations-cheap	268
arith-max-rows	55
conflicts	244
datatype accessor ax	452
minimized lits	72
arith-bound-propagations-lp	145
datatype constructor ax	1403
num allocs	2962524684
final checks	288
added eqs	14425
del clause	935
arith eq adapter	600
arith-upper	925
time	0.002000
memory	41.250000
max memory	53.760000

Expand

start[0.115s]
  List.length ( :var_0: ) >= 5
  && is_sorted ( :var_0: ) && is_sorted (List.rev ( :var_0: ))

simplify

into	(List.length ( :var_0: ) >= 5 && is_sorted ( :var_0: )) && is_sorted (List.rev ( :var_0: ))
expansions	[]
rewrite_steps
forward_chaining

unroll
expr
(|List.rev_2469| x_77)
expansions
unroll
expr
(is_sorted_64 (|List.rev_2469| x_77))
expansions
unroll
expr
(is_sorted_64 x_77)
expansions
unroll
expr
(|List.length_2465| x_77)
expansions

unroll

expr	(\|List.rev_2469\| (\|get.::.1_2464\| x_77))
expansions

unroll

expr	(\|List.append_2473\| (\|List.rev_2469\| (\|get.::.1_2464\| x_77)) (\|::_3\| (\|get.::.0_2463\| x_77) \|[]_…
expansions

unroll

expr	(\|List.length_2465\| (\|get.::.1_2464\| x_77))
expansions

unroll

expr	(\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))
expansions

unroll

expr	(\|List.append_2473\| (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))) (\|::_3\| (\|get.::.…
expansions

unroll

expr	(let ((a!1 (\|::_3\| (\|get.::.0_2463\| (\|get.::.1_2464\| (\|List.rev_2469\| x_77))) (\|g…
expansions

unroll

expr	(\|List.length_2465\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))
expansions

unroll

expr	(is_sorted_64 (\|::_3\| (\|get.::.0_2463\| (\|get.::.1_2464\| x_77)) (\|get.::.1_2464…
expansions

unroll

expr	(\|List.append_2473\| (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| x_77))) (\|::_3\| (\|get.::.…
expansions

unroll

expr	(\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))
expansions

unroll

expr	(let ((a!1 (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(\|List.length_2465\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))
expansions

unroll

expr	(let ((a!1 (\|::_3\| (\|get.::.0_2463\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))) (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.r…
expansions

unroll

expr	(let ((a!1 (\|get.::.0_2463\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.l…
expansions

unroll

expr	(let ((a!1 (\|get.::.0_2463\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.r…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.l…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (is_sort…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.r…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| x_77)))))) (is_sort…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.l…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (is_sort…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77))))) (a!2 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.r…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| x_77)))))) (let ((a!2…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| (\|get.::.1_2464\| x_77)))))) (\|List.a…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_2464\| (\|get.::.1_2464\| (\|get.::.1_2464\| (\|List.rev_2469\| x_77)))))) (is_sort…
expansions

Sat (Some let (x : int list) = [427723; 427723; 427723; 427723; 427723] )

digraph "proof" {
p_238 [label="Start (List.length ( :var_0: ) \>= 5\l       && is_sorted ( :var_0: ) && is_sorted (List.rev ( :var_0: ))\l       :time 0.115s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_238 -> p_237 [label=""];
p_237 [label="Simplify ((List.length ( :var_0: ) \>= 5 && is_sorted ( :var_0: ))\l          && is_sorted (List.rev ( :var_0: )) :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_237 -> p_236 [label=""];
p_236 [label="Unroll ([List.rev x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_236 -> p_235 [label=""];
p_235 [label="Unroll ([is_sorted (List.rev x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_235 -> p_234 [label=""];
p_234 [label="Unroll ([is_sorted x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_234 -> p_233 [label=""];
p_233 [label="Unroll ([List.length x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_233 -> p_232 [label=""];
p_232 [label="Unroll ([List.rev (List.tl x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_232 -> p_231 [label=""];
p_231 [label="Unroll ([List.append (List.rev (List.tl x)) [List.hd x]], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_231 -> p_230 [label=""];
p_230 [label="Unroll ([List.length (List.tl x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_230 -> p_229 [label=""];
p_229 [label="Unroll ([List.rev (List.tl (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_229 -> p_228 [label=""];
p_228 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_228 -> p_227 [label=""];
p_227 [label="Unroll ([let (_x_0 : int list) = List.tl (List.rev x) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_227 -> p_226 [label=""];
p_226 [label="Unroll ([List.length (List.tl (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_226 -> p_225 [label=""];
p_225 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_225 -> p_224 [label=""];
p_224 [label="Unroll ([List.append (List.tl (List.rev (List.tl x))) [List.hd x]], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_224 -> p_223 [label=""];
p_223 [label="Unroll ([List.rev (List.tl (List.tl (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_223 -> p_222 [label=""];
p_222 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_222 -> p_221 [label=""];
p_221 [label="Unroll ([List.length (List.tl (List.tl (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_221 -> p_220 [label=""];
p_220 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_220 -> p_219 [label=""];
p_219 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         List.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_219 -> p_218 [label=""];
p_218 [label="Unroll ([List.rev (List.tl (List.tl (List.tl (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_218 -> p_217 [label=""];
p_217 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.rev x)) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_217 -> p_216 [label=""];
p_216 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\l         List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_216 -> p_215 [label=""];
p_215 [label="Unroll ([List.length (List.tl (List.tl (List.tl (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_215 -> p_214 [label=""];
p_214 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_214 -> p_213 [label=""];
p_213 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         List.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_213 -> p_212 [label=""];
p_212 [label="Unroll ([List.append (List.tl (List.tl (List.rev (List.tl x)))) [List.hd x]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_212 -> p_211 [label=""];
p_211 [label="Unroll ([List.rev (List.tl (List.tl (List.tl (List.tl (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_211 -> p_210 [label=""];
p_210 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\l         List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_210 -> p_209 [label=""];
p_209 [label="Unroll ([List.length (List.tl (List.tl (List.tl (List.tl (List.tl x)))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_209 -> p_208 [label=""];
p_208 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_208 -> p_207 [label=""];
p_207 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         List.append (List.tl (List.tl (List.rev (List.tl _x_0))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_207 -> p_206 [label=""];
p_206 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\l         List.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_206 -> p_205 [label=""];
p_205 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         List.append (List.tl (List.tl (List.rev (List.tl _x_0))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_205 -> p_204 [label=""];
p_204 [label="Unroll ([List.rev\l         (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_204 -> p_203 [label=""];
p_203 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl x))) in\l         List.append (List.tl (List.rev (List.tl _x_0))) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_203 -> p_202 [label=""];
p_202 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (List.rev x))) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_202 -> p_201 [label=""];
p_201 [label="Unroll ([let (_x_0 : int list)\l             = List.tl (List.tl (List.tl (List.tl (List.tl x))))\l         in List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_201 -> p_200 [label=""];
p_200 [label="Unroll ([List.length\l         (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_200 -> p_199 [label=""];
p_199 [label="Unroll ([let (_x_0 : int list)\l             = List.tl (List.tl (List.tl (List.tl (List.tl x))))\l         in is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_199 -> p_198 [label=""];
p_198 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         List.append (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_198 -> p_197 [label=""];
p_197 [label="Unroll ([List.append (List.tl (List.tl (List.tl (List.rev (List.tl x)))))\l         [List.hd x]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_197 -> p_196 [label=""];
p_196 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl x)) in\l         List.append (List.tl (List.tl (List.rev (List.tl _x_0))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_196 -> p_195 [label=""];
p_195 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl x) in\l         List.append (List.tl (List.tl (List.tl (List.rev (List.tl _x_0)))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_195 -> p_194 [label=""];
p_194 [label="Unroll ([List.rev\l         (List.tl\l          (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_194 -> p_193 [label=""];
p_193 [label="Unroll ([let (_x_0 : int list) = List.tl x in\l         List.append\l         (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl _x_0))))))\l         [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_193 -> p_192 [label=""];
p_192 [label="Unroll ([let (_x_0 : int list)\l             = List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))\l         in List.append (List.rev (List.tl _x_0)) [List.hd _x_0]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_192 -> p_191 [label=""];
p_191 [label="Unroll ([List.append\l         (List.tl (List.tl (List.tl (List.tl (List.rev (List.tl x))))))\l         [List.hd x]],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_191 -> p_190 [label=""];
p_190 [label="Unroll ([let (_x_0 : int list)\l             = List.tl (List.tl (List.tl (List.tl (List.rev x))))\l         in is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_190 -> p_189 [label=""];
p_189 [label="Sat (Some  let (x : int list) = [427723; 427723; 427723; 427723; 427723]\l)",shape=box,style=filled,fontname="courier",fontsize=14];
}

Proving Merge Sort sorts¶

Now that we've defined our is_sorted predicate, we're ready to state one of our main verification goals: that merge_sort sorts!

We can write this this way:

theorem merge_sort_sorts x =
 is_sorted (merge_sort x)

Before we try to prove this for all possible cases by induction, let's ask Imandra to verify that this property holds up to our current recursion unrolling bound (100).

Try this!

In [20]:

verify (fun x -> is_sorted (merge_sort x))

Out[20]:

- : int list -> bool = <fun>

Unknown (Verified up to bound 100)

Expand

expanded

odds (List.tl (odds (List.tl (odds (List.tl (odds x))))))
let (_x_0 : int list) = merge_sort (odds x) in let (_x_1 : int list) = merge_sort (odds (List.tl x)) in let (_x_2 : bool) = List.hd _x_1 <= List.hd _x_0 in merge (if _x_2 then _x_0 else (List.tl _x_0)) (if _x_2 then List.tl _x_1 else _x_1)
let (_x_0 : int list) = odds (List.tl (odds x)) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (odds (List.tl (odds (odds (List.tl x)))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl x))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds x)
merge_sort (odds (List.tl (odds (odds (odds (List.tl x))))))
merge_sort (odds (List.tl (odds (odds (odds x)))))
let (_x_0 : int list) = odds (List.tl x) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (List.tl (odds (odds x)))
let (_x_0 : int list) = odds (odds (odds x)) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (odds (odds (List.tl x))))
merge_sort (odds (odds (List.tl (odds x))))
odds (List.tl (List.tl (odds (odds (List.tl x)))))
odds (List.tl x)
let (_x_0 : int list) = odds (odds (List.tl x)) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
merge_sort (odds (odds (List.tl (odds (odds (List.tl x))))))
merge_sort (odds (odds x))
merge_sort (odds (odds (List.tl (odds (odds x)))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds x))))))
odds (List.tl (odds (odds (List.tl x))))
odds x
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl (odds x)))))))
let (_x_0 : int list) = odds (odds (odds (List.tl x))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl x)))))))
odds (List.tl (odds (List.tl (odds (List.tl x)))))
merge_sort (odds (odds (odds (odds x))))
odds (odds (List.tl x))
odds (List.tl (odds (odds (List.tl (odds x)))))
merge_sort (odds (List.tl (odds (List.tl (odds (odds x))))))
odds (List.tl (List.tl (List.tl (odds x))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))))
merge_sort (odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))))
let (_x_0 : int list) = odds x in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
merge_sort (odds (List.tl (odds x)))
let (_x_0 : int list) = odds (odds x) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (odds (List.tl (odds (odds x))))
odds (List.tl (List.tl (List.tl (odds (odds (List.tl x))))))
odds (List.tl (List.tl x))
odds (List.tl (List.tl (List.tl (odds (odds x)))))
is_sorted (merge_sort x)
let (_x_0 : int list) = odds x in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in merge (if _x_6 then _x_4 else (List.tl _x_4)) (if _x_6 then List.tl _x_5 else _x_5)
odds (List.tl (odds (odds (odds (List.tl x)))))
merge_sort (odds (List.tl (odds (odds (List.tl (odds x))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl x)))))
odds (List.tl (List.tl (odds (odds x))))
merge_sort (odds (List.tl (odds (List.tl x))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))
merge_sort (odds (odds (List.tl x)))
odds (odds (odds (List.tl (odds x))))
let (_x_0 : int list) = odds (List.tl x) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in merge (if _x_6 then _x_4 else (List.tl _x_4)) (if _x_6 then List.tl _x_5 else _x_5)
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl x))))))
merge_sort (odds (List.tl (odds (List.tl (odds x)))))
merge_sort (odds (odds (List.tl (odds (List.tl (odds x))))))
odds (odds (odds x))
let (_x_0 : int list) = odds (List.tl (odds (odds (List.tl x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (odds (List.tl (odds x))))
let (_x_0 : int list) = odds x in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
let (_x_0 : int list) = odds (List.tl x) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
merge_sort (odds (odds (odds x)))
odds (List.tl (odds (List.tl (odds (odds (List.tl x))))))
odds (List.tl (odds x))
odds (List.tl (odds (List.tl (odds (odds x)))))
merge_sort (odds (List.tl (odds (odds (List.tl x)))))
odds (List.tl (List.tl (List.tl x)))
merge (merge_sort (odds x)) (merge_sort (odds (List.tl x)))
merge_sort (odds x)
let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (List.tl (odds x)))
odds (List.tl (odds (odds (odds x))))
odds (List.tl (List.tl (List.tl (odds (List.tl (odds x))))))
merge_sort (odds (odds (odds (List.tl x))))
let (_x_0 : int list) = odds (odds (List.tl x)) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (List.tl (List.tl x))))
merge_sort (odds (odds (List.tl (odds (List.tl x)))))
let (_x_0 : int list) = merge_sort (odds x) in let (_x_1 : int list) = merge_sort (odds (List.tl x)) in let (_x_2 : bool) = List.hd _x_1 <= List.hd _x_0 in let (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in let (_x_4 : int list) = if _x_2 then List.tl _x_1 else _x_1 in let (_x_5 : bool) = List.hd _x_4 <= List.hd _x_3 in merge (if _x_5 then _x_3 else (List.tl _x_3)) (if _x_5 then List.tl _x_4 else _x_4)
merge_sort (odds (odds (odds (List.tl (odds x)))))
let (_x_0 : int list) = odds (odds x) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (odds x)))
let (_x_0 : int list) = merge_sort (odds x) in let (_x_1 : int list) = merge_sort (odds (List.tl x)) in let (_x_2 : bool) = List.hd _x_1 <= List.hd _x_0 in let (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in let (_x_4 : int list) = if _x_2 then List.tl _x_1 else _x_1 in let (_x_5 : bool) = List.hd _x_4 <= List.hd _x_3 in let (_x_6 : int list) = if _x_5 then _x_3 else List.tl _x_3 in let (_x_7 : int list) = if _x_5 then List.tl _x_4 else _x_4 in let (_x_8 : bool) = List.hd _x_7 <= List.hd _x_6 in merge (if _x_8 then _x_6 else (List.tl _x_6)) (if _x_8 then List.tl _x_7 else _x_7)
odds (List.tl (List.tl (List.tl (List.tl (odds (List.tl x))))))
odds (odds (List.tl (odds (List.tl x))))
merge_sort x
odds (List.tl (List.tl (List.tl (List.tl (odds x)))))
odds (odds (odds (List.tl x)))
let (_x_0 : int list) = List.tl (List.tl (merge_sort x)) in is_sorted ((List.hd _x_0) :: (List.tl _x_0))
let (_x_0 : int list) = odds (List.tl (odds x)) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
let (_x_0 : int list) = List.tl (merge_sort x) in is_sorted ((List.hd _x_0) :: (List.tl _x_0))
merge_sort (odds (List.tl x))
odds (odds (List.tl (odds (List.tl (odds x)))))
odds (List.tl (List.tl (odds (List.tl x))))
merge_sort (odds (odds (odds (odds (List.tl x)))))
odds (List.tl (odds (List.tl x)))
odds (List.tl (List.tl (List.tl (odds (List.tl x)))))
let (_x_0 : int list) = List.tl (List.tl (List.tl (merge_sort x))) in is_sorted ((List.hd _x_0) :: (List.tl _x_0))
merge_sort (odds (List.tl (odds (odds x))))
odds (odds (odds (odds x)))
let (_x_0 : int list) = odds (List.tl (odds (odds x))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (odds (List.tl (odds x)))))

blocked

let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds (List.tl (odds x)))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (odds (odds (List.tl (odds (odds x))))))
odds (List.tl (List.tl (List.tl (odds (odds (List.tl (odds x)))))))
odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl x)))))))
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl x))))))))
odds (List.tl (odds (odds (List.tl (odds (odds (List.tl x)))))))
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl (odds (odds x))))))))
merge_sort (odds (odds (List.tl (odds (List.tl (odds (odds (List.tl x))))))))
merge_sort (odds (List.tl (odds (odds (List.tl (odds (odds x)))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (odds x)))))))
odds (List.tl (List.tl (List.tl (odds (odds (odds x))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl (odds x))))))))
odds (odds (odds (List.tl (odds (List.tl x)))))
odds (List.tl (odds (odds (odds (List.tl (odds x))))))
let (_x_0 : int list) = odds (List.tl (odds (odds x))) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (odds (odds (odds (List.tl (odds x)))))
odds (List.tl (List.tl (List.tl (odds (odds (odds (List.tl x)))))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds x)))) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
let (_x_0 : int list) = odds (odds (odds (odds x))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
merge_sort (odds (List.tl (odds (List.tl (odds (odds (List.tl (odds x))))))))
merge_sort (odds (odds (List.tl (odds (List.tl (odds (odds x)))))))
odds (List.tl (odds (odds (List.tl (odds (List.tl x))))))
odds (List.tl (List.tl (List.tl (odds (List.tl (odds (odds (List.tl x))))))))
let (_x_0 : int list) = odds (odds (odds x)) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (odds (odds (odds (odds (List.tl x)))))
merge_sort (odds (odds (odds (odds (odds (List.tl x))))))
odds (List.tl (odds (List.tl (odds (odds (List.tl (odds x)))))))
merge_sort (odds (odds (odds (odds (odds x)))))
let (_x_0 : int list) = odds (odds (List.tl x)) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in merge (if _x_6 then _x_4 else (List.tl _x_4)) (if _x_6 then List.tl _x_5 else _x_5)
let (_x_0 : int list) = odds (List.tl (odds (odds (List.tl x)))) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
merge_sort (odds (List.tl (odds (odds (List.tl (odds (List.tl (odds x))))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (odds x))))))))
let (_x_0 : int list) = odds (List.tl x) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in let (_x_7 : int list) = if _x_6 then _x_4 else List.tl _x_4 in let (_x_8 : int list) = if _x_6 then List.tl _x_5 else _x_5 in let (_x_9 : bool) = List.hd _x_8 <= List.hd _x_7 in merge (if _x_9 then _x_7 else (List.tl _x_7)) (if _x_9 then List.tl _x_8 else _x_8)
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl (odds x)))))))))
odds (List.tl (odds (List.tl (odds (odds (odds x))))))
odds (odds (List.tl (odds (odds (odds (List.tl x))))))
let (_x_0 : int list) = odds (odds (List.tl (odds (List.tl (odds x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (List.tl (odds (odds (odds x)))))
odds (List.tl (List.tl (List.tl (odds (List.tl (odds (odds x)))))))
let (_x_0 : int list) = odds (odds (List.tl (odds (List.tl x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (odds (List.tl (odds (odds (odds (List.tl x)))))))
merge_sort (odds (List.tl (odds (odds (List.tl (odds (List.tl x)))))))
merge_sort (odds (odds (List.tl (odds (List.tl (odds (List.tl (odds x))))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))))))
merge_sort (odds (odds (odds (List.tl (odds (List.tl (odds x)))))))
odds (List.tl (List.tl (odds (odds (odds (List.tl x))))))
odds (List.tl (List.tl (odds (odds (odds x)))))
odds (List.tl (List.tl (List.tl (List.tl (odds (List.tl (odds x)))))))
merge_sort (odds (List.tl (odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))))))
let (_x_0 : int list) = odds (odds (List.tl (odds (odds x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (odds (List.tl (odds (odds (List.tl x))))))
let (_x_0 : int list) = odds (List.tl (odds (odds (List.tl (odds x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (odds (List.tl (odds (odds x)))))
let (_x_0 : int list) = List.tl (List.tl (List.tl (List.tl (merge_sort x)))) in is_sorted ((List.hd _x_0) :: (List.tl _x_0))
let (_x_0 : int list) = odds (odds x) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in merge (if _x_6 then _x_4 else (List.tl _x_4)) (if _x_6 then List.tl _x_5 else _x_5)
merge_sort (odds (odds (odds (List.tl (odds (odds x))))))
odds (List.tl (odds (List.tl (odds (List.tl (odds (odds (List.tl x))))))))
odds (odds (List.tl (odds (List.tl (odds (List.tl (odds x)))))))
merge_sort (odds (odds (List.tl (odds (List.tl (odds (List.tl x)))))))
odds (List.tl (List.tl (List.tl (List.tl (odds (odds x))))))
merge_sort (odds (odds (odds (List.tl (odds (odds (List.tl x)))))))
odds (odds (odds (odds (odds x))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl x))) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
odds (List.tl (List.tl (List.tl (List.tl (odds (odds (List.tl x)))))))
let (_x_0 : int list) = odds (List.tl (odds (odds (odds x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (List.tl (odds (List.tl (odds (odds x))))))
odds (List.tl (List.tl (List.tl (odds (List.tl (odds (List.tl (odds x))))))))
odds (List.tl (List.tl (odds (List.tl (odds (List.tl (odds x)))))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds (odds x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
merge_sort (odds (odds (odds (odds (List.tl (odds x))))))
odds (List.tl (odds (List.tl (odds (List.tl (odds (odds x)))))))
odds (odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))))
merge_sort (odds (List.tl (odds (odds (odds (List.tl (odds x)))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))))
odds (List.tl (List.tl (odds (List.tl (odds (odds x))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds (odds (List.tl x))))))))
let (_x_0 : int list) = odds x in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in let (_x_7 : int list) = if _x_6 then _x_4 else List.tl _x_4 in let (_x_8 : int list) = if _x_6 then List.tl _x_5 else _x_5 in let (_x_9 : bool) = List.hd _x_8 <= List.hd _x_7 in merge (if _x_9 then _x_7 else (List.tl _x_7)) (if _x_9 then List.tl _x_8 else _x_8)
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl x)))))))))
odds (List.tl (List.tl (List.tl (odds (List.tl (odds (List.tl x)))))))
odds (odds (List.tl (odds (odds (List.tl (odds x))))))
let (_x_0 : int list) = odds (odds (odds (odds (List.tl x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (odds (odds (odds (odds (List.tl x))))))
merge_sort (odds (odds (odds (List.tl (odds (List.tl x))))))
odds (List.tl (odds (odds (odds (odds x)))))
let (_x_0 : int list) = odds (odds (List.tl (odds (odds (List.tl x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (odds (List.tl (odds (odds (List.tl x)))))))
merge_sort (odds (List.tl (odds (odds (odds (odds x))))))
merge_sort (odds (List.tl (odds (List.tl (odds (odds (odds (List.tl x))))))))
merge_sort (odds (odds (List.tl (odds (odds (List.tl (odds x)))))))
merge_sort (odds (List.tl (odds (odds (odds (odds (List.tl x)))))))
let (_x_0 : int list) = odds (odds (List.tl (odds x))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (List.tl (List.tl (odds (odds (List.tl (odds x))))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (List.tl (odds (List.tl (odds (List.tl x))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds (odds x)))))))
let (_x_0 : int list) = odds (odds (odds (List.tl (odds x)))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
odds (odds (odds (List.tl (odds (List.tl (odds x))))))
let (_x_0 : int list) = merge_sort (odds x) in let (_x_1 : int list) = merge_sort (odds (List.tl x)) in let (_x_2 : bool) = List.hd _x_1 <= List.hd _x_0 in let (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in let (_x_4 : int list) = List.tl _x_3 in let (_x_5 : int list) = if _x_2 then List.tl _x_1 else _x_1 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_3 in let (_x_7 : int list) = List.tl (if _x_6 then … else _x_4) in let (_x_8 : int list) = List.tl _x_5 in let (_x_9 : int list) = if _x_6 then _x_8 else _x_5 in let (_x_10 : int list) = if _x_6 then _x_3 else _x_4 in let (_x_11 : bool) = List.hd _x_9 <= List.hd _x_10 in let (_x_12 : bool) = List.hd (if _x_11 then List.tl _x_9 else _x_9) <= List.hd (if _x_11 then _x_10 else (List.tl _x_10)) in let (_x_13 : int list) = List.tl (if _x_6 then _x_8 else …) in merge (if _x_12 then if _x_11 then if _x_6 then … else _x_4 else _x_7 else (List.tl (if _x_11 then if _x_6 then … else _x_4 else _x_7))) (if _x_12 then List.tl (if _x_11 then _x_13 else if _x_6 then _x_8 else …) else if _x_11 then _x_13 else if _x_6 then _x_8 else …)
let (_x_0 : int list) = odds (odds (odds (List.tl x))) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in merge (if _x_3 then _x_1 else (List.tl _x_1)) (if _x_3 then List.tl _x_2 else _x_2)
let (_x_0 : int list) = odds (List.tl (odds (odds (odds (List.tl x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
merge_sort (odds (odds (List.tl (odds (odds (odds x))))))
odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl (odds x))))))))
let (_x_0 : int list) = odds (List.tl (odds x)) in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in let (_x_3 : bool) = List.hd _x_2 <= List.hd _x_1 in let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in let (_x_6 : bool) = List.hd _x_5 <= List.hd _x_4 in merge (if _x_6 then _x_4 else (List.tl _x_4)) (if _x_6 then List.tl _x_5 else _x_5)
odds (List.tl (odds (odds (List.tl (odds (List.tl (odds x)))))))
let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds (List.tl x))))) in merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))
merge_sort (odds (List.tl (odds (odds (List.tl (odds (odds (List.tl x))))))))
odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl x))))))))
odds (List.tl (List.tl (odds (List.tl (odds (List.tl x))))))
merge_sort (odds (List.tl (odds (List.tl (odds (odds (odds x)))))))
merge_sort (odds (odds (List.tl (odds (odds (odds (List.tl x)))))))

digraph "call graph" {
goal [label="not (is_sorted (merge_sort x))",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
goal -> call_9 [label="calls"];
goal -> call_10 [label="calls"];
call_9 [label="merge_sort x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_9 -> call_79 [label="calls"];
call_9 -> call_77 [label="calls"];
call_9 -> call_80 [label="calls"];
call_9 -> call_76 [label="calls"];
call_9 -> call_78 [label="calls"];
call_10 [label="is_sorted (merge_sort x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_10 -> call_276 [label="calls"];
call_79 [label="merge_sort (odds (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_79 -> call_544 [label="calls"];
call_79 -> call_546 [label="calls"];
call_79 -> call_543 [label="calls"];
call_79 -> call_545 [label="calls"];
call_79 -> call_542 [label="calls"];
call_77 [label="merge_sort (odds x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_77 -> call_951 [label="calls"];
call_77 -> call_953 [label="calls"];
call_77 -> call_952 [label="calls"];
call_77 -> call_950 [label="calls"];
call_77 -> call_949 [label="calls"];
call_80 [label="merge (merge_sort (odds x)) (merge_sort (odds (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_80 -> call_1206 [label="calls"];
call_80 -> call_1206 [label="calls"];
call_76 [label="odds x",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_76 -> call_725 [label="calls"];
call_78 [label="odds (List.tl x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_78 -> call_452 [label="calls"];
call_276 [label="let (_x_0 : int list) = List.tl (merge_sort x) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_276 -> call_1754 [label="calls"];
call_544 [label="odds (List.tl (odds (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_544 -> call_2006 [label="calls"];
call_546 [label="let (_x_0 : int list) = odds (List.tl x) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_546 -> call_3322 [label="calls"];
call_546 -> call_3322 [label="calls"];
call_543 [label="merge_sort (odds (odds (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_543 -> call_2460 [label="calls"];
call_543 -> call_2464 [label="calls"];
call_543 -> call_2461 [label="calls"];
call_543 -> call_2463 [label="calls"];
call_543 -> call_2462 [label="calls"];
call_545 [label="merge_sort (odds (List.tl (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_545 -> call_2109 [label="calls"];
call_545 -> call_2110 [label="calls"];
call_545 -> call_2112 [label="calls"];
call_545 -> call_2111 [label="calls"];
call_545 -> call_2113 [label="calls"];
call_542 [label="odds (odds (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_542 -> call_943 [label="calls"];
call_951 [label="odds (List.tl (odds x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_951 -> call_3677 [label="calls"];
call_953 [label="let (_x_0 : int list) = odds x in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_953 -> call_4634 [label="calls"];
call_953 -> call_4634 [label="calls"];
call_952 [label="merge_sort (odds (List.tl (odds x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_952 -> call_3991 [label="calls"];
call_952 -> call_3987 [label="calls"];
call_952 -> call_3989 [label="calls"];
call_952 -> call_3990 [label="calls"];
call_952 -> call_3988 [label="calls"];
call_950 [label="merge_sort (odds (odds x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_950 -> call_4448 [label="calls"];
call_950 -> call_4449 [label="calls"];
call_950 -> call_4446 [label="calls"];
call_950 -> call_4445 [label="calls"];
call_950 -> call_4447 [label="calls"];
call_949 [label="odds (odds x)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_949 -> call_4332 [label="calls"];
call_1206 [label="let (_x_0 : int list) = merge_sort (odds x) in\llet (_x_1 : int list) = merge_sort (odds (List.tl x)) in\llet (_x_2 : bool) = List.hd _x_1 \<= List.hd _x_0 in\lmerge (if _x_2 then _x_0 else (List.tl _x_0))\l(if _x_2 then List.tl _x_1 else _x_1)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1206 -> call_2624 [label="calls"];
call_1206 -> call_2624 [label="calls"];
call_725 [label="odds (List.tl (List.tl x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_725 -> call_815 [label="calls"];
call_452 [label="odds (List.tl (List.tl (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_452 -> call_1583 [label="calls"];
call_1754 [label="let (_x_0 : int list) = List.tl (List.tl (merge_sort x)) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1754 -> call_7159 [label="calls"];
call_2006 [label="odds (List.tl (List.tl (List.tl (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2006 -> call_6275 [label="calls"];
call_3322 [label="let (_x_0 : int list) = odds (List.tl x) in\llet (_x_1 : int list) = merge_sort (odds _x_0) in\llet (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\llet (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\lmerge (if _x_3 then _x_1 else (List.tl _x_1))\l(if _x_3 then List.tl _x_2 else _x_2)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3322 -> call_7512 [label="calls"];
call_3322 -> call_7512 [label="calls"];
call_2460 [label="odds (odds (odds (List.tl x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2460 -> call_7114 [label="calls"];
call_2464 [label="let (_x_0 : int list) = odds (odds (List.tl x)) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2464 -> call_8595 [label="calls"];
call_2464 -> call_8595 [label="calls"];
call_2461 [label="merge_sort (odds (odds (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2461 -> call_8347 [label="calls"];
call_2461 -> call_8348 [label="calls"];
call_2461 -> call_8350 [label="calls"];
call_2461 -> call_8346 [label="calls"];
call_2461 -> call_8349 [label="calls"];
call_2463 [label="merge_sort (odds (List.tl (odds (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2463 -> call_6893 [label="calls"];
call_2463 -> call_6895 [label="calls"];
call_2463 -> call_6894 [label="calls"];
call_2463 -> call_6892 [label="calls"];
call_2463 -> call_6891 [label="calls"];
call_2462 [label="odds (List.tl (odds (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2462 -> call_6692 [label="calls"];
call_2109 [label="odds (odds (List.tl (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2109 -> call_19707 [label="calls"];
call_2110 [label="merge_sort (odds (odds (List.tl (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2110 -> call_24016 [label="calls"];
call_2110 -> call_24018 [label="calls"];
call_2110 -> call_24019 [label="calls"];
call_2110 -> call_24017 [label="calls"];
call_2110 -> call_24015 [label="calls"];
call_2112 [label="merge_sort (odds (List.tl (odds (List.tl (odds (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2112 -> call_8325 [label="calls"];
call_2112 -> call_8332 [label="calls"];
call_2112 -> call_8339 [label="calls"];
call_2112 -> call_3673 [label="calls"];
call_2112 -> call_10306 [label="calls"];
call_2111 [label="odds (List.tl (odds (List.tl (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2111 -> call_12099 [label="calls"];
call_2113 [label="let (_x_0 : int list) = odds (List.tl (odds (List.tl x))) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2113 -> call_13355 [label="calls"];
call_2113 -> call_13355 [label="calls"];
call_943 [label="odds (List.tl (List.tl (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_943 -> call_4952 [label="calls"];
call_3677 [label="odds (List.tl (List.tl (List.tl (odds x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3677 -> call_10319 [label="calls"];
call_4634 [label="let (_x_0 : int list) = odds x in\llet (_x_1 : int list) = merge_sort (odds _x_0) in\llet (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\llet (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\lmerge (if _x_3 then _x_1 else (List.tl _x_1))\l(if _x_3 then List.tl _x_2 else _x_2)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4634 -> call_15502 [label="calls"];
call_4634 -> call_15502 [label="calls"];
call_3991 [label="let (_x_0 : int list) = odds (List.tl (odds x)) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3991 -> call_12929 [label="calls"];
call_3991 -> call_12929 [label="calls"];
call_3987 [label="odds (odds (List.tl (odds x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3987 -> call_3030 [label="calls"];
call_3989 [label="odds (List.tl (odds (List.tl (odds x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3989 -> call_435 [label="calls"];
call_3990 [label="merge_sort (odds (List.tl (odds (List.tl (odds x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3990 -> call_11914 [label="calls"];
call_3990 -> call_11918 [label="calls"];
call_3990 -> call_11915 [label="calls"];
call_3990 -> call_11917 [label="calls"];
call_3990 -> call_11916 [label="calls"];
call_3988 [label="merge_sort (odds (odds (List.tl (odds x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_3988 -> call_12315 [label="calls"];
call_3988 -> call_12312 [label="calls"];
call_3988 -> call_12311 [label="calls"];
call_3988 -> call_12314 [label="calls"];
call_3988 -> call_12313 [label="calls"];
call_4448 [label="merge_sort (odds (List.tl (odds (odds x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4448 -> call_1995 [label="calls"];
call_4448 -> call_12918 [label="calls"];
call_4448 -> call_9187 [label="calls"];
call_4448 -> call_5236 [label="calls"];
call_4448 -> call_5237 [label="calls"];
call_4449 [label="let (_x_0 : int list) = odds (odds x) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4449 -> call_15263 [label="calls"];
call_4449 -> call_15263 [label="calls"];
call_4446 [label="merge_sort (odds (odds (odds x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4446 -> call_15039 [label="calls"];
call_4446 -> call_15041 [label="calls"];
call_4446 -> call_15040 [label="calls"];
call_4446 -> call_15043 [label="calls"];
call_4446 -> call_15042 [label="calls"];
call_4445 [label="odds (odds (odds x))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4445 -> call_14811 [label="calls"];
call_4447 [label="odds (List.tl (odds (odds x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4447 -> call_13366 [label="calls"];
call_4332 [label="odds (List.tl (List.tl (odds x)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_4332 -> call_5260 [label="calls"];
call_2624 [label="let (_x_0 : int list) = merge_sort (odds x) in\llet (_x_1 : int list) = merge_sort (odds (List.tl x)) in\llet (_x_2 : bool) = List.hd _x_1 \<= List.hd _x_0 in\llet (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in\llet (_x_4 : int list) = if _x_2 then List.tl _x_1 else _x_1 in\llet (_x_5 : bool) = List.hd _x_4 \<= List.hd _x_3 in\lmerge (if _x_5 then _x_3 else (List.tl _x_3))\l(if _x_5 then List.tl _x_4 else _x_4)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_2624 -> call_9198 [label="calls"];
call_2624 -> call_9198 [label="calls"];
call_815 [label="odds (List.tl (List.tl (List.tl (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_815 -> call_1909 [label="calls"];
call_1583 [label="odds (List.tl (List.tl (List.tl (List.tl (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_1583 -> call_5255 [label="calls"];
call_7159 [label="let (_x_0 : int list) = List.tl (List.tl (List.tl (merge_sort x))) in\lis_sorted ((List.hd _x_0) :: (List.tl _x_0))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_7159 -> call_26145 [label="calls"];
call_6275 [label="odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl x)))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6275 -> call_26098 [label="calls"];
call_7512 [label="let (_x_0 : int list) = odds (List.tl x) in\llet (_x_1 : int list) = merge_sort (odds _x_0) in\llet (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\llet (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\llet (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in\llet (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in\llet (_x_6 : bool) = List.hd _x_5 \<= List.hd _x_4 in\lmerge (if _x_6 then _x_4 else (List.tl _x_4))\l(if _x_6 then List.tl _x_5 else _x_5)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_7512 -> call_26023 [label="calls"];
call_7512 -> call_26023 [label="calls"];
call_7114 [label="odds (List.tl (List.tl (odds (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_7114 -> call_22866 [label="calls"];
call_8595 [label="let (_x_0 : int list) = odds (odds (List.tl x)) in\llet (_x_1 : int list) = merge_sort (odds _x_0) in\llet (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\llet (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\lmerge (if _x_3 then _x_1 else (List.tl _x_1))\l(if _x_3 then List.tl _x_2 else _x_2)",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8595 -> call_33433 [label="calls"];
call_8595 -> call_33433 [label="calls"];
call_8347 [label="merge_sort (odds (odds (odds (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8347 -> call_29187 [label="calls"];
call_8347 -> call_29174 [label="calls"];
call_8347 -> call_29177 [label="calls"];
call_8347 -> call_29179 [label="calls"];
call_8347 -> call_29178 [label="calls"];
call_8348 [label="odds (List.tl (odds (odds (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8348 -> call_28366 [label="calls"];
call_8350 [label="let (_x_0 : int list) = odds (odds (odds (List.tl x))) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8350 -> call_29670 [label="calls"];
call_8350 -> call_29670 [label="calls"];
call_8346 [label="odds (odds (odds (odds (List.tl x))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8346 -> call_26019 [label="calls"];
call_8349 [label="merge_sort (odds (List.tl (odds (odds (odds (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_8349 -> call_29425 [label="calls"];
call_8349 -> call_29428 [label="calls"];
call_8349 -> call_29427 [label="calls"];
call_8349 -> call_29426 [label="calls"];
call_8349 -> call_29424 [label="calls"];
call_6893 [label="odds (List.tl (odds (List.tl (odds (odds (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6893 -> call_4624 [label="calls"];
call_6895 [label="let (_x_0 : int list) = odds (List.tl (odds (odds (List.tl x)))) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6895 -> call_27836 [label="calls"];
call_6895 -> call_27836 [label="calls"];
call_6894 [label="merge_sort (odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6894 -> call_24286 [label="calls"];
call_6894 -> call_12902 [label="calls"];
call_6894 -> call_15491 [label="calls"];
call_6894 -> call_14745 [label="calls"];
call_6894 -> call_14759 [label="calls"];
call_6892 [label="merge_sort (odds (odds (List.tl (odds (odds (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6892 -> call_26087 [label="calls"];
call_6892 -> call_26078 [label="calls"];
call_6892 -> call_26109 [label="calls"];
call_6892 -> call_26110 [label="calls"];
call_6892 -> call_26088 [label="calls"];
call_6891 [label="odds (odds (List.tl (odds (odds (List.tl x)))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6891 -> call_7157 [label="calls"];
call_6692 [label="odds (List.tl (List.tl (List.tl (odds (odds (List.tl x))))))",shape=box,style=filled,color="green",fontname="courier",fontsize=14];
call_6692 -> call_24296 [label="calls"];
call_19707 [label="odds (List.tl (List.tl (odds (List.tl (odds (List.tl x))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_24016 [label="merge_sort (odds (odds (odds (List.tl (odds (List.tl x))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_24018 [label="merge_sort (odds (List.tl (odds (odds (List.tl (odds (List.tl x)))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_24019 [label="let (_x_0 : int list) = odds (odds (List.tl (odds (List.tl x)))) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_24017 [label="odds (List.tl (odds (odds (List.tl (odds (List.tl x))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_24015 [label="odds (odds (odds (List.tl (odds (List.tl x)))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_8325 [label="let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds (List.tl x))))) in\lmerge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_8332 [label="odds (odds (List.tl (odds (List.tl (odds (List.tl x))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_8339 [label="merge_sort (odds (odds (List.tl (odds (List.tl (odds (List.tl x)))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_3673 [label="merge_sort\l(odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl x))))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_10306 [label="odds (List.tl (odds (List.tl (odds (List.tl (odds (List.tl x)))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_12099 [label="odds (List.tl (List.tl (List.tl (odds (List.tl (odds (List.tl x)))))))",shape=box,style=filled,color="yellow",fontname="courier",fontsize=14];
call_13355 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_4952 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_10319 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15502 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12929 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_3030 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_435 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_11914 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_11918 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_11915 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_11917 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_11916 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12315 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12312 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12311 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12314 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12313 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_1995 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12918 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_9187 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_5236 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_5237 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15263 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15039 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15041 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15040 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15043 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15042 [label="\<…\> (skipped 5)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_14811 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_13366 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_5260 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_9198 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_1909 [label="\<…\> (skipped 2)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_5255 [label="\<…\> (skipped 1)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26145 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26098 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26023 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_22866 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_33433 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29187 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29174 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29177 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29179 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29178 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_28366 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29670 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26019 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29425 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29428 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29427 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29426 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_29424 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_4624 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_27836 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_24286 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_12902 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_15491 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_14745 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_14759 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26087 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26078 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26109 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26110 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_26088 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_7157 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
call_24296 [label="\<…\> (skipped 0)",shape=box,style=filled,color="cyan",fontname="courier",fontsize=14];
}

proof attempt

ground_instances	100
definitions	0
inductions	0
search_time	1.917s

Expand

start[1.917s] is_sorted (merge_sort ( :var_0: ))

unroll
expr
(merge_sort_56 x_79)
expansions
unroll
expr
(is_sorted_64 (merge_sort_56 x_79))
expansions
unroll
expr
(odds_1824 (|get.::.1_1823| x_79))
expansions

unroll

expr	(merge_sort_56 (odds_1824 (\|get.::.1_1823\| x_79)))
expansions

unroll
expr
(odds_1824 x_79)
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))
expansions

unroll
expr
(merge_sort_56 (odds_1824 x_79))
expansions

unroll

expr	(merge_14 (merge_sort_56 (odds_1824 x_79)) (merge_sort_56 (odds_1824 (\|get.::.1_1823\| x_79…
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79))))
expansions

unroll

expr	(let ((a!1 (\|::_3\| (\|get.::.0_1822\| (\|get.::.1_1823\| (merge_sort_56 x_79))) (\|get…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))))) (odds_18…
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79))))
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 a!1))
expansions

unroll

expr	(odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))
expansions

unroll

expr	(merge_sort_56 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79))))
expansions

unroll

expr	(let ((a!1 (\|get.::.0_1822\| (merge_sort_56 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!4 (\|get.::…
expansions

unroll

expr	(let ((a!1 (merge_sort_56 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!2 (odds_1824 (\|g…
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))
expansions

unroll

expr	(merge_sort_56 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))
expansions

unroll
expr
(odds_1824 (odds_1824 x_79))
expansions

unroll

expr	(merge_sort_56 (odds_1824 (odds_1824 x_79)))
expansions

unroll

expr	(let ((a!1 (merge_sort_56 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_14 (merge_sort_…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 a!1…
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 x_79))))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))))) (odds_18…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79))))
expansions

unroll

expr	(let ((a!1 (\|get.::.0_1822\| (\|get.::.1_1823\| (\|get.::.1_1823\| (merge_sort_56 x_79))))) (a!2 (\|…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79))))) (a!2 (merge_sort_…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 a!1))
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!2 (\|get.::.1_1823\| (…
expansions

unroll

expr	(let ((a!1 (\|get.::.0_1822\| (merge_sort_56 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!3 (\|get.::…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))))) (odds_18…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 a!1…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 a!1))
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))) (a!2 (\|get.::.1_1823\| (…
expansions

unroll

expr	(odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79))))
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (merge_sort_56 a!1))
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(odds_1824 (odds_1824 (odds_1824 x_79)))
expansions

unroll

expr	(merge_sort_56 (odds_1824 (odds_1824 (odds_1824 x_79))))
expansions

unroll

expr	(let ((a!1 (merge_sort_56 (odds_1824 (odds_1824 (odds_1824 x_79))))) (a!2 (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (merge_sort_56 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))) (a!2 (\|get.::.0_182…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))))) (odds_18…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (odds_182…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_14 (merge_sor…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (merge_sort_56 x_79)))))) (is_sorted…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (let ((a!2 (merge_sort…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|get.::.1_1823…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 (\|g…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79)))))) (merge_14 (merge_sort_56 (…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| x_79))))) (a!2 (merge_sort_…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!2 (odds_1824 (…
expansions

unroll

expr	(let ((a!1 (\|get.::.0_1822\| (merge_sort_56 (odds_1824 (\|get.::.1_1823\| x_79))))) (a!3 (\|get.::…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|g…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| (\|get.::.1_1823\| x_79)))))) (let ((a!2…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (odds_1824 (\|get.::.1_1823…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|get.::.…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (odds_1824 x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79)))))) (merge_14 (merge_sort_56 (…
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (odds_1824 (odds_1824 x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(odds_1824 (odds_1824 (odds_1824 (odds_1824 x_79))))
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (odds_1824 x_79)))))) (merge_sort_56 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (odds_182…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (odds_1824 (odds_1824 x_79))))) (a!2 (\|get.::.1_1823\| (odds_1…
expansions

unroll

expr	(let ((a!1 (odds_1824 (\|get.::.1_1823\| (odds_1824 (odds_1824 x_79))))) (a!2 (merge_sort_56 (od…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 (\|get.::.1_1823…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 (odds…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (odds_1824 a!1))
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))) (a!2 (odds_1824 (…
expansions

unroll

expr	(let ((a!1 (merge_sort_56 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79))))) (a!2 (\|get.::.0_182…
expansions

unroll

expr	(let ((a!1 (odds_1824 (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (merge_sort_56 (odds_1824 …
expansions

unroll

expr	(let ((a!1 (\|get.::.1_1823\| (odds_1824 (\|get.::.1_1823\| (odds_1824 x_79)))))) (let ((a!2 (merge_sort…
expansions

digraph "proof" {
p_202 [label="Start (is_sorted (merge_sort ( :var_0: )) :time 1.917s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_202 -> p_201 [label=""];
p_201 [label="Unroll ([merge_sort x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_201 -> p_200 [label=""];
p_200 [label="Unroll ([is_sorted (merge_sort x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_200 -> p_199 [label=""];
p_199 [label="Unroll ([odds (List.tl x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_199 -> p_198 [label=""];
p_198 [label="Unroll ([merge_sort (odds (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_198 -> p_197 [label=""];
p_197 [label="Unroll ([odds x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_197 -> p_196 [label=""];
p_196 [label="Unroll ([odds (List.tl (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_196 -> p_195 [label=""];
p_195 [label="Unroll ([merge_sort (odds x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_195 -> p_194 [label=""];
p_194 [label="Unroll ([merge (merge_sort (odds x)) (merge_sort (odds (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_194 -> p_193 [label=""];
p_193 [label="Unroll ([odds (List.tl (List.tl (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_193 -> p_192 [label=""];
p_192 [label="Unroll ([let (_x_0 : int list) = List.tl (merge_sort x) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_192 -> p_191 [label=""];
p_191 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_191 -> p_190 [label=""];
p_190 [label="Unroll ([odds (List.tl (odds (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_190 -> p_189 [label=""];
p_189 [label="Unroll ([merge_sort (odds (List.tl (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_189 -> p_188 [label=""];
p_188 [label="Unroll ([odds (odds (List.tl x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_188 -> p_187 [label=""];
p_187 [label="Unroll ([merge_sort (odds (odds (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_187 -> p_186 [label=""];
p_186 [label="Unroll ([let (_x_0 : int list) = merge_sort (odds x) in\l         let (_x_1 : int list) = merge_sort (odds (List.tl x)) in\l         let (_x_2 : bool) = List.hd _x_1 \<= List.hd _x_0 in\l         merge (if _x_2 then _x_0 else (List.tl _x_0))\l         (if _x_2 then List.tl _x_1 else _x_1)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_186 -> p_185 [label=""];
p_185 [label="Unroll ([let (_x_0 : int list) = odds (List.tl x) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_185 -> p_184 [label=""];
p_184 [label="Unroll ([odds (List.tl (odds x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_184 -> p_183 [label=""];
p_183 [label="Unroll ([merge_sort (odds (List.tl (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_183 -> p_182 [label=""];
p_182 [label="Unroll ([odds (odds x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_182 -> p_181 [label=""];
p_181 [label="Unroll ([merge_sort (odds (odds x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_181 -> p_180 [label=""];
p_180 [label="Unroll ([let (_x_0 : int list) = odds x in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_180 -> p_179 [label=""];
p_179 [label="Unroll ([odds (List.tl (List.tl (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_179 -> p_178 [label=""];
p_178 [label="Unroll ([odds (List.tl (List.tl (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_178 -> p_177 [label=""];
p_177 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_177 -> p_176 [label=""];
p_176 [label="Unroll ([odds (List.tl (List.tl (List.tl (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_176 -> p_175 [label=""];
p_175 [label="Unroll ([odds (List.tl (odds (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_175 -> p_174 [label=""];
p_174 [label="Unroll ([merge_sort (odds (List.tl (odds (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_174 -> p_173 [label=""];
p_173 [label="Unroll ([odds (odds (odds (List.tl x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_173 -> p_172 [label=""];
p_172 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (merge_sort x)) in\l         is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_172 -> p_171 [label=""];
p_171 [label="Unroll ([let (_x_0 : int list) = odds (List.tl x) in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         merge (if _x_3 then _x_1 else (List.tl _x_1))\l         (if _x_3 then List.tl _x_2 else _x_2)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_171 -> p_170 [label=""];
p_170 [label="Unroll ([merge_sort (odds (odds (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_170 -> p_169 [label=""];
p_169 [label="Unroll ([let (_x_0 : int list) = odds (odds (List.tl x)) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_169 -> p_168 [label=""];
p_168 [label="Unroll ([let (_x_0 : int list) = merge_sort (odds x) in\l         let (_x_1 : int list) = merge_sort (odds (List.tl x)) in\l         let (_x_2 : bool) = List.hd _x_1 \<= List.hd _x_0 in\l         let (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in\l         let (_x_4 : int list) = if _x_2 then List.tl _x_1 else _x_1 in\l         let (_x_5 : bool) = List.hd _x_4 \<= List.hd _x_3 in\l         merge (if _x_5 then _x_3 else (List.tl _x_3))\l         (if _x_5 then List.tl _x_4 else _x_4)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_168 -> p_167 [label=""];
p_167 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_167 -> p_166 [label=""];
p_166 [label="Unroll ([odds (List.tl (List.tl (List.tl (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_166 -> p_165 [label=""];
p_165 [label="Unroll ([odds (List.tl (odds (List.tl (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_165 -> p_164 [label=""];
p_164 [label="Unroll ([merge_sort (odds (List.tl (odds (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_164 -> p_163 [label=""];
p_163 [label="Unroll ([odds (odds (List.tl (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_163 -> p_162 [label=""];
p_162 [label="Unroll ([odds (List.tl (odds (List.tl (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_162 -> p_161 [label=""];
p_161 [label="Unroll ([merge_sort (odds (odds (List.tl (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_161 -> p_160 [label=""];
p_160 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds x)) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_160 -> p_159 [label=""];
p_159 [label="Unroll ([odds (List.tl (odds (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_159 -> p_158 [label=""];
p_158 [label="Unroll ([merge_sort (odds (List.tl (odds (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_158 -> p_157 [label=""];
p_157 [label="Unroll ([merge_sort (odds (List.tl (odds (List.tl (odds (List.tl x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_157 -> p_156 [label=""];
p_156 [label="Unroll ([odds (odds (odds x))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_156 -> p_155 [label=""];
p_155 [label="Unroll ([merge_sort (odds (odds (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_155 -> p_154 [label=""];
p_154 [label="Unroll ([let (_x_0 : int list) = odds (odds x) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_154 -> p_153 [label=""];
p_153 [label="Unroll ([let (_x_0 : int list) = odds x in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         merge (if _x_3 then _x_1 else (List.tl _x_1))\l         (if _x_3 then List.tl _x_2 else _x_2)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_153 -> p_152 [label=""];
p_152 [label="Unroll ([odds (odds (List.tl (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_152 -> p_151 [label=""];
p_151 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_151 -> p_150 [label=""];
p_150 [label="Unroll ([odds\l         (List.tl\l          (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x)))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_150 -> p_149 [label=""];
p_149 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl (odds (List.tl x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_149 -> p_148 [label=""];
p_148 [label="Unroll ([odds (List.tl (List.tl (odds (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_148 -> p_147 [label=""];
p_147 [label="Unroll ([merge_sort (odds (odds (List.tl (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_147 -> p_146 [label=""];
p_146 [label="Unroll ([odds (List.tl (List.tl (List.tl (odds (odds (List.tl x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_146 -> p_145 [label=""];
p_145 [label="Unroll ([odds (List.tl (odds (List.tl (odds (odds (List.tl x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_145 -> p_144 [label=""];
p_144 [label="Unroll ([merge_sort\l         (odds (List.tl (odds (List.tl (odds (odds (List.tl x)))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_144 -> p_143 [label=""];
p_143 [label="Unroll ([odds (odds (List.tl (odds (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_143 -> p_142 [label=""];
p_142 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds (List.tl x))) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_142 -> p_141 [label=""];
p_141 [label="Unroll ([let (_x_0 : int list) = List.tl (List.tl (List.tl (merge_sort x)))\l         in is_sorted ((List.hd _x_0) :: (List.tl _x_0))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_141 -> p_140 [label=""];
p_140 [label="Unroll ([merge_sort (odds (odds (List.tl (odds (odds (List.tl x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_140 -> p_139 [label=""];
p_139 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds (odds (List.tl x)))) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_139 -> p_138 [label=""];
p_138 [label="Unroll ([odds (List.tl (odds (odds (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_138 -> p_137 [label=""];
p_137 [label="Unroll ([odds\l         (List.tl (List.tl (List.tl (List.tl (List.tl (odds (List.tl x)))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_137 -> p_136 [label=""];
p_136 [label="Unroll ([merge_sort (odds (List.tl (odds (odds (odds (List.tl x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_136 -> p_135 [label=""];
p_135 [label="Unroll ([odds (odds (odds (odds (List.tl x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_135 -> p_134 [label=""];
p_134 [label="Unroll ([merge_sort (odds (odds (odds (odds (List.tl x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_134 -> p_133 [label=""];
p_133 [label="Unroll ([let (_x_0 : int list) = odds (odds (odds (List.tl x))) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_133 -> p_132 [label=""];
p_132 [label="Unroll ([let (_x_0 : int list) = odds (List.tl x) in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in\l         let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in\l         let (_x_6 : bool) = List.hd _x_5 \<= List.hd _x_4 in\l         merge (if _x_6 then _x_4 else (List.tl _x_4))\l         (if _x_6 then List.tl _x_5 else _x_5)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_132 -> p_131 [label=""];
p_131 [label="Unroll ([let (_x_0 : int list) = odds (odds (List.tl x)) in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         merge (if _x_3 then _x_1 else (List.tl _x_1))\l         (if _x_3 then List.tl _x_2 else _x_2)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_131 -> p_130 [label=""];
p_130 [label="Unroll ([let (_x_0 : int list) = merge_sort (odds x) in\l         let (_x_1 : int list) = merge_sort (odds (List.tl x)) in\l         let (_x_2 : bool) = List.hd _x_1 \<= List.hd _x_0 in\l         let (_x_3 : int list) = if _x_2 then _x_0 else List.tl _x_0 in\l         let (_x_4 : int list) = if _x_2 then List.tl _x_1 else _x_1 in\l         let (_x_5 : bool) = List.hd _x_4 \<= List.hd _x_3 in\l         let (_x_6 : int list) = if _x_5 then _x_3 else List.tl _x_3 in\l         let (_x_7 : int list) = if _x_5 then List.tl _x_4 else _x_4 in\l         let (_x_8 : bool) = List.hd _x_7 \<= List.hd _x_6 in\l         merge (if _x_8 then _x_6 else (List.tl _x_6))\l         (if _x_8 then List.tl _x_7 else _x_7)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_130 -> p_129 [label=""];
p_129 [label="Unroll ([odds (List.tl (List.tl (List.tl (List.tl (List.tl (odds x))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_129 -> p_128 [label=""];
p_128 [label="Unroll ([odds (List.tl (List.tl (odds (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_128 -> p_127 [label=""];
p_127 [label="Unroll ([odds\l         (List.tl\l          (List.tl\l           (List.tl (List.tl (List.tl (List.tl (List.tl (List.tl x))))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_127 -> p_126 [label=""];
p_126 [label="Unroll ([odds (List.tl (List.tl (odds (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_126 -> p_125 [label=""];
p_125 [label="Unroll ([odds (List.tl (List.tl (List.tl (odds (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_125 -> p_124 [label=""];
p_124 [label="Unroll ([odds (List.tl (List.tl (List.tl (odds (List.tl (odds x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_124 -> p_123 [label=""];
p_123 [label="Unroll ([odds (List.tl (odds (List.tl (odds (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_123 -> p_122 [label=""];
p_122 [label="Unroll ([odds (List.tl (odds (List.tl (odds (List.tl (odds x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_122 -> p_121 [label=""];
p_121 [label="Unroll ([merge_sort (odds (List.tl (odds (List.tl (odds (odds x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_121 -> p_120 [label=""];
p_120 [label="Unroll ([odds (odds (List.tl (odds (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_120 -> p_119 [label=""];
p_119 [label="Unroll ([merge_sort (odds (odds (List.tl (odds (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_119 -> p_118 [label=""];
p_118 [label="Unroll ([odds (List.tl (odds (odds (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_118 -> p_117 [label=""];
p_117 [label="Unroll ([merge_sort\l         (odds (List.tl (odds (List.tl (odds (List.tl (odds x)))))))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_117 -> p_116 [label=""];
p_116 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds (odds x))) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_116 -> p_115 [label=""];
p_115 [label="Unroll ([merge_sort (odds (List.tl (odds (odds (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_115 -> p_114 [label=""];
p_114 [label="Unroll ([odds (odds (odds (odds x)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_114 -> p_113 [label=""];
p_113 [label="Unroll ([merge_sort (odds (odds (odds (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_113 -> p_112 [label=""];
p_112 [label="Unroll ([odds (odds (List.tl (odds (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_112 -> p_111 [label=""];
p_111 [label="Unroll ([let (_x_0 : int list) = odds (odds (odds x)) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_111 -> p_110 [label=""];
p_110 [label="Unroll ([let (_x_0 : int list) = odds (odds x) in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         merge (if _x_3 then _x_1 else (List.tl _x_1))\l         (if _x_3 then List.tl _x_2 else _x_2)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_110 -> p_109 [label=""];
p_109 [label="Unroll ([odds (List.tl (odds (odds (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_109 -> p_108 [label=""];
p_108 [label="Unroll ([merge_sort (odds (List.tl (odds (odds (List.tl (odds x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_108 -> p_107 [label=""];
p_107 [label="Unroll ([merge_sort (odds (odds (List.tl (odds (List.tl (odds x))))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_107 -> p_106 [label=""];
p_106 [label="Unroll ([odds (odds (odds (List.tl (odds x))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_106 -> p_105 [label=""];
p_105 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds x)) in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         merge (if _x_3 then _x_1 else (List.tl _x_1))\l         (if _x_3 then List.tl _x_2 else _x_2)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_105 -> p_104 [label=""];
p_104 [label="Unroll ([let (_x_0 : int list) = odds x in\l         let (_x_1 : int list) = merge_sort (odds _x_0) in\l         let (_x_2 : int list) = merge_sort (odds (List.tl _x_0)) in\l         let (_x_3 : bool) = List.hd _x_2 \<= List.hd _x_1 in\l         let (_x_4 : int list) = if _x_3 then _x_1 else List.tl _x_1 in\l         let (_x_5 : int list) = if _x_3 then List.tl _x_2 else _x_2 in\l         let (_x_6 : bool) = List.hd _x_5 \<= List.hd _x_4 in\l         merge (if _x_6 then _x_4 else (List.tl _x_4))\l         (if _x_6 then List.tl _x_5 else _x_5)],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_104 -> p_103 [label=""];
p_103 [label="Unroll ([merge_sort (odds (odds (odds (List.tl (odds x)))))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_103 -> p_102 [label=""];
p_102 [label="Unroll ([let (_x_0 : int list) = odds (List.tl (odds (List.tl (odds x)))) in\l         merge (merge_sort (odds _x_0)) (merge_sort (odds (List.tl _x_0)))],\l        [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
}

Excellent. This gives us quite some confidence that this result is true. Let's now try to prove it by induction. We'll want to use an induction principle suggested by the definition of merge_sort. Let's use our usual strategy of #max_induct 1, so we can analyse Imandra's output to help us find needed lemmata.

Note, we could prove this theorem directly without any lemmas by using #max_induct 3, but it's good practice to use #max_induct 1 and have Imandra help us develop useful collections of lemmas.

Try this!

In [21]:

#max_induct 1

Out[21]:

Try this!

In [22]:

theorem merge_sort_sorts x =
 is_sorted (merge_sort x)
[@@induct functional merge_sort]

Out[22]:

val merge_sort_sorts : int list -> bool = <fun>
Goal:

is_sorted (merge_sort x).

1 nontautological subgoal.

We shall induct according to a scheme derived from merge_sort.

Induction scheme:

 (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ x)
 && (not Is_a([], x)
     && not Is_a([], List.tl x) && φ (odds (List.tl x)) && φ (odds x)
     ==> φ x).

2 nontautological subgoals.

Subgoal 2:

|---------------------------------------------------------------------------
 C0. not Is_a([], List.tl x) && not Is_a([], x)
 C1. is_sorted (merge_sort x)

But simplification reduces this to true, using the definitions of is_sorted
and merge_sort.

Subgoal 1:

 H0. not Is_a([], x)
 H1. not Is_a([], List.tl x)
 H2. is_sorted (merge_sort (odds (List.tl x)))
 H3. is_sorted (merge_sort (odds x))
|---------------------------------------------------------------------------
 is_sorted (merge_sort x)

This simplifies, using the definition of merge_sort to:

Subgoal 1':

 H0. is_sorted (merge_sort (odds (List.tl x)))
 H1. is_sorted (merge_sort (odds x))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)
 C2. is_sorted (merge (merge_sort (odds x)) (merge_sort (odds (List.tl x))))


We can eliminate destructors by the following substitution:
 x -> x1 :: x2

This produces the modified subgoal:

Subgoal 1'':

 H0. is_sorted (merge_sort (odds (x1 :: x2)))
 H1. is_sorted (merge_sort (odds x2))
|---------------------------------------------------------------------------
 C0. Is_a([], x2)
 C1. is_sorted (merge (merge_sort (odds (x1 :: x2))) (merge_sort (odds x2)))


Candidates for generalization:

 odds (x1 :: x2)
 odds x2

This produces the modified subgoal:

Subgoal 1''':

 H0. is_sorted (merge_sort gen_1)
 H1. is_sorted (merge_sort gen_2)
|---------------------------------------------------------------------------
 C0. Is_a([], x2)
 C1. is_sorted (merge (merge_sort gen_1) (merge_sort gen_2))


Candidates for generalization:

 merge_sort gen_1
 merge_sort gen_2

This produces the modified subgoal:

Subgoal 1'''':

 H0. is_sorted gen_3
 H1. is_sorted gen_4
|---------------------------------------------------------------------------
 C0. Is_a([], x2)
 C1. is_sorted (merge gen_3 gen_4)


Must try induction.

 ⚠  Aborting proof attempt for merge_sort_sorts.

 ⓘ  Rules:
    (:def is_sorted)
    (:def merge_sort)
    (:induct merge_sort)

Checkpoints:

 H0. is_sorted gen_3
 H1. is_sorted gen_4
|---------------------------------------------------------------------------
 C0. Is_a([], x2)
 C1. is_sorted (merge gen_3 gen_4)

Error[/server]: Maximum induction depth reached (1). You can set this with #max_induct.

Analysing the output of this proof attempt, we notice the following components of our Checkpoint:

H1. is_sorted gen_1
 H2. is_sorted gen_2
|---------------------------------------------------------------------------
 is_sorted (merge gen_2 gen_1)

Ah, of course! We need to prove a lemma that merge respects the sortedness of its inputs.

Let's do this by functional induction following the definition of merge and install it as a rewrite rule. We'll allow nested induction (#max_induct 2), but it's a good exercise to do this proof without it (deriving an additional lemma!).

Try this!

In [23]:

#max_induct 2;;

theorem merge_sorts x y =
 is_sorted x && is_sorted y
 ==>
 is_sorted (merge x y)
[@@induct functional merge]
[@@rewrite]

Out[23]:

val merge_sorts : int list -> int list -> bool = <fun>
Goal:

is_sorted x && is_sorted y ==> is_sorted (merge x y).

1 nontautological subgoal.

We shall induct according to a scheme derived from merge.

Induction scheme:

 (not (List.hd x < List.hd y && not Is_a([], y) && not Is_a([], x))
  && not (not (List.hd x < List.hd y) && not Is_a([], y) && not Is_a([], x))
  ==> φ x y)
 && (not Is_a([], x)
     && not Is_a([], y) && not (List.hd x < List.hd y) && φ x (List.tl y)
     ==> φ x y)
    && (not Is_a([], x)
        && not Is_a([], y) && List.hd x < List.hd y && φ (List.tl x) y
        ==> φ x y).

3 nontautological subgoals.

Subgoal 3:

 H0. is_sorted x
 H1. is_sorted y
 H2. not
     ((not (List.hd y <= List.hd x) && not Is_a([], y)) && not Is_a([], x))
 H3. not ((List.hd y <= List.hd x && not Is_a([], y)) && not Is_a([], x))
|---------------------------------------------------------------------------
 is_sorted (merge x y)

But simplification reduces this to true, using the definitions of is_sorted
and merge.

Subgoal 2:

 H0. is_sorted x
 H1. is_sorted y
 H2. not Is_a([], x)
 H3. not Is_a([], y)
 H4. List.hd y <= List.hd x
 H5. is_sorted x && is_sorted (List.tl y) ==> is_sorted (merge x (List.tl y))
|---------------------------------------------------------------------------
 is_sorted (merge x y)

This simplifies, using the definition of merge to the following 2 subgoals:

Subgoal 2.2:

 H0. List.hd y <= List.hd x
 H1. is_sorted x
 H2. is_sorted y
|---------------------------------------------------------------------------
 C0. Is_a([], y)
 C1. Is_a([], x)
 C2. is_sorted (merge x (List.tl y))
 C3. is_sorted (List.tl y)
 C4. is_sorted ((List.hd y) :: (merge x (List.tl y)))

But we verify Subgoal 2.2 by recursive unrolling.

Subgoal 2.1:

 H0. List.hd y <= List.hd x
 H1. is_sorted x
 H2. is_sorted y
 H3. is_sorted (merge x (List.tl y))
|---------------------------------------------------------------------------
 C0. Is_a([], y)
 C1. Is_a([], x)
 C2. is_sorted ((List.hd y) :: (merge x (List.tl y)))

But we verify Subgoal 2.1 by recursive unrolling.

Subgoal 1:

 H0. is_sorted x
 H1. is_sorted y
 H2. not Is_a([], x)
 H3. not Is_a([], y)
 H4. not (List.hd y <= List.hd x)
 H5. is_sorted (List.tl x) && is_sorted y ==> is_sorted (merge (List.tl x) y)
|---------------------------------------------------------------------------
 is_sorted (merge x y)

This simplifies, using the definition of merge to the following 2 subgoals:

Subgoal 1.2:

 H0. is_sorted x
 H1. is_sorted y
|---------------------------------------------------------------------------
 C0. Is_a([], y)
 C1. Is_a([], x)
 C2. is_sorted (merge (List.tl x) y)
 C3. is_sorted (List.tl x)
 C4. List.hd y <= List.hd x
 C5. is_sorted ((List.hd x) :: (merge (List.tl x) y))

But we verify Subgoal 1.2 by recursive unrolling.

Subgoal 1.1:

 H0. is_sorted x
 H1. is_sorted y
 H2. is_sorted (merge (List.tl x) y)
|---------------------------------------------------------------------------
 C0. Is_a([], y)
 C1. Is_a([], x)
 C2. List.hd y <= List.hd x
 C3. is_sorted ((List.hd x) :: (merge (List.tl x) y))

But we verify Subgoal 1.1 by recursive unrolling.

 ⓘ  Rules:
    (:def is_sorted)
    (:def merge)
    (:induct merge)

Proved

proof

ground_instances

definitions

inductions

search_time

1.863s

details

Expand

smt_stats

num checks	10
arith-assume-eqs	3
arith-make-feasible	22
arith-max-columns	16
arith-conflicts	2
rlimit count	233714
arith-cheap-eqs	2
mk clause	165
datatype occurs check	61
mk bool var	259
arith-lower	9
arith-diseq	2
datatype splits	17
decisions	54
propagations	127
interface eqs	3
arith-max-rows	7
conflicts	17
datatype accessor ax	13
minimized lits	2
datatype constructor ax	29
final checks	14
added eqs	300
del clause	116
arith eq adapter	11
arith-upper	13
memory	118.430000
max memory	118.430000
num allocs	32679905653.000000

Expand

start[1.863s, "Goal"]
  is_sorted ( :var_0: ) && is_sorted ( :var_1: )
  ==> is_sorted (merge ( :var_0: ) ( :var_1: ))

subproof

(not (is_sorted x) || not (is_sorted y)) || is_sorted (merge x y)

start[1.863s, "1"]
  (not (is_sorted x) || not (is_sorted y)) || is_sorted (merge x y)

induction on (functional merge)
:scheme (not (List.hd x < List.hd y && not Is_a([], y) && not Is_a([], x))
         && not
            (not (List.hd x < List.hd y)
             && not Is_a([], y) && not Is_a([], x))
         ==> φ x y)
        && (not Is_a([], x)
            && not Is_a([], y)
               && not (List.hd x < List.hd y) && φ x (List.tl y)
            ==> φ x y)
           && (not Is_a([], x)
               && not Is_a([], y)
                  && List.hd x < List.hd y && φ (List.tl x) y
               ==> φ x y)

Split (let (_x_0 : bool) = is_sorted x in
       let (_x_1 : bool) = is_sorted y in
       let (_x_2 : bool) = is_sorted (merge x y) || not (_x_0 && _x_1) in
       let (_x_3 : bool) = List.hd y <= List.hd x in
       let (_x_4 : bool) = not _x_3 in
       let (_x_5 : bool) = not Is_a([], y) in
       let (_x_6 : bool) = not Is_a([], x) in
       let (_x_7 : bool) = _x_6 && _x_5 in
       let (_x_8 : int list) = List.tl y in
       let (_x_9 : int list) = List.tl x in
       ((_x_2
         || not
            (not ((_x_4 && _x_5) && _x_6) && not ((_x_3 && _x_5) && _x_6)))
        && (_x_2
            || not
               ((_x_7 && _x_3)
                && (is_sorted (merge x _x_8) || not (_x_0 && is_sorted _x_8)))))
       && (_x_2
           || not
              ((_x_7 && _x_4)
               && (is_sorted (merge _x_9 y) || not (is_sorted _x_9 && _x_1))))
       :cases [let (_x_0 : bool) = List.hd y <= List.hd x in
               let (_x_1 : bool) = not Is_a([], y) in
               let (_x_2 : bool) = not Is_a([], x) in
               (((not (is_sorted x) || not (is_sorted y))
                 || (not _x_0 && _x_1) && _x_2)
                || (_x_0 && _x_1) && _x_2)
               || is_sorted (merge x y);
               let (_x_0 : bool) = is_sorted x in
               let (_x_1 : int list) = List.tl y in
               (((((not _x_0 || not (is_sorted y)) || Is_a([], x))
                  || Is_a([], y))
                 || not (List.hd y <= List.hd x))
                || not (_x_0 && is_sorted _x_1 ==> is_sorted (merge x _x_1)))
               || is_sorted (merge x y);
               let (_x_0 : bool) = is_sorted y in
               let (_x_1 : int list) = List.tl x in
               (((((not (is_sorted x) || not _x_0) || Is_a([], x))
                  || Is_a([], y))
                 || List.hd y <= List.hd x)
                || not (is_sorted _x_1 && _x_0 ==> is_sorted (merge _x_1 y)))
               || is_sorted (merge x y)])

subproof

let (_x_0 : bool) = is_sorted y in let (_x_1 : int list) = List.tl x in (((((not (is_sorted x) || not _x_0) || Is_a([], x)) || Is_a([], y)) || List.hd y <= List.hd x) || not (is_sorted _x_1 && _x_0 ==> is_sorted (merge _x_1 y))) || is_sorted (merge x y)

start[1.861s, "1"]
  let (_x_0 : bool) = is_sorted y in
  let (_x_1 : int list) = List.tl x in
  (((((not (is_sorted x) || not _x_0) || Is_a([], x)) || Is_a([], y))
    || List.hd y <= List.hd x)
   || not (is_sorted _x_1 && _x_0 ==> is_sorted (merge _x_1 y)))
  || is_sorted (merge x y)

simplify

into	let (_x_0 : bool) = Is_a([], y) \|\| Is_a([], x) in let (_x_1 : int list) = List.tl x in let (_x_2 : int list) = merge _x_1 y in let (_x_3 : bool) = is_sorted _x_2 in let (_x_4 : int) = List.hd x in let (_x_5 : bool) = List.hd y <= _x_4 in let (_x_6 : bool) = not (is_sorted x) in let (_x_7 : bool) = not (is_sorted y) in let (_x_8 : bool) = is_sorted (_x_4 :: _x_2) in ((((((_x_0 \|\| _x_3) \|\| is_sorted _x_1) \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| _x_8) && (((((_x_0 \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| _x_8) \|\| not _x_3)
expansions	[merge, merge]
rewrite_steps
forward_chaining

```
Subproof
```
```
Subproof
```

subproof

let (_x_0 : bool) = is_sorted x in let (_x_1 : int list) = List.tl y in (((((not _x_0 || not (is_sorted y)) || Is_a([], x)) || Is_a([], y)) || not (List.hd y <= List.hd x)) || not (_x_0 && is_sorted _x_1 ==> is_sorted (merge x _x_1))) || is_sorted (merge x y)

start[1.861s, "2"]
  let (_x_0 : bool) = is_sorted x in
  let (_x_1 : int list) = List.tl y in
  (((((not _x_0 || not (is_sorted y)) || Is_a([], x)) || Is_a([], y))
    || not (List.hd y <= List.hd x))
   || not (_x_0 && is_sorted _x_1 ==> is_sorted (merge x _x_1)))
  || is_sorted (merge x y)

simplify

into	let (_x_0 : bool) = Is_a([], y) \|\| Is_a([], x) in let (_x_1 : int list) = List.tl y in let (_x_2 : int list) = merge x _x_1 in let (_x_3 : bool) = is_sorted _x_2 in let (_x_4 : int) = List.hd y in let (_x_5 : bool) = not (_x_4 <= List.hd x) in let (_x_6 : bool) = not (is_sorted x) in let (_x_7 : bool) = not (is_sorted y) in let (_x_8 : bool) = is_sorted (_x_4 :: _x_2) in ((((((_x_0 \|\| _x_3) \|\| is_sorted _x_1) \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| _x_8) && (((((_x_0 \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| not _x_3) \|\| _x_8)
expansions	[merge, merge]
rewrite_steps
forward_chaining

```
Subproof
```
```
Subproof
```

subproof
let (_x_0 : bool) = List.hd y <= List.hd x in let (_x_1 : bool) = not Is_a([], y) in let (_x_2 : bool) = not Is_a([], x) in (((not (is_sorted x) || not (is_sorted y)) || (not _x_0 && _x_1) && _x_2) || (_x_0 && _x_1) && _x_2) || is_sorted (merge x y)
- start[1.861s, "3"] let (_x_0 : bool) = List.hd y <= List.hd x in let (_x_1 : bool) = not Is_a([], y) in let (_x_2 : bool) = not Is_a([], x) in (((not (is_sorted x) || not (is_sorted y)) || (not _x_0 && _x_1) && _x_2) || (_x_0 && _x_1) && _x_2) || is_sorted (merge x y)
- simplify
  into
  true
  expansions
  [merge, is_sorted, merge, is_sorted, merge, is_sorted, merge, is_sorted]
  rewrite_steps
  forward_chaining

digraph "proof" {
p_456 [label="Start (is_sorted ( :var_0: ) && is_sorted ( :var_1: )\l       ==\> is_sorted (merge ( :var_0: ) ( :var_1: )) :name \"Goal\"\l       :time 1.863s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_456 -> p_454 [label=""];
subgraph cluster_455 {
  color=blue;
p_454 [label="Start ((not (is_sorted x) \|\| not (is_sorted y)) \|\| is_sorted (merge x y)\l       :name \"1\" :time 1.863s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_454 -> p_453 [label=""];
p_453 [label="Induct ((functional merge),\l        :scheme (not\l                 (List.hd x \< List.hd y && not Is_a([], y) && not Is_a([], x))\l                 && not\l                    (not (List.hd x \< List.hd y)\l                     && not Is_a([], y) && not Is_a([], x))\l                 ==\> φ x y)\l                && (not Is_a([], x)\l                    && not Is_a([], y)\l                       && not (List.hd x \< List.hd y) && φ x (List.tl y)\l                    ==\> φ x y)\l                   && (not Is_a([], x)\l                       && not Is_a([], y)\l                          && List.hd x \< List.hd y && φ (List.tl x) y\l                       ==\> φ x y))",shape=box,style=filled,fontname="courier",fontsize=14];
p_453 -> p_452 [label=""];
p_452 [label="Split (let (_x_0 : bool) = is_sorted x in\l       let (_x_1 : bool) = is_sorted y in\l       let (_x_2 : bool) = is_sorted (merge x y) \|\| not (_x_0 && _x_1) in\l       let (_x_3 : bool) = List.hd y \<= List.hd x in\l       let (_x_4 : bool) = not _x_3 in\l       let (_x_5 : bool) = not Is_a([], y) in\l       let (_x_6 : bool) = not Is_a([], x) in\l       let (_x_7 : bool) = _x_6 && _x_5 in\l       let (_x_8 : int list) = List.tl y in\l       let (_x_9 : int list) = List.tl x in\l       ((_x_2\l         \|\| not\l            (not ((_x_4 && _x_5) && _x_6) && not ((_x_3 && _x_5) && _x_6)))\l        && (_x_2\l            \|\| not\l               ((_x_7 && _x_3)\l                && (is_sorted (merge x _x_8) \|\| not (_x_0 && is_sorted _x_8)))))\l       && (_x_2\l           \|\| not\l              ((_x_7 && _x_4)\l               && (is_sorted (merge _x_9 y) \|\| not (is_sorted _x_9 && _x_1))))\l       :cases [let (_x_0 : bool) = List.hd y \<= List.hd x in\l               let (_x_1 : bool) = not Is_a([], y) in\l               let (_x_2 : bool) = not Is_a([], x) in\l               (((not (is_sorted x) \|\| not (is_sorted y))\l                 \|\| (not _x_0 && _x_1) && _x_2)\l                \|\| (_x_0 && _x_1) && _x_2)\l               \|\| is_sorted (merge x y);\l               let (_x_0 : bool) = is_sorted x in\l               let (_x_1 : int list) = List.tl y in\l               (((((not _x_0 \|\| not (is_sorted y)) \|\| Is_a([], x))\l                  \|\| Is_a([], y))\l                 \|\| not (List.hd y \<= List.hd x))\l                \|\| not (_x_0 && is_sorted _x_1 ==\> is_sorted (merge x _x_1)))\l               \|\| is_sorted (merge x y);\l               let (_x_0 : bool) = is_sorted y in\l               let (_x_1 : int list) = List.tl x in\l               (((((not (is_sorted x) \|\| not _x_0) \|\| Is_a([], x))\l                  \|\| Is_a([], y))\l                 \|\| List.hd y \<= List.hd x)\l                \|\| not (is_sorted _x_1 && _x_0 ==\> is_sorted (merge _x_1 y)))\l               \|\| is_sorted (merge x y)])",shape=box,style=filled,fontname="courier",fontsize=14];
p_452 -> p_438 [label=""];
subgraph cluster_439 {
  color=blue;
p_438 [label="Start (let (_x_0 : bool) = is_sorted y in\l       let (_x_1 : int list) = List.tl x in\l       (((((not (is_sorted x) \|\| not _x_0) \|\| Is_a([], x)) \|\| Is_a([], y))\l         \|\| List.hd y \<= List.hd x)\l        \|\| not (is_sorted _x_1 && _x_0 ==\> is_sorted (merge _x_1 y)))\l       \|\| is_sorted (merge x y) :name \"1\" :time 1.861s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_438 -> p_437 [label=""];
p_437 [label="Simplify (let (_x_0 : bool) = Is_a([], y) \|\| Is_a([], x) in\l          let (_x_1 : int list) = List.tl x in\l          let (_x_2 : int list) = merge _x_1 y in\l          let (_x_3 : bool) = is_sorted _x_2 in\l          let (_x_4 : int) = List.hd x in\l          let (_x_5 : bool) = List.hd y \<= _x_4 in\l          let (_x_6 : bool) = not (is_sorted x) in\l          let (_x_7 : bool) = not (is_sorted y) in\l          let (_x_8 : bool) = is_sorted (_x_4 :: _x_2) in\l          ((((((_x_0 \|\| _x_3) \|\| is_sorted _x_1) \|\| _x_5) \|\| _x_6) \|\| _x_7)\l           \|\| _x_8)\l          && (((((_x_0 \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| _x_8) \|\| not _x_3)\l          :expansions [merge; merge] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_437 -> p_432 [label=""];
subgraph cluster_433 {
  color=blue;
p_432 [label="Start (let (_x_0 : int) = List.hd x in\l       let (_x_1 : int list) = merge (List.tl x) y in\l       (((((Is_a([], y) \|\| Is_a([], x)) \|\| List.hd y \<= _x_0)\l          \|\| not (is_sorted x))\l         \|\| not (is_sorted y))\l        \|\| is_sorted (_x_0 :: _x_1))\l       \|\| not (is_sorted _x_1) :name \"1.1\" :time 0.301s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_432 -> p_430 [label=""];
subgraph cluster_431 {
  color=blue;
p_430 [label="Start (let (_x_0 : int list) = merge (List.tl ( :var_0: )) ( :var_1: ) in\l       let (_x_1 : int) = List.hd ( :var_0: ) in\l       (((((not (is_sorted ( :var_0: )) \|\| not (is_sorted ( :var_1: )))\l           \|\| not (is_sorted _x_0))\l          \|\| Is_a([], ( :var_1: )))\l         \|\| Is_a([], ( :var_0: )))\l        \|\| List.hd ( :var_1: ) \<= _x_1)\l       \|\| is_sorted (_x_1 :: _x_0) :time 0.018s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_430 -> p_429 [label=""];
p_429 [label="Simplify (let (_x_0 : int list) = merge (List.tl ( :var_0: )) ( :var_1: ) in\l          let (_x_1 : int) = List.hd ( :var_0: ) in\l          (((((Is_a([], ( :var_1: )) \|\| Is_a([], ( :var_0: )))\l              \|\| not (is_sorted _x_0))\l             \|\| List.hd ( :var_1: ) \<= _x_1)\l            \|\| not (is_sorted ( :var_0: )))\l           \|\| not (is_sorted ( :var_1: )))\l          \|\| is_sorted (_x_1 :: _x_0) :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_429 -> p_428 [label=""];
p_428 [label="Unroll ([is_sorted ((List.hd x) :: (merge (List.tl x) y))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_428 -> p_427 [label=""];
p_427 [label="Unroll ([is_sorted y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_427 -> p_426 [label=""];
p_426 [label="Unroll ([is_sorted x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_426 -> p_425 [label=""];
p_425 [label="Unroll ([merge (List.tl x) y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_425 -> p_424 [label=""];
p_424 [label="Unsat",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_437 -> p_435 [label=""];
subgraph cluster_436 {
  color=blue;
p_435 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = merge _x_0 y in\l       let (_x_2 : int) = List.hd x in\l       ((((((Is_a([], y) \|\| Is_a([], x)) \|\| is_sorted _x_1) \|\| is_sorted _x_0)\l          \|\| List.hd y \<= _x_2)\l         \|\| not (is_sorted x))\l        \|\| not (is_sorted y))\l       \|\| is_sorted (_x_2 :: _x_1) :name \"1.2\" :time 0.301s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_435 -> p_423 [label=""];
subgraph cluster_434 {
  color=blue;
p_423 [label="Start (let (_x_0 : int list) = List.tl ( :var_0: ) in\l       let (_x_1 : int list) = merge _x_0 ( :var_1: ) in\l       let (_x_2 : int) = List.hd ( :var_0: ) in\l       ((((((not (is_sorted ( :var_0: )) \|\| not (is_sorted ( :var_1: )))\l            \|\| Is_a([], ( :var_1: )))\l           \|\| Is_a([], ( :var_0: )))\l          \|\| is_sorted _x_1)\l         \|\| is_sorted _x_0)\l        \|\| List.hd ( :var_1: ) \<= _x_2)\l       \|\| is_sorted (_x_2 :: _x_1) :time 0.018s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_423 -> p_422 [label=""];
p_422 [label="Simplify (let (_x_0 : int) = List.hd ( :var_0: ) in\l          let (_x_1 : int list) = List.tl ( :var_0: ) in\l          let (_x_2 : int list) = merge _x_1 ( :var_1: ) in\l          ((((((Is_a([], ( :var_1: )) \|\| Is_a([], ( :var_0: )))\l               \|\| List.hd ( :var_1: ) \<= _x_0)\l              \|\| not (is_sorted ( :var_0: )))\l             \|\| not (is_sorted ( :var_1: )))\l            \|\| is_sorted _x_2)\l           \|\| is_sorted _x_1)\l          \|\| is_sorted (_x_0 :: _x_2) :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_422 -> p_421 [label=""];
p_421 [label="Unroll ([is_sorted ((List.hd x) :: (merge (List.tl x) y))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_421 -> p_420 [label=""];
p_420 [label="Unroll ([is_sorted (List.tl x)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_420 -> p_419 [label=""];
p_419 [label="Unroll ([merge (List.tl x) y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_419 -> p_418 [label=""];
p_418 [label="Unroll ([is_sorted (merge (List.tl x) y)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_418 -> p_417 [label=""];
p_417 [label="Unroll ([is_sorted y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_417 -> p_416 [label=""];
p_416 [label="Unroll ([is_sorted x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_416 -> p_415 [label=""];
p_415 [label="Unsat",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}
p_452 -> p_447 [label=""];
subgraph cluster_448 {
  color=blue;
p_447 [label="Start (let (_x_0 : bool) = is_sorted x in\l       let (_x_1 : int list) = List.tl y in\l       (((((not _x_0 \|\| not (is_sorted y)) \|\| Is_a([], x)) \|\| Is_a([], y))\l         \|\| not (List.hd y \<= List.hd x))\l        \|\| not (_x_0 && is_sorted _x_1 ==\> is_sorted (merge x _x_1)))\l       \|\| is_sorted (merge x y) :name \"2\" :time 1.861s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_447 -> p_446 [label=""];
p_446 [label="Simplify (let (_x_0 : bool) = Is_a([], y) \|\| Is_a([], x) in\l          let (_x_1 : int list) = List.tl y in\l          let (_x_2 : int list) = merge x _x_1 in\l          let (_x_3 : bool) = is_sorted _x_2 in\l          let (_x_4 : int) = List.hd y in\l          let (_x_5 : bool) = not (_x_4 \<= List.hd x) in\l          let (_x_6 : bool) = not (is_sorted x) in\l          let (_x_7 : bool) = not (is_sorted y) in\l          let (_x_8 : bool) = is_sorted (_x_4 :: _x_2) in\l          ((((((_x_0 \|\| _x_3) \|\| is_sorted _x_1) \|\| _x_5) \|\| _x_6) \|\| _x_7)\l           \|\| _x_8)\l          && (((((_x_0 \|\| _x_5) \|\| _x_6) \|\| _x_7) \|\| not _x_3) \|\| _x_8)\l          :expansions [merge; merge] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_446 -> p_441 [label=""];
subgraph cluster_442 {
  color=blue;
p_441 [label="Start (let (_x_0 : int) = List.hd y in\l       let (_x_1 : int list) = merge x (List.tl y) in\l       (((((Is_a([], y) \|\| Is_a([], x)) \|\| not (_x_0 \<= List.hd x))\l          \|\| not (is_sorted x))\l         \|\| not (is_sorted y))\l        \|\| not (is_sorted _x_1))\l       \|\| is_sorted (_x_0 :: _x_1) :name \"2.1\" :time 0.907s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_441 -> p_414 [label=""];
subgraph cluster_440 {
  color=blue;
p_414 [label="Start (let (_x_0 : int) = List.hd ( :var_1: ) in\l       let (_x_1 : int list) = merge ( :var_0: ) (List.tl ( :var_1: )) in\l       (((((not (_x_0 \<= List.hd ( :var_0: )) \|\| not (is_sorted ( :var_0: )))\l           \|\| not (is_sorted ( :var_1: )))\l          \|\| not (is_sorted _x_1))\l         \|\| Is_a([], ( :var_1: )))\l        \|\| Is_a([], ( :var_0: )))\l       \|\| is_sorted (_x_0 :: _x_1) :time 0.016s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_414 -> p_413 [label=""];
p_413 [label="Simplify (let (_x_0 : int list) = merge ( :var_0: ) (List.tl ( :var_1: )) in\l          let (_x_1 : int) = List.hd ( :var_1: ) in\l          (((((Is_a([], ( :var_1: )) \|\| Is_a([], ( :var_0: )))\l              \|\| not (is_sorted _x_0))\l             \|\| not (_x_1 \<= List.hd ( :var_0: )))\l            \|\| not (is_sorted ( :var_0: )))\l           \|\| not (is_sorted ( :var_1: )))\l          \|\| is_sorted (_x_1 :: _x_0) :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_413 -> p_412 [label=""];
p_412 [label="Unroll ([is_sorted ((List.hd y) :: (merge x (List.tl y)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_412 -> p_411 [label=""];
p_411 [label="Unroll ([is_sorted y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_411 -> p_410 [label=""];
p_410 [label="Unroll ([is_sorted x], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_410 -> p_409 [label=""];
p_409 [label="Unroll ([merge x (List.tl y)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_409 -> p_408 [label=""];
p_408 [label="Unsat",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_446 -> p_444 [label=""];
subgraph cluster_445 {
  color=blue;
p_444 [label="Start (let (_x_0 : int list) = List.tl y in\l       let (_x_1 : int list) = merge x _x_0 in\l       let (_x_2 : int) = List.hd y in\l       ((((((Is_a([], y) \|\| Is_a([], x)) \|\| is_sorted _x_1) \|\| is_sorted _x_0)\l          \|\| not (_x_2 \<= List.hd x))\l         \|\| not (is_sorted x))\l        \|\| not (is_sorted y))\l       \|\| is_sorted (_x_2 :: _x_1) :name \"2.2\" :time 0.907s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_444 -> p_407 [label=""];
subgraph cluster_443 {
  color=blue;
p_407 [label="Start (let (_x_0 : int) = List.hd ( :var_1: ) in\l       let (_x_1 : int list) = List.tl ( :var_1: ) in\l       let (_x_2 : int list) = merge ( :var_0: ) _x_1 in\l       ((((((not (_x_0 \<= List.hd ( :var_0: )) \|\| not (is_sorted ( :var_0: )))\l            \|\| not (is_sorted ( :var_1: )))\l           \|\| Is_a([], ( :var_1: )))\l          \|\| Is_a([], ( :var_0: )))\l         \|\| is_sorted _x_2)\l        \|\| is_sorted _x_1)\l       \|\| is_sorted (_x_0 :: _x_2) :time 0.018s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_407 -> p_406 [label=""];
p_406 [label="Simplify (let (_x_0 : int) = List.hd ( :var_1: ) in\l          let (_x_1 : int list) = List.tl ( :var_1: ) in\l          let (_x_2 : int list) = merge ( :var_0: ) _x_1 in\l          ((((((Is_a([], ( :var_1: )) \|\| Is_a([], ( :var_0: )))\l               \|\| not (_x_0 \<= List.hd ( :var_0: )))\l              \|\| not (is_sorted ( :var_0: )))\l             \|\| not (is_sorted ( :var_1: )))\l            \|\| is_sorted _x_2)\l           \|\| is_sorted _x_1)\l          \|\| is_sorted (_x_0 :: _x_2) :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_406 -> p_405 [label=""];
p_405 [label="Unroll ([is_sorted ((List.hd y) :: (merge x (List.tl y)))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_405 -> p_404 [label=""];
p_404 [label="Unroll ([is_sorted (List.tl y)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_404 -> p_403 [label=""];
p_403 [label="Unroll ([merge x (List.tl y)], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_403 -> p_402 [label=""];
p_402 [label="Unroll ([is_sorted (merge x (List.tl y))], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_402 -> p_401 [label=""];
p_401 [label="Unroll ([is_sorted y], [[]])",shape=box,style=filled,fontname="courier",fontsize=14];
p_401 -> p_400 [label=""];
p_400 [label="Unsat",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}
p_452 -> p_450 [label=""];
subgraph cluster_451 {
  color=blue;
p_450 [label="Start (let (_x_0 : bool) = List.hd y \<= List.hd x in\l       let (_x_1 : bool) = not Is_a([], y) in\l       let (_x_2 : bool) = not Is_a([], x) in\l       (((not (is_sorted x) \|\| not (is_sorted y))\l         \|\| (not _x_0 && _x_1) && _x_2)\l        \|\| (_x_0 && _x_1) && _x_2)\l       \|\| is_sorted (merge x y) :name \"3\" :time 1.861s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_450 -> p_449 [label=""];
p_449 [label="Simplify (true\l          :expansions [merge;\l                       is_sorted;\l                       merge;\l                       is_sorted;\l                       merge;\l                       is_sorted;\l                       merge;\l                       is_sorted]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}

Excellent! Now that we have that key lemma proved and available as a rewrite rule, let's return to our original goal:

Try this!

In [24]:

theorem merge_sort_sorts x =
 is_sorted (merge_sort x)
[@@induct functional merge_sort]

Out[24]:

val merge_sort_sorts : int list -> bool = <fun>
Goal:

is_sorted (merge_sort x).

1 nontautological subgoal.

We shall induct according to a scheme derived from merge_sort.

Induction scheme:

 (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ x)
 && (not Is_a([], x)
     && not Is_a([], List.tl x) && φ (odds (List.tl x)) && φ (odds x)
     ==> φ x).

2 nontautological subgoals.

Subgoal 2:

|---------------------------------------------------------------------------
 C0. not Is_a([], List.tl x) && not Is_a([], x)
 C1. is_sorted (merge_sort x)

But simplification reduces this to true, using the definitions of is_sorted
and merge_sort.

Subgoal 1:

 H0. not Is_a([], x)
 H1. not Is_a([], List.tl x)
 H2. is_sorted (merge_sort (odds (List.tl x)))
 H3. is_sorted (merge_sort (odds x))
|---------------------------------------------------------------------------
 is_sorted (merge_sort x)

This simplifies, using the definition of merge_sort to:

Subgoal 1':

 H0. is_sorted (merge_sort (odds (List.tl x)))
 H1. is_sorted (merge_sort (odds x))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)
 C2. is_sorted (merge (merge_sort (odds x)) (merge_sort (odds (List.tl x))))

But simplification reduces this to true, using the rewrite rule merge_sorts.

 ⓘ  Rules:
    (:def is_sorted)
    (:def merge_sort)
    (:rw merge_sorts)
    (:induct merge_sort)

Proved

proof

ground_instances	0
definitions	5
inductions	1
search_time	0.256s

Expand

start[0.256s, "Goal"] is_sorted (merge_sort ( :var_0: ))

subproof

is_sorted (merge_sort x)

start[0.256s, "1"] is_sorted (merge_sort x)

induction on (functional merge_sort)
:scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ x)
        && (not Is_a([], x)
            && not Is_a([], List.tl x)
               && φ (odds (List.tl x)) && φ (odds x)
            ==> φ x)

Split (let (_x_0 : int list) = List.tl x in
       let (_x_1 : bool) = not Is_a([], _x_0) in
       let (_x_2 : bool) = not Is_a([], x) in
       let (_x_3 : bool) = is_sorted (merge_sort x) in
       (_x_1 && _x_2 || _x_3)
       && (_x_3
           || not
              (((_x_2 && _x_1) && is_sorted (merge_sort (odds _x_0)))
               && is_sorted (merge_sort (odds x))))
       :cases [not Is_a([], List.tl x) && not Is_a([], x)
               || is_sorted (merge_sort x);
               let (_x_0 : int list) = List.tl x in
               (((Is_a([], x) || Is_a([], _x_0))
                 || not (is_sorted (merge_sort (odds _x_0))))
                || not (is_sorted (merge_sort (odds x))))
               || is_sorted (merge_sort x)])

subproof

let (_x_0 : int list) = List.tl x in (((Is_a([], x) || Is_a([], _x_0)) || not (is_sorted (merge_sort (odds _x_0)))) || not (is_sorted (merge_sort (odds x)))) || is_sorted (merge_sort x)

start[0.256s, "1"]
  let (_x_0 : int list) = List.tl x in
  (((Is_a([], x) || Is_a([], _x_0))
    || not (is_sorted (merge_sort (odds _x_0))))
   || not (is_sorted (merge_sort (odds x))))
  || is_sorted (merge_sort x)

simplify

into	let (_x_0 : int list) = List.tl x in let (_x_1 : int list) = merge_sort (odds _x_0) in let (_x_2 : int list) = merge_sort (odds x) in (((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (is_sorted _x_1)) \|\| not (is_sorted _x_2)) \|\| is_sorted (merge _x_2 _x_1)
expansions	merge_sort
rewrite_steps
forward_chaining

simplify
into
true
expansions
[]
rewrite_steps
merge_sorts
forward_chaining

subproof
not Is_a([], List.tl x) && not Is_a([], x) || is_sorted (merge_sort x)
- start[0.256s, "2"] not Is_a([], List.tl x) && not Is_a([], x) || is_sorted (merge_sort x)
- simplify
  into
  true
  expansions
  [is_sorted, merge_sort, is_sorted, merge_sort]
  rewrite_steps
  forward_chaining

digraph "proof" {
p_468 [label="Start (is_sorted (merge_sort ( :var_0: )) :name \"Goal\" :time 0.256s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_468 -> p_466 [label=""];
subgraph cluster_467 {
  color=blue;
p_466 [label="Start (is_sorted (merge_sort x) :name \"1\" :time 0.256s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_466 -> p_465 [label=""];
p_465 [label="Induct ((functional merge_sort),\l        :scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==\> φ x)\l                && (not Is_a([], x)\l                    && not Is_a([], List.tl x)\l                       && φ (odds (List.tl x)) && φ (odds x)\l                    ==\> φ x))",shape=box,style=filled,fontname="courier",fontsize=14];
p_465 -> p_464 [label=""];
p_464 [label="Split (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = not Is_a([], _x_0) in\l       let (_x_2 : bool) = not Is_a([], x) in\l       let (_x_3 : bool) = is_sorted (merge_sort x) in\l       (_x_1 && _x_2 \|\| _x_3)\l       && (_x_3\l           \|\| not\l              (((_x_2 && _x_1) && is_sorted (merge_sort (odds _x_0)))\l               && is_sorted (merge_sort (odds x))))\l       :cases [not Is_a([], List.tl x) && not Is_a([], x)\l               \|\| is_sorted (merge_sort x);\l               let (_x_0 : int list) = List.tl x in\l               (((Is_a([], x) \|\| Is_a([], _x_0))\l                 \|\| not (is_sorted (merge_sort (odds _x_0))))\l                \|\| not (is_sorted (merge_sort (odds x))))\l               \|\| is_sorted (merge_sort x)])",shape=box,style=filled,fontname="courier",fontsize=14];
p_464 -> p_459 [label=""];
subgraph cluster_460 {
  color=blue;
p_459 [label="Start (let (_x_0 : int list) = List.tl x in\l       (((Is_a([], x) \|\| Is_a([], _x_0))\l         \|\| not (is_sorted (merge_sort (odds _x_0))))\l        \|\| not (is_sorted (merge_sort (odds x))))\l       \|\| is_sorted (merge_sort x) :name \"1\" :time 0.256s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_459 -> p_458 [label=""];
p_458 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = merge_sort (odds _x_0) in\l          let (_x_2 : int list) = merge_sort (odds x) in\l          (((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (is_sorted _x_1))\l           \|\| not (is_sorted _x_2))\l          \|\| is_sorted (merge _x_2 _x_1) :expansions [merge_sort] :rw []\l          :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_458 -> p_457 [label=""];
p_457 [label="Simplify (true :expansions [] :rw [merge_sorts] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_464 -> p_462 [label=""];
subgraph cluster_463 {
  color=blue;
p_462 [label="Start (not Is_a([], List.tl x) && not Is_a([], x) \|\| is_sorted (merge_sort x)\l       :name \"2\" :time 0.256s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_462 -> p_461 [label=""];
p_461 [label="Simplify (true :expansions [is_sorted; merge_sort; is_sorted; merge_sort]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}

Beautiful! So now we've proved half of our specification: merge_sort sorts!

Merge Sort contains the right elements¶

Let's now turn to the second half of our correctness criterion: That merge_sort x contains "the same" elements as x.

What does this mean, and why does it matter?

An incorrect sorting function¶

Consider the sorting function bad_sort defined as bad_sort x = [].

Clearly, we could prove theorem bad_sort_sorts x = is_sorted (bad_sort x), even though we'd never want to use bad_sort as a sorting function in practice.

That is, computing a sorted list is only one piece of the puzzle. We must also verify that merge_sort x contains exactly the same elements as x, including their multiplicity).

Multiset equivalence¶

How can we express this concept? We'll use the notion of a multiset and count the number of occurrences of each element of x, and make sure these are respected by merge_sort.

We'll begin by defining a function num_occurs x y which counts the number of times an element x appears in the list y.

Try this!

In [25]:

let rec num_occurs x y =
 match y with
  | [] -> 0
  | hd :: tl when hd = x ->
    1 + num_occurs x tl
  | _ :: tl ->
    num_occurs x tl

Out[25]:

val num_occurs : 'a -> 'a list -> int = <fun>

termination proof

Termination proof

call `num_occurs x (List.tl y)` from `num_occurs x y`

original

num_occurs x y

sub

num_occurs x (List.tl y)

original ordinal

Ordinal.Int (_cnt y)

sub ordinal

Ordinal.Int (_cnt (List.tl y))

path

[List.hd y = x && not Is_a([], y)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.011s

details

Expand

smt_stats

num checks	7
arith-make-feasible	7
arith-max-columns	12
rlimit count	3672
mk clause	19
datatype occurs check	21
mk bool var	52
arith-lower	3
datatype splits	3
decisions	9
propagations	14
arith-max-rows	4
conflicts	3
datatype accessor ax	9
datatype constructor ax	7
final checks	6
added eqs	38
del clause	6
arith eq adapter	3
arith-upper	6
memory	103.390000
max memory	118.430000
num allocs	37491948318.000000

Expand

start[0.011s]
  let (_x_0 : int) = count.list (const 0) y in
  let (_x_1 : ty_0 list) = List.tl y in
  let (_x_2 : int) = count.list (const 0) _x_1 in
  let (_x_3 : bool) = List.hd _x_1 = x in
  let (_x_4 : bool) = not Is_a([], _x_1) in
  List.hd y = x && not Is_a([], y) && _x_0 >= 0 && _x_2 >= 0
  ==> not (_x_3 && _x_4) && not (not _x_3 && _x_4)
      || Ordinal.( << ) (Ordinal.Int _x_2) (Ordinal.Int _x_0)

simplify

into	let (_x_0 : ty_0 list) = List.tl y in let (_x_1 : bool) = List.hd _x_0 = x in let (_x_2 : bool) = not Is_a([], _x_0) in let (_x_3 : int) = count.list (const 0) _x_0 in let (_x_4 : int) = count.list (const 0) y in (not (_x_1 && _x_2) && not (not _x_1 && _x_2) \|\| Ordinal.( << ) (Ordinal.Int _x_3) (Ordinal.Int _x_4)) \|\| not (((List.hd y = x && not Is_a([], y)) && _x_4 >= 0) && _x_3 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll

expr	(\|`count.list (const 0)[0]`_4885\| y_4871)
expansions

unroll

expr	(\|`count.list (const 0)[0]`_4885\| (\|get.::.1_4864\| y_4871))
expansions

unroll

expr	(\|Ordinal.<<_126\| (\|Ordinal.Int_111\| (\|`count.list (const 0)[0]`_4885\| (\|get.::.…
expansions

Unsat

call `num_occurs x (List.tl y)` from `num_occurs x y`

original

num_occurs x y

sub

num_occurs x (List.tl y)

original ordinal

Ordinal.Int (_cnt y)

sub ordinal

Ordinal.Int (_cnt (List.tl y))

path

[not (List.hd y = x) && not Is_a([], y)]

proof

detailed proof

summary
full

ground_instances

definitions

inductions

search_time

0.013s

details

Expand

smt_stats

num checks	7
arith-make-feasible	7
arith-max-columns	12
rlimit count	1847
mk clause	19
datatype occurs check	21
mk bool var	52
arith-lower	3
datatype splits	3
decisions	9
propagations	14
arith-max-rows	4
conflicts	3
datatype accessor ax	9
datatype constructor ax	7
final checks	6
added eqs	37
del clause	6
arith eq adapter	3
arith-upper	6
memory	100.770000
max memory	118.430000
num allocs	37321146955.000000

Expand

start[0.013s]
  let (_x_0 : int) = count.list (const 0) y in
  let (_x_1 : ty_0 list) = List.tl y in
  let (_x_2 : int) = count.list (const 0) _x_1 in
  let (_x_3 : bool) = List.hd _x_1 = x in
  let (_x_4 : bool) = not Is_a([], _x_1) in
  not (List.hd y = x) && not Is_a([], y) && _x_0 >= 0 && _x_2 >= 0
  ==> not (_x_3 && _x_4) && not (not _x_3 && _x_4)
      || Ordinal.( << ) (Ordinal.Int _x_2) (Ordinal.Int _x_0)

simplify

into	let (_x_0 : ty_0 list) = List.tl y in let (_x_1 : bool) = List.hd _x_0 = x in let (_x_2 : bool) = not Is_a([], _x_0) in let (_x_3 : int) = count.list (const 0) _x_0 in let (_x_4 : int) = count.list (const 0) y in (not (_x_1 && _x_2) && not (not _x_1 && _x_2) \|\| Ordinal.( << ) (Ordinal.Int _x_3) (Ordinal.Int _x_4)) \|\| not (((not (List.hd y = x) && not Is_a([], y)) && _x_4 >= 0) && _x_3 >= 0)
expansions	[]
rewrite_steps
forward_chaining

unroll

expr	(\|`count.list (const 0)[0]`_4885\| y_4871)
expansions

unroll

expr	(\|`count.list (const 0)[0]`_4885\| (\|get.::.1_4864\| y_4871))
expansions

unroll

expr	(\|Ordinal.<<_126\| (\|Ordinal.Int_111\| (\|`count.list (const 0)[0]`_4885\| (\|get.::.…
expansions

Unsat

Anticipating the need to reason about the interplay of num_occurs and merge, let's prove the following nice lemmas characterising their relationship (applying the max_induct 1 strategy to find these lemmas as above is a great exercise).

Try this!

In [26]:

theorem num_occur_merge a x y =
 num_occurs a (merge x y) = num_occurs a x + num_occurs a y
[@@induct functional merge]
[@@rewrite]

Out[26]:

val num_occur_merge : int -> int list -> int list -> bool = <fun>
Goal:

num_occurs a (merge x y) = num_occurs a x + num_occurs a y.

1 nontautological subgoal.

We shall induct according to a scheme derived from merge.

Induction scheme:

 (not (List.hd x < List.hd y && not Is_a([], y) && not Is_a([], x))
  && not (not (List.hd x < List.hd y) && not Is_a([], y) && not Is_a([], x))
  ==> φ a x y)
 && (not Is_a([], x)
     && not Is_a([], y) && not (List.hd x < List.hd y) && φ a x (List.tl y)
     ==> φ a x y)
    && (not Is_a([], x)
        && not Is_a([], y) && List.hd x < List.hd y && φ a (List.tl x) y
        ==> φ a x y).

3 nontautological subgoals.

Subgoal 3:

 H0. not
     ((not (List.hd y <= List.hd x) && not Is_a([], y)) && not Is_a([], x))
 H1. not ((List.hd y <= List.hd x && not Is_a([], y)) && not Is_a([], x))
|---------------------------------------------------------------------------
 num_occurs a (merge x y) = num_occurs a x + num_occurs a y

But simplification reduces this to true, using the definitions of merge and
num_occurs.

Subgoal 2:

 H0. not Is_a([], x)
 H1. not Is_a([], y)
 H2. List.hd y <= List.hd x
 H3. num_occurs a (merge x (List.tl y)) =
     num_occurs a x + num_occurs a (List.tl y)
|---------------------------------------------------------------------------
 num_occurs a (merge x y) = num_occurs a x + num_occurs a y

But simplification reduces this to true, using the definitions of merge and
num_occurs.

Subgoal 1:

 H0. not Is_a([], x)
 H1. not Is_a([], y)
 H2. not (List.hd y <= List.hd x)
 H3. num_occurs a (merge (List.tl x) y) =
     num_occurs a (List.tl x) + num_occurs a y
|---------------------------------------------------------------------------
 num_occurs a (merge x y) = num_occurs a x + num_occurs a y

But simplification reduces this to true, using the definitions of merge and
num_occurs.

 ⓘ  Rules:
    (:def merge)
    (:def num_occurs)
    (:induct merge)

Proved

proof

ground_instances	0
definitions	14
inductions	1
search_time	0.194s

Expand

start[0.194s, "Goal"]
  num_occurs ( :var_0: ) (merge ( :var_1: ) ( :var_2: )) =
  num_occurs ( :var_0: ) ( :var_1: ) + num_occurs ( :var_0: ) ( :var_2: )

subproof

num_occurs a (merge x y) = num_occurs a x + num_occurs a y

start[0.194s, "1"] num_occurs a (merge x y) = num_occurs a x + num_occurs a y

induction on (functional merge)
:scheme (not (List.hd x < List.hd y && not Is_a([], y) && not Is_a([], x))
         && not
            (not (List.hd x < List.hd y)
             && not Is_a([], y) && not Is_a([], x))
         ==> φ a x y)
        && (not Is_a([], x)
            && not Is_a([], y)
               && not (List.hd x < List.hd y) && φ a x (List.tl y)
            ==> φ a x y)
           && (not Is_a([], x)
               && not Is_a([], y)
                  && List.hd x < List.hd y && φ a (List.tl x) y
               ==> φ a x y)

Split (let (_x_0 : bool) = List.hd y <= List.hd x in
       let (_x_1 : bool) = not _x_0 in
       let (_x_2 : bool) = not Is_a([], y) in
       let (_x_3 : bool) = not Is_a([], x) in
       let (_x_4 : int) = num_occurs a x in
       let (_x_5 : int) = num_occurs a y in
       let (_x_6 : bool) = num_occurs a (merge x y) = _x_4 + _x_5 in
       let (_x_7 : bool) = _x_3 && _x_2 in
       let (_x_8 : int list) = List.tl y in
       let (_x_9 : int list) = List.tl x in
       ((not (not ((_x_1 && _x_2) && _x_3) && not ((_x_0 && _x_2) && _x_3))
         || _x_6)
        && (not
            ((_x_7 && _x_0)
             && num_occurs a (merge x _x_8) = _x_4 + num_occurs a _x_8)
            || _x_6))
       && (not
           ((_x_7 && _x_1)
            && num_occurs a (merge _x_9 y) = num_occurs a _x_9 + _x_5)
           || _x_6)
       :cases [let (_x_0 : bool) = List.hd y <= List.hd x in
               let (_x_1 : bool) = not Is_a([], y) in
               let (_x_2 : bool) = not Is_a([], x) in
               ((not _x_0 && _x_1) && _x_2 || (_x_0 && _x_1) && _x_2)
               || num_occurs a (merge x y) = num_occurs a x + num_occurs a y;
               let (_x_0 : int list) = List.tl y in
               let (_x_1 : int) = num_occurs a x in
               (((Is_a([], x) || Is_a([], y)) || not (List.hd y <= List.hd x))
                || not
                   (num_occurs a (merge x _x_0) = _x_1 + num_occurs a _x_0))
               || num_occurs a (merge x y) = _x_1 + num_occurs a y;
               let (_x_0 : int list) = List.tl x in
               let (_x_1 : int) = num_occurs a y in
               (((Is_a([], x) || Is_a([], y)) || List.hd y <= List.hd x)
                || not
                   (num_occurs a (merge _x_0 y) = num_occurs a _x_0 + _x_1))
               || num_occurs a (merge x y) = num_occurs a x + _x_1])

subproof
let (_x_0 : int list) = List.tl x in let (_x_1 : int) = num_occurs a y in (((Is_a([], x) || Is_a([], y)) || List.hd y <= List.hd x) || not (num_occurs a (merge _x_0 y) = num_occurs a _x_0 + _x_1)) || num_occurs a (merge x y) = num_occurs a x + _x_1
- start[0.193s, "1"] let (_x_0 : int list) = List.tl x in let (_x_1 : int) = num_occurs a y in (((Is_a([], x) || Is_a([], y)) || List.hd y <= List.hd x) || not (num_occurs a (merge _x_0 y) = num_occurs a _x_0 + _x_1)) || num_occurs a (merge x y) = num_occurs a x + _x_1
- simplify
  into
  true
  expansions
  [num_occurs, num_occurs, merge]
  rewrite_steps
  forward_chaining
subproof
let (_x_0 : int list) = List.tl y in let (_x_1 : int) = num_occurs a x in (((Is_a([], x) || Is_a([], y)) || not (List.hd y <= List.hd x)) || not (num_occurs a (merge x _x_0) = _x_1 + num_occurs a _x_0)) || num_occurs a (merge x y) = _x_1 + num_occurs a y
- start[0.193s, "2"] let (_x_0 : int list) = List.tl y in let (_x_1 : int) = num_occurs a x in (((Is_a([], x) || Is_a([], y)) || not (List.hd y <= List.hd x)) || not (num_occurs a (merge x _x_0) = _x_1 + num_occurs a _x_0)) || num_occurs a (merge x y) = _x_1 + num_occurs a y
- simplify
  into
  true
  expansions
  [num_occurs, num_occurs, merge]
  rewrite_steps
  forward_chaining
subproof
let (_x_0 : bool) = List.hd y <= List.hd x in let (_x_1 : bool) = not Is_a([], y) in let (_x_2 : bool) = not Is_a([], x) in ((not _x_0 && _x_1) && _x_2 || (_x_0 && _x_1) && _x_2) || num_occurs a (merge x y) = num_occurs a x + num_occurs a y
- start[0.193s, "3"] let (_x_0 : bool) = List.hd y <= List.hd x in let (_x_1 : bool) = not Is_a([], y) in let (_x_2 : bool) = not Is_a([], x) in ((not _x_0 && _x_1) && _x_2 || (_x_0 && _x_1) && _x_2) || num_occurs a (merge x y) = num_occurs a x + num_occurs a y
- simplify
  into
  true
  expansions
  [num_occurs, merge, num_occurs, merge, num_occurs, merge, num_occurs, merge]
  rewrite_steps
  forward_chaining

digraph "proof" {
p_494 [label="Start (num_occurs ( :var_0: ) (merge ( :var_1: ) ( :var_2: )) =\l       num_occurs ( :var_0: ) ( :var_1: )\l       + num_occurs ( :var_0: ) ( :var_2: ) :name \"Goal\" :time 0.194s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_494 -> p_492 [label=""];
subgraph cluster_493 {
  color=blue;
p_492 [label="Start (num_occurs a (merge x y) = num_occurs a x + num_occurs a y :name \"1\"\l       :time 0.194s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_492 -> p_491 [label=""];
p_491 [label="Induct ((functional merge),\l        :scheme (not\l                 (List.hd x \< List.hd y && not Is_a([], y) && not Is_a([], x))\l                 && not\l                    (not (List.hd x \< List.hd y)\l                     && not Is_a([], y) && not Is_a([], x))\l                 ==\> φ a x y)\l                && (not Is_a([], x)\l                    && not Is_a([], y)\l                       && not (List.hd x \< List.hd y) && φ a x (List.tl y)\l                    ==\> φ a x y)\l                   && (not Is_a([], x)\l                       && not Is_a([], y)\l                          && List.hd x \< List.hd y && φ a (List.tl x) y\l                       ==\> φ a x y))",shape=box,style=filled,fontname="courier",fontsize=14];
p_491 -> p_490 [label=""];
p_490 [label="Split (let (_x_0 : bool) = List.hd y \<= List.hd x in\l       let (_x_1 : bool) = not _x_0 in\l       let (_x_2 : bool) = not Is_a([], y) in\l       let (_x_3 : bool) = not Is_a([], x) in\l       let (_x_4 : int) = num_occurs a x in\l       let (_x_5 : int) = num_occurs a y in\l       let (_x_6 : bool) = num_occurs a (merge x y) = _x_4 + _x_5 in\l       let (_x_7 : bool) = _x_3 && _x_2 in\l       let (_x_8 : int list) = List.tl y in\l       let (_x_9 : int list) = List.tl x in\l       ((not (not ((_x_1 && _x_2) && _x_3) && not ((_x_0 && _x_2) && _x_3))\l         \|\| _x_6)\l        && (not\l            ((_x_7 && _x_0)\l             && num_occurs a (merge x _x_8) = _x_4 + num_occurs a _x_8)\l            \|\| _x_6))\l       && (not\l           ((_x_7 && _x_1)\l            && num_occurs a (merge _x_9 y) = num_occurs a _x_9 + _x_5)\l           \|\| _x_6)\l       :cases [let (_x_0 : bool) = List.hd y \<= List.hd x in\l               let (_x_1 : bool) = not Is_a([], y) in\l               let (_x_2 : bool) = not Is_a([], x) in\l               ((not _x_0 && _x_1) && _x_2 \|\| (_x_0 && _x_1) && _x_2)\l               \|\| num_occurs a (merge x y) = num_occurs a x + num_occurs a y;\l               let (_x_0 : int list) = List.tl y in\l               let (_x_1 : int) = num_occurs a x in\l               (((Is_a([], x) \|\| Is_a([], y)) \|\| not (List.hd y \<= List.hd x))\l                \|\| not\l                   (num_occurs a (merge x _x_0) = _x_1 + num_occurs a _x_0))\l               \|\| num_occurs a (merge x y) = _x_1 + num_occurs a y;\l               let (_x_0 : int list) = List.tl x in\l               let (_x_1 : int) = num_occurs a y in\l               (((Is_a([], x) \|\| Is_a([], y)) \|\| List.hd y \<= List.hd x)\l                \|\| not\l                   (num_occurs a (merge _x_0 y) = num_occurs a _x_0 + _x_1))\l               \|\| num_occurs a (merge x y) = num_occurs a x + _x_1])",shape=box,style=filled,fontname="courier",fontsize=14];
p_490 -> p_482 [label=""];
subgraph cluster_483 {
  color=blue;
p_482 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int) = num_occurs a y in\l       (((Is_a([], x) \|\| Is_a([], y)) \|\| List.hd y \<= List.hd x)\l        \|\| not (num_occurs a (merge _x_0 y) = num_occurs a _x_0 + _x_1))\l       \|\| num_occurs a (merge x y) = num_occurs a x + _x_1 :name \"1\"\l       :time 0.193s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_482 -> p_481 [label=""];
p_481 [label="Simplify (true :expansions [num_occurs; num_occurs; merge] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_490 -> p_485 [label=""];
subgraph cluster_486 {
  color=blue;
p_485 [label="Start (let (_x_0 : int list) = List.tl y in\l       let (_x_1 : int) = num_occurs a x in\l       (((Is_a([], x) \|\| Is_a([], y)) \|\| not (List.hd y \<= List.hd x))\l        \|\| not (num_occurs a (merge x _x_0) = _x_1 + num_occurs a _x_0))\l       \|\| num_occurs a (merge x y) = _x_1 + num_occurs a y :name \"2\"\l       :time 0.193s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_485 -> p_484 [label=""];
p_484 [label="Simplify (true :expansions [num_occurs; num_occurs; merge] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_490 -> p_488 [label=""];
subgraph cluster_489 {
  color=blue;
p_488 [label="Start (let (_x_0 : bool) = List.hd y \<= List.hd x in\l       let (_x_1 : bool) = not Is_a([], y) in\l       let (_x_2 : bool) = not Is_a([], x) in\l       ((not _x_0 && _x_1) && _x_2 \|\| (_x_0 && _x_1) && _x_2)\l       \|\| num_occurs a (merge x y) = num_occurs a x + num_occurs a y\l       :name \"3\" :time 0.193s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_488 -> p_487 [label=""];
p_487 [label="Simplify (true\l          :expansions [num_occurs;\l                       merge;\l                       num_occurs;\l                       merge;\l                       num_occurs;\l                       merge;\l                       num_occurs;\l                       merge]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}

Try this!

In [27]:

theorem num_occurs_arith (x : int list) (a : int) =
  x <> [] && List.tl x <> []
  ==>
  num_occurs a (odds (List.tl x))
  =
  num_occurs a x - num_occurs a (odds x)
  [@@induct functional num_occurs]
  [@@rewrite]

Out[27]:

val num_occurs_arith : int list -> int -> bool = <fun>
Goal:

x <> [] && List.tl x <> []
==> num_occurs a (odds (List.tl x)) = num_occurs a x - num_occurs a (odds x).

1 nontautological subgoal.

We shall induct according to a scheme derived from num_occurs.

Induction scheme:

 (not (List.hd x = a && not Is_a([], x))
  && not (not (List.hd x = a) && not Is_a([], x)) ==> φ a x)
 && (not Is_a([], x) && not (List.hd x = a) && φ a (List.tl x) ==> φ a x)
    && (not Is_a([], x) && List.hd x = a && φ a (List.tl x) ==> φ a x).

3 nontautological subgoals.

Subgoal 3:

 H0. not (x = [])
 H1. not (List.tl x = [])
 H2. not (List.hd x = a && not Is_a([], x))
 H3. not (not (List.hd x = a) && not Is_a([], x))
|---------------------------------------------------------------------------
 num_occurs a (odds (List.tl x)) =
 num_occurs a x + -1 * num_occurs a (odds x)

But simplification reduces this to true.

Subgoal 2:

 H0. not (x = [])
 H1. not (List.tl x = [])
 H2. not Is_a([], x)
 H3. not (List.hd x = a)
 H4. not (List.tl x = []) && not (List.tl (List.tl x) = [])
     ==> num_occurs a (odds (List.tl (List.tl x))) =
         num_occurs a (List.tl x) + -1 * num_occurs a (odds (List.tl x))
|---------------------------------------------------------------------------
 num_occurs a (odds (List.tl x)) =
 num_occurs a x + -1 * num_occurs a (odds x)

This simplifies, using the definitions of num_occurs and odds to the
following 4 subgoals:

Subgoal 2.4:

 H0. (List.tl x) <> []
 H1. (List.tl (List.tl x)) <> []
 H2. num_occurs a (odds (List.tl (List.tl x))) =
     num_occurs a (List.tl (List.tl x))
     + -1 * num_occurs a (odds (List.tl x))
|---------------------------------------------------------------------------
 C0. List.hd x = a
 C1. Is_a([], x)
 C2. List.hd (List.tl x) = a
 C3. num_occurs a (odds (List.tl x)) =
     num_occurs a (List.tl x)
     + -1 * num_occurs a (odds (List.tl (List.tl x)))

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 2.3:

 H0. (List.tl x) <> []
 H1. (List.tl (List.tl x)) <> []
 H2. num_occurs a (odds (List.tl (List.tl x))) =
     1 + num_occurs a (List.tl (List.tl x))
     + -1 * num_occurs a (odds (List.tl x))
 H3. List.hd (List.tl x) = a
|---------------------------------------------------------------------------
 C0. List.hd x = a
 C1. Is_a([], x)
 C2. num_occurs a (odds (List.tl x)) =
     num_occurs a (List.tl x)
     + -1 * num_occurs a (odds (List.tl (List.tl x)))

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 2.2:

 H0. (List.tl x) <> []
 H1. List.tl (List.tl x) = []
|---------------------------------------------------------------------------
 C0. List.hd x = a
 C1. Is_a([], x)
 C2. List.hd (List.tl x) = a
 C3. 0 =
     num_occurs a (List.tl x)
     + -1 * num_occurs a (odds (List.tl (List.tl x)))

This simplifies, using the definitions of num_occurs and odds to:

Subgoal 2.2':

 H0. List.tl (List.tl x) = []
 H1. (List.tl x) <> []
|---------------------------------------------------------------------------
 C0. List.hd x = a
 C1. Is_a([], x)
 C2. List.hd (List.tl x) = a
 C3. 0 = num_occurs a (List.tl (List.tl x))

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 2.1:

 H0. (List.tl x) <> []
 H1. List.tl (List.tl x) = []
 H2. List.hd (List.tl x) = a
|---------------------------------------------------------------------------
 C0. List.hd x = a
 C1. Is_a([], x)
 C2. 1 =
     num_occurs a (List.tl x)
     + -1 * num_occurs a (odds (List.tl (List.tl x)))

This simplifies, using the definitions of num_occurs and odds to:

Subgoal 2.1':

 H0. List.tl (List.tl x) = []
 H1. (List.tl x) <> []
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. List.hd x = List.hd (List.tl x)
 C2. 0 = num_occurs (List.hd (List.tl x)) (List.tl (List.tl x))

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 1:

 H0. not (x = [])
 H1. not (List.tl x = [])
 H2. not Is_a([], x)
 H3. List.hd x = a
 H4. not (List.tl x = []) && not (List.tl (List.tl x) = [])
     ==> num_occurs a (odds (List.tl (List.tl x))) =
         num_occurs a (List.tl x) + -1 * num_occurs a (odds (List.tl x))
|---------------------------------------------------------------------------
 num_occurs a (odds (List.tl x)) =
 num_occurs a x + -1 * num_occurs a (odds x)

This simplifies, using the definitions of num_occurs and odds to the
following 4 subgoals:

Subgoal 1.4:

 H0. (List.tl x) <> []
 H1. (List.tl (List.tl x)) <> []
 H2. num_occurs (List.hd x) (odds (List.tl (List.tl x))) =
     num_occurs (List.hd x) (List.tl (List.tl x))
     + -1 * num_occurs (List.hd x) (odds (List.tl x))
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. num_occurs (List.hd x) (odds (List.tl x)) =
     num_occurs (List.hd x) (List.tl x)
     + -1 * num_occurs (List.hd x) (odds (List.tl (List.tl x)))
 C2. List.hd (List.tl x) = List.hd x

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 1.3:

 H0. (List.tl x) <> []
 H1. (List.tl (List.tl x)) <> []
 H2. List.hd (List.tl x) = List.hd x
 H3. num_occurs (List.hd x) (odds (List.tl (List.tl x))) =
     1 + num_occurs (List.hd x) (List.tl (List.tl x))
     + -1 * num_occurs (List.hd x) (odds (List.tl x))
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. num_occurs (List.hd x) (odds (List.tl x)) =
     num_occurs (List.hd x) (List.tl x)
     + -1 * num_occurs (List.hd x) (odds (List.tl (List.tl x)))

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 1.2:

 H0. (List.tl x) <> []
 H1. List.tl (List.tl x) = []
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. 0 =
     num_occurs (List.hd x) (List.tl x)
     + -1 * num_occurs (List.hd x) (odds (List.tl (List.tl x)))
 C2. List.hd (List.tl x) = List.hd x

This simplifies, using the definitions of num_occurs and odds to:

Subgoal 1.2':

 H0. List.tl (List.tl x) = []
 H1. (List.tl x) <> []
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. 0 = num_occurs (List.hd x) (List.tl (List.tl x))
 C2. List.hd (List.tl x) = List.hd x

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 1.1:

 H0. (List.tl x) <> []
 H1. List.tl (List.tl x) = []
 H2. List.hd (List.tl x) = List.hd x
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. 1 =
     num_occurs (List.hd x) (List.tl x)
     + -1 * num_occurs (List.hd x) (odds (List.tl (List.tl x)))

This simplifies, using the definitions of num_occurs and odds to:

Subgoal 1.1':

 H0. List.tl (List.tl x) = []
 H1. (List.tl x) <> []
 H2. List.hd (List.tl x) = List.hd x
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. 0 = num_occurs (List.hd x) (List.tl (List.tl x))

But simplification reduces this to true, using the definition of num_occurs.

 ⓘ  Rules:
    (:def num_occurs)
    (:def odds)
    (:induct num_occurs)

Proved

proof

ground_instances	0
definitions	48
inductions	1
search_time	1.262s

Expand

start[1.262s, "Goal"]
  let (_x_0 : int list) = List.tl ( :var_0: ) in
  not (( :var_0: ) = []) && not (_x_0 = [])
  ==> num_occurs ( :var_1: ) (odds _x_0) =
      num_occurs ( :var_1: ) ( :var_0: ) -
      num_occurs ( :var_1: ) (odds ( :var_0: ))

subproof

let (_x_0 : int list) = List.tl x in (x = [] || _x_0 = []) || num_occurs a (odds _x_0) = num_occurs a x + -1 * num_occurs a (odds x)

start[1.261s, "1"]
  let (_x_0 : int list) = List.tl x in
  (x = [] || _x_0 = [])
  || num_occurs a (odds _x_0) = num_occurs a x + -1 * num_occurs a (odds x)

induction on (functional num_occurs)
:scheme (not (List.hd x = a && not Is_a([], x))
         && not (not (List.hd x = a) && not Is_a([], x)) ==> φ a x)
        && (not Is_a([], x) && not (List.hd x = a) && φ a (List.tl x)
            ==> φ a x)
           && (not Is_a([], x) && List.hd x = a && φ a (List.tl x)
               ==> φ a x)

Split (let (_x_0 : int list) = List.tl x in
       let (_x_1 : bool) = not (_x_0 = []) in
       let (_x_2 : int) = num_occurs a (odds _x_0) in
       let (_x_3 : bool)
           = not (not (x = []) && _x_1)
             || _x_2 = num_occurs a x + -1 * num_occurs a (odds x)
       in
       let (_x_4 : bool) = List.hd x = a in
       let (_x_5 : bool) = not Is_a([], x) in
       let (_x_6 : bool) = not _x_4 in
       let (_x_7 : int list) = List.tl _x_0 in
       let (_x_8 : bool)
           = not (_x_1 && not (_x_7 = []))
             || num_occurs a (odds _x_7) = num_occurs a _x_0 + -1 * _x_2
       in
       ((_x_3 || not (not (_x_4 && _x_5) && not (_x_6 && _x_5)))
        && (_x_3 || not ((_x_5 && _x_6) && _x_8)))
       && (_x_3 || not ((_x_5 && _x_4) && _x_8))
       :cases [let (_x_0 : int list) = List.tl x in
               let (_x_1 : bool) = List.hd x = a in
               let (_x_2 : bool) = not Is_a([], x) in
               (((x = [] || _x_0 = []) || _x_1 && _x_2) || not _x_1 && _x_2)
               || num_occurs a (odds _x_0) =
                  num_occurs a x + -1 * num_occurs a (odds x);
               let (_x_0 : int list) = List.tl x in
               let (_x_1 : bool) = _x_0 = [] in
               let (_x_2 : int list) = List.tl _x_0 in
               let (_x_3 : int) = num_occurs a (odds _x_0) in
               ((((x = [] || _x_1) || Is_a([], x)) || List.hd x = a)
                || not
                   (not _x_1 && not (_x_2 = [])
                    ==> num_occurs a (odds _x_2) =
                        num_occurs a _x_0 + -1 * _x_3))
               || _x_3 = num_occurs a x + -1 * num_occurs a (odds x);
               let (_x_0 : int list) = List.tl x in
               let (_x_1 : bool) = _x_0 = [] in
               let (_x_2 : int list) = List.tl _x_0 in
               let (_x_3 : int) = num_occurs a (odds _x_0) in
               ((((x = [] || _x_1) || Is_a([], x)) || not (List.hd x = a))
                || not
                   (not _x_1 && not (_x_2 = [])
                    ==> num_occurs a (odds _x_2) =
                        num_occurs a _x_0 + -1 * _x_3))
               || _x_3 = num_occurs a x + -1 * num_occurs a (odds x)])

subproof

let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = _x_0 = [] in let (_x_2 : int list) = List.tl _x_0 in let (_x_3 : int) = num_occurs a (odds _x_0) in ((((x = [] || _x_1) || Is_a([], x)) || not (List.hd x = a)) || not (not _x_1 && not (_x_2 = []) ==> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3)) || _x_3 = num_occurs a x + -1 * num_occurs a (odds x)

start[1.260s, "1"]
  let (_x_0 : int list) = List.tl x in
  let (_x_1 : bool) = _x_0 = [] in
  let (_x_2 : int list) = List.tl _x_0 in
  let (_x_3 : int) = num_occurs a (odds _x_0) in
  ((((x = [] || _x_1) || Is_a([], x)) || not (List.hd x = a))
   || not
      (not _x_1 && not (_x_2 = [])
       ==> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3))
  || _x_3 = num_occurs a x + -1 * num_occurs a (odds x)

simplify

into	let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = Is_a([], x) \|\| _x_0 = [] in let (_x_2 : int list) = List.tl _x_0 in let (_x_3 : bool) = _x_2 = [] in let (_x_4 : int) = List.hd x in let (_x_5 : int) = num_occurs _x_4 (odds _x_0) in let (_x_6 : int) = num_occurs _x_4 (odds _x_2) in let (_x_7 : int) = num_occurs _x_4 _x_0 + -1 * _x_6 in let (_x_8 : bool) = (_x_1 \|\| _x_3) \|\| _x_5 = _x_7 in let (_x_9 : int) = num_occurs _x_4 _x_2 in let (_x_10 : int) = -1 * _x_5 in let (_x_11 : bool) = List.hd _x_0 = _x_4 in let (_x_12 : bool) = not _x_11 in let (_x_13 : bool) = _x_1 \|\| not _x_3 in ((((_x_8 \|\| not (_x_6 = _x_9 + _x_10)) \|\| _x_11) && ((_x_8 \|\| _x_12) \|\| not (_x_6 = 1 + _x_9 + _x_10))) && ((_x_13 \|\| 0 = _x_7) \|\| _x_11)) && ((_x_13 \|\| 1 = _x_7) \|\| _x_12)
expansions	[num_occurs, odds, num_occurs, num_occurs, num_occurs, num_occurs, odds, num_occurs, odds, num_occurs, num_occurs, odds, num_occurs, num_occurs]
rewrite_steps
forward_chaining

```
Subproof
```
```
Subproof
```
```
Subproof
```
```
Subproof
```

subproof

let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = _x_0 = [] in let (_x_2 : int list) = List.tl _x_0 in let (_x_3 : int) = num_occurs a (odds _x_0) in ((((x = [] || _x_1) || Is_a([], x)) || List.hd x = a) || not (not _x_1 && not (_x_2 = []) ==> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3)) || _x_3 = num_occurs a x + -1 * num_occurs a (odds x)

start[1.261s, "2"]
  let (_x_0 : int list) = List.tl x in
  let (_x_1 : bool) = _x_0 = [] in
  let (_x_2 : int list) = List.tl _x_0 in
  let (_x_3 : int) = num_occurs a (odds _x_0) in
  ((((x = [] || _x_1) || Is_a([], x)) || List.hd x = a)
   || not
      (not _x_1 && not (_x_2 = [])
       ==> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3))
  || _x_3 = num_occurs a x + -1 * num_occurs a (odds x)

simplify

into	let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = (List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = [] in let (_x_2 : int list) = List.tl _x_0 in let (_x_3 : bool) = _x_2 = [] in let (_x_4 : bool) = _x_1 \|\| _x_3 in let (_x_5 : int) = num_occurs a (odds _x_2) in let (_x_6 : int) = num_occurs a _x_2 in let (_x_7 : int) = num_occurs a (odds _x_0) in let (_x_8 : int) = -1 * _x_7 in let (_x_9 : bool) = List.hd _x_0 = a in let (_x_10 : int) = num_occurs a _x_0 + -1 * _x_5 in let (_x_11 : bool) = _x_7 = _x_10 in let (_x_12 : bool) = not _x_9 in let (_x_13 : bool) = _x_1 \|\| not _x_3 in (((((_x_4 \|\| not (_x_5 = _x_6 + _x_8)) \|\| _x_9) \|\| _x_11) && (((_x_4 \|\| not (_x_5 = 1 + _x_6 + _x_8)) \|\| _x_12) \|\| _x_11)) && ((_x_13 \|\| _x_9) \|\| 0 = _x_10)) && ((_x_13 \|\| _x_12) \|\| 1 = _x_10)
expansions	[num_occurs, odds, num_occurs, num_occurs, num_occurs, num_occurs, odds, num_occurs, odds, num_occurs, num_occurs, odds, num_occurs, num_occurs]
rewrite_steps
forward_chaining

```
Subproof
```
```
Subproof
```
```
Subproof
```
```
Subproof
```

subproof
let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = List.hd x = a in let (_x_2 : bool) = not Is_a([], x) in (((x = [] || _x_0 = []) || _x_1 && _x_2) || not _x_1 && _x_2) || num_occurs a (odds _x_0) = num_occurs a x + -1 * num_occurs a (odds x)
- start[1.261s, "3"] let (_x_0 : int list) = List.tl x in let (_x_1 : bool) = List.hd x = a in let (_x_2 : bool) = not Is_a([], x) in (((x = [] || _x_0 = []) || _x_1 && _x_2) || not _x_1 && _x_2) || num_occurs a (odds _x_0) = num_occurs a x + -1 * num_occurs a (odds x)
- simplify
  into
  true
  expansions
  []
  rewrite_steps
  forward_chaining

digraph "proof" {
p_536 [label="Start (let (_x_0 : int list) = List.tl ( :var_0: ) in\l       not (( :var_0: ) = []) && not (_x_0 = [])\l       ==\> num_occurs ( :var_1: ) (odds _x_0) =\l           num_occurs ( :var_1: ) ( :var_0: ) -\l           num_occurs ( :var_1: ) (odds ( :var_0: ))\l       :name \"Goal\" :time 1.262s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_536 -> p_534 [label=""];
subgraph cluster_535 {
  color=blue;
p_534 [label="Start (let (_x_0 : int list) = List.tl x in\l       (x = [] \|\| _x_0 = [])\l       \|\| num_occurs a (odds _x_0) =\l          num_occurs a x + -1 * num_occurs a (odds x)\l       :name \"1\" :time 1.261s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_534 -> p_533 [label=""];
p_533 [label="Induct ((functional num_occurs),\l        :scheme (not (List.hd x = a && not Is_a([], x))\l                 && not (not (List.hd x = a) && not Is_a([], x)) ==\> \l                 φ a x)\l                && (not Is_a([], x)\l                    && not (List.hd x = a) && φ a (List.tl x) ==\> φ a x)\l                   && (not Is_a([], x) && List.hd x = a && φ a (List.tl x)\l                       ==\> φ a x))",shape=box,style=filled,fontname="courier",fontsize=14];
p_533 -> p_532 [label=""];
p_532 [label="Split (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = not (_x_0 = []) in\l       let (_x_2 : int) = num_occurs a (odds _x_0) in\l       let (_x_3 : bool)\l           = not (not (x = []) && _x_1)\l             \|\| _x_2 = num_occurs a x + -1 * num_occurs a (odds x)\l       in\l       let (_x_4 : bool) = List.hd x = a in\l       let (_x_5 : bool) = not Is_a([], x) in\l       let (_x_6 : bool) = not _x_4 in\l       let (_x_7 : int list) = List.tl _x_0 in\l       let (_x_8 : bool)\l           = not (_x_1 && not (_x_7 = []))\l             \|\| num_occurs a (odds _x_7) = num_occurs a _x_0 + -1 * _x_2\l       in\l       ((_x_3 \|\| not (not (_x_4 && _x_5) && not (_x_6 && _x_5)))\l        && (_x_3 \|\| not ((_x_5 && _x_6) && _x_8)))\l       && (_x_3 \|\| not ((_x_5 && _x_4) && _x_8))\l       :cases [let (_x_0 : int list) = List.tl x in\l               let (_x_1 : bool) = List.hd x = a in\l               let (_x_2 : bool) = not Is_a([], x) in\l               (((x = [] \|\| _x_0 = []) \|\| _x_1 && _x_2) \|\| not _x_1 && _x_2)\l               \|\| num_occurs a (odds _x_0) =\l                  num_occurs a x + -1 * num_occurs a (odds x);\l               let (_x_0 : int list) = List.tl x in\l               let (_x_1 : bool) = _x_0 = [] in\l               let (_x_2 : int list) = List.tl _x_0 in\l               let (_x_3 : int) = num_occurs a (odds _x_0) in\l               ((((x = [] \|\| _x_1) \|\| Is_a([], x)) \|\| List.hd x = a)\l                \|\| not\l                   (not _x_1 && not (_x_2 = [])\l                    ==\> num_occurs a (odds _x_2) =\l                        num_occurs a _x_0 + -1 * _x_3))\l               \|\| _x_3 = num_occurs a x + -1 * num_occurs a (odds x);\l               let (_x_0 : int list) = List.tl x in\l               let (_x_1 : bool) = _x_0 = [] in\l               let (_x_2 : int list) = List.tl _x_0 in\l               let (_x_3 : int) = num_occurs a (odds _x_0) in\l               ((((x = [] \|\| _x_1) \|\| Is_a([], x)) \|\| not (List.hd x = a))\l                \|\| not\l                   (not _x_1 && not (_x_2 = [])\l                    ==\> num_occurs a (odds _x_2) =\l                        num_occurs a _x_0 + -1 * _x_3))\l               \|\| _x_3 = num_occurs a x + -1 * num_occurs a (odds x)])",shape=box,style=filled,fontname="courier",fontsize=14];
p_532 -> p_510 [label=""];
subgraph cluster_511 {
  color=blue;
p_510 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = _x_0 = [] in\l       let (_x_2 : int list) = List.tl _x_0 in\l       let (_x_3 : int) = num_occurs a (odds _x_0) in\l       ((((x = [] \|\| _x_1) \|\| Is_a([], x)) \|\| not (List.hd x = a))\l        \|\| not\l           (not _x_1 && not (_x_2 = [])\l            ==\> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3))\l       \|\| _x_3 = num_occurs a x + -1 * num_occurs a (odds x) :name \"1\"\l       :time 1.260s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_510 -> p_509 [label=""];
p_509 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : bool) = Is_a([], x) \|\| _x_0 = [] in\l          let (_x_2 : int list) = List.tl _x_0 in\l          let (_x_3 : bool) = _x_2 = [] in\l          let (_x_4 : int) = List.hd x in\l          let (_x_5 : int) = num_occurs _x_4 (odds _x_0) in\l          let (_x_6 : int) = num_occurs _x_4 (odds _x_2) in\l          let (_x_7 : int) = num_occurs _x_4 _x_0 + -1 * _x_6 in\l          let (_x_8 : bool) = (_x_1 \|\| _x_3) \|\| _x_5 = _x_7 in\l          let (_x_9 : int) = num_occurs _x_4 _x_2 in\l          let (_x_10 : int) = -1 * _x_5 in\l          let (_x_11 : bool) = List.hd _x_0 = _x_4 in\l          let (_x_12 : bool) = not _x_11 in\l          let (_x_13 : bool) = _x_1 \|\| not _x_3 in\l          ((((_x_8 \|\| not (_x_6 = _x_9 + _x_10)) \|\| _x_11)\l            && ((_x_8 \|\| _x_12) \|\| not (_x_6 = 1 + _x_9 + _x_10)))\l           && ((_x_13 \|\| 0 = _x_7) \|\| _x_11))\l          && ((_x_13 \|\| 1 = _x_7) \|\| _x_12)\l          :expansions [num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_509 -> p_497 [label=""];
subgraph cluster_498 {
  color=blue;
p_497 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = List.hd x in\l       (((Is_a([], x) \|\| _x_0 = []) \|\| not (_x_1 = []))\l        \|\| 1 = num_occurs _x_2 _x_0 + -1 * num_occurs _x_2 (odds _x_1))\l       \|\| not (List.hd _x_0 = _x_2) :name \"1.1\" :time 0.320s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_497 -> p_496 [label=""];
p_496 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = List.tl _x_0 in\l          let (_x_2 : int) = List.hd x in\l          (((Is_a([], x) \|\| not (_x_1 = [])) \|\| not (_x_0 \<\> []))\l           \|\| 0 = num_occurs _x_2 _x_1)\l          \|\| not (List.hd _x_0 = _x_2)\l          :expansions [num_occurs; odds; num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_496 -> p_495 [label=""];
p_495 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_509 -> p_501 [label=""];
subgraph cluster_502 {
  color=blue;
p_501 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = List.hd x in\l       (((Is_a([], x) \|\| _x_0 = []) \|\| not (_x_1 = []))\l        \|\| 0 = num_occurs _x_2 _x_0 + -1 * num_occurs _x_2 (odds _x_1))\l       \|\| List.hd _x_0 = _x_2 :name \"1.2\" :time 0.320s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_501 -> p_500 [label=""];
p_500 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = List.tl _x_0 in\l          let (_x_2 : int) = List.hd x in\l          (((Is_a([], x) \|\| not (_x_1 = [])) \|\| not (_x_0 \<\> []))\l           \|\| 0 = num_occurs _x_2 _x_1)\l          \|\| List.hd _x_0 = _x_2 :expansions [num_occurs; odds; num_occurs]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_500 -> p_499 [label=""];
p_499 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_509 -> p_504 [label=""];
subgraph cluster_505 {
  color=blue;
p_504 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = List.hd x in\l       let (_x_3 : int) = num_occurs _x_2 (odds _x_0) in\l       let (_x_4 : int) = num_occurs _x_2 (odds _x_1) in\l       ((((Is_a([], x) \|\| _x_0 = []) \|\| _x_1 = [])\l         \|\| _x_3 = num_occurs _x_2 _x_0 + -1 * _x_4)\l        \|\| not (List.hd _x_0 = _x_2))\l       \|\| not (_x_4 = 1 + num_occurs _x_2 _x_1 + -1 * _x_3) :name \"1.3\"\l       :time 0.320s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_504 -> p_503 [label=""];
p_503 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_509 -> p_507 [label=""];
subgraph cluster_508 {
  color=blue;
p_507 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = List.hd x in\l       let (_x_3 : int) = num_occurs _x_2 (odds _x_0) in\l       let (_x_4 : int) = num_occurs _x_2 (odds _x_1) in\l       ((((Is_a([], x) \|\| _x_0 = []) \|\| _x_1 = [])\l         \|\| _x_3 = num_occurs _x_2 _x_0 + -1 * _x_4)\l        \|\| not (_x_4 = num_occurs _x_2 _x_1 + -1 * _x_3))\l       \|\| List.hd _x_0 = _x_2 :name \"1.4\" :time 0.321s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_507 -> p_506 [label=""];
p_506 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_532 -> p_527 [label=""];
subgraph cluster_528 {
  color=blue;
p_527 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = _x_0 = [] in\l       let (_x_2 : int list) = List.tl _x_0 in\l       let (_x_3 : int) = num_occurs a (odds _x_0) in\l       ((((x = [] \|\| _x_1) \|\| Is_a([], x)) \|\| List.hd x = a)\l        \|\| not\l           (not _x_1 && not (_x_2 = [])\l            ==\> num_occurs a (odds _x_2) = num_occurs a _x_0 + -1 * _x_3))\l       \|\| _x_3 = num_occurs a x + -1 * num_occurs a (odds x) :name \"2\"\l       :time 1.261s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_527 -> p_526 [label=""];
p_526 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : bool) = (List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = [] in\l          let (_x_2 : int list) = List.tl _x_0 in\l          let (_x_3 : bool) = _x_2 = [] in\l          let (_x_4 : bool) = _x_1 \|\| _x_3 in\l          let (_x_5 : int) = num_occurs a (odds _x_2) in\l          let (_x_6 : int) = num_occurs a _x_2 in\l          let (_x_7 : int) = num_occurs a (odds _x_0) in\l          let (_x_8 : int) = -1 * _x_7 in\l          let (_x_9 : bool) = List.hd _x_0 = a in\l          let (_x_10 : int) = num_occurs a _x_0 + -1 * _x_5 in\l          let (_x_11 : bool) = _x_7 = _x_10 in\l          let (_x_12 : bool) = not _x_9 in\l          let (_x_13 : bool) = _x_1 \|\| not _x_3 in\l          (((((_x_4 \|\| not (_x_5 = _x_6 + _x_8)) \|\| _x_9) \|\| _x_11)\l            && (((_x_4 \|\| not (_x_5 = 1 + _x_6 + _x_8)) \|\| _x_12) \|\| _x_11))\l           && ((_x_13 \|\| _x_9) \|\| 0 = _x_10))\l          && ((_x_13 \|\| _x_12) \|\| 1 = _x_10)\l          :expansions [num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs;\l                       odds;\l                       num_occurs;\l                       num_occurs]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_526 -> p_514 [label=""];
subgraph cluster_515 {
  color=blue;
p_514 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       ((((List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = []) \|\| not (_x_1 = []))\l        \|\| not (List.hd _x_0 = a))\l       \|\| 1 = num_occurs a _x_0 + -1 * num_occurs a (odds _x_1) :name \"2.1\"\l       :time 0.872s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_514 -> p_513 [label=""];
p_513 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = List.tl _x_0 in\l          let (_x_2 : int) = List.hd _x_0 in\l          (((Is_a([], x) \|\| not (_x_1 = [])) \|\| not (_x_0 \<\> []))\l           \|\| List.hd x = _x_2)\l          \|\| 0 = num_occurs _x_2 _x_1\l          :expansions [num_occurs; odds; num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_513 -> p_512 [label=""];
p_512 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_526 -> p_518 [label=""];
subgraph cluster_519 {
  color=blue;
p_518 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       ((((List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = []) \|\| not (_x_1 = []))\l        \|\| List.hd _x_0 = a)\l       \|\| 0 = num_occurs a _x_0 + -1 * num_occurs a (odds _x_1) :name \"2.2\"\l       :time 0.872s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_518 -> p_517 [label=""];
p_517 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = List.tl _x_0 in\l          ((((List.hd x = a \|\| Is_a([], x)) \|\| not (_x_1 = []))\l            \|\| not (_x_0 \<\> []))\l           \|\| List.hd _x_0 = a)\l          \|\| 0 = num_occurs a _x_1 :expansions [num_occurs; odds; num_occurs]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_517 -> p_516 [label=""];
p_516 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_526 -> p_521 [label=""];
subgraph cluster_522 {
  color=blue;
p_521 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = num_occurs a (odds _x_1) in\l       let (_x_3 : int) = num_occurs a (odds _x_0) in\l       (((((List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = []) \|\| _x_1 = [])\l         \|\| not (_x_2 = 1 + num_occurs a _x_1 + -1 * _x_3))\l        \|\| not (List.hd _x_0 = a))\l       \|\| _x_3 = num_occurs a _x_0 + -1 * _x_2 :name \"2.3\" :time 0.872s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_521 -> p_520 [label=""];
p_520 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_526 -> p_524 [label=""];
subgraph cluster_525 {
  color=blue;
p_524 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = List.tl _x_0 in\l       let (_x_2 : int) = num_occurs a (odds _x_1) in\l       let (_x_3 : int) = num_occurs a (odds _x_0) in\l       (((((List.hd x = a \|\| Is_a([], x)) \|\| _x_0 = []) \|\| _x_1 = [])\l         \|\| not (_x_2 = num_occurs a _x_1 + -1 * _x_3))\l        \|\| List.hd _x_0 = a)\l       \|\| _x_3 = num_occurs a _x_0 + -1 * _x_2 :name \"2.4\" :time 0.872s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_524 -> p_523 [label=""];
p_523 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_532 -> p_530 [label=""];
subgraph cluster_531 {
  color=blue;
p_530 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = List.hd x = a in\l       let (_x_2 : bool) = not Is_a([], x) in\l       (((x = [] \|\| _x_0 = []) \|\| _x_1 && _x_2) \|\| not _x_1 && _x_2)\l       \|\| num_occurs a (odds _x_0) =\l          num_occurs a x + -1 * num_occurs a (odds x)\l       :name \"3\" :time 1.261s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_530 -> p_529 [label=""];
p_529 [label="Simplify (true :expansions [] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}

Finally, let's put the pieces together and prove our main remaining theorem.

And now, our second main theorem at last:

Try this!

In [28]:

theorem merge_sort_elements a (x : int list) =
 num_occurs a x = num_occurs a (merge_sort x)
[@@induct functional merge_sort]

Out[28]:

val merge_sort_elements : int -> int list -> bool = <fun>
Goal:

num_occurs a x = num_occurs a (merge_sort x).

1 nontautological subgoal.

We shall induct according to a scheme derived from merge_sort.

Induction scheme:

 (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ a x)
 && (not Is_a([], x)
     && not Is_a([], List.tl x) && φ a (odds (List.tl x)) && φ a (odds x)
     ==> φ a x).

2 nontautological subgoals.

Subgoal 2:

|---------------------------------------------------------------------------
 C0. not Is_a([], List.tl x) && not Is_a([], x)
 C1. num_occurs a x = num_occurs a (merge_sort x)

This simplifies, using the definitions of merge_sort and num_occurs to the
following 3 subgoals:

Subgoal 2.3:

 H0. Is_a([], List.tl x)
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. List.hd x = a
 C2. num_occurs a x = 0

This simplifies, using the definition of num_occurs to:

Subgoal 2.3':

 H0. Is_a([], List.tl x)
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. List.hd x = a
 C2. num_occurs a (List.tl x) = 0

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 2.2:

 H0. Is_a([], List.tl x)
 H1. List.hd x = a
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. num_occurs a x = 1

This simplifies, using the definition of num_occurs to:

Subgoal 2.2':

 H0. Is_a([], List.tl x)
|---------------------------------------------------------------------------
 C0. Is_a([], x)
 C1. num_occurs (List.hd x) (List.tl x) = 0

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 2.1:

 H0. Is_a([], List.tl x)
 H1. Is_a([], x)
|---------------------------------------------------------------------------
 num_occurs a x = 0

But simplification reduces this to true, using the definition of num_occurs.

Subgoal 1:

 H0. not Is_a([], x)
 H1. not Is_a([], List.tl x)
 H2. num_occurs a (odds (List.tl x)) =
     num_occurs a (merge_sort (odds (List.tl x)))
 H3. num_occurs a (odds x) = num_occurs a (merge_sort (odds x))
|---------------------------------------------------------------------------
 num_occurs a x = num_occurs a (merge_sort x)

This simplifies, using the definitions of merge_sort and num_occurs, and the
rewrite rule num_occurs_arith to the following 2 subgoals:

Subgoal 1.2:

 H0. num_occurs a (odds x) = num_occurs a (merge_sort (odds x))
 H1. num_occurs a (List.tl x) + -1 * num_occurs a (odds x) =
     num_occurs a (merge_sort (odds (List.tl x)))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)
 C2. List.hd x = a
 C3. num_occurs a (List.tl x) =
     num_occurs a
     (merge (merge_sort (odds x)) (merge_sort (odds (List.tl x))))

But simplification reduces this to true, using the rewrite rule
num_occur_merge.

Subgoal 1.1:

 H0. num_occurs a (odds x) = num_occurs a (merge_sort (odds x))
 H1. List.hd x = a
 H2. num_occurs a (List.tl x) + -1 * num_occurs a (odds x) =
     -1 + num_occurs a (merge_sort (odds (List.tl x)))
|---------------------------------------------------------------------------
 C0. Is_a([], List.tl x)
 C1. Is_a([], x)
 C2. num_occurs a (List.tl x) =
     -1
     + num_occurs a
       (merge (merge_sort (odds x)) (merge_sort (odds (List.tl x))))

But simplification reduces this to true, using the rewrite rule
num_occur_merge.

 ⓘ  Rules:
    (:def merge_sort)
    (:def num_occurs)
    (:rw num_occur_merge)
    (:rw num_occurs_arith)
    (:induct merge_sort)

Proved

proof

ground_instances	0
definitions	17
inductions	1
search_time	1.532s

Expand

start[1.532s, "Goal"]
  num_occurs ( :var_0: ) ( :var_1: ) =
  num_occurs ( :var_0: ) (merge_sort ( :var_1: ))

subproof

num_occurs a x = num_occurs a (merge_sort x)

start[1.532s, "1"] num_occurs a x = num_occurs a (merge_sort x)

induction on (functional merge_sort)
:scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==> φ a x)
        && (not Is_a([], x)
            && not Is_a([], List.tl x)
               && φ a (odds (List.tl x)) && φ a (odds x)
            ==> φ a x)

Split (let (_x_0 : int list) = List.tl x in
       let (_x_1 : bool) = not Is_a([], _x_0) in
       let (_x_2 : bool) = not Is_a([], x) in
       let (_x_3 : bool) = num_occurs a x = num_occurs a (merge_sort x) in
       let (_x_4 : int list) = odds _x_0 in
       let (_x_5 : int list) = odds x in
       (_x_1 && _x_2 || _x_3)
       && (not
           (((_x_2 && _x_1)
             && num_occurs a _x_4 = num_occurs a (merge_sort _x_4))
            && num_occurs a _x_5 = num_occurs a (merge_sort _x_5))
           || _x_3)
       :cases [not Is_a([], List.tl x) && not Is_a([], x)
               || num_occurs a x = num_occurs a (merge_sort x);
               let (_x_0 : int list) = List.tl x in
               let (_x_1 : int list) = odds _x_0 in
               let (_x_2 : int list) = odds x in
               (((Is_a([], x) || Is_a([], _x_0))
                 || not (num_occurs a _x_1 = num_occurs a (merge_sort _x_1)))
                || not (num_occurs a _x_2 = num_occurs a (merge_sort _x_2)))
               || num_occurs a x = num_occurs a (merge_sort x)])

subproof

let (_x_0 : int list) = List.tl x in let (_x_1 : int list) = odds _x_0 in let (_x_2 : int list) = odds x in (((Is_a([], x) || Is_a([], _x_0)) || not (num_occurs a _x_1 = num_occurs a (merge_sort _x_1))) || not (num_occurs a _x_2 = num_occurs a (merge_sort _x_2))) || num_occurs a x = num_occurs a (merge_sort x)

start[1.531s, "1"]
  let (_x_0 : int list) = List.tl x in
  let (_x_1 : int list) = odds _x_0 in
  let (_x_2 : int list) = odds x in
  (((Is_a([], x) || Is_a([], _x_0))
    || not (num_occurs a _x_1 = num_occurs a (merge_sort _x_1)))
   || not (num_occurs a _x_2 = num_occurs a (merge_sort _x_2)))
  || num_occurs a x = num_occurs a (merge_sort x)

simplify

into	let (_x_0 : int list) = List.tl x in let (_x_1 : int list) = odds x in let (_x_2 : int) = num_occurs a _x_1 in let (_x_3 : int list) = merge_sort _x_1 in let (_x_4 : bool) = (Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (_x_2 = num_occurs a _x_3) in let (_x_5 : bool) = List.hd x = a in let (_x_6 : int) = num_occurs a _x_0 in let (_x_7 : int) = _x_6 + -1 * _x_2 in let (_x_8 : int list) = merge_sort (odds _x_0) in let (_x_9 : int) = num_occurs a _x_8 in let (_x_10 : int) = num_occurs a (merge _x_3 _x_8) in (((_x_4 \|\| _x_5) \|\| not (_x_7 = _x_9)) \|\| _x_6 = _x_10) && (((_x_4 \|\| not _x_5) \|\| not (_x_7 = -1 + _x_9)) \|\| _x_6 = -1 + _x_10)
expansions	[merge_sort, num_occurs, merge_sort, num_occurs, num_occurs]
rewrite_steps	num_occurs_arith
forward_chaining

```
Subproof
```
```
Subproof
```

subproof

not Is_a([], List.tl x) && not Is_a([], x) || num_occurs a x = num_occurs a (merge_sort x)

start[1.531s, "2"]
  not Is_a([], List.tl x) && not Is_a([], x)
  || num_occurs a x = num_occurs a (merge_sort x)

simplify

into	let (_x_0 : bool) = not Is_a([], List.tl x) in let (_x_1 : bool) = Is_a([], x) in let (_x_2 : bool) = _x_0 \|\| _x_1 in let (_x_3 : bool) = List.hd x = a in let (_x_4 : int) = num_occurs a x in let (_x_5 : bool) = _x_4 = 0 in (((_x_2 \|\| _x_3) \|\| _x_5) && ((_x_2 \|\| not _x_3) \|\| _x_4 = 1)) && ((_x_0 \|\| not _x_1) \|\| _x_5)
expansions	[num_occurs, merge_sort, num_occurs, num_occurs, num_occurs, num_occurs, merge_sort]
rewrite_steps
forward_chaining

```
Subproof
```
```
Subproof
```
```
Subproof
```

digraph "proof" {
p_564 [label="Start (num_occurs ( :var_0: ) ( :var_1: ) =\l       num_occurs ( :var_0: ) (merge_sort ( :var_1: )) :name \"Goal\"\l       :time 1.532s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_564 -> p_562 [label=""];
subgraph cluster_563 {
  color=blue;
p_562 [label="Start (num_occurs a x = num_occurs a (merge_sort x) :name \"1\" :time 1.532s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_562 -> p_561 [label=""];
p_561 [label="Induct ((functional merge_sort),\l        :scheme (not (not Is_a([], List.tl x) && not Is_a([], x)) ==\> φ a x)\l                && (not Is_a([], x)\l                    && not Is_a([], List.tl x)\l                       && φ a (odds (List.tl x)) && φ a (odds x)\l                    ==\> φ a x))",shape=box,style=filled,fontname="courier",fontsize=14];
p_561 -> p_560 [label=""];
p_560 [label="Split (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : bool) = not Is_a([], _x_0) in\l       let (_x_2 : bool) = not Is_a([], x) in\l       let (_x_3 : bool) = num_occurs a x = num_occurs a (merge_sort x) in\l       let (_x_4 : int list) = odds _x_0 in\l       let (_x_5 : int list) = odds x in\l       (_x_1 && _x_2 \|\| _x_3)\l       && (not\l           (((_x_2 && _x_1)\l             && num_occurs a _x_4 = num_occurs a (merge_sort _x_4))\l            && num_occurs a _x_5 = num_occurs a (merge_sort _x_5))\l           \|\| _x_3)\l       :cases [not Is_a([], List.tl x) && not Is_a([], x)\l               \|\| num_occurs a x = num_occurs a (merge_sort x);\l               let (_x_0 : int list) = List.tl x in\l               let (_x_1 : int list) = odds _x_0 in\l               let (_x_2 : int list) = odds x in\l               (((Is_a([], x) \|\| Is_a([], _x_0))\l                 \|\| not (num_occurs a _x_1 = num_occurs a (merge_sort _x_1)))\l                \|\| not (num_occurs a _x_2 = num_occurs a (merge_sort _x_2)))\l               \|\| num_occurs a x = num_occurs a (merge_sort x)])",shape=box,style=filled,fontname="courier",fontsize=14];
p_560 -> p_544 [label=""];
subgraph cluster_545 {
  color=blue;
p_544 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = odds _x_0 in\l       let (_x_2 : int list) = odds x in\l       (((Is_a([], x) \|\| Is_a([], _x_0))\l         \|\| not (num_occurs a _x_1 = num_occurs a (merge_sort _x_1)))\l        \|\| not (num_occurs a _x_2 = num_occurs a (merge_sort _x_2)))\l       \|\| num_occurs a x = num_occurs a (merge_sort x) :name \"1\" :time 1.531s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_544 -> p_543 [label=""];
p_543 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          let (_x_1 : int list) = odds x in\l          let (_x_2 : int) = num_occurs a _x_1 in\l          let (_x_3 : int list) = merge_sort _x_1 in\l          let (_x_4 : bool)\l              = (Is_a([], _x_0) \|\| Is_a([], x))\l                \|\| not (_x_2 = num_occurs a _x_3)\l          in\l          let (_x_5 : bool) = List.hd x = a in\l          let (_x_6 : int) = num_occurs a _x_0 in\l          let (_x_7 : int) = _x_6 + -1 * _x_2 in\l          let (_x_8 : int list) = merge_sort (odds _x_0) in\l          let (_x_9 : int) = num_occurs a _x_8 in\l          let (_x_10 : int) = num_occurs a (merge _x_3 _x_8) in\l          (((_x_4 \|\| _x_5) \|\| not (_x_7 = _x_9)) \|\| _x_6 = _x_10)\l          && (((_x_4 \|\| not _x_5) \|\| not (_x_7 = -1 + _x_9))\l              \|\| _x_6 = -1 + _x_10)\l          :expansions [merge_sort;\l                       num_occurs;\l                       merge_sort;\l                       num_occurs;\l                       num_occurs]\l          :rw [num_occurs_arith] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_543 -> p_538 [label=""];
subgraph cluster_539 {
  color=blue;
p_538 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = odds x in\l       let (_x_2 : int) = num_occurs a _x_1 in\l       let (_x_3 : int list) = merge_sort _x_1 in\l       let (_x_4 : int) = num_occurs a _x_0 in\l       let (_x_5 : int list) = merge_sort (odds _x_0) in\l       ((((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (_x_2 = num_occurs a _x_3))\l         \|\| not (List.hd x = a))\l        \|\| not (_x_4 + -1 * _x_2 = -1 + num_occurs a _x_5))\l       \|\| _x_4 = -1 + num_occurs a (merge _x_3 _x_5) :name \"1.1\" :time 0.453s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_538 -> p_537 [label=""];
p_537 [label="Simplify (true :expansions [] :rw [num_occur_merge] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_543 -> p_541 [label=""];
subgraph cluster_542 {
  color=blue;
p_541 [label="Start (let (_x_0 : int list) = List.tl x in\l       let (_x_1 : int list) = odds x in\l       let (_x_2 : int) = num_occurs a _x_1 in\l       let (_x_3 : int list) = merge_sort _x_1 in\l       let (_x_4 : int) = num_occurs a _x_0 in\l       let (_x_5 : int list) = merge_sort (odds _x_0) in\l       ((((Is_a([], _x_0) \|\| Is_a([], x)) \|\| not (_x_2 = num_occurs a _x_3))\l         \|\| List.hd x = a)\l        \|\| not (_x_4 + -1 * _x_2 = num_occurs a _x_5))\l       \|\| _x_4 = num_occurs a (merge _x_3 _x_5) :name \"1.2\" :time 0.453s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_541 -> p_540 [label=""];
p_540 [label="Simplify (true :expansions [] :rw [num_occur_merge] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
p_560 -> p_558 [label=""];
subgraph cluster_559 {
  color=blue;
p_558 [label="Start (not Is_a([], List.tl x) && not Is_a([], x)\l       \|\| num_occurs a x = num_occurs a (merge_sort x) :name \"2\" :time 1.531s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_558 -> p_557 [label=""];
p_557 [label="Simplify (let (_x_0 : bool) = not Is_a([], List.tl x) in\l          let (_x_1 : bool) = Is_a([], x) in\l          let (_x_2 : bool) = _x_0 \|\| _x_1 in\l          let (_x_3 : bool) = List.hd x = a in\l          let (_x_4 : int) = num_occurs a x in\l          let (_x_5 : bool) = _x_4 = 0 in\l          (((_x_2 \|\| _x_3) \|\| _x_5) && ((_x_2 \|\| not _x_3) \|\| _x_4 = 1))\l          && ((_x_0 \|\| not _x_1) \|\| _x_5)\l          :expansions [num_occurs;\l                       merge_sort;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       num_occurs;\l                       merge_sort]\l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_557 -> p_547 [label=""];
subgraph cluster_548 {
  color=blue;
p_547 [label="Start ((not Is_a([], List.tl x) \|\| not Is_a([], x)) \|\| num_occurs a x = 0\l       :name \"2.1\" :time 1.486s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_547 -> p_546 [label=""];
p_546 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_557 -> p_551 [label=""];
subgraph cluster_552 {
  color=blue;
p_551 [label="Start (((not Is_a([], List.tl x) \|\| Is_a([], x)) \|\| not (List.hd x = a))\l       \|\| num_occurs a x = 1 :name \"2.2\" :time 1.487s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_551 -> p_550 [label=""];
p_550 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          (not Is_a([], _x_0) \|\| Is_a([], x))\l          \|\| num_occurs (List.hd x) _x_0 = 0 :expansions [num_occurs] \l          :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_550 -> p_549 [label=""];
p_549 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
p_557 -> p_555 [label=""];
subgraph cluster_556 {
  color=blue;
p_555 [label="Start (((not Is_a([], List.tl x) \|\| Is_a([], x)) \|\| List.hd x = a)\l       \|\| num_occurs a x = 0 :name \"2.3\" :time 1.487s)",shape=box,style=filled,fontname="courier",fontsize=14];
p_555 -> p_554 [label=""];
p_554 [label="Simplify (let (_x_0 : int list) = List.tl x in\l          ((not Is_a([], _x_0) \|\| Is_a([], x)) \|\| List.hd x = a)\l          \|\| num_occurs a _x_0 = 0 :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
p_554 -> p_553 [label=""];
p_553 [label="Simplify (true :expansions [num_occurs] :rw [] :fc [])",shape=box,style=filled,fontname="courier",fontsize=14];
}
}
}
}

So now we're sure merge_sort really is a proper sorting function.

Merge Sort is Correct!¶

To recap, we've proved:

theorem merge_sort_sorts x =
 is_sorted (merge_sort x)

and

theorem merge_sort_elements a (x : int list) =
 num_occurs a x = num_occurs a (merge_sort x)

Beautiful! Happy proving (and sorting)!

into	true
expansions	[]
rewrite_steps
forward_chaining	List.len_nonnegative List.len_nonnegative