This is acl2-doc-emacs.info, produced by makeinfo version 4.13 from
acl2-doc-emacs.texinfo.

This is documentation for ACL2 Version 6.3
Copyright (C) 2013  University of Texas at Austin

This program is free software; you can redistribute it and/or modify
it under the terms of Version 2 of the GNU General Public License as
published by the Free Software Foundation.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.

Written by:  Matt Kaufmann and J Strother Moore
Department of Computer Sciences
University of Texas at Austin
Austin, TX 78712-1188 U.S.A.

INFO-DIR-SECTION Math
START-INFO-DIR-ENTRY
* acl2: (acl2-doc-emacs). Applicative Common Lisp
END-INFO-DIR-ENTRY


File: acl2-doc-emacs.info,  Node: NOTE-3-5,  Next: NOTE-3-5(R),  Prev: NOTE-3-4(R),  Up: RELEASE-NOTES

NOTE-3-5    ACL2 Version  3.5 (May, 2009) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  3.4 into the
following categories: changes to existing features, new features,
heuristic improvements, bug fixes, new and updated books, Emacs
support, and experimental hons version.  Each change is described in
just one category, though of course many changes could be placed in
more than one category.

*CHANGES TO EXISTING FEATURES*

Many improvements have been made to ACL2's "evisceration" mechanism for
hiding substructures of objects before they are printed, and to related
documentation:

     o A new documentation topic explains evisc-tuples.  See *note
     EVISC-TUPLE::.

     o A new interface, set-evisc-tuple, has been provided for setting
     the four global evisc-tuples.  See *note SET-EVISC-TUPLE::.

     o A new mode, "iprinting", allows eviscerated output to be read
     back in.  See *note SET-IPRINT::.

     o Function default-evisc-tuple has been deprecated and will
     probably be eliminated in future releases; use abbrev-evisc-tuple
     instead.  Also eliminated is the brr-term-evisc-tuple (also the
     user-brr-term-evisc-tuple).  The term-evisc-tuple controls
     printing formerly controlled by the brr-term-evisc-tuple or
     user-brr-term-evisc-tuple.

     o ACL2 output is done in a more consistent manner, respecting the
     intention of those four global evisc-tuples.  In particular, more
     proof output is sensitive to the term-evisc-tuple.  Again, see
     *note SET-EVISC-TUPLE::.

     o A special value, :DEFAULT, may be provided to set-evisc-tuple in
     order to restore these evisc-tuples to their original settings.

     o (Details for heavy users of the evisc-tuple mechanism) (1) There
     are no longer state globals named user-term-evisc-tuple or
     user-default-evisc-tuple.  (2) Because of the above-mentioned
     :DEFAULT, if you have referenced state globals directly, you
     should use accessors instead, for example (abbrev-evisc-tuple
     state) instead of (@ abbrev-evisc-tuple).  (3) For uniformity,
     set-trace-evisc-tuple now takes a second argument, state.

Improved break-on-error in several ways.  First, it breaks earlier in a
more appropriate place.  Thanks to Dave Greve for highlighting this
problem with the existing implementation.  Also, break-on-error now
breaks on hard errors, not only soft errors (see *note ER::, options
hard and hard?).  Thanks to Warren Hunt and Anna Slobodova for sending
an example that showed a flaw in an initial improvement.  Finally, new
options cause printing of the call stack for some host Common Lisps.
See *note BREAK-ON-ERROR::.  Thanks to Bob Boyer for requesting this
feature.

Trace! may now be used in raw Lisp (though please note that all
soundness claims are off any time you evaluate forms in raw Lisp!).
Thanks to Bob Boyer for feedback that led to this enhancement.

ACL2 now searches for file acl2-customization.lsp in addition to (and
just before) its existing search for acl2-customization.lisp; See *note
ACL2-CUSTOMIZATION::.  Thanks to Jared Davis for suggesting this change,
which supports the methodology that files with a .lisp extension are
certifiable books (thus avoiding the need to set the BOOKS variable in
makefiles; see *note BOOKS-CERTIFICATION-CLASSIC::).

Improved the error message for illegal declare forms of the form (type
(satisfies ...)).  Thanks to Dave Greve for sending an example
highlighting the issue.

If trace output is going to a file (because open-trace-file has been
executed), then a note will be printed to that effect at the time that
a call of trace$ or trace! is applied to one or more trace specs.

The notion of redundancy (see *note REDUNDANT-EVENTS::) has been made
more restrictive for mutual-recursion events.  Now, if either the old
or new event is a mutual-recursion event, then redundancy requires that
both are mutual-recursion events that define the same set of function
symbols.  Although we are not aware of any soundness bugs fixed by this
modification, nevertheless we believe that it reduces the risk of
soundness bugs in the future.

The definition of trace* has been moved to a book, misc/trace1.lisp.  A
new version, used in ACL2s, is in book misc/trace-star.lisp.  Trace
utilities trace$ and trace! are still built into ACL2.  [Note: File
misc/trace1.lisp was deleted after Version  4.2.]

Certain certificate files will now be much smaller, by printing in a way
that takes advantage of structure sharing.  Certifying the following
example produces a .cert file of over 3M before this change, but less
than 1K after the change.

     (defun nest (i)
       ;; Makes an exponentially-sized nest of conses i deep.
       (if (zp i)
           nil
         (let ((next (nest (1- i))))
           (cons next next))))

     (make-event
      `(defconst *big* ',(nest 20)))

Thanks to Sol Swords for providing the above example and to him as well
as to Bob Boyer, Jared Davis, and Warren Hunt for encouraging
development of this improvement.  We have also applied this improvement
to the printing of function definitions to files on behalf of
certify-book and comp.

Names of symbols are now printed with vertical bars according to the
Common Lisp spec.  Formerly, if the first character of a symbol name
could be the first character of the print representation of a number,
then the symbol was printed using vertical bars (|..|) around its name.
Now, a much more restrictive test for "potential numbers" is used,
which can result in fewer such vertical bars.  Base 16 is now carefully
considered as well; see *note SET-PRINT-BASE::.  Thanks to Bob Boyer
for requesting this improvement.  Note that macros set-acl2-print-base
and set-acl2-print-case have been replaced by functions; see *note
SET-PRINT-BASE:: and see *note SET-PRINT-CASE::.

The ACL2 reader now supports `#.' syntax in place of the `#, syntax
formerly supported.  Thanks to Bob Boyer for requesting this change.
See *note SHARP-DOT-READER::.  NOTE that because of this change, `#.'
no longer causes an abort; instead please use (a!) or optionally, if in
the ACL2 loop, :a!; see *note A!::.

Some small changes have been made related to gag-mode:

     o Gag-mode now suppresses some messages that were being printed
     upon encountering disjunctive splits from :OR hints.  Thanks to Sol
     Swords for suggesting this improvement.

     o ACL2 had printed "Q.E.D." with all output suppressed and
     gag-mode enabled.  Now, "Q.E.D." will be suppressed when PROVE and
     SUMMARY output are suppressed, even if gag-mode is enabled.

     o The use of set-gag-mode had drastic effects on the inhibited
     output (see *note SET-INHIBIT-OUTPUT-LST::), basically inhibiting
     nearly all output (even most warnings) when turning on gag-mode
     and enabling all output except proof-tree output when turning off
     gag-mode.  Now, set-gag-mode only inhibits or enables proof
     (PROVE) output, according to whether gag-mode is being turned on
     or off (respectively).  The related utility set-saved-output has
     also been modified, basically to eliminate :all as a first
     argument and to allow t and :all as second arguments, for
     inhibiting prover output or virtually all output, respectively
     (see *note SET-SAVED-OUTPUT::).

A defstub event signature specifying output of the form (mv ...) now
introduces a :type-prescription rule asserting that the new function
returns a true-listp result.  Thanks to Bob Boyer for sending the
following example, which motivated this change.

     (defstub census (*) => (mv * *))
     (defn foo (x)
       (mv-let (a1 a2)
               (census x)
               (list a1 a2)))

Improved the efficiency of string-append so that in raw Lisp, it calls
concatenate.  Thanks to Jared Davis for suggesting this change,
including the use of mbe.  A minor change was made to the definition of
concatenate to support this change, and the lemma append-to-nil was
added (see below).

The checksum algorithm used for certificate files of books has been
changed.  Thanks to Jared Davis for contributing the new code.  This
change will likely not be noticed unless one is using the experimental
hons version of ACL2, where it can greatly speed up book certification
and inclusion because of function memoization (of source function
fchecksum-obj).

Fewer calls are made to the checksum algorithm on behalf of
certify-book and a few other operations.  Thanks to Jared Davis for
providing data that helped lead us to these changes.

Formatted printing directives ~p, ~q, ~P, and ~Q are deprecated, though
still supported.  See *note FMT::.  Instead, please use ~x, ~y, ~X, and
~Y (respectively).  As a by-product, rule names in proof output are no
longer hyphenated.

A new keyword, :multiplicity, is available for tracing raw Lisp
functions using the ACL2 trace utility.  See *note TRACE$::.

Users may now control whether or not a slow array access results in a
warning printed to the screen (which is the default, as before), and if
so, whether or not the warning is followed by a break.  See *note
SLOW-ARRAY-WARNING::.

On linux-like systems (including Mac OS X and SunOS), :comp will now
write its temporary files into the "/tmp" directory, which is the value
of state global 'tmp-dir.  You can change that directory with (assign
tmp-dir "<your_temp_directory_path>").

The messages printed for uncertified books have been enhanced.  Thanks
to Jared Davis for requesting such an improvement.

A function definition that would be redundant if in :logic mode is now
considered redundant even if it (the new definition) is in :program
mode.  That is, if a definition is "downgraded" from :logic to :program
mode, the latter (:program mode) definition is considered redundant.
Previously, such redundancy was disallowed, but we have relaxed that
restriction because of a scenario brought to our attention by Jared
Davis: include a book with the :logic mode definition, and then include
a book with the :program mode definition followed by
verify-termination.  Thanks, Jared.

The ACL2 reader no longer accepts characters other than those
recognized by standard-char-p except for #\Tab, #\Page, and #\Rubout
(though it still accepts strings containing such characters).  As a
result, no make-event expansion is allowed to contain any such
unacceptable character or string.  Thanks to Sol Swords for sending an
example that led us to make this restriction.  A simple example is the
following book:

     (in-package "ACL2")
     (defconst *my-null* (code-char 0))
     (make-event `(defconst *new-null* ,*my-null*))

For this book, a call of certify-book formerly broke during the
compilation phase, but if there was no compilation, then a call of
include-book broke.  Now, the error occurs upon evaluation of the
make-event form.

ACL2 now collects up guards from declare forms more as a user might
expect, without introducing an unexpected ordering of conjuncts.  We
thank Jared Davis for sending us the following illustrative example,
explained below.

     (defun f (x n)
       (declare (xargs :guard (and (stringp x)
                                   (natp n)
                                   (= (length x) n)))
                (type string x)
                (ignore x n))
       t)

Formerly, a guard was generated for this example by unioning the
conjuncts from the :guard onto a list containing the term (string x)
generated from the type declaration, resulting in an effective guard of:

     (and (natp n)
          (= (length x) n)
          (stringp x))

The guard of this guard failed to be verified because (stringp x)) now
comes after the call (length x).  With the fix, contributions to the
guards are collected up in the order in which they appear.  So in the
above example, the effective guard is the specified :guard; the
contribution (stringp x) comes later, and is thus dropped since it is
redundant.  NOTE by the way that if :guard and :stobjs are specified in
the same xargs form, then for purposes of collecting up the effective
guard as described above, :stobjs will be treated as through it comes
before the :guard.

Modified close-output-channel to try to do a better job flushing
buffers.  Thanks to Bob Boyer for helpful correspondence.

The notion of "subversive recursion" has been modified so that some
functions are no longer marked as subversive.  See *note
SUBVERSIVE-RECURSIONS::, in particular the discussion elaborating on
the notion of "involved in the termination argument" at the end of that
documentation topic.

Formerly, :type-prescription rules for new definitions inside
encapsulate forms were sometimes added as constraints.  This is no
longer the case.  See also discussion of the "soundness bug in the
forming of constraints", which is related.

*NEW FEATURES*

It is now possible to affect ACL2's termination analysis (and resulting
induction analysis).  Thanks to Peter Dillinger for requesting this
feature.  The default behavior is essentially unchanged.  But for
example, the following definition is accepted by ACL2 because of the
use of the new :ruler-extenders features; See *note RULER-EXTENDERS::.

       (defun f (x)
         (declare (xargs :ruler-extenders :all))
         (cons 3
               (if (consp x)
                   (f (cdr x))
                 nil)))

The following lemma was added in support of the improvement to
string-append described above:

     (defthm append-to-nil
       (implies (true-listp x)
                (equal (append x nil)
                       x)))

A mechanism has been provided for users to contribute documentation.
See *note MANAGING-ACL2-PACKAGES:: for an example, which contains a
link to an external web page on effective use of ACL2 packages, kindly
provided by Jared Davis.  ACL2 documentation strings may now link to
external web pages using the new symbol, ~url; see *note MARKUP::.  Of
course, those links appear in the web version of the documentation, but
you made need to take a bit of action in order for these to appear as
links in the Emacs Info version; see *note DOCUMENTATION::.

Added intersectp (similar to intersectp-eq and intersectp-equal).

The user now has more control over how ACL2 prints forms; See *note
PRINT-CONTROL::.  Thanks to Bob Boyer for useful discussions leading to
this enhancement.

Some Common Lisp implementations only allow the syntax
pkg-name::expression when expression is a symbol.  The ACL2 reader has
been modified to support a package prefix for arbitrary expressions;
see *note SHARP-BANG-READER::.  Thanks to Hanbing Liu for a query that
led to this feature and to Pascal J. Bourguignon for suggesting an
implmentation.

Ill-formed documentation strings need not cause an error.  See *note
SET-IGNORE-DOC-STRING-ERROR::.  Thanks to Bob Boyer for requesting this
feature.

Type declarations are now permitted in let* forms; see *note LET*::,
see *note DECLARE::, and see *note TYPE-SPEC::.

(For Lisp programmers) Macro with-live-state has been provided for
programmers who refer to free variable STATE, for example with macros
that generate uses of STATE, and want to avoid compiler warnings when
evaluating in raw Lisp.  For example, the following form can be
submitted either inside or outside the ACL2 loop to get the desired
effect (see *note DOC-STRING::): (with-live-state (f-put-global
'doc-prefix " " state)).  For another example use of this macro, see
the definition of trace$ (ACL2 source file other-events.lisp).

(System hackers only) Added :redef- to undo the effect of :redef+.  See
*note REDEF-::.

Function random$ is a built-in random number generator.  See *note
RANDOM$::.  Thanks to Sol Swords for requesting this feature and
providing an initial implementation.

*HEURISTIC IMPROVEMENTS*

Sped up guard generation for some functions with large if-then-else
structures in their bodies.  Thanks to Sol Swords for sending an
illustrative example.

Sped up guard generation in some cases by evaluating ground
(variable-free) subexpressions.  Thanks to Bob Boyer for sending a
motivating example: (defn foo (x) (case x ((1 2) 1) ((3 4) 3) ... ((999
1000) 999))).

Modified slightly a heuristic association of "size" with constants,
which can result in significant speed-ups in proofs involving constants
that are very large cons trees.

Added a restriction in the linear arithmetic procedure for deleting
polynomial inequalities from the linear database.  Formerly, an
inequality could be deleted if it was implied by another inequality.
Now, such deletion requires that certain heuristic "parent tree"
information is at least as restrictive for the weaker inequality as for
the stronger.  Thanks to Dave Greve for bringing a relevant example to
our attention and working with us to figure out some surprising
behavior, and to Robert Krug for making a key observation leading to
the fix.

(GCL especially) Improved compiled code slightly by communicating to
raw Lisp the output type when a function body is of the form (the
character ...).  This tiny improvement will probably only be observed
in GCL, if at all.

Applied a correction suggested by Robert Krug to the variant of
term-order used in parts of ACL2's arithmetic reasoning.

*BUG FIXES*

Fixed bugs in the handling of flet expressions, one of which had the
capability of rendering ACL2 unsound.  Thanks to Sol Swords for
pointing out two issues and sending examples.  One example illustrated
how ACL2 was in essence throwing away outer flet bindings when
processing an inner flet.  We have exploited that example to prove a
contradiction, as follows: this book was certifiable before this fix.

     (in-package "ACL2")

     (defun a (x)
       (list 'c x))

     ; Example from Sol Swords, which failed to be admitted (claiming that
     ; function A is undefined) without the above definition of A.
     (defun foo1 (x y)
        (flet ((a (x) (list 'a x)))
          (flet ((b (y) (list 'b y)))
            (b (a (list x y))))))

     (defthm not-true
       (equal (foo1 3 4)
              '(b (c (3 4))))
       :hints (("Goal"
                :in-theory
                (disable (:executable-counterpart foo1))))
       :rule-classes nil)

     (defthm contradiction
       nil
       :hints (("Goal" :use not-true))
       :rule-classes nil)

Sol's second example, below, pointed to a second bug related to
computing output signatures in the presence of nested flet expressions,
which we have also fixed: this form failed before the fix.

     :trans (flet ((foo (a) (list (flet ((bar (b) b)) a)))) x)

Fixed a subtle soundness bug in the forming of constraints from deduced
type prescriptions.  As a result, when ACL2 prints a warning message
labeling encapsulated functions as "subversive", ACL2 will no longer
deduce :type-prescription rules for those functions.  Examples that
exploit the bug in ACL2 Version_3.4 may be found in comments in ACL2
source function convert-type-set-to-term (file other-processes.lisp) and
especially in function putprop-type-prescription-lst (file
defuns.lisp).  For more on the general issue of "subversive
recursions," see *note SUBVERSIVE-RECURSIONS::.)

Fixed a soundness bug in the handling of inequalities by the type-set
mechanism, which was using the inequality database inside the body of a
lambda.

Fixed a long-standing soundness bug in compress1 and compress2, whose
raw Lisp code gave the logically incorrect result in the case of a
single entry other than the header, where that entry mapped an index to
the default value.  Also fixed soundness bugs in compress1, in the case
of :order >, where the raw Lisp code could drop the header from the
result or, when the input alist had entries in ascending order, fail to
return an alist in descending order.  For example, the following book
certified successfully.

     (in-package "ACL2")
     (defthm true-formula-1
       (equal (compress1 'a '((:HEADER :DIMENSIONS (4) :MAXIMUM-LENGTH 5
                                       :DEFAULT 1 :NAME A :ORDER <)
                              (1 . 1)))
              '((:HEADER :DIMENSIONS (4) :MAXIMUM-LENGTH 5
                         :DEFAULT 1 :NAME A :ORDER <)))
       :hints (("Goal" :in-theory (disable (compress1))))
       :rule-classes nil)
     (defthm ouch-1
       nil
       :hints (("Goal" :use true-formula-1))
       :rule-classes nil)
     (defthm true-formula-2
       (equal (compress1 'a '((:HEADER :DIMENSIONS (4) :MAXIMUM-LENGTH 5
                                       :DEFAULT NIL :NAME A :ORDER >)
                              (1 . 1)
                              (2 . 2)))
              '((:HEADER :DIMENSIONS (4) :MAXIMUM-LENGTH 5
                         :DEFAULT NIL :NAME A :ORDER >)
                (2 . 2)
                (1 . 1)))
       :hints (("Goal" :in-theory (disable (compress1))))
       :rule-classes nil)
     (defthm ouch-2
       nil
       :hints (("Goal" :use true-formula-2))
       :rule-classes nil)
     (defthm true-formula-3
       (equal (compress1 'a '((:HEADER :DIMENSIONS (3) :MAXIMUM-LENGTH 4
                                       :NAME A :ORDER >)
                              (1 . B)
                              (0 . A)))
              '((:HEADER :DIMENSIONS (3) :MAXIMUM-LENGTH 4
                         :NAME A :ORDER >)
                (1 . B)
                (0 . A)))
       :hints (("Goal" :in-theory (disable (compress1))))
       :rule-classes nil)
     (defthm ouch-3
       nil
       :hints (("Goal" :use true-formula-3))
       :rule-classes nil)

Fixed a soundness bug involving measured subsets and verify-termination,
by changing verify-termination so that it uses make-event.  See *note
VERIFY-TERMINATION::, in particular the discussion about make-event
near the end of that documentation topic.  Peter Dillinger first raised
the idea to us of making such a change; when we found this soundness
bug, we were certainly happy to do so!

Fixed a bug that could cause a hard Lisp error but not, apparently,
unsoundness.  The bug was in the lack of attention to the order of
guard and type declarations when checking for redundancy.  In the
following example, the second definition was redundant during the first
pass of the encapsulate form.  The second definition, however, was
stored on the second pass with a guard of (and (consp (car x)) (consp
x)), which caused a hard Lisp error when evaluating (foo 3) due to a
misguided attempt to evaluate (car 3) in raw Lisp.  The fix is to
restrict redundancy of definitions so that the guard and type
declarations must be in the same order for the two definitions.

     (encapsulate
      ()
      (local (defun foo (x)
               (declare (xargs :guard (consp x)))
               (declare (xargs :guard (consp (car x))))
               x))
      (defun foo (x)
        (declare (xargs :guard (consp (car x))))
        (declare (xargs :guard (consp x)))
        x))
     ; Now we get a hard Lisp error from evaluation of the guard of foo:
     (foo 3)

Fixed a bug in the guard violation report for function
intern-in-package-of-symbol.  Thanks to Dave Greve for bringing this
bug to our attention.

Made a change to allow certain hints, in particular certain
:clause-processor hints, that had previously caused errors during
termination proofs by viewing the function being defined as not yet
existing.  Thanks to Sol Swords for bringing this issue to our
attention with a nice example.

ACL2 now properly handles interrupts (via control-c) issued during
printing of the checkpoint summary.  Previously it was possible on some
platforms to make ACL2 hang when interrupting both during a proof and
during the ensuing printing of the checkpoint summary.  Thanks to Jared
Davis and Sol Swords for bringing this problem to our attention.

Fixed a bug that was preventing, inside some book "b", the use of a
:dir argument to include-book that refers to a directory defined using
add-include-book-dir earlier in the book "b".  (We found this
ourselves, but we thank John Cowles for observing it independently and
sending us a nice example.)

(GCL and CCL only) Fixed a bug in certain under-the-hood type
inferencing.  Thanks to Sol Swords for sending an example using stobjs
defined with the :inline keyword, along with a helpful backtrace in
CCL, and to Gary Byers for his debugging help.

Fixed a bug in print-gv, which was mishandling calls of functions with
more than one argument.

Fixed a bug in the handling of AND and OR terms by the proof-checker
command DV, including numeric ("diving") commands.  Thanks for Mark
Reitblatt for bringing this problems to our attention with a helpful
example.

Fixed printing of goal names resulting from the application of :OR
hints so that they aren't ugly when working in other than the "ACL2"
package.  Thanks to Sol Swords for bringing this issue to our attention.

Fixed proof-tree printing so that interrupts will not cause problems
with hiding ordinary output because of incomplete proof-tree output.
Thanks to Peter Dillinger for pointing out this issue.

Fixed a hard error that could be caused by mishandling a forced
hypothesis during forward-chaining.  Thanks to Peter Dillinger for
bringing this bug to our attention by sending a useful example.

Fixed a bug that could cause simplifications to fail because of alleged
"specious simplification."  This bug could appear when deriving an
equality from the linear arithmetic database, and then attempting to
add this equality to the current goal's hypotheses when it was already
present.  Thanks to Eric Smith for sending a helpful example (in July
2005!) that helped us debug this issue.

Fixed a bug in processing of :type-set-inverter rules.

Fixed a bug that was causing an error, at least for an underlying Lisp
of CCL (OpenMCL), when ec-call was applied to a term returning multiple
values.  Thanks to Sol Swords for sending an example that brought this
bug to our attention.

Fixed handling of array orders to treat keyword value :order :none
correctly from an array's header.  Previously, there were two problems.
One problem was that :order :none was treated like the default for
:order, <, while :order nil was treated in the manner specified by
:order :none (see *note ARRAYS::).  Now, both :order :none and :order
nil are treated as :order nil had been treated, i.e., so that there is
no reordering of the alist by compress1.  The other problem with this
case of :order was that the :maximum-length field of the header was not
being respected: the length could grow without bound.  Now, as
previously explained (but not previously implemented) -- see *note
ARRAYS:: -- a compress1 call made on behalf of aset1 causes a hard
error if the header of the supplied array specifies an :order of :none
or nil.

An ignorable declare form had caused an error in some contexts when it
should have been allowed.  In particular, this problem could arise when
using an ignorable declaration at the top level in a defabbrev form.
It could also arise upon calling verify-termination when the
corresponding defun form contained an ignorable declaration at the top
level.  These bugs have been fixed.

Contrary to existing documentation (see *note MAKE-EVENT-DETAILS::),
the value of "ld special variable" ld-skip-proofsp was always set to nil
during make-event expansion, not merely when the make-event form has a
non-nil value for keyword parameter :check-expansion.  This has been
fixed.  Thanks to Sol Swords for bringing this issue to our attention.

We have disallowed the certification of a book when not at the
top-level, either directly in the top-level loop or at the top level of
ld.  Before this restriction, the following would certify a book with a
definition such as (defun foo (x) (h x)) that calls function h before
defining it, if the certification was by way of the form such as:

     (er-progn (defun h (x) x) (certify-book "my-book"))

But a subsequent include-book of "my-book" would then fail, because h
is not defined at the top level.

Printing with fmt directive ~c now works properly even when the
print-base is other than 10.  Thanks to Sol Swords for reporting this
bug and providing a fix for it.

(SBCL, CMUCL, and CCL only) Fixed a bug in sys-call-status in the case
that the underlying Common Lisp is SBCL, CMUCL, or CCL (OpenMCL).
Thanks to Jun Sawada for bringing this bug to our attention and
providing a fix.

Fixed a bug that was preventing local defstobj events in encapsulate
events.  Thanks to Jared Davis for bringing this bug to our attention.

Fixed a bug evidenced by error message "Unexpected form in certification
world", which could result from attempting to certify a book after
evaluating an encapsulate form with a local defmacro.  Thanks to Jared
Davis for pointing out this bug and sending the example:

     (encapsulate
      ()
      (local (defmacro foo (x) `(table foo 'bar ,x)))
      (local (foo 3)))

Formerly, evaluating a trace$ form inside a wormhole such as the
break-rewrite loop could leave the user in a bad state after returning
to the top level, in which that function could not be untraced.  This
has been fixed.  Note however that when you proceed from a break in the
break-rewrite loop, the tracing state will be the same as it was when
you entered that break: all effects of calling trace$ and untrace$ are
erased when you proceed from the break.

A :guard of (and) is no longer ignored.  Thanks to Sol Swords for
bringing this bug to our attention.

A bug has been fixed that could result in needlessly weak induction
schemes in the case that a recursive call is made in the first argument
of prog2$.  This has been fixed by including prog2$ as a default
ruler-extender in the new ruler-extenders feature (see above, and see
*note RULER-EXTENDERS::).  For details on this bug see Example 11 in
distributed book books/misc/misc2/ruler-extenders-tests.lisp.

(For CCL/OpenMCL on Windows) ACL2 should now build on CCL (OpenMCL) on
Windows.  Thanks to David Rager for bringing this issue to our
attention and helping with a fix that worked for CCL 1.2, and to the
CCL team for improving handling of Windows-style filenames in CCL 1.3.

*NEW AND UPDATED BOOKS*

See `http://code.google.com/p/acl2-books/wiki/BooksSince34' for a list
of books in Version  3.5 of ACL2 but not Version  3.4.

Run the shell command

     svn log -r 94:HEAD

to see all changes to books/ since the release of Version  3.4.

Here are just a few highlights.

Thanks largely to Jared Davis, many Makefiles have been improved to do
automatic dependency analysis.  See *note BOOKS-CERTIFICATION-CLASSIC::
for how to get your own Makefiles to do this by adding a line: -include
Makefile-deps.

Libraries books/arithmetic-4/ and books/rtl/rel7/ have been eliminated
from the default book certification (make regression), in favor of new
libraries books/arithmetic-5/ and books/rtl/rel8/ contributed by Robert
Krug and Hanbing Liu, respectively.  They and Jun Sawada have arranged
the compatibility of these libraries; i.e., it is possible to evaluate
both of the following in the same session:

     (include-book "arithmetic-5/top" :dir :system)
     (include-book "rtl/rel8/lib/top" :dir :system)

Library books/rtl/rel1/ is no longer certified by default (though it is
still distributed in support of ACL2(r); see *note REAL::).

*EMACS SUPPORT*

Slightly modified Control-t e (defined in emacs/emacs-acl2.el) to
comprehend the notion of an "ACL2 scope", and added Control-t o to
insert a superior encapsulate defining such a scope.  See the Emacs
documentation for Control-t e (generally obtained after typing
Control-h k).

Modified distributed file emacs/emacs-acl2.el so that if you put the
following two forms in your ~/.emacs file above the form that loads
emacs/emacs-acl2.el, then Emacs will not start up a shell.  Thanks to
Terry Parks for leading us to this modification.

     (defvar acl2-skip-shell nil)
     (setq acl2-skip-shell t)

*EXPERIMENTAL HONS VERSION*

Bob Boyer and others have contributed numerous changes for the
experimental "hons" version of ACL2 (see *note HONS-AND-MEMOIZATION::).

The ACL2 state can now be queried with (@ hons-enabled) so that a
result of t says that one is in the experimental hons version, while
nil says the opposite.


File: acl2-doc-emacs.info,  Node: NOTE-3-5(R),  Next: NOTE-3-6,  Prev: NOTE-3-5,  Up: RELEASE-NOTES

NOTE-3-5(R)    ACL2 Version  3.5(r) (May, 2009) Notes

Please also see *note NOTE-3-5:: for changes in Version  3.5 of ACL2.

This release incorporates improvements from Ruben Gamboa in support for
non-standard analysis in ACL2(r), in the following ways:

ACL2(r) now supports non-classical objects that are not also numeric,
e.g., non-classical cons pairs.  Consequently, the built-in
standard-numberp has been replaced with standardp.

If f is a classical function, the value (f x1 ... xn) is guaranteed to
be standard when the xi are standard.  ACL2(r) can now recognize this
fact automatically, using defun-std.  For example, the following can be
used to assert that the square root of 2 is a standard value.

     (defthm-std sqrt-2-rational
       (standardp (acl2-sqrt 2)))

More generally, the expression (f x1 ... xn) can contain free variables,
but the result is guaranteed to be standard when the variables take on
standard variables, as in the following:

     (defthm-std sqrt-x-rational
       (implies (standardp x)
                (standardp (acl2-sqrt x))))

A potential soundness bug in encapsulate was fixed.  Specifically, when
a classical, constrained function is instantiated with a lambda
expression containing free variables, it may produce non-standard
values depending on the values of the free variables.  This means that
the functional instantiation cannot be used to justify a non-classical
theorem.  For example, consider the following sequence:

     (encapsulate
       ((f (x) t))
       (local (defun f (x) x)))
     (defthm-std f-x-standard
       (implies (standardp x)
                (standardp (f x))))
     (defthm plus-x-standard
       (implies (standardp x)
                (standardp (+ x y)))
       :hints (("Goal"
                :use ((:functional-instance f-x-standard
                                            (f (lambda (x) (+ x y))))))))
     (defthm plus-x-eps-not-standard
       (implies (standardp x)
                (not (standardp (+ x (/ (i-large-integer)))))))
     (defthm nil-iff-t
       nil
       :hints (("Goal"
               :use ((:instance plus-x-standard
                                (y (/ (i-large-integer))))
                     (:instance plus-x-eps-not-standard)))))

ACL2(r) also supports the introduction of non-classical functions with
defchoose.  These behave just as normal functions introduced with
defchoose, but they have a non-classical choice property.

Finally, ACL2(r) now comes with a revamped library supporting
non-standard analysis, still distributed separately as books/nonstd/.
The new library uses defchoose to state more natural and useful
versions of the IVT, MVT, etc.  It also supports the introduction of
inverse functions, e.g., logarithms.  Finally, the library has much
more extensive support for differentiation.


File: acl2-doc-emacs.info,  Node: NOTE-3-6,  Next: NOTE-3-6(R),  Prev: NOTE-3-5(R),  Up: RELEASE-NOTES

NOTE-3-6    ACL2 Version  3.6 (August, 2009) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  3.5 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, distributed books, Emacs support,
and experimental hons-and-memoization version.  Each change is
described in just one category, though of course many changes could be
placed in more than one category.

Note that (starting with ACL2 Version  3.5) LispWorks is no longer
supported as a platform for ACL2, as the LispWorks compiler could not
handle the ACL2 sources; see comments in the ACL2 sources about
"function size" being "too large".

*CHANGES TO EXISTING FEATURES*

In the xargs declare form, the function symbol (or symbols, plural, in
the case of mutual-recursion) being defined may now be used in the
specified :measure and :guard terms.  Note that, the definition(s) of
the new symbol(s) are still not used in the termination proof.  Thanks
to Daron Vroon for discussions leading to this addition for the measure
and to Dave Greve for requesting such an enhancement for the guard.

Processing of the :guard-hints in an xargs declare form is now delayed
until the start of guard verification.  As a result, the function
symbol(s) being defined may now be used as one might expect in such
hints, for example in an :in-theory form.  Thanks to Jared Davis for
suggesting that we make such an improvement and providing an example.

Made a low-level change to make-event in support of the ACL2s utility
"dynamic-make-event".  Thanks to Peter Dillinger for explaining the
issue leading to this change.

Modified the failure message printed when a measure conjecture fails to
be proved, to indicate whether or not the hint :ruler-extenders :all
would create a different measure conjecture.  Thanks to Peter Dillinger
for suggesting such a modification.

A call of add-default-hints had added hints to the end of the current
list of default hints.  Now, it adds them to the beginning of that
list, so that they are tried first.  However, add-default-hints now
takes a keyword argument, :at-end.  If that argument is supplied and
evaluates to other than nil, then the previous behavior occurs.

When save-exec is used to save ACL2 images, the build dates are now
printed on separate lines at startup and in the executable script.
Thanks To Bob Boyer for requesting some newlines.

Forward-chaining rules are now generated so that every let (also let*
and lambda) expression is expanded away, as is every call of a
so-called "guard holder" (must-be-equal, prog2$, ec-call, the).  These
were formerly only expanded away in the conclusion.  Thanks to Konrad
Slind for a helpful email leading to this change.

Current-theory now causes a hard error when applied to a name not found
in the current ACL2 logical world, rather than simply returning nil.

When the underlying Common Lisp is GCL, ACL2 no longer uses the #n=
reader macro when writing out certain files, including certificate
files.  In all other Lisps, it now uses the #n= "print-circle" feature
not only for certificate files and "expansion.lsp" files written for
example in support of make-event, but also for files written in support
of :comp.  This is all managed with new state global variable
print-circle-files; see *note PRINT-CONTROL::.  Thanks to Dave Greve
for pointing out that GCL is limited by default to 1024 indices for #n=.

*NEW FEATURES*

A documentation topic explains in some detail how hints work with the
ACL2 proof "waterfall": see *note HINTS-AND-THE-WATERFALL::.  This
topic may be useful to those who write computed hints (see *note
COMPUTED-HINTS::) or other advanced hints.

Added a new hint keyword, :no-thanks, that avoids printing the usual
"Thanks" message for hints.  Thanks to Peter Dillinger for requesting
this feature.

Added a new hint keyword, :backtrack, that checks the goals produced by
processing a goal, and can cause the goal to be re-processed using a new
hint.  See *note HINTS::.  Thanks to Pete Manolios for a conversation
that led to the idea of this hint.

Added a new class of hints, override-hints, that is similar to
default-hints, except that override-hints are always applied, even if
the user has supplied a hint explicitly for the goal.  See *note
OVERRIDE-HINTS::.  Thanks to Pete Manolios and Harsh Raju Chamarthi for
useful discussions on this topic, including its application to testing.

When a goal ready to be pushed for proof by induction is given the new
hint ":do-not-induct :otf", it is indeed pushed for proof by induction,
rather than causing immediate failure as in the case of the hint
":do-not-induct t".  Instead, the proof fails when the goal is later
picked to be proved by induction.  Thanks to Peter Dillinger for
discussions leading to this feature.

Related to computed hints only: Each history entry in the list stored in
variable HIST (see *note COMPUTED-HINTS::) now has a :CLAUSE field,
which provide's access to a goal's parent, parent's parent, and so on
(within the same induction and forcing round only).

It is now possible to inhibit warnings produced by in-theory events and
hints that occur when certain built-in definitions and
executable-counterparts are disabled: just evaluate (assign
verbose-theory-warning nil).  Thanks to Jared Davis (and probably
others in the past) for requesting such a mechanism.

*HEURISTIC IMPROVEMENTS*

A source function (linearize-lst) was replaced by tail-recursive code,
which can avoid a stack overflow.  Thanks to Dave Greve for sending a
helpful example.

The heuristics for limiting forward-chaining have been slightly relaxed,
to allow derivations based on the occurrence of all arguments of the
forward-chaining rule's conclusion in the goal (after stripping leading
calls of NOT).  Thanks to Dave Greve for contributing this improvement
and providing a motivating example.

We simplified induction schemes by eliminating each hypothesis of the
form (not (equal term (quote const))) for which some other hypothesis
in the same case equates term with some (presumably other) quoted
constant.  Thanks to Dave Greve for requesting an improvement of this
sort.

*BUG FIXES*

Fixed a soundness bug related to redundancy of encapsulate events (see
*note REDUNDANT-EVENTS::) and ruler-extenders.  A proof of nil in ACL2
Version  3.5 appears in a comment in (deflabel note-3-6 ...) in the ACL2
source code.  The fix is to insist that in order for one encapsulate
event to be redundant with another, they must be evaluated with the same
default-ruler-extenders.  Analogous to this issue of
default-ruler-extenders for encapsulates is an issue of the
default-verify-guards-eagerness, which has similarly been fixed.

Fixed soundness bugs related to the handling of subversive-recursions
for constraints.  Proofs of nil in ACL2 Version  3.5 appear in a
comment in (deflabel note-3-6 ...) in the ACL2 source code.

Fixed a bug that could cause the following error during calls of
certify-book in the presence of calls of skip-proofs in the book:

        ACL2 Warning [Skip-proofs] in

        HARD ACL2 ERROR in FMT0: Illegal Fmt Syntax.  The tilde-@ directive at
        position 0 of the string below is illegal because its variable evaluated
        to 0, which is neither a string nor a list.

        "~@0"

Thanks to Dave Greve for reporting this bug and making available a very
helpful test case.

The :corollary of a rule (see *note RULE-CLASSES::) failed to use the
default-hints of the logical world.  This has been fixed.

(CCL only) We removed a call, for CCL 1.3 (and beyond) only, of foreign
function sync in the closing of output channels.  Thanks to Daron Vroon
for reporting issues with such a call on a non-Intel platform.

Fixed a bug in reporting failures when monitoring rewrite rules with
free variables in the hypotheses, that could cause a hard Lisp error
(from which ACL2 continues, however).  Thanks to Eric Smith for sending
a very helpful example with his bug report.

Fixed the handling of :induct hints, which had thrown away hint
information from parent goals.  For example, the thm form below failed
to prove even though the second hint is in some sense superfluous;
induction occurs automatically at "Goal'" even without the hint on
that.  The failure was due to discarding the hint information on "Goal".

     (in-theory (disable append))
     (thm (equal (cdr (cons a (append (append x y) z))) (append x y z))
          :hints
          (("Goal" :in-theory (enable append))
           ("Goal'" :induct t) ; failed unless this line is commented out
           ))

Fixed a bug in the args command that was failing to show the formals of
primitives (built-in functions like consp that do not come with explicit
definitions).  Thanks to John Cowles for pointing out this bug.  (At a
lower level, the bug was that primitives failed to have 'stobjs-in or
'stobjs-out properties.)

Fixed bugs in the utility supporting moving directories of certified
books, sometimes used in Debian builds (as described in source function
make-certificate-file).  Thanks to Alan Dunn for pointing out such a
bug, in paths associated with defpkg events in portcullis commands in
certificates (which are used for error reporting).  There were also
bugs, now fixed, that prevented renaming some book paths.  Please note
that this mechanism is not guaranteed to be sound; in particular, it
can probably misbehave when macros are used to generate portcullis
events.  However, it seems likely that such issues will be very rare.

Eliminated warnings that could arise when tracing a function with
trace$.  Now, when trace$ is applied to a function without option
:native, that function's declarations and documentation are discarded.

Fixed a bug that could cause a failure when building an executable image
using SBCL as the underlying Common Lisp.  Thanks to Jun Sawada for
reporting this failure.  We made a similar fix for CMUCL.

Fixed a bug in save-exec in the case that an absolute pathnanme is
supplied.  Thanks to Jared Davis for bringing this bug to our attention.

Fixed a bug in the use of trace$ with the :native and :multiplicity
options that caused hard errors for some underlying Lisps.

Fixed a bug in the interaction of trace$ and :comp, which caused error
as comp tried to re-trace functions that it temporarily untraced.

*NEW AND UPDATED BOOKS AND RELATED INFRASTRUCTURE*

See `http://code.google.com/p/acl2-books/wiki/BooksSince35' for a list
of books in Version  3.6 of ACL2 but not Version  3.5.  For _changes_ to
existing books rather than _additions_, see the log entries at
`http://code.google.com/p/acl2-books/source/list' starting with revision
r286 up through revision r329.

It is no longer required to specify a value for environment (or `make')
variable ACL2_SYSTEM_BOOKS when running `make' in the distributed book
directory, even when that directory is not under the directory
containing the ACL2 executable.  Thanks to Peter Dillinger for
providing this improvement, by modifying books/Makefile-generic and, as
needed, distributed book Makefiles.

Thanks to Peter Dillinger, some books in support of the ACL2 Sedan
(ACL2s) are more easily available for ACL2 users who do not use ACL2s.
See *note ACL2-SEDAN::.

*EMACS SUPPORT*

If the following form is evaluated before the load of
emacs/emacs-acl2.el, then variables are now set to reflect the directory
containing that file.

     (if (boundp '*acl2-sources-dir*)
         (makunbound '*acl2-sources-dir*))

Fixed info-dir-entry line in generated info file (by patching
doc/write-acl2-texinfo.lisp).  Thanks to Alan Dunn for providing this
patch.

*EXPERIMENTAL HONS VERSION*

Bob Boyer and others have contributed numerous changes for the
experimental "hons" version of ACL2 (see *note HONS-AND-MEMOIZATION::).
A number of these have been crafted to work specifically with CCL
(Clozure Common Lisp, formerly OpenMCL), which is now required as the
underlying Lisp for the "hons" version of ACL2.

A heuristic (source function too-many-ifs has been made more scalable
(for the non-HONS version as well, in fact), but with no functional
change.  Thanks to Jared Davis for noticing performance issues and
suggesting fixes.

Other changes including the following, quoting Bob Boyer:

     The CCL CASE macro now does better than a dumb linear search in
     some CASEes.

     SH and CSH are functions to talk to the underlying Gnu-Linux from
     CCL.  Good for repeated calling when you simply cannot afford the
     copying cost of a FORK because you are using, say, a dozen
     gigabytes.

     Added CCL compiler-macros for IF and OR, to support some
     'coverage' analysis, cf. IF-REPORT, extending the profiling.

     Introduced the type 'mfixnum' so that things like counting honses
     and counting calls to memoized or profiled functions can run fast
     in CCL 64 bits and yet still run at all under 32 bits.

     Moved all HONSes to CCL's newish static space, which permits the
     address of a cons to be used as a hash key, as in most Lisps.
     (CCL moves most conses and most everything when it does a
     compacting-gc.)

     Quite a few changes in the memoize-fn reporting.

     Added a timer facility, cf. call-with-timeout.  Good for running
     under throttle some gross thoughts like 'Is it true that you can't
     fit 12 pigeons into 11 holes' on some propositional calculus
     systems/functions.

     Added rwx-size, pid-owner-cmdlines, rss, and proc-stat to help see
     what is really going on virtually in Gnu-Linux.

     Fixed at least one bug in compact-print-file and helped make its
     integration into ACL2's read-object$ a little more sound.  Still
     worried some about *print-readably* vs. readtable-case.  Does
     anyone else stay awake late at night worrying about readtable-case?

     Revised how the *watch-dog-process* interrupts the main process
     for the thousandth time, cf. watch.  Haven't changed it in weeks,
     which means that (a) it is getting tolerable or (b) I've run out
     of gas.



File: acl2-doc-emacs.info,  Node: NOTE-3-6(R),  Next: NOTE-3-6-1,  Prev: NOTE-3-6,  Up: RELEASE-NOTES

NOTE-3-6(R)    ACL2 Version  3.6(r) (August, 2009) Notes

Please also see *note NOTE-3-6:: for changes in Version  3.6 of ACL2.


File: acl2-doc-emacs.info,  Node: NOTE-3-6-1,  Next: NOTE-4-0,  Prev: NOTE-3-6(R),  Up: RELEASE-NOTES

NOTE-3-6-1    ACL2 Version  3.6.1 (September, 2009) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

The essential changes to ACL2 since Version  3.6 are the two bug fixes
described below.  There was also some functionality-neutral code
refactoring, as requested by Daron Vroon in support of the ACL2 Sedan
(see *note ACL2-SEDAN::).  Also see
`http://code.google.com/p/acl2-books/wiki/BooksSince36' for a list of
books in Version  3.6.1 of ACL2 but not Version  3.6.  For _changes_ to
existing books rather than _additions_, see the log entries at
`http://code.google.com/p/acl2-books/source/list' starting with
revision r329 up through revision 350.

Fixed a soundness bug in the handling of ruler-extenders, specifically
in the handling of LET-expressions.  Thanks to Pete Manolios, who sent
us a proof of nil, essentially as follows.  In the termination proof for
foo below, the binding of x to (cons t x) was not substituted into the
recursive call of foo for purposes of the termination proof.

     (defun foo (x)
       (declare (xargs :ruler-extenders :all))
       (let ((x (cons t x)))
         (if (endp (cdr x))
             x
           (cons t (foo (cdr x))))))

     (defthm foo-bad
       nil
       :hints (("Goal"
                :use ((:instance foo (x '(3))))
                :in-theory (disable foo (foo))))
       :rule-classes nil)

Fixed a typo in code supporting ruler-extenders (specifically, swapped
arguments in a recursive call of ACL2 source function
get-ruler-extenders2, which could cause problems for functions defined
using mutual-recursion).  Thanks to Daron Vroon for bringing this bug
to our attention, pointing out the swapped arguments.


File: acl2-doc-emacs.info,  Node: NOTE-4-0,  Next: NOTE-4-0(R),  Prev: NOTE-3-6-1,  Up: RELEASE-NOTES

NOTE-4-0    ACL2 Version  4.0 (July, 2010) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  3.6.1 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, distributed books, Emacs support,
and experimental versions.  Each change is described in just one
category, though of course many changes could be placed in more than
one category.  Also see *note NOTE-3-6-1:: for other changes since
Version  3.6.

*CHANGES TO EXISTING FEATURES*

There have been extensive changes to the handling of compiled files for
books, which may generally be invisible to most users.  The basic idea
is that when compiled files are loaded on behalf of include-book, they
are now loaded before events in the book are processed, not afterwards.
This can speed up calls of include-book, especially if the underlying
Lisp compiles all definitions on the fly (as is the case for CCL and
SBCL).  One functional change is that for keyword argument
:load-compiled-file of include-book, the values :comp-raw, :try, and
:comp! are no longer legal.  (Note that the handling of :comp-raw was
actually broken, so it seems that this value wasn't actually used by
anyone; also, the handling of :comp! formerly could cause an error in
some Lisp platforms, including SBCL.)  Another change is that if
include-book is called with :load-compiled-file t, then each sub-book
must have a compiled file or a so-called "expansion file"; see *note
BOOK-COMPILED-FILE::.  In the unlikely event that this presents a
problem, the makefile provides a way to build with compilation
disabled; see *note COMPILATION::.  Users of raw mode (see *note
SET-RAW-MODE::) will be happy to know that include-book now works if
there an up-to-date compiled file for the book, since portcullis
commands are now incorporated into that compiled file.  The mechanism
for saving expansion files has changed, and the :save-expansion
argument of certify-book has been eliminated; see *note CERTIFY-BOOK::.
More discussion of ACL2's new handling of book compilation is described
in a new documentation topic; see *note BOOK-COMPILED-FILE::.

It was possible to get a hard Lisp error when certifying a book with a
redundant defconst form whose term is not identical to the existing
defconst form for the same name.  The following example illustrates the
problem, which has been fixed (as part of the change in handling of
compiled files for books, described above).  Imagine that after the
initial (in-package "ACL2") form, file foo.lisp has just the form
(defconst *a* (append nil nil)).  Then before the fix, we could have:

       ACL2 !>(defconst *a* nil)
       [[output omitted]]
       ACL2 !>(certify-book "foo" 1)
       [[initial output omitted]
       * Step 5:  Compile the functions defined in "/v/joe/foo.lisp".
       Compiling /v/joe/foo.lisp.
       End of Pass 1.
       End of Pass 2.
       OPTIMIZE levels: Safety=0 (No runtime error checking), Space=0, Speed=3
       Finished compiling /vjoe/foo.lisp.
       Loading /v/joe/foo.lisp

       Error: Illegal attempt to redeclare the constant *A*.

The wormhole facility has been changed to repair a bug that allowed
guard violations to go undetected.  The major change has to do with the
treatment of what used to be called the "pseudo-flag" argument which has
been replaced by a quoted lambda expression.  See *note
NOTE-4-0-WORMHOLE-CHANGES:: for help in converting calls of wormhole.
Also see see *note WORMHOLE:: and see *note WORMHOLE-EVAL::.

The function assign-wormhole-output has been eliminated but its
functionality can be provided by wormhole-eval.

The ACL2 tutorial has been greatly expanded, for example to include a
self-contained discussion of rewriting.  See *note ACL2-TUTORIAL::.

Formerly, the mbe macro and must-be-equal function were disallowed in
any definition within an encapsulate having a non-empty signature.
Now, these are allowed provided the definition has been declared to be
non-executable (see *note DEFUN-NX::).  As a result, defevaluator
events may now include must-be-equal among the function symbols known
by the evaluator; this had not previously been allowed.  Thanks to Sol
Swords for discussions leading to this relaxation for defevaluator.

Princ$ now prints strings more efficiently.  Thanks to Jared Davis for
suggesting the improvements to princ$.

The use of xargs declaration :non-executable t no longer requires the
absence of state or declared stobjs among the formal parameters of a
function definition.  As before, the use of :non-executable t turns off
single-threadedness checking for the body, and also as before, attempts
to execute the function will fail.  Thanks to Sol Swords for requesting
this relaxation (for automatic generation of so-called "flag functions"
for definitions using mutual-recursion).

The documentation has been improved for explaining to advanced users the
details of the ACL2 hint mechanism; see *note
HINTS-AND-THE-WATERFALL::, and see the example about
nonlinearp-default-hint in distributed book
books/hints/basic-tests.lisp.  Thanks to Robert Krug for useful
discussions, in particular suggesting the above example as one to be
explained with the documentation.

The time$ macro has been enhanced to allow user control of the timing
message that is printed, and of when it is printed.  See *note TIME$::.
Thanks to Jared Davis for providing the essential design, helpful
documentation (largely incorporated), and an initial implementation for
raw Lisp.

The :ttags argument to include-book had been required when including a
certified book that uses trust tags.  This is no longer the case:
essentially, :ttags defaults to :all except that warnings will be
printed.  Thanks to Jared Davis for requesting such a relaxation, and
to him and Sandip Ray for useful discussions.

The definition of mv-let has been modified so that the single-step
macroexpansion (see *note TRANS1::) of its calls can be evaluated.
Thanks to Pete Manolios for bringing this evaluation issue to our
attention and ensuing discussions.

All calls of so-called "guard-holders" -- prog2$, must-be-equal (from
calls of see *note MBE::), ec-call, and mv-list -- are now removed
before storing hypotheses of rules of class :rewrite or :linear.
Thanks to Sol Swords for requesting this enhancement and sending the
following example in the case of rewrite rules.

     (defthm foo
       (prog2$ (cw "asdf")
               (and (equal (car (cons x y)) x)
                    (equal (cdr (cons x y)) y))))

The handling of fmt directive ~s has been modified so that if the
argument is a symbol that would normally be printed using vertical bars
(|), then that symbol is printed as with ~f.  Thanks to Jared Davis for
providing the following example showing that treatment of ~s was a bit
unexpected: (cw "~s0.~%" '|fo\|o|).

Error messages have been improved for ill-formed terms (in ACL2's
so-called "translation" routines).  Thanks to Jared Davis for
requesting such an enhancement.

Modified defun-sk so that it executes in :logic mode.  Previously,
evaluation of a defun-sk event in :program mode caused a somewhat
inscrutable error, but now, :program mode is treated the same as :logic
mode for purposes of defun-sk.

The "system hacker" commands (redef+) and (redef-) are now embedded
event forms (see *note EMBEDDED-EVENT-FORM::), hence may be used in
books as well as in progn and encapsulate events.  Also, these two
commands are now no-ops in raw Lisp.

The function symbol worldp (in the "ACL2" package) has been renamed to
plist-worldp.

The function gc$-fn (resulting from macroexpansion of gc$) is now in
:logic mode.  Thanks to Jared Davis for requesting this change.

The user now has control over whether compilation is used, for example
whether or not certify-book compiles by default, using function
set-compiler-enabled.  See *note COMPILATION::.

Modified the conversion of relative to absolute pathnames in portcullis
commands for book certification.  Now, more pathnames remain as relative
pathnames.

The "Ttags" warning that can be printed by include-book is now given
even if set-inhibit-output-lst has specified `warning'.  To suppress
it, specify warning! instead, for example, (set-inhibit-output-lst
'(acl2::warning! acl2::proof-tree)).

On occasion, ACL2 prints the message "Flushing current installed world"
as it cleans up when certain actions (installing a world) are
interrupted.  This operation has been sped up considerably.  If your
session includes many events, you can probably speed up any such
operation further by invoking reset-prehistory.  Thanks to Jared Davis
for sending a query that led us to make this improvement.

Calls of the form (ec-call (must-be-equal logic exec)) are no longer
allowed, since we do not have confidence that they would be handled
correctly.

The underlying function for good-bye (and hence for exit and quit) is
now in :logic mode.  Thanks to Jared Davis for requesting this
enhancement.

We now require that every function symbol in the signature of an
encapsulate event have a :logic mode definition at the end of the first
pass, not merely a :program mode definition (which formerly was
sufficient).  You can still define such a function in :program mode,
provided it is followed by a :logic mode definition (where of course
both definitions are local, since we are discussing functions is
introduced in the signature).  Thanks to Carl Eastlund for bringing
this issue to our attention.  (Note: An analogous modification has been
made for :bdd hints as well.)

The following functions now have raw Lisp implementations that may run
faster than their ACL2 definitions: assoc-eq, assoc-equal, member-eq,
member-equal, subsetp-eq, subsetp-equal, remove-eq, remove-equal,
position-eq, and position-equal.  Thanks to Jared Davis for suggesting
that we consider such an improvement.

We now avoid infinite loops caused when tracing functions that implement
trace$.  Thanks to Rob Sumners and Eric Smith for useful discussions.

The implementation of trace! has been modified slightly, to accommodate
the fix for "some holes in the handling of trust tags" described later,
below.

This item applies unless the host Lisp is GCL.  An interrupt
(control-c) will now cause a proof to exit normally in most cases, by
simulating a timeout, as though with-prover-time-limit had been called
with a time-limit of 0.  If the first interrupt doesn't terminate the
proof, a second one should do so (because a different, more "severe"
mechanism is used after the first attempt).  As a result, redo-flat
should work as one might expect even if a proof is interrupted.  Thanks
to Dave Greve for requesting this enhancement to redo-flat.  Technical
note: for reasons related to this change, time-limits are no longer
checked in evaluator functions (ev-fncall, ev, ev-lst, ev-fncall-w,
ev-w, and ev-w-lst).

It is now legal for proof-checker macro-commands to appear in
:instructions that are used in place of :hints.  Thanks to Sandip Ray
for (most recently) requesting this feature.

The value of :command-conventions for ld special variable
ld-post-eval-print is now treated as though it were t if the value ld
special variable ld-error-triples is nil.  The following example
illustrates this change.

     ACL2 !>(ld-post-eval-print state) ; default
     :COMMAND-CONVENTIONS
     ACL2 !>(ld-error-triples state) ; default
     T
     ACL2 !>(set-ld-error-triples nil state)
     *** Then, before the change:
     ACL2 !>(mv t 3 state)
      3
     *** Instead, after the change:
     ACL2 !>(mv t 3 state)
     (T 3 <state>)

The default behavior of ld has been changed.  Formerly when an error
occurred that halted a subsidiary call of ld, then the parent ld would
continue.  That is no longer the case.  Consider the following example.

     (ld '((ld '((defun f (x) x)
                 (defun bad (x)) ; ERROR -- missing the body
                 ))
           (defun g (x) x)))

Formerly, g would be defined in the resulting logical world.  Now, the
error halts not only the inner ld but also the outer ld.  See *note
LD::, and for details of the new default value for :ld-error-action,
:RETURN!, see see *note LD-ERROR-ACTION::.  Also see the paragraph
below about a new utility, :p!.  Thanks to Robert Krug and Sandip Ray
for helpful discussions.

Environment variable ACL2-CUSTOMIZATION has been replaced by
ACL2_CUSTOMIZATION -- that is, the hyphen has been replaced by an
underscore -- so that it can be set conveniently in the bash shell.
See *note ACL2-CUSTOMIZATION::.

The "Warnings:" summary is now omitted when there are no warnings,
where formerly "Warnings:  None" was printed.  Thanks to Jared Davis
for suggesting this change.

We have modified the generation of constraints for encapsulate events
in two primary ways, neither of them likely to affect many users.  One
change is that the virtual movement of definitions and theorems to in
front of an encapsulate event, or of definitions to behind that event,
is no longer inhibited in the case of nested encapsulates with non-empty
signatures.  The following example illustrates the other change, as
discussed below.

     (encapsulate
      ((f (x) t))
      (local (defun f (x) x))
      (defun g (x) (cons x (f x)))
      (defun h (x) (g x))
      (defthm h-is-f (equal (car (h x)) x)))

Previously, the constraint on f and h was essentially the conjunction
of the definition of h and the theorem h-is-f.  Now, the definition of
g is conjoined as well; moreover, g receives the same constraint as do
f and h, where previously g was only constrained by its definition.
While we are not aware of a soundness bug caused by the previous
approach, the new approach follows more precisely the intended notion
of constraint.

The use of trace$ (or trace!) option :multiplicity had been required
when option :native was supplied.  This is no longer the case.  Also, a
bug has been fixed that had prevented :multiplicity from working
properly in GCL and Allegro CL.

Several errors have been eliminated that formerly occurred when the
constraints for a function symbol were unknown because it was
constrained using a dependent clause-processor (see *note
DEFINE-TRUSTED-CLAUSE-PROCESSOR::.  Now, it is assumed that the
supporters argument in a define-trusted-clause-processor event is such
that every ancestor of any function symbol constrained by the "promised
encapsulate" of that event among, or ancestral in, those supporters.
Thanks to Sol Swords, Sandip Ray, and Jared Davis for helpful
discussions.

The notion of constraint for functions introduced by defun has been
modified slightly.  No longer do we remove from the body of the
definition calls of so-called "guard-holders": prog2$, must-be-equal,
ec-call, and mv-list, and uses of the-error generated by the.  Also, we
now expand calls of the-error with the same aggressive heuristics
applied to a number of other functions (technically, adding it to the
list *expandable-boot-strap-non-rec-fns*).

*NEW FEATURES*

A new event, defattach, allows evaluation of calls of constrained
(encapsulated) functions.  In particular, users can now, in principle,
soundly modify ACL2 source code; please feel free to contact the ACL2
implementors if you are interested in doing so.  See *note DEFATTACH::.

Eric Smith has noticed that if you exit the break-rewrite loop using
:a! during an ld of a file, then all changes to the logical world are
discarded that were made during that call of ld.  A new utility, :p!,
pops just one level instead, and avoids discarding that work.  (This
change is related to an item above, "The default behavior of ld has
been changed.")  Thanks to Eric for pointing out this issue.

New function mv-list is the identity function logically, but converts
multiple values to lists.  The first argument is the number of values,
so an example form is as follows, where foo returns three values:
(mv-list 3 (foo x y)).  Thanks to Sol Swords for requesting this
feature and for reporting a soundness bug in one of our preliminary
implementations.

A new state global variable, host-lisp, has as its value a keyword
whose value depends on the underlying Common Lisp implementation.  Use
(@ host-lisp) to see its value.

It is now possible to write documentation for HTML without error when
there are links to nonexistent documentation topics.  See the comments
in macro acl2::write-html-file at the end of file
doc/write-acl2-html.lisp.  When there are such errors, they should be
easier to understand than previously.  Thanks to Alan Dunn for
providing the initial modifications.

It is now possible to inhibit specified parts of the Summary printed at
the conclusion of an event.  See *note SET-INHIBITED-SUMMARY-TYPES::.
Also see *note WITH-OUTPUT::, in particular the discussion of the new
:summary keyword.  Thanks to Sol Swords for requesting more control
over the Summary.

A new :hints keyword, :case-split-limitations, can override the default
case-split-limitations settings (see *note
SET-CASE-SPLIT-LIMITATIONS::) in the simplifier.  Thanks to Ian Johnson
for requesting this addition and providing an initial implementation.

It is now possible to defer and avoid some ttag-related output; see
*note SET-DEFERRED-TTAG-NOTES::.  Thanks to Jared Davis for requesting
less verbosity from ttag-related output.

A new command, :pl2, allows you to restrict the rewrite rules printed
that apply to a given term.  See *note PL2::.  Thanks to Robert Krug for
requesting such a capability.

ACL2 now provides a utility for canonicalizing filenames, so that soft
links are resolved; see *note CANONICAL-PATHNAME::.  Moreover, ACL2
uses this utility in its own sources, which can eliminate some issues.
In particular, include-book with argument :ttags :all no longer breaks
when given a book name differing from the book name that was used at
certification time; thanks to Sol Swords for reporting that problem.
Also, certain errors have been eliminated involving the combination of
packages in the certification world and trust tags; thanks to Jared
Davis for sending an example of that problem.

You can now suppress or enable guard-checking for an individual form;
see *note WITH-GUARD-CHECKING::.  Thanks to Sol Swords for requesting
this feature.

The walkabout utility has been documented (thanks to Rob Sumners for
suggesting this documentation).  This utility can make it easy to
explore a large cons tree.  New interactive commands (pp n) and (pp
print-level print-length) have been added to restrict how much of the
current object is displayed.  See *note WALKABOUT::.

Rules of class :type-prescription may now be provided a
:backchain-limit-lst keyword.  The default behavior is unchanged, but
now type-set is sensitive not only to the new :backchain-limit-lst of a
:type-prescription rule (if supplied) but to the
default-backchain-limit of the current logical world.  Setting of
backchain-limits can now specify either the new (type-set) limit or the
old limit (for rewriting); see *note SET-DEFAULT-BACKCHAIN-LIMIT:: and
see *note SET-BACKCHAIN-LIMIT::.  Moreover, the functions
default-backchain-limit and backchain-limit now take a second argument
of :ts or :rewrite to specify which backchain-limit is desired.

*HEURISTIC IMPROVEMENTS*

The so-called "too-many-ifs" heuristic has been modified.  Such a
heuristic has been employed in ACL2 (and previous Boyer-Moore provers)
for many years, in order to limit the introduction of calls of IF by
non-recursive functions.  Most users need not be concerned with this
change, but two proofs in the regression suite (out of thousands)
needed trivial adjustment, so user proofs could need tweaking.  In one
application, this modification sped up proofs by 15%; but the change in
runtime for the regression suite is negligible, so such speedups may
vary.  Thanks to Sol Swords for providing a test from ACL2 runs at
Centaur Technology, which was useful in re-tuning this heuristic.

Guard proof obligations could have size quadratic in the number of
clauses in a case statement.  This inefficiency has been removed with a
change that eliminates a hypothesis of the form (not (eql term
constant)) when there is already a stronger hypothesis, equating the
same term with a different constant.  Thanks to Sol Swords for bringing
this problem to our attention and suggesting an alternate approach to
solving it, which we may consider in the future if related efficiency
problems persist.

We adjusted the heuristics for determining induction schemes in the
presence of ruler-extenders, when handling calls of a function symbol
that is a ruler-extender, in either of two cases: either the function
takes only one argument; or the function is prog2$ or ec-call, and the
first argument contains no recursive call.  These cases are treated
more directly as though the ruler-extender call is replaced by the
unique (in the case of prog2$ and ec-call, the second) argument.

A new :type-prescription rule, true-listp-append, has been added:

     (implies (true-listp b)
              (true-listp (append a b)))

If you are interested in the motivation for adding this rule, see
comments in true-listp-append in ACL2 source file axioms.lisp.

The use of :forward-chaining lemmas has been improved slightly.  In
previous versions, a conclusion derived by forward chaining was
discarded if it was derivable by type-set reasoning, since it was
"already provable."  But this heuristic prevented the conclusion from
triggering further forward chaining.  This has been fixed.  Thanks to
Dave Greve for pointing out this problem.

The fundamental utility that turns an IF expression into a set of
clauses has been optimized to better handle tests of the form (equal x
'constant) and their negations.  This eliminates an exponential
explosion in large case analyses.  But it comes at the inconveience of
sometimes reordering the clauses produced.  The latter aspect of this
change may require you to change some Subgoal numbers in proof hints.
We apologize for the inconvenience.

Certification can now run faster (specifically, the compilation phase)
for books with very large structures generated by make-event, when
there is significant sharing of substructure, because of a custom
optimization of the Lisp reader.  Thanks to Sol Swords for bringing
this efficiency issue to our attention.

Jared Davis reported inefficiency in certain make-event evaluation due
to a potentially expensive "bad lisp object" check on the expansion
produced by the make-event.  This check has been eliminated except in
the case that the expansion introduces packages (for example, by
including a book during the expansion phase that introduces packages).
Thanks to Jared for providing a helpful example.

The application of rules of class :induction had the potential to loop
(as commented in ACL2 source function apply-induction-rule).  This has
been fixed.  Thanks to Daron Vroon and Pete Manolios for sending nice
examples causing the loop.

Heuristics have been tweaked so that false goals may be simplified to
nil that had formerly been left unchanged by simplification, perhaps
resulting in useless and distracting proofs by induction.  Thanks to
Pete Manolios for pointing out this issue by sending the following
example: (thm (<= (+ 1 (acl2-count x)) 0)).  (Technical explanation:
When every literal in a clause simplifies to nil, even though we might
not normally delete one or more such literals, we will replace the
entire clause by the false clause.)

Improved the efficiency of the built-in function, take.  Thanks to Bob
Boyer for suggesting this improvement.

ACL2 can now use evaluation to relieve hypotheses when applying
:type-prescription rules.  Thanks to Peter Dillinger and Dave Greve for
requesting this enhancement, and to Robert Krug for a relevant
discussion long ago.

Evaluation has been sped up during theorems for calls of mv-let, by
avoiding repeated evaluation of the expression to which its variables
are bound.  Thanks to Sol Swords for requesting this improvement and
sending an illustrative example.

Modified a heuristic to avoid the opening up non-recursive function
calls on calls of hide involving if-expressions.  For example, the thm
form below is now admitted

     (defun bar (x)
       (cons x x))
     (thm (equal (bar (hide (if a b c)))
          (cons (hide (if a b c)) (hide (if a b c)))))

*BUG FIXES*

Fixed a soundness bug in destructor elimination, which was preventing
some cases from being generated.  Thanks to Eric Smith for reporting
this bug and sending a helpful example.  (Technical detail: the fixes
were in ACL2 source functions apply-instantiated-elim-rule and
eliminate-destructors-clause1, and comments in the former contain Eric's
example.)

Fixed a bug that supported a proof of nil by exploiting the fact that
portcullis commands were not included in check-sum computations in a
book's certificate.  For such a proof of nil, see the relevant comment
in the ACL2 source file ld.lisp under (deflabel note-4-0 ...).

Changed the implementation of add-include-book-dir.  The previous
implementation could allow relative pathnames to be stored in the
portcullis commands of certificates of books, which perhaps could lead
to unsoundness (though we did not try to exploit this to prove nil).
Thanks to Jared Davis for reporting a bug in our first new
implementation.  An additional change to both add-include-book-dir and
delete-include-book-dir is that these now work in raw-mode (see *note
SET-RAW-MODE::).  (Thanks to Dave Greve for suggesting a reduction in
the warnings we produced related to raw-mode.)  Note that it is no
longer permitted to make a direct call of the form (table
acl2-defaults-table :include-book-dir-alist ...); use
add-include-book-dir instead.

Fixed a soundness bug related to xargs keyword :non-executable.  New
macros, defun-nx and defund-nx, have been provided for declaring
functions to be non-executable; see *note DEFUN-NX::.  While we expect
this bug to occur only rarely if at all in practice, the following
example shows how it could be evoked.

       ;;;;;;;;;;;;;;;;;;;;
       ;;; Book sub.lisp
       ;;;;;;;;;;;;;;;;;;;;
       (in-package "ACL2")
       (defun f ()
         (declare (xargs :guard t
                         :non-executable t))
         (mv-let (a b c)
                 (mv 3 4)
                 (declare (ignore a b))
                 c))
       (defun g ()
         (declare (xargs :guard t))
         (prog2$ (mv-let (x y z)
                         (mv 2 3 4)
                         (declare (ignore x y z))
                         nil)
                 (f)))
       (defthm g-nil
         (equal (g) nil)
         :hints (("Goal" :in-theory (disable (f))))
         :rule-classes nil)
       ;;;;;;;;;;;;;;;;;;;;
       ;;; Book top.lisp
       ;;;;;;;;;;;;;;;;;;;;
       (in-package "ACL2")
       (include-book "sub")
       (defthm contradiction
         nil
         :hints (("Goal" :use g-nil))
         :rule-classes nil)

The modification described above pertaining to defun-nx also prevents
execution of non-executable functions that have been traced.  The
following example illustrates the problem; now, the following defun of
g is illegal, and the problem disappears if defun-nx is used instead.

     (defun g (x) ; Use defun-nx to avoid an error after Version_3.6.1.
       (declare (xargs :guard t :non-executable t))
       x)
     (g 3) ; causes error, as expected
     (trace$ g)
     (g 3) ; returned 3 before the bug fix; after fix, causes error as expected

A hard error was possible when attempting to include an uncertified book
containing events of the form (make-event '(local ...)).  This has been
fixed.  Thanks to Sol Swords for bringing this issue to our attention.

Fixed a bug in the heuristic improvement described for Version_3.6 (see
*note NOTE-3-6::) as "We simplified induction schemes...."  The bug had
prevented, in unusual cases such as the following (notice the impossible
case), a proof by induction.

     (defun foo (a x)
       (and (consp x)
            (case a
              (0 (foo (car x) (cdr x)))
              (1 (foo (cdr x) (car x)))
              (0 (foo a (cons x x))))))
     (in-theory (disable (:type-prescription foo)))
     (thm (atom (foo a x)))

Macro cw-gstack did not work with an :evisc-tuple argument.  This has
been fixed by changing cw-gstack so that it now evaluates its
arguments.  Thanks to Sol Swords for bringing this bug to our attention.

Fixed a bug in :pso during the printing of failure messages for
termination proofs.

Fixed a bug in the handling of #. (see *note SHARP-DOT-READER::).
Thanks to Bob Boyer for bringing this bug to our attention.

Replaced a hard Lisp error with a clean error, in certain cases that a
:hints value is erroneously supplied as a non-nil atom.  Example: (thm
(equal x x) :hints 3).

Fixed a bug in the interaction of function tracing with conversion of a
function from :program to :logic mode.  The following example
illustrates what had been wrong.

     (defun f (x)
       (declare (xargs :mode :program))
       (car x))
     (f 3) ; raw Lisp hard error
     (trace$ f)
     (f 3) ; raw Lisp hard error (still)
     (defun f (x) (car x)) ; upgrade f to :logic mode
     (f 3) ; clean guard violation; f is no longer traced
     (trace$) ; uh oh - f is shown as traced
     (untrace$ f)
     (f 3) ; OUCH: hard Lisp error because old :program mode definition of
           ; the executable counterpart (sometimes called *1*f) was restored!

Made a fix so that when building ACL2 with `make' option ACL2_SAFETY=3,
there will no longer be any safety-0 compiled code generated.  Thanks
to Gary Byers for bringing this bug to our attention.

Fixed a bug in the handling of override-hints that generate custom
keyword hints (see *note CUSTOM-KEYWORD-HINTS::) involving the variable
stable-under-simplificationp.  Thanks to Ian Johnson for bringing this
bug to our attention with explanation that included a helpful example,
included as comment in the ACL2 source code for function
apply-override-hint.

The saved_acl2 script in CLISP could contain unexpected characters where
simple newlines were expected.  Dave Greve found this in a Cygwin
environment on Windows.  Thanks to Dave for reporting this bug and
experimenting with a fix, and thanks to the CLISP folks for providing
helpful information.

Fixed a bug that could make :oops cause an error.  Also, the oops
command can no longer take you back before a reset-prehistory event.

(GCL only) Fixed a bug that could occur when calling trace in raw Lisp
in GCL.

Proof summaries have been improved, so that they account for runes used
in rewriting that takes place when generating goals to be proved in a
forcing round.  Thanks to Jared Davis for sending us an example
illustrating this issue.

Fixed a bug that (at least in CCL) could put extra backslashes (`\') in
a pathname that ACL2 writes out to the executable script created by a
build.  Thanks to Gary Byers for explaining that the CCL behavior is
legal (for our previous use of Common Lisp function merge-pathnames).

We closed some holes in the handling of trust tags (also known as
"ttags"; see *note DEFTTAG::) by include-book.  The following example
illustrates this rather subtle situation.  Consider the following book.

     (in-package "ACL2")
     (make-event
      (er-progn
       (encapsulate
        ()
        (defttag :foo)
        (value-triple "Imagine something bad here!"))
       (value '(value-triple :some-value)))
      :check-expansion t)

Formerly, the following commands succeeded.

     (certify-book "test3" 0 t :ttags :all)
     :u
     (include-book "test3" :ttags nil)

But because of make-event keyword argument :check-expansion t, we know
that the event (defttag :foo) is evaluated by the above include-book
form, and hence the :ttags argument of include-book, above, should have
specified :foo.  The problem was that defttag forms evaluated during
make-event expansion did not contribute to the trust tag information
stored in the book's certificate.  Note: Because of this change, one
should avoid using make-event with :check-expansion t when the
expansion would introduce a defttag event during include-book but not
certify-book time.  For an example illustrating this issue, see *note
MAKE-EVENT-DETAILS::, specifically the new version of the section
labeled "A note on ttags" at the end of that documentation topic.

Closed a small loophole that had the potential, in rare circumstances,
to violate atomicity of under-the-hood updates for ACL2 arrays.

The following example was formerly allowed, but resulted in a
guard-verified function (here, g) whose guard proof obligation is not a
theorem outside the encapsulate event.  We now disallow guard
verification for functions introduced non-locally inside an encapsulate
event unless we determine that the proof obligations hold outside the
encapsulate event as well.

     (encapsulate
      ((f (x) t))
      (local (defun f (x) (declare (xargs :guard t)) (consp x)))
      ;; ERROR!
      (defun g (x)
        (declare (xargs :guard (f x)))
        (car x)))

The use of :comp on stobj functions had potentially caused a hard Lisp
error; for example, this could occur when (defstobj foo fld) was
followed by :comp foop.  This has been fixed.

Fixed a bug that could cause a raw Lisp error when the first argument of
with-local-stobj is not a symbol.

It had been possible to use the reserved keyword
:computed-hints-replacement as the name of a custom keyword hint (see
*note CUSTOM-KEYWORD-HINTS::).  This has been fixed.  Thanks to Dave
Greve, who pointed out a confusing hint error message (which has also
been fixed) that led us to this issue.

Fixed a bug that could cause a hard Lisp error, instead of a graceful
ACL2 error, if keyword :backchain-limit-lst in a rule class is given a
cons that is not a true list, such as (1 . 1).

Eliminated an error that could occur when redefining a function as a
macro and then compiling, as in the example below.

     (defun foo (x) x)
     :redef!
     (defmacro foo (x) x)
     :comp t

Thanks to Eric Smith for sending the above example in his bug report.

Fixed a bug that could result in an assertion when a clause-processor
causes an error.

*NEW AND UPDATED BOOKS AND RELATED INFRASTRUCTURE*

See `http://code.google.com/p/acl2-books/source/list' for a record of
books changed or added since the preceding release, with log entries.

We note in particular the new system/ directory, which begins to specify
ACL2 system code in anticipation of opening the architecture of ACL2
(see *note DEFATTACH:: for a relevant tool).  Some system functions
were changed slightly (but with the expectation of not generally
affecting ACL2 behavior) in support of the development of this
directory.  Those interested in contributing to further such efforts
are invited to contact the ACL2 implementors.

New utilities have been provided for certifying most of the distributed
books with more `make'-level parallelism.  For example, we have
obtained close to a 12x reduction in time by using `make -j 24
regression-fast' on a 24-processor machine.  For more information see
books/make-targets, or to include the books/workshops in the regression
run, see books/regression-targets.  Thanks to Sol Swords for providing
these nice utilities.

The top-level makefile, GNUmakefile, has been fixed so that the build
processes (which are inherently sequential) will ignore the -j option of
`make'.  Note that regressions can still, however, be done in parallel,
as the -j option will be passed automatically to the appropriate `make'
command.

*EMACS SUPPORT*

*EXPERIMENTAL VERSIONS*

The HONS version, supported primarily by Bob Boyer and Warren Hunt (see
*note HONS-AND-MEMOIZATION::), has undergone numerous improvements.  For
example, keyword argument :FORGET is now supported when calling memoize
from within the ACL2 loop, and system function worse-than is memoized
with the :condition that both terms are function applications (clearing
the memo-table after each prover invocation).  Thanks to Jared Davis
and Sol Swords for investigating the memoization of worse-than, and
with suitable condition.  Thanks also to Jared Davis for contributing
structural modifications to the implementation of hons.

David Rager contributed modifications to the parallel version (see
*note PARALLELISM::), which include taking advantage of atomic
increments available at least since Version 1.0.21 of SBCL and Version
1.3 of CCL.

* Menu:

* NOTE-4-0-WORMHOLE-CHANGES:: how to convert calls of wormhole for Version  4.0


File: acl2-doc-emacs.info,  Node: NOTE-4-0-WORMHOLE-CHANGES,  Prev: NOTE-4-0,  Up: NOTE-4-0

NOTE-4-0-WORMHOLE-CHANGES    how to convert calls of wormhole for Version  4.0

Here we describe how to convert an "old-style" call of wormhole -- that
is, a call suitable for ACL2 versions preceding  4.0 -- in which the
pseudo-flag was t.  In order to convert such a call

     (wormhole t 'name input form ...)

to a new-style call, the following steps must be carried out.  Note
that the wormhole name must always be quoted now.

First, eliminate the first argument, t, and add a new second argument
that is the quoted lambda expression

     '(lambda (whs) (set-wormhole-entry-code whs :ENTER))

Setting the entry code to :ENTER is not necessary if you maintain the
invariant (after initialization) that it is always :ENTER.  In that
case, the simpler quoted lambda will suffice:

     '(lambda (whs) whs)

Second, change the form argument so that instead of talking about the
state-global variable wormhole-output it talks about the state-global
variable wormhole-status.  Look for (@ wormhole-output), (assign
wormhole-output ...), (f-get-global 'wormhole-output ...) and
(f-put-global 'wormhole-output ...) in form and replace them with
expressions involving wormhole-status.

However, remember that the old data stored in wormhole-output is now in
the wormhole-data component of the wormhole-status.  Thus, for example,
an old use of (@ wormhole-output) will typically be replaced by
(wormhole-data (@ wormhole-status)) and an old use of (assign
wormhole-output ...) will typically be replaced by

     (assign wormhole-status (set-wormhole-data (@ wormhole-status) ...))

In summary, an old-style call like

     (wormhole t 'name
               input
               '(...1 (@ wormhole-output) ...2
                 ...3 (assign wormhole-output ...4) ...5)
               ...6)

can become

     (wormhole 'name
               '(lambda (whs) (set-wormhole-entry-code whs :ENTER))
               input
               '(...1 (wormhole-data (@ wormhole-status)) ...2
                 ...3 (assign wormhole-status
                             (set-wormhole-data (@ wormhole-status)
                                                ...4) ...5)
               ...6)

In any case, and especially if your wormhole call had a pseudo-flag
other than t, we recommend that you see *note WORMHOLE::.


File: acl2-doc-emacs.info,  Node: NOTE-4-0(R),  Next: NOTE-4-1,  Prev: NOTE-4-0,  Up: RELEASE-NOTES

NOTE-4-0(R)    ACL2 Version  4.0(r) (July, 2010) Notes

Please see *note NOTE-4-0:: for changes in Version  4.0 of ACL2.


File: acl2-doc-emacs.info,  Node: NOTE-4-1,  Next: NOTE-4-1(R),  Prev: NOTE-4-0(R),  Up: RELEASE-NOTES

NOTE-4-1    ACL2 Version  4.1 (September, 2010) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  4.1 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, distributed books, Emacs support,
and experimental versions.  Each change is described in just one
category, though of course many changes could be placed in more than
one category.

*CHANGES TO EXISTING FEATURES*

The guard associated with calls of the macro, search, has been weakened
so that now, given strings are no longer restricted to contain only
standard characters unless the :test argument is char-equal.

Modified the writing of "hidden defpkg" forms into certificate files
(see *note HIDDEN-DEFPKG::), to support moving certificate files for
distributed books, as is done by ACL2s (see *note ACL2-SEDAN::) and
Debian releases of ACL2.  Thanks to Camm Maguire for reporting a
problem with Debian releases of ACL2 that led to this change.

Expanded the constant *acl2-exports* by adding intersection-equal to
the list.  Thanks to Jared Davis for requesting this change.

The :comp utility now compiles functions that have code conditionalized
for raw Lisp only (presumably because a trust tag was active when they
were defined).  Previously, this was not the case when :comp was
applied to more than a single function symbol.

*NEW FEATURES*

A new macro, top-level, allows evaluation directly in the top level
loop for forms that normally need to be evaluated inside function
bodies, such as with-local-stobj.  See *note TOP-LEVEL::.  Thanks to
Jared Davis for requesting such a utility.

Added count, a Common Lisp function, to ACL2.  In support of that
addition, also added rewrite rule eqlablep-nth.

*HEURISTIC IMPROVEMENTS*

[None this time.]

*BUG FIXES*

We fixed a soundness bug that could occur when a function that returns
multiple values that is called in its own guard.  Thanks to Sol Swords
for reporting this bug and sending a small self-contained example,
which is included in a comment in the function chk-acceptable-defuns1
in ACL2 source file defuns.lisp.

It was possible to cause an error when giving theory hints during
redefinition of functions.  This has been fixed.  Thanks to Ian Johnson
for sending an example that nicely illustrated this problem.

Fixed system function io? for the case that formal parameter commentp
is t and vars is non-empty.  Thanks to David Rager for bringing to our
attention the fact that io? was broken for such a combination of
parameters.

Not exactly a bug fix, but: defun-sk was breaking when a :guard is
specified, so we have improved the documentation (see *note DEFUN-SK::)
to explain how to provide verified guards for a function introduced by
defun-sk.  Thanks to Jared Davis for bringing this issue to our
attention.

Made a fix to the handling of interrupts, which in rare cases might
have left one in a state where all subsequent proof attempts were
labeled as "Aborting due to an interrupt".

Fixed :pso and related utilities, so that when proof output is
redirected to a file, all summary output goes to that file rather than
to the terminal.

(GCL on Windows only) Removed an inappropriate check, resulting in an
error about "pathname-device," that could prevent Windows GCL builds of
ACL2.  Thanks to Camm Maguire for reporting this problem and a helpful
discussion.

(Windows only) Modified the computation of canonical pathnames to avoid
issues of case-insensitivity, in particular for the drive (e.g., "C:"
vs. "c:").  Thanks to Harsh Raju Chamarthi for reporting this issue and
helping with its debugging.

(Windows only) The value of (@ distributed-books-dir) no longer will be
missing the Windows drive prefix, for example, "C:".  Thanks to Harsh
Raju Chamarthi for reporting this issue and helping with its debugging.

*NEW AND UPDATED BOOKS AND RELATED INFRASTRUCTURE*

See `http://code.google.com/p/acl2-books/source/list' for a record of
books changed or added since the preceding release, with log entries.

Modified books/Makefile-generic by adding a new BOOKS_SKIP_COMP
variable, which is used in Makefiles in some subdirectories of books/,
in order to avoid errors when compiling certified books for multiple
Lisps.

*EMACS SUPPORT*

Distributed file emacs/emacs-acl2.el has been modified so that the forms
control-t e and control-t control-e now pick up package markers (see
*note SHARP-BANG-READER::), in the following sense: if the top-level
form is preceded by a line starting with #!, then that line is included
in the inserted string.  Thanks to Jared Davis for suggesting this
enhancement and providing a preliminary implementation.

*EXPERIMENTAL VERSIONS*

For the HONS version there have been some changes to memoize:

     Memoize accepts a new keyword, :recursive, that is a synonym for
     the existing keyword :inline.  Thanks to Sol Swords for requesting
     this addition.  Moreover, it is now enforced that these keywords
     have Boolean values.

     Memoize may now be called on :program mode functions.  Thanks to
     Sol Swords for requesting this enhancement.

     A bug has been fixed.  Now, if memoize is called with a
     :condition-fn (with value other than nil or t), then the guard of
     the memoized function and the :condition-fn must be the same.
     Previously, one could exploit the lack of such a check to get a
     hard Lisp error, for example as follows.

               (defun f (x) (declare (xargs :guard t)) x)
               (defun cf (x) (declare (xargs :guard (consp x))) (car x))
               (memoize 'f :condition-fn 'cf)
               (f 3)

     Memoization is now illegal for built-in functions that use
     underlying raw Lisp in their implementations.  To see why,
     consider the form (gc$), which is a macro call expanding to
     (gc$-fn nil).  Previously, after evaluation of (memoize 'gc$-fn),
     a call of gc$ would no longer call the garbage collector, which
     had been invoked by raw Lisp code.  Now, evaluation of (memoize
     'gc$-fn) causes an error.


File: acl2-doc-emacs.info,  Node: NOTE-4-1(R),  Next: NOTE-4-2,  Prev: NOTE-4-1,  Up: RELEASE-NOTES

NOTE-4-1(R)    ACL2 Version  4.1(r) (September, 2010) Notes

Please see *note NOTE-4-1:: for changes in Version  4.1 of ACL2.


File: acl2-doc-emacs.info,  Node: NOTE-4-2,  Next: NOTE-4-2(R),  Prev: NOTE-4-1(R),  Up: RELEASE-NOTES

NOTE-4-2    ACL2 Version  4.2 (January, 2011) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  4.2 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, distributed books, Emacs support,
and experimental versions.  Each change is described in just one
category, though of course many changes could be placed in more than
one category.

*CHANGES TO EXISTING FEATURES*

The accumulated-persistence utility can now do finer-grained tracking,
providing data for individual hypotheses and the conclusion of a rule.
See *note ACCUMULATED-PERSISTENCE::.  To try this out, evaluate the form
(accumulated-persistence :all); then see *note
ACCUMULATED-PERSISTENCE:: for a discussion of display options using
show-accumulated-persistence.  Thanks to Dave Greve for suggesting this
new capability and collaborating on its design and implementation.

The defattach utility now permits the use of :program mode functions,
though this requires the use of a trust tag (see *note DEFTTAG::).  See
*note DEFATTACH:: and for discussion of the new capability, see *note
DEFPROXY::, which explains how part of this change involves allowing
:program mode functions to be declared non-executable.

Redefinition (see *note LD-REDEFINITION-ACTION::) is no longer
permitted for functions that have attachments (see *note DEFATTACH::).
In such cases, the attachment must be removed first, e.g. with
(defattach foo nil).

Made small changes to mv-nth and defun-sk in order to permit guard
verification of functions introduced with more than one quantified
variable in a defun-sk form.  The change to mv-nth is to weaken the
guard by eliminating the requirement that the second argument satisfy
true-listp, and replacing the call of endp in the definition body by a
corresponding call of atom.  The new definition of mv-nth is thus
logically equivalent to the old definition, but with a weaker guard.
Thanks to Sol Swords for sending the following example, for which the
final verify-guards form had failed but now succeeds.

     (defstub foo (a b c) nil)
     (defun-sk forall-a-b-foo (c)
        (forall (a b) (foo a b c))
        :witness-dcls ((declare (Xargs :guard t
                                       :verify-guards nil))))
     (verify-guards forall-a-b-foo)

The implementations of prog2$, time$, with-prover-time-limit,
with-guard-checking, mbe (and must-be-equal), and ec-call have changed.
See the discussion below of the new utility, return-last.  A
consequence is that trace$ is explicitly disallowed for these and
related symbols, which formerly could cause hard Lisp errors, because
they are now macros.  Tracing of return-last is also disallowed.
Another consequence is that time$ now prints a more abbreviated message
by default, but a version of the old behavior can be obtained with
:mintime nil.

The following utilities no longer print an observation about raw-mode
transitions: set-raw-mode-on, set-raw-mode-on!, set-raw-mode, and
set-raw-mode-off.  Thanks to Jared Davis for suggestion this change in
the case of include-book (which proved awkward to restrict to that
case).

The system function translate-and-test now permits its LAMBDA form to
refer to the variable WORLD, which is bound to the current ACL2 logical
world.

Modified abort handling to avoid talking about an interrupt when the
error was caused by a Lisp error rather than an interrupt.

The value of the constant *acl2-exports*, which is still a list, has
been extended significantly, though only with the addition of symbols
that one might reasonably have expected all along to belong to this
list.  A new distributed book, books/misc/check-acl2-exports.lisp,
checks (at certification time) that no documented constant, macro, or
function symbol in the "ACL2" package has been accidentally omitted from
*acl2-exports*.  Thanks to Dave Greve for helpful discussions related to
this change.

Improved the built-in `untranslate' functions to produce let*
expressions when appropriate (more to help with tools that call
untranslate and the like, than to help with proof output).

The utility redo-flat now works for certify-book failures, just as it
continues to work for failures of encapsulate and progn.

The following only affects users who use trust tags to add to list
values of either of the state global variables
program-fns-with-raw-code or logic-fns-with-raw-code.  For functions
that belong to either of the above two lists, trace$ will supply a
default value of :fncall to keyword :notinline, to avoid discarding
raw-Lisp code for the function.

The guard of the macro intern has been strengthened so that its second
argument may no longer be either the symbol *main-lisp-package-name* or
the string "COMMON-LISP".  That change supports another change, namely
that the following symbols in the "COMMON-LISP" package are no longer
allowed into ACL2: symbols in that package that are not members of the
list constant *common-lisp-symbols-from-main-lisp-package* yet are
imported into the "COMMON-LISP" package from another package.  See
*note PKG-IMPORTS:: and see *note SYMBOL-PACKAGE-NAME::.  To see why we
made that change, consider for example the following theorem, which
ACL2 was able to prove when the host Lisp is GCL.

     (let ((x "ALLOCATE") (y 'car))
       (implies (and (stringp x)
                     (symbolp y)
                     (equal (symbol-package-name y)
                            "COMMON-LISP"))
                (equal (symbol-package-name (intern-in-package-of-symbol x y))
                       "SYSTEM")))

Now suppose that one includes a book with this theorem (with
:rule-classes nil), using an ACL2 built on top of a different host
Lisp, say CCL, that does not import the symbol SYSTEM::ALLOCATE into
the "COMMON-LISP" package.  Then then one can prove nil by giving this
theorem as a :use hint.

The axioms introduced by defpkg have changed.  See the discussion of
pkg-imports under "NEW FEATURES" below.

The error message for free variables (e.g., in definition bodies and
guards) now supplies additional information when there are governing IF
conditions.  Thanks to Jared Davis for requesting this enhancement and
collaborating in its design.

The command :redef- now turns off redefinition.

Improved proof output in the case of a :clause-processor hint that
proves the goal, so that the clause-processor function name is printed.

The proof-checker command `then' now stops at the first failure (if
any).

It is no longer permitted to submit definitions in :logic mode for
merely part of an existing mutual-recursion event.  Such an action left
the user in an odd state and seemed a potential soundness hole.

The function break$ is now in :logic mode.  Thanks to Jared Davis for
requesting this enhancement.

The macro verify-termination now provides clearer output in the case
that it is redundant.  More important perhaps, as a courtesy it now
causes an error when applied to a constrained function, since
presumably such an application was unintended (as the constrained
function could never have been in :program mode).  Note that if one
desires different behavior, one can create one's own version of
verify-termination (but with a different name).

Improved the guards for the following functions, often weakening them,
to reflect more precisely the requirements for calling eq:
alist-difference-eq, intersection-eq, intersection1-eq, intersectp-eq,
not-in-domain-eq, set-difference-assoc-eq, set-equalp-eq, and union-eq.
Thanks to Jared Davis for pointing out this issue for intersectp-eq.

(CCL only) Made a change that can reduce the size of a compiled file
produced by certify-book when the host Lisp is CCL, by discarding source
information (for example, discarding local events).

*NEW FEATURES*

See the discussion above about new statistics that can be gathered by
the accumulated-persistence utility.

A new hint, :instructions, allows use of the proof-checker at the level
of hints to the prover.  Thanks to Pete Manolios for requesting this
feature (in 2001!).  See *note INSTRUCTIONS::.

(For system hackers) There are new versions of system functions
translate1 and translate, namely translate1-cmp and translate-cmp
respectively, that do not take or return state.  See the Essay on
Context-message Pairs for relevant information.  Thanks to David Rager
for collaborating on this enhancement.

A new utility, return-last, is now the unique ACL2 function that can
pass back a multiple value result from one of its arguments.  Thus, now
the following are macros whose calls ultimately expand to calls of
return-last: prog2$, time$, with-prover-time-limit,
with-guard-checking, mbe (and must-be-equal), and ec-call.  With an
active trust tag, an advanced user can now write code that has side
effects in raw Lisp; see *note RETURN-LAST::.  Thanks to Jared Davis
for requesting this feature.

A new function, pkg-imports, specifies the list of symbols imported
into a given package.  The axioms for defpkg have been strengthened,
taking advantage of this function.  Now one can prove theorems using
ACL2 that we believe could not previously be proved using ACL2, for
example the following.

     (equal (symbol-package-name (intern-in-package-of-symbol str t))
            (symbol-package-name (intern-in-package-of-symbol str nil)))

Thanks to Sol Swords for a helpful report, which included the example
above.  See *note PKG-IMPORTS:: and see *note DEFPKG::.

Added function no-duplicatesp-eq.

Added a new hint keyword, :backchain-limit-rw, to control the level of
backchaining for rewrite, meta, and linear rules.  This overrides, for
the current goal and (as with :in-theory hints) descendent goals, the
default backchain-limit (see *note SET-BACKCHAIN-LIMIT::).  Thanks to
Jared Davis for requesting this feature.

Support is now provided for creating and certifying books that do not
depend on trust tags, in the case that the only use of trust tags is
during make-event expansion.  See *note SET-WRITE-ACL2X::.  Thanks to
Sol Swords for reporting a couple of bugs in a preliminary
implementation.

Function (file-write-date$ filename state) has been added, giving the
write date of the given file.

See *note FORWARD-CHAINING-REPORTS:: for how to get new reports on the
forward chaining activity occurring in your proof attempts.  Thanks to
Dave Greve for inspiring the addition of this utility.

It is now possible to use ACL2's printing utilities to return strings,
by opening output channels to the keyword :STRING rather than to
filenames.  See *note IO::.  Thanks to Jared Davis for a helpful
conversation that led us to add this feature.

*HEURISTIC IMPROVEMENTS*

We have slightly improved the handling of :forward-chaining rules that
contain free variables.  Formerly, such rules might fire only once,
when the first match for a free variable is discovered, and would not
fire again even if subsequent forward chaining made available another
match.  This made it difficult to predict whether a rule with free
variables would fire or not, depending as it did on the order in which
newly derived conclusions were added.  The new handling is a little
slower but more predictable.  Thanks to Dave Greve for sending a helpful
example that led us to consider making such an improvement.

We have slightly improved the so-called "type-set" heuristics to work a
bit harder on terms of the form (rec term), where rec is a so-called
"compound-recognizer" function, that is, a function with a
corresponding enabled :compound-recognizer rule.  Thanks to Jared Davis
for sending a helpful example (found, in essence, in the modified
function type-set-rec, source file type-set-b.lisp).

We made three heuristic improvements in the way contexts (so-called
"type-alists") are computed from goals ("clauses").  Although these
changes did not noticeably affect timing results for the ACL2 regression
suite, they can be very helpful for goals with many hypotheses.  Thanks
to Dave Greve for sending a useful example (one where we found a goal
with 233 hypotheses!).

The algorithm for substituting alists into terms was modified.  This
change is unlikely to affect many users, but in one example it resulted
in a speed-up of about 21%.  Thanks to Dave Greve for supplying that
example.

Sped up include-book a bit by memoizing checksums of symbols.  (This
change pertains to "normal" ACL2 only, not the hons version (see *note
HONS-AND-MEMOIZATION::, where such memoization already occurred.)  We
found about a 23% speed-up on an example from Dave Greve.

Made a small change to the algorithm used to prove hypotheses of
:type-prescription rules (ACL2 source function type-set-relieve-hyps).
One change avoids a linear walk through the context (the "type-alist"
structure), while the other could avoid storing unnecessary forced
assumptions (into the so-called "tag-tree").

*BUG FIXES*

Fixed a long-standing soundness bug caused by the interaction of forced
hypotheses with destructor elimination.  The fix was to avoid using
forcing when building the context (so-called "type-alist") when the
goal is considered for destructor elimination; those who are interested
can see a discussion in source function eliminate-destructors-clause1,
which includes a proof of nil that no longer succeeds.  A similar fix
was made for generalization, though we have not exploited the previous
code to prove nil in that case.

Fixed a bug that allowed book certification to ignore skip-proofs around
encapsulate events.  Thus, a book could contain an event of the form
(skip-proofs (encapsulate ...)), and a call of certify-book on that
book could succeed even without supplying keyword :skip-proofs-okp t.
This bug was introduced in Version  3.5 (May, 2009).

Fixed a bug that could occur when including a book that attempts to
redefine a function as a macro, or vice-versa.  (For details of the
issue, see the comment in the definition of variable
*hcomp-fn-macro-restore-ht* in source file other-events.lisp.)

(Windows only) Fixed handling of the Windows drive so that an executable
image saved on one machine can be used on another, even with a different
drive.  Thanks to Harsh Raju Chamarthi for reporting this issue and
doing a lot of testing and collaboration to help us get this right.

Made a change to avoid possible low-level errors, such as bus errors,
when quitting ACL2 by calling good-bye or its synonyms.  This was
occurring in CCL, and we are grateful to Gary Byers for helping us find
the source of those errors (which basically was that ACL2 was
attempting to quit while already in the process of quitting).

Fixed a bug in with-guard-checking, which was being ignored in function
bodies.

Fixed a bug in top-level, which was not reverting the logical world
when an error resulted from evaluation of the given form.  Thanks to
Jared Davis for bringing this bug to our attention.

Fixed a long-standing bug (back through Version  2.7) that was
discarding changes to the connected book directory (see *note CBD::)
when exiting and then re-entering the top-level ACL2 loop (with lp).

In some host Lisps, it has been possible to be in a situation where it
is impossible to interrupt checkpoint printing during the summary.  We
had thought this solved when the host Lisp was CCL, but Sol Swords sent
us an example (for which we are grateful) illustrating that this
behavior could occur.  This has been fixed.

Fixed a bug in a proof obligation generated for :meta and
:clause-processor rules, that the guard on the metafunction or
clause-processor function, fn, holds under suitable assumptions.  Those
assumptions include not only that the first argument of fn satisfies
pseudo-termp, but also that all stobj inputs satisfy the corresponding
stobj recognizer predicates.  We had erroneously considered stobj
outputs of fn instead of stobj inputs.  Thanks to Sol Swords for
bringing this bug to our attention with a simple example, and correctly
pointing us to the bug in our code.

Fixed the following bugs in defattach.  We hadn't always been applying
the full functional substitution when generating guard proof
obligations.  We had been able to hit an assertion when reattaching to
more than one function.  Attachment was permitted in the case of an
untouchable function (see *note REMOVE-UNTOUCHABLE::).  Finally, the
guard proof obligation could fail in the case that the two functions
have different formal parameter lists, as in the following example.

     (encapsulate
      ((foo (x) x :guard (symbolp x)))
      (local (defun foo (x) x)))
     (defun bar (x2)
       (declare (xargs :guard (symbolp x2)))
       x2)
     (defattach foo bar)

Fixed a raw Lisp error that could be caused by including a book using
make-event to define a function symbol in a locally-introduced package.
An example appears in a comment in ACL2 source function
write-expansion-file.

Made a change that can prevent an error near the end of book
certification when the underlying Host Lisp is Allegro Common Lisp, in
the case that environment variable ACL2_SYSTEM_BOOKS has been set to
the name of a directory with a parent that is a soft link.  Thanks to
Dave Greve for supplying an example to led us to this fix, which
involves avoiding Allegro CL's implementation of the Common Lisp
function, truename.

Fixed a bug that was failing to substitute fully using bindings of free
variables in forced hypotheses.  A related change is that instead of
binding such a free variable to a new variable of the form ???-Y, the
new variable is now of the form UNBOUND-FREE-Y.

Fixed a bug that could inhibit the printing of certain theory warnings
(and probably, in the other direction, cause inappropriate such
printing).

We eliminated excessive "Raw-mode" warnings about add-include-book-dir
that could be generated by the use of raw-mode during include-book.
Thanks to Dave Greve for bringing this issue to our attention.

Fixed the printing of results from forms within an encapsulate, so that
they are abbreviated according to the ld-evisc-tuple.

It is now possible to evaluate stobj-related forms after evaluating
:set-guard-checking :none or :set-guard-checking nil, even in cases
where such evaluation formerly caused a guard violation due to a bug in
ACL2.  Here is an example of an error that no longer occurs.

     ACL2 !>(defstobj st fld)

     Summary
     Form:  ( DEFSTOBJ ST ...)
     Rules: NIL
     Time:  0.00 seconds (prove: 0.00, print: 0.00, other: 0.00)
      ST
     ACL2 !>(set-guard-checking :none)

     Turning off guard checking entirely.  To allow execution in raw Lisp
     for functions with guards other than T, while continuing to mask guard
     violations, :SET-GUARD-CHECKING NIL.  See :DOC set-guard-checking.

     ACL2 >(fld st)


     ACL2 Error in TOP-LEVEL:  The guard for the function call (FLD ST),
     which is (STP ST), is violated by the arguments in the call (FLD ST).
     [... etc. ...]

You can understand how things now work by imagining that when a function
introduced by defstobj is called, guard-checking values of :none or nil
are temporarily converted to t.  Thanks to Pete Manolios, Ian Johnson,
and Harsh Raju Chamarthi for requesting this improvement.

Fixed a bug in which the wrong attachment could be made when the same
function has an attachment in a book and another in the certification
world of that book (possibly even built into ACL2), if the load of a
compiled file is aborted because a sub-book's compiled file is missing.
The bug has been present since the time that defattach was added
(Version_4.0).  An example may be found in a comment in the deflabel
for note-4-2 (ACL2 source file ld.lisp).

The :doc and related utilities now cause a clean error when provided
other than a symbol.  Thanks to Jared Davis for pointing out the raw
Lisp error that had occurred in such cases.

It had been the case that in raw-mode (see *note SET-RAW-MODE::), it
was possible to confuse include-book when including a book in a
directory different from the current directory.  This has been fixed.
Thanks to Hanbing Liu for bringing this problem to our attention with a
small example.

*NEW AND UPDATED BOOKS AND RELATED INFRASTRUCTURE*

Many changes have been made to the distributed books, thanks to an
active ACL2 community.  You can contribute books and obtain updates
between ACL2 releases by visiting the acl2-books project web page,
`http://acl2-books.googlecode.com/'.

There is new Makefile support for certifying just some of the
distributed books.  See *note BOOKS-CERTIFICATION-CLASSIC::, in
particular discussion of the variable ACL2_BOOK_DIRS.  Thanks to Sandip
Ray for requesting this enhancement.

The documentation for make-event now points to a new book,
books/make-event/defrule.lisp, that shows how make-event can be used to
do macroexpansion before generating events.  Thanks to Carl Eastlund for
useful interaction on the acl2-help mailing list that led us to add this
example.

*EMACS SUPPORT*

Incorporated a version of changes from Jared Davis to the control-t f
emacs utility (distributed file emacs/emacs-acl2.el), so that one can
fill a format string from anywhere within the string.

*EXPERIMENTAL VERSIONS*

We refrain from listing changes here to experimental versions, other
than an enhancement to the HONS version that can reduce sizes of
certificate files, by applying hons-copy to introduce structure sharing
(ACL2 source function make-certificate-file1).


File: acl2-doc-emacs.info,  Node: NOTE-4-2(R),  Next: NOTE-4-3,  Prev: NOTE-4-2,  Up: RELEASE-NOTES

NOTE-4-2(R)    ACL2 Version  4.2(r) (January, 2011) Notes

Please see *note NOTE-4-2:: for changes in Version  4.2 of ACL2.


File: acl2-doc-emacs.info,  Node: NOTE-4-3,  Next: NOTE-4-3(R),  Prev: NOTE-4-2(R),  Up: RELEASE-NOTES

NOTE-4-3    ACL2 Version  4.3 (July, 2011) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  4.2 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level and to
distributed books, Emacs support, and experimental versions.  Each
change is described in just one category, though of course many changes
could be placed in more than one category.

*CHANGES TO EXISTING FEATURES*

Significant changes have been made for list-processing primitives such
as member and assoc; see *note EQUALITY-VARIANTS::.  In summary:
instead of separate functions based on eq, eql, and equal, there is
essentially just one function, which is based on equal; the eq and eql
variants are logically just the equal variant.  For example, member-eq
and member are macros that generate corresponding calls of member-equal
in the logic, although in raw Lisp they will execute using tests eq and
eql, respectively.  References to any of these in logical contexts such
as theories are now references to the function based on equal; for
example, the hint :in-theory (disable member) is completely equivalent
to the hint :in-theory (disable member-equal).  Distributed books have
been modified as necessary to accommodate this change.  While the need
for such changes was relatively infrequent, changes were for example
needed in contexts where terms are manipulated directly; for example,
defevaluator needs to mention member-equal rather than member, just as
it was already the case to mention, say, binary-append rather than
append.  Again, see *note EQUALITY-VARIANTS:: for more information
about equality variants.

A few improvements were made in support of the modified treatment of
equality variants discussed above.  The changes include the following.

     o We now allow the use of macro aliases (see *note
     MACRO-ALIASES-TABLE:: in :trigger-fns of rules (see *note
     RULE-CLASSES::).

     o We now remove so-called "guard holders" (including calls of
     return-last, hence of mbe) in :trigger-terms of rules.

     o We also remove guard holders in formulas of :congruence and
     type-prescription rules.

     o Macros union-eq and intersection-eq can now take any positive
     number of arguments, and union-eq can take zero arguments.
     (Thanks to Jared Davis for requesting this enhancement.)  The same
     can be said for new macros union$ and intersection$, respectively.

     o A few changes were made to built-in theorems from source file
     axioms.lisp, in particular disabling :type-prescription rule
     consp-assoc-equal (formerly two enabled rules, consp-assoc-eq and
     consp-assoc) but adding this theorem as a :forward-chaining rule,
     and similarly for
     true-list-listp-forward-to-true-listp-assoc-equal (and eliminating
     rule true-list-listp-forward-to-true-listp-assoc-eq; and disabling
     rule true-listp-cadr-assoc-eq-for-open-channels-p.  Also, theorem
     all-boundp-preserves-assoc has been renamed to
     all-boundp-preserves-assoc-equal and also strengthened.

     o Some guards were slightly improved (logically weaker or the
     same).

Improved get-output-stream-string$ to allow for a context and to do
genuine error printing instead of using cw.  See *note IO::.

Added the symbols flet and with-local-stobj to *acl2-exports*.

A small change was made to the processing of more than one :guard
declaration for the same function.  In particular, a guard of t is
essentially ignored.

Attachments are now allowed during evaluation of the first argument of
prog2$ even in contexts (such as proofs) during which the use of
attachments is normally prohibited.  More generally, the second of the
three arguments of return-last has this property, except in the case of
mbe (or related macros like mbe1), where the exec argument may provide
the value.  Thanks to Sol Swords for useful discussions leading us to
implement this enhancement.

The restriction has been removed that prohibited the use of mbe inside
encapsulate events with a non-empty signature.  This restriction was
introduced in Version  3.4, but has not been necessary since Version
4.0, when we first started disallowing guard verification for functions
introduced non-locally inside such encapsulate events.

We weakened the checks involving common ancestors for evaluator and
meta (and clause-processor) functions (see *note
EVALUATOR-RESTRICTIONS::) so that except in the mbe case, the
next-to-last argument of return-last is not considered.  Thanks to Sol
Swords for bringing this issue to our attention.

The macro append no longer requires at least two arguments.  Thanks to
Dave Greve for requesting this enhancement.

(Mostly for system hackers) Now, break-on-error breaks at a more
appropriate (earlier) time for certain system functions that do not
return state, such as translate11.  Thanks to David Rager for
requesting this improvement.

Show-accumulated-persistence may take a new argument, :runes, which
simply causes an alphabetical list of runes to be printed out.

Improved trace$ so that :entry, :exit, and :cond forms may reference
state even if the function being traced does not include state as a
formal.

The system function acl2x-expansion-alist now takes a second argument,
namely state.  This change allows for more flexibility in the sorts of
attachments that can be made to this function (see *note DEFATTACH::).
Thanks to Jared Davis and Sol Swords for requesting this enhancement
and providing a preliminary implementation.

An obscure proof-checker change, unlikely to affect users, replaces the
state global variables erp, val, print-macroexpansion-flg, and
print-prompt-and-instr-flg by pc-erp, pc-val,
pc-print-macroexpansion-flg, and pc-print-prompt-and-instr-flg,
respectively.

State globals fmt-hard-right-margin and fmt-soft-right-margin are now
untouchable (see *note SET-FMT-HARD-RIGHT-MARGIN:: and see *note
PUSH-UNTOUCHABLE::).  If you bind these state globals with
state-global-let*, then you will need to do so with appropriate setters
to restore their values, for example as follows.

       (state-global-let*
        ((fmt-hard-right-margin 500 set-fmt-hard-right-margin)
         (fmt-soft-right-margin 480 set-fmt-soft-right-margin))
        ...)

The error message has been improved for the case of evaluating an
undefined function that has an attachment (see *note DEFATTACH::).
Thanks to Jared Davis for sending the following example, which
illustrates the additional part of the message.

       ACL2 !>(defstub foo (x) t)
       [[... output omitted ...]]
       ACL2 !>(defattach foo identity)
       [[... output omitted ...]]
       ACL2 !>(defconst *x* (foo 3))


       ACL2 Error in ( DEFCONST *X* ...):  ACL2 cannot ev the call of undefined
       function FOO on argument list:

       (3)

       Note that because of logical considerations, attachments (including
       IDENTITY) must not be called in this context.

       [[... additional output omitted ...]]

The directory string supplied to add-include-book-dir no longer must
terminate with the `/' character, as had been required in some Lisp
implementations.  Thanks to Sol Swords for bringing this issue to our
attention.

We no longer print induction schemes with gag-mode; use :pso if you
want to see them.  Thanks to Dave Greve for this suggestion.

It is now legal to supply a constant for a stobj array dimension.  See
*note DEFSTOBJ::.  Thanks to Warren Hunt for requesting this
enhancement.

We cleaned up a few issues with defpkg.

     o It is no longer illegal to submit a defpkg form in raw-mode (see
     *note SET-RAW-MODE::).  Thanks to Jun Sawada for reporting an
     example in which an include-book form submitted in raw-mode caused
     an error because of a `hidden' defpkg form (see *note
     HIDDEN-DEFPKG::).  There will no longer be an error in such cases.

     o It had been the case that locally including a book could make it
     possible to use a package defined by that book.  Consider for
     example the following book, foo.lisp.

          (in-package "ACL2")
          (local (include-book "arithmetic/top" :dir :system))

     After certifying this book, it had been possible to admit the
     following events in a new session.

          (include-book "foo")
          (defconst acl2-asg::*foo* 3)
          (defconst *c* 'acl2-asg::xyz)

     In Version_4.3, neither of these defconst events is admitted.

     o A hard Lisp error is now avoided that had been possible in rare
     cases when including books with hidden packages (see *note
     HIDDEN-DEFPKG::). An example may be found in a comment in the
     deflabel for note-4-3 (in ACL2 source file ld.lisp).

The undocumented (but sometimes useful) functions packn1 and packn are
now guard-verified :logic mode functions.  Thanks to Sandip Ray for
requesting this enhancement.

It had been the case that when including a book, functions defined in
the book's certification world (that is, in its portcullis commands)
were typically not given compiled code.  That has been fixed.

The commands :pl and :pl2 have been improved, primarily by printing
information for more rule classes.  See *note PL:: and see *note PL2::.
See also the item below about the new proof-checker command,
show-type-prescriptions.

*NEW FEATURES*

New macros mv?-let and mv? extend the funtionality of mv-let and mv
(respectively) to the case of a single value.

Macro with-local-state is available for system programmers who wish bind
state locally, essentially using with-local-stobj.  But this should
only be done with extreme care, and it requires an active trust tag;
see *note WITH-LOCAL-STATE::.

Formatted printing functions now have analogues that print to strings
and do not take an output channel or state as arguments.  See *note
PRINTING-TO-STRINGS::.

The system function ancestors-check is now available for verified
modification by users, i.e., attachment using (defattach
ancestors-check <your_function>).  Thanks to Robert Krug for providing
the necessary proof support, which we modified only in small ways.

New macros, observation-cw and warning$-cw, provide formatted printing
of observations and warnings (respectively) without state.  Thanks to
Harsh Raju Chamarthi and David Rager for requests leading to these
utilities.  Observation-cw is now used in some of the distributed books
(thanks to Robert Krug for useful interaction for that).

The proof-checker command type-alist (see *note
PROOF-CHECKER-COMMANDS::) now takes an optional third argument that
causes the production of forward-chaining reports (see *note
FORWARD-CHAINING-REPORTS::).  Thanks to Dave Greve for requesting such
an enhancement.

The reports generated by forward-chaining, forward-chaining-reports,
have been changed to indicate when a conclusion reached by forward
chaining is REDUNDANT with respect to the type information already
known.  Thanks to Dave Greve for suggesting this enhancement.

The utility with-prover-time-limit is now legal for events (see *note
EMBEDDED-EVENT-FORM::).  For example, the following is now legal.

     (encapsulate
      ()
      (with-prover-time-limit
       2
       (defthm append-assoc
         (equal (append (append x y) z)
                (append x (append y z))))))

The new utility with-prover-step-limit is analogous to the utility
with-prover-time-limit, but counts "prover steps" rather than checking
for time elapsed.  See *note WITH-PROVER-STEP-LIMIT::.  Also see *note
SET-PROVER-STEP-LIMIT:: to provide a default step-limit.  Note that just
as with-prover-time-limit may now be used to create events, as
discussed just above, with-prover-step-limit may also be used to create
events.  Thanks to Carl Eastlund for requesting support for step-limits.

The macro progn$ is analogous to prog2$, but allows an arbitrary number
of arguments.  For example:

     ACL2 !>:trans1 (progn$ (f1 x) (f2 x) (f3 x))
      (PROG2$ (F1 X) (PROG2$ (F2 X) (F3 X)))
     ACL2 !>

Thanks to David Rager for contributing this macro.

The macro defattach may now be supplied the argument :skip-checks
:cycles.  In this case, as with argument :skip-checks t, a trust tag is
reuired (see *note DEFTTAG::), and no logical claims are made.  The
effect is to avoid the usual check that the extended ancestor relation
has no cycles (see *note DEFATTACH::).  Thanks to Dave Greve for
requesting this feature.

You can now limit the printing of subgoal names when using
:set-gag-mode :goals.  See *note SET-PRINT-CLAUSE-IDS::.  Thanks to
Karl Hoech for a suggestion leading to this enhancement.

A new proof-checker command, show-type-prescriptions, or st for short,
provides information about :type-prescription rules that match a given
term.  Thanks to Dave Greve for requesting this enhancement.  See also
the item above about related improvements to commands :pl and :pl2.

*HEURISTIC IMPROVEMENTS*

ACL2 now avoids some repeated attempts to rewrite hypotheses of rewrite
rules.  See *note SET-RW-CACHE-STATE:: for a discussion of this
behavior and how to avoid it.  The default behavior has been observed
to reduce by 11% the overall time required to complete a regression.
Here are the directories that had the top three time decreases and top
three time increases, shown in seconds.

       -368 coi/gacc (1064 down to 696: decrease of 35%)
       -220 workshops/1999/ste (664 down to 444: decrease of 33%)
       -148 unicode (331 down to 183: decrease of 45%)
       ....
         +7 workshops/2002/cowles-flat/support (229 up to 236: increase of 3%)
         +8 workshops/1999/ivy/ivy-v2/ivy-sources (508 up to 516: increase of 2%)
        +12 workshops/2009/hardin/deque-stobj (78 up to 91: increase of 17%)

The so-called "ancestors check," which is used to limit backchaining,
has been strengthened so that two calls of equal are considered the same
even if their arguments appear in the opposite order.  Thanks to Robert
Krug for providing an implementation and a useful discussion.

The check for irrelevant-formals in processing of defuns has been made
more efficient.  Thanks to Eric Smith for reporting this issue in 2001
(!) and thanks to Warren Hunt for recently sending an example.  For that
example, we have seen the time for the irrelevant-formals check reduced
from about 10 seconds to about 0.04 seconds.

(GCL only) The macro mv has been modified so that certain fixnum boxing
can be avoided.

(Allegro CL only) We have set to nil four Allegro CL variables that
otherwise enable storing of certain source information (for details,
see the discussion of "cross-referencing" in ACL2 source file
acl2-init.lisp).  As a result of this change we have about a 6% speedup
on the regression suite, but a 27% time reduction on an example that
includes a lot of books.

Exhaustive matching for the case of free-variables has been extended to
type-prescription rules, in analogy to the default setting :match-free
:all already in place for rewrite, linear, and forward-chaining rules.
See *note FREE-VARIABLES-TYPE-PRESCRIPTION::.  Thanks to Dave Greve for
requesting this enhancement.

*BUG FIXES*

A soundness bug was fixed in some raw-Lisp code implementing the
function, take.  Thanks to Sol Swords for pointing out this bug with
(essentially) the following proof of nil.

     (defthmd take-1-nil-logic
       (equal (take 1 nil) '(nil))
       :hints(("Goal" :in-theory (disable (take)))))
     (thm nil :hints (("Goal" :use take-1-nil-logic)))

Calls of mbe in "safe-mode" situations -- i.e., during evaluation of
defconst, value-triple, and defpkg forms, and during macroexpansion --
are now guard-checked.  Thus, in these situations both the :logic and
:exec forms will be evaluated, with an error if the results are not
equal.  Formerly, only the :logic form was evaluated, which was a
soundness bug that could be exploited to prove nil.  For a such a proof
and a bit of further explanation, see the example at the top of the
comments for (deflabel note-4-3 ..) in ACL2 source file ld.lisp.

It had been possible to prove nil by proving the following theorem
using ACL2 built on CCL and then proving its negation using ACL2 built
on a different host Lisp.

     (defthm host-lisp-is-ccl
       (equal (cdr (assoc 'host-lisp *initial-global-table*))
              :ccl)
       :rule-classes nil)

This hole has been plugged by moving the setting of 'host-lisp out of
the constant *initial-global-table*.

Fixed trace$ for arguments that are stobj accessors or updaters.  It
also gives an informative error in this case when the accessor or
updater is a macro (because the introducing defstobj event specified
:inline t).

Avoided a potential error that could occur when no user home directory
is located.  Our previous solution for Windows simply avoided looking
for ACL2 customization files (see *note ACL2-CUSTOMIZATION::) and
acl2-init.lsp files in a user's home directory.  With this change, we
handle such files the same for Windows as for non-Windows systems: we
always look for ACL2 customization files (see *note
ACL2-CUSTOMIZATION::) and acl2-init.lsp files in a user's home
directory, but only if such a directory exists.  Thanks to Hanbing Liu
for reporting this issue.

(GCL only) Fixed a bug that prevented the use of
get-output-stream-string$ when the host Lisp is GCL.

Fixed with-live-state to work properly for executable counterparts
(so-called "*1*" functions).

Fixed a bug in the error message caused by violating the guard of a
macro call.

Fixed a bug in an error message that one could get when calling
defattach with argument :skip-checks t to attach to a :program mode
function symbol that was introduced with defun.  (This is indeed an
error, but the message was confusing.)  Thanks to Robert Krug for
bringing this bug to our attention.

Fixed a bug in the loop-checking done on behalf of defattach, which
could miss a loop.  For an example, see the comment about loop-checking
in the comments for (deflabel note-4-3 ..) in ACL2 source file ld.lisp.

Terms of the form (hide <term>) without free variables could be
simplified, contrary to the purpose of hide.  This is no longer the
case,  Thanks to Dave Greve for reporting this issue.

An infinite loop could occur when an error was encountered in a call of
wormhole-eval, for example with the following form, and this has been
fixed.

     (wormhole-eval 'demo
                    '(lambda ()
                       (er hard 'my-top "Got an error!"))
                    nil)

Fixed a bug in detection of package redefinition.  While we have no
example demonstrating this as a soundness bug, we cannot rule it out.

Fixed a bug in the message produced by an erroneous call of flet.
Thanks to Jared Davis for reporting this bug and sending a helpful
example.

For a failed defaxiom or defthm event, we now avoid printing runes that
are used only in processing proposed rules to be stored, but not in the
proof itself.  Thanks to Dave Greve for sending us an example that led
us to make this fix.

ACL2 did not reliably enforce the restriction against non-local
include-book events inside encapsulate events, as illustrated by the
following examples.

     ; not permitted (as expected)
     (encapsulate () (include-book "foo"))

     ; permitted (as expected)
     (encapsulate () (local (include-book "foo")))

     ; formerly permitted (surprisingly); now, not permitted
     (local (encapsulate () (include-book "foo")))

Moreover, the corresponding error message has been fixed.  Thanks to
Jared Davis and Sandip Ray for relevant discussions.

When include-book is given a first argument that is not a string, a
more graceful error now occurs, where previously an ugly raw Lisp error
had occurred.  Thanks to Eric Smith for bringing this bug to our
attention.

Fixed a bug in an error message that was printed when an unexpected
expression has occurred where a declare form is expected.

(Since all functions are compiled when the host Lisp is CCL or SBCL, the
following bug fix did not occur for those host Lisps.)  After
evaluation of (set-compile-fns t), all defined functions are expected
to run with compiled code; but this was not the case for functions
exported from an encapsulate event.  This has been fixed.

It had been the case that the :puff command was broken for include-book
form whose book had been certified in a world with an
add-include-book-dir event.  This has been fixed.

Evaluation of stobj updaters (see *note DEFSTOBJ::) may no longer use
attachments (see *note DEFATTACH::).  This is a subtle point that will
likely not affect many users.  Thanks to Jared Davis for bringing this
issue to our attention; a slight variant of his example appears in a
comment in ACL2 source function oneify-cltl-code.

It had been the case that even when a stobj creator function was
declared to be untouchable (see *note PUSH-UNTOUCHABLE::), a
with-local-stobj form based on that same stobj was permitted.  Now,
such forms are not admitted.  Thanks to Jared Davis for a query leading
to this fix.

Fixed a buggy message upon guard violations, which was suggesting the
use of (set-guard-checking :none) in some cases when guard-checking was
already set to :none.

It had been possible to get a hard Lisp error when computing with
ec-call in books.  The following is an example of such a book, whose
certification no longer causes an error.

     (in-package "ACL2")
     (defun f (x) x)
     (defconst *c* (ec-call (f 3)))
     (defun g (x) (cons x x))

The command :pl2, and also the proof-checker commands rewrite and
show-rewrites (and hence their respective aliases r and sr), now take
rule-id arguments that can be :definition runes.  These commands dealt
with definition rules already, e.g.

     :pl2 (append x y) binary-append

but they did not allow explicit specification of :definition runes,
e.g.:

     :pl2 (append x y) (:definition binary-append)

The following example illustrates a bug in the processing of (admittedly
obscure) hints of the form :do-not-induct name, where name is not t,
:otf-flg-override, :otf, or nil.  In this example, ACL2 had essentially
ignored the hint and reverted to prove the original goal by induction,
rather than to skip the goal temporarily as is expected for such hints.
Thanks to David Rager for a helpful discussion.

     (thm (and (equal (append (append x y) z) (append x y z))
               (equal (append (append x2 y2) z2) (append x2 y2 z2)))
          :hints (("Subgoal 1" :do-not-induct some-name)))

Fixed a slight bug in the definitions of built-in theories.  For
example, in a fresh ACL2 session the value of the following form is nil,
but formerly included several :definition runes.

     (let ((world (w state)))
       (set-difference-theories (function-theory :here)
                                (function-theory 'ground-zero)))

*CHANGES AT THE SYSTEM LEVEL AND TO DISTRIBUTED BOOKS*

Many changes have been made to the distributed books, as recorded in
svn logs under the `Source' and 'Updates' links at
`http://acl2-books.googlecode.com/'.  Here we list some of the more
significant changes.

     o A large library has been graciously contributed by the formal
     verification group at Centaur Technology.  See books/centaur/ and,
     in particular, file books/centaur/README, which explains how the
     library depends on the experimental HONS extension (see *note
     HONS-AND-MEMOIZATION::).

     o Among the new books is an illustration of defattach,
     books/misc/defattach-example.lisp, as well as a variant of
     defattach that avoids the need for guard verification,
     books/misc/defattach-bang.lisp.

     o Distributed book books/misc/trace1.lisp has been deleted.  It had
     provided slightly more friendly trace output for new users, but
     distributed book books/misc/trace-star.lisp may be better suited
     for that purpose.

ACL2 can once again be built on LispWorks (i.e., as the host Lisp), at
least with LispWorks 6.0.  Thanks to David Rager for useful
conversations.  Several changes have been made from previous
LispWorks-based ACL2 executables:
o ACL2 now starts up in its read-eval-print loop.
o You can save an image with save-exec.
o Multiprocessing is not enabled.
o The stack size is managed using a LispWorks variable that causes the
stack to grow as needed.
o When ACL2 is built a script file is written, as is done for other host
Lisps.  Thus, (assuming that no PREFIX is specified), saved_acl2 is
just a small text file that invokes a binary executable, which for
Lispworks is saved_acl2.lw.

The HTML documentation no longer has extra newlines in <pre>
environments.

Statistics on ACL2 code size may be found in distributed file
doc/acl2-code-size.txt.  This file and other information can be found in
a new documentation topic, about-acl2.

Fixed the build process to pay attention to environment variable
ACL2_SYSTEM_BOOKS (which may be supplied as a command-line argument to
`make').  An ACL2 executable can thus now be built even when there is no
books/ subdirectory if a suitable replacement directory is supplied.

Some warnings from the host Lisp are now suppressed that could formerly
appear.  For example, the warnings shown below occurs in Version  4.2
using Allegro CL, but not in Version  4.3.

     ACL2 !>(progn (set-ignore-ok t)
                   (set-irrelevant-formals-ok t)
                   (defun bar (x y)
                     x))
     [[.. output omitted ..]]
      BAR
     ACL2 !>:comp bar
     ; While compiling BAR:
     Warning: Variable Y is never used.
     ; While compiling (LABELS ACL2_*1*_ACL2::BAR ACL2_*1*_ACL2::BAR):
     Warning: Variable Y is never used.
      BAR
     ACL2 !>

*EMACS SUPPORT*

The distributed Emacs file emacs/emacs-acl2.el now indents calls of
er@par and warning$@par the same way that calls of defun are indented.

*EXPERIMENTAL VERSIONS*

The parallel version (see *note PARALLELISM::) now supports parallel
evaluation of the "waterfall" part of the ACL2 prover; see *note
SET-WATERFALL-PARALLELISM::.  Thanks to David Rager for doing the
primary design and implementation work.

A new macro, spec-mv-let, supports speculative and parallel execution
in the parallel version, courtesy of David Rager.

Among the enhancements for the HONS version (see *note
HONS-AND-MEMOIZATION::) are the following.

     Memoized functions may now be traced (see *note TRACE$::).  Thanks
     to Sol Swords for requesting this enhancement.

     Memoize-summary and clear-memoize-statistics are now :logic mode
     functions that return nil.  Thanks to Sol Swords for this
     enhancement.

     Memoize is now explicitly illegal for constrained functions.
     (Already such memoization was ineffective.)

     A new keyword argument, :AOKP, controls whether or not to allow
     memoization to take advantage of attachments; see *note MEMOIZE::
     and for relevant background, see *note DEFATTACH::.

     Memoize is now illegal by default for :logic mode functions that
     have not had their guards verified.  See *note MEMOIZE:: (keyword
     :ideal-okp) and see *note ACL2-DEFAULTS-TABLE:: (key
     :memoize-ideal-okp) for and explanation of this restriction and
     how to avoid it.

     History commands such as :pe and :pbt now display "M" or "m" to
     indicate memoized functions.  See *note PC::.



File: acl2-doc-emacs.info,  Node: NOTE-4-3(R),  Next: NOTE-5-0,  Prev: NOTE-4-3,  Up: RELEASE-NOTES

NOTE-4-3(R)    ACL2 Version  4.3(r) (July, 2011) Notes

Please see *note NOTE-4-3:: for changes in Version  4.3 of ACL2.


File: acl2-doc-emacs.info,  Node: NOTE-5-0,  Next: NOTE-6-0,  Prev: NOTE-4-3(R),  Up: RELEASE-NOTES

NOTE-5-0    ACL2 Version  5.0 (August, 2012) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  4.3 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level and to
distributed books, Emacs support, and experimental versions.  Each
change is described in just one category, though of course many changes
could be placed in more than one category.

NOTE: ACL2 is now distributed under Version 2 of the GNU General Public
License.  [Added later: The license has changed since Version_5.0.  See
LICENSE.]  Formerly, any later version had been acceptable.  Moreover,
books are no longer distributed from a University of Texas website, but
rather, from Google Code at
`http://code.google.com/p/acl2-books/downloads/'.

*CHANGES TO EXISTING FEATURES*

A fatal error now occurs if environment variable ACL2_CUSTOMIZATION has
a value other than NONE or the empty string, but is not the name of an
existing file.  Thanks to Harsh Raju Chamarthi for requesting such a
change.

Functions read-acl2-oracle (and read-acl2-oracle@par), read-run-time,
and main-timer are no longer untouchable (see *note
REMOVE-UNTOUCHABLE::).

We now avoid certain duplicate conjuncts in the constraint stored for
encapsulate events.  For example, the constraint stored for the
following event formerly included (EQUAL (FOOP (CONS X Y)) (FOOP Y)) and
(BOOLEANP (FOOP X)) twice each, but no more.

     (encapsulate
      ((foop (x) t))
      (local (defun foop (x) (declare (ignore x)) t))
      (defthm foop-constraints
        (and (booleanp (foop x))
             (equal (foop (cons x y)) (foop y)))
        :rule-classes
        ((:type-prescription :corollary (booleanp (foop x)))
         (:rewrite :corollary (equal (foop (cons x y)) (foop y))))))

The :guard for a constrained function (see *note SIGNATURE::) may now
mention function symbols introduced in the same encapsulate event that
introduces that function.  Thanks to Nathan Wetzler for a helpful
discussion leading to this improvement.

The test for redundancy (see *note REDUNDANT-EVENTS::) of encapsulate
events has been improved in cases involving redefinition (see *note
LD-REDEFINITION-ACTION::).  Thanks to Jared Davis for providing the
following example, which illustrates the problem.

       (redef!)

       (encapsulate ()
         (defun g (x)
           (+ 3 x)))

       (g 0) ; 3, as expected

       (encapsulate ()
         (defun g (x)
           (+ 4 x)))

       (g 0) ; 4, as expected

       ; Unfortunately, the following was flagged as redundant because it agreed
       ; with the first encapsulate above.  That has been fixed; now, it is
       ; recognized as not being redundant.
       (encapsulate ()
         (defun g (x)
           (+ 3 x)))

The test for redundancy of defun and defconst events has been improved
in the case that redefinition is active.  In that case, redundancy now
additionally requires that the "translated" body is unchanged, i.e.,
even after expanding macro calls and replacing constants (defined by
defconst) with their values.  Thanks to Sol Swords for requesting this
enhancement, and to Jared Davis for pointing out a bug in a preliminary
change.  See *note REDUNDANT-EVENTS::, in particular the "Note About
Unfortunate Redundancies".  Note that this additional requirement was
already in force for redundancy of defmacro events.

The macro defmacro-last and the table return-last-table have been
modified so that when they give special treatment to a macro mac and
its raw Lisp counterpart mac-raw, a call (return-last 'mac-raw ...)
can be made illegal when encountered directly in the top level loop, as
opposed to inside a function body.  See *note RETURN-LAST::.  Thanks to
Harsh Raju Chamarthi for showing us an example that led us to make this
improvement.

We removed a barrier to admitting function definitions, as we explain
using the following example.

     (defun foo (m state)
       (declare (xargs :stobjs state))
       (if (consp m)
           (let ((state (f-put-global 'last-m m state)))
             (foo (cdr m) state))
         state))

Previously, ACL2 complained that it could not determine the outputs of
the LET form, as is necessary in order to ensure that STATE is returned
by it.  ACL2 now works harder to solve this problem as well as the
analogous problem for MV-LET and, more generally for mutual-recursion.
(The main idea is to reverse the order of processing the IF branches if
necessary.)  We thank Sol Swords for contributing a version of the
above example and requesting this improvement.

It is no longer the case that break-on-error causes a Lisp break when
encountering an error during translation of user input into internal
(translated) form (see *note TERM::).  The reason is that an
improvement to the translation process, specifically the one described
in the preceding paragraph, allows certain backtracking from "errors",
which are intended to be silent rather than causing breaks into raw
Lisp.  Thanks to Jared Davis for sending an example leading to this
change.

(CCL and SBCL only) When the host Lisp is CCL or SBCL, then since all
functions are compiled, a certify-book command will no longer load the
newly-compiled file (and similarly for include-book with argument
:load-compiled-file :comp).

Set-write-acl2x now returns an error triple and can take more values,
some of which automatically allow including uncertified books when
certify-book is called with argument :acl2x t.

The environment variable COMPILE_FLG has been renamed ACL2_COMPILE_FLG;
see *note CERTIFY-BOOK::.

The macros defthmd and defund no longer return an error triple with
value :SKIPPED when proofs are being skipped.  Rather, the value
returned is the same as would be returned on success when proofs are not
skipped.

For those who use set-write-acl2x: now, when certify-book is called
without a :ttagsx argument supplied, then the value of :ttagsx defaults
to the (explicit or default) value of the :ttags argument.

The :pl and :pl2 commands can now accept terms that had previously been
rejected.  For example, the command :pl (member a (append x y)) had
caused an error, but now it works as one might reasonably expect,
treating member as member-equal (see *note EQUALITY-VARIANTS:: for
relevant background).  Thanks to Jared Davis for reporting this problem
by sending the above example.

We have eliminated some hypotheses in built-in rewrite rules
characterp-nth and ordered-symbol-alistp-delete-assoc-eq.

Added the symbols f-get-global, f-put-global, and state-global-let* to
*acl2-exports*.

Added to the guards of push-untouchable and remove-untouchable the
requirement that the second argument must be a Boolean.  Thanks to
Jared Davis for sending an example that led to this change.

The built-in function string-for-tilde-@-clause-id-phrase has been put
into :logic mode and had its guards verified, as have some subsidiary
functions.  A few new rules have been added in support of this work;
search for string-for-tilde-@-clause-id-phrase in ACL2 source file
boot-strap-pass-2.lisp if interested.  Thanks to David Rager for
contributing an initial version of this improvement.

All trust tags are now in the keyword package.  The defttag event may
still take a symbol in an arbitrary package, but the trust tag created
will be in the keyword package (with the same symbol-name as the symbol
provided).  Similarly, non-nil symbols occurring in the :ttags argument
of an include-book or certify-book command will be converted to
corresponding keywords.  See *note DEFTTAG::.

There have been several changes to gag-mode.  It is now is initially set
to :goals, suppressing most proof commentary other than key checkpoints;
see *note SET-GAG-MODE::.  (As before, see *note PSO:: for how to
recover the proof output.)  Also, top-level induction schemes are once
again printed when gag-mode is on, though these as well as printing of
guard conjectures can be abbreviated ("eviscerated") with a new
evisc-tuple; see *note SET-EVISC-TUPLE::, in particular the discussion
there of :GAG-MODE.  Finally, the commentary printed within gag-mode
that is related to forcing-rounds is now less verbose.  Thanks to Dave
Greve and David Rager for discussions leading to the change in the
printing of induction schemes under gag-mode; thanks to Warren Hunt for
an email that led us to similar handling for printing of guard
conjectures; and thanks to Robert Krug for a suggestion that led us to
restore, in abbreviated form, important information about the sources
of forcing round goals.

An error now occurs if ld is called while loading a compiled book.  See
*note CALLING-LD-IN-BAD-CONTEXTS::.  Thanks to David Rager for
reporting a low-level assertion failure that led us to make this change.

The proof-checker interactive loop is more robust: most errors will
leave you in that loop, rather than kicking you out of the
proof-checker and thus back to the main ACL2 read-eval-print loop.
Thanks to David Hardin for suggesting this improvement in the case of
errors arising from extra right parentheses.

The summary at the end of a proof now prints the following note when
appropriate:

     [NOTE: A goal of NIL was generated.  See :DOC nil-goal.]

See *note NIL-GOAL::.

Improved dmr to show the function being called in the case of explicit
evaluation: "(EV-FNCALL function-being-called)".

It is now permitted to bind any number of stobjs to themselves in the
bindings of a LET expression.  But if any stobj is bound to other than
itself in LET bindings, then there still must be only one binding in
that LET expression.  The analogous relaxation holds for LAMBDA
expressions.  Thanks to Sol Swords for requesting such a change, which
was needed for some code generated by macro calls.

The macro top-level now returns without error; See *note TOP-LEVEL::.
Formerly, this macro always returned an error triple (mv t .. state),
which meant that normal calls of ld would stop after encountering a
call of top-level.  Thanks to Jared Davis for bringing this issue to our
attention.

It is no longer the case that when you specify xargs keyword
:non-executable t in a defun form rather than using defun-nx, then the
form of the body need match only the shape (prog2$ (throw-nonexec-error
... ...) ...).  We now require that the body of the definition of a
function symbol, fn, with formals (x1 ... xk), be of the form (prog2$
(throw-nonexec-error 'fn (list x1 ... xk)) ...).  This fixes the
following odd behavior, which could be considered a bug.  Consider a
book that contains the following two events.

     (defun foo (x)
       (declare (xargs :guard t :non-executable t :mode :logic))
       (prog2$ (throw-nonexec-error 'bar (list x))
               (cons 3 x)))
     (defn h (x)
       (foo x))

After certifying this book and then including it in a new session, the
behavior occurred that is displayed below; notice the mention of BAR.
However, if the two forms were submitted directly in the loop, then the
error message had mentioned FOO instead of BAR.  This discrepancy has
been eliminated, by rejecting the proposed definition of foo because
the name in the first argument of throw-nonexec-error was 'bar where
now it must be 'foo.

     ACL2 !>(h 3)


     ACL2 Error in TOP-LEVEL:  ACL2 cannot ev the call of undefined function
     BAR on argument list:

     (3)

     To debug see :DOC print-gv, see :DOC trace, and see :DOC wet.

     ACL2 !>

A tautology checker used in the ACL2 sources (function if-tautologyp)
has been limited somewhat in the effort it makes to recognize a
tautology.  While we expect it to be rare for the effect of this change
to be noticeable, we thank Sol Swords for sending us an example that
motivated this change: a guard verification that took about 5 seconds
in Version_4.3 now takes, on the same machine, about 0.07 seconds.

The behavior of backquote (`) has been changed slightly to be compatible
with its behavior in raw Lisp.  The change is to allow the use of
comma-atsign (,@) at the end of a list, as in the following example.

     (let ((x 3) (y 2) (z 7)) `(,x ,y ,@z))

Formerly, evaluation of this form had caused a guard violation in the
ACL2 loop unless guard-checking was off (i.e., set-guard-checking was
invoked with nil or :none), in which case it returned (3 2).  But we
observed evaluation of this form to return (3 2 . 7) in every host Lisp
on which ACL2 runs (Allegro CL, CCL, CLISP, CMUCL, GCL, LispWorks, and
SBCL).  Now, ACL2 behaves like these Lisps.

A call of the theory macro had previously returned nil when applied to
other than the name of name of a previously executed deftheory event.
Now, a hard error occurs.

The table binop-table has been replaced by the table untrans-table.
However, add-binop and remove-binop continue to have the same effect as
before.  See *note ADD-MACRO-FN::, which is a new feature discussed
below.

The function booleanp is now defined using eq instead of equal, which
may increase its efficiency.  Thanks to Jared Davis for this change.

For pairs (key . val) in the macro-aliases-table, there had been a
requirement that val is a known function symbol.  Now, it only needs to
be a symbol.  (This change was made to support the new feature,
defun-inline, described elsewhere in these release notes.)

*NEW FEATURES*

A new "tau system" provides a kind of "type checker."  See *note
TAU-SYSTEM::.  Thanks to Dave Greve for supplying a motivating example
(on which this system can provide significant speedup), and to Sol
Swords for sending a very helpful bug report on a preliminary
implementation.

Users may now arrange for additional summary information to be printed
at the end of events.  [Note added at Version_6.1: Formerly we pointed
here to print-summary-user, but now, see *note FINALIZE-EVENT-USER::;
also see *note NOTE-6-1::].  Thanks to Harsh Raju Chamarthi for
requesting this feature and participating in a design discussion.

A new, advanced proof-checker command, geneqv, shows the generated
equivalence relation at the current subterm.  Thanks to Dave Greve for
an inquiry leading to this enhancement.

A new reader macro, #u, permits the use of underscore characters in a
number.  See *note SHARP-U-READER::.  Thanks to Jared Davis for
requesting this capability.

New proof-checker commands pl and pr provide interfaces to the ACL2
commands :pl and :pr, respectively.  These can be useful if you want to
see trivially-proved hypotheses, as now clarified in the proof-checker
documentation for its show-rewrites command.  See *note
PROOF-CHECKER-COMMANDS::.  Thanks to Pete Manolios for suggesting such
clarification and capability.

It is now legal to call non-executable functions without the usual
signature restrictions imposed on executable code.  For example, the
third event below was not admissible, but now it is.

     (defstobj foo fld)
     (defun-nx id (x)
       x)
     (defun f (foo)
       (declare (xargs :stobjs foo :verify-guards nil))
       (cons 3 (id foo)))

Thanks to Jared Davis for requesting this enhancement, in particular for
calling non-executable functions in the :logic part of an mbe call.
Here is Jared's example, which is admissible now but formerly was not.

     (defstobj foo (fld))
     (defun-nx my-identity (x) x)
     (defun my-fld (foo)
       (declare (xargs :stobjs foo))
       (mbe :logic (my-identity foo)
            :exec (let ((val (fld foo)))
                    (update-fld val foo))))

A new macro, non-exec, allows the use of non-executable code, for
example inside ordinary function definitions.  Thanks to Sol Swords for
requesting this enhancement.

A new "provisional certification" process is supported that can allow
books to be certified before their included sub-books have been
certified, thus allowing for potentially much greater `make'-level
parallelism.  See *note PROVISIONAL-CERTIFICATION::.  Thanks to Jared
Davis for requesting this feature and for helpful discussions, based in
part on rudimentary provisional certification schemes that he developed
first at Rockwell Collins and later for his `Milawa' project.  Also,
thanks to Jared and to Sol Swords for testing this feature and for
providing a fix for a bug in a preliminary implementation, and thanks
to Sol for providing performance feedback and a crucial suggestion that
led to an improved implementation.

Event summaries now show the names of events that were mentioned in
hints of type :use, :by, or :clause-processor.  See *note
SET-INHIBITED-SUMMARY-TYPES::.  Thanks to Francisco J. Martin Mateos for
requesting such an enhancement (actually thanks to the community, as his
request is the most recent but this has come up from time to time
before).

ACL2 now stores a data structure representing the relation "Event A is
used in the proof of Event B."  See *note DEAD-EVENTS::, which explains
this data structure and mentions one application: to identify dead code
and unused theorems.  Thanks to Shilpi Goel for requesting such a
feature and for helpful feedback.

A new documentation topic provides a guide to programming with state;
see *note PROGRAMMING-WITH-STATE::.  Thanks to Sarah Weissman for
suggesting that such a guide might be useful, and to David Rager for
helpful feedback on a preliminary version.  There also has been some
corresponding reorganization of the documentation as well as creation
of additional documentation (e.g., see *note STATE-GLOBAL-LET*::).
Now, most built-in functions and macros commonly used in programs (as
opposed to events like defun, for example) are subtopics of a new topic
-- see *note ACL2-BUILT-INS:: -- which is a subtopic of programming, a
topic that in turn has considerably fewer direct subtopics than before.

It is now possible to bind extra variables in a :USE hint, thus avoiding
the error message: "The formula you wish to instantiate, ..., mentions
only the variable(s) ...".  See *note LEMMA-INSTANCE::, in particular
the discussion of keyword :extra-bindings-ok.  Thanks to Sol Swords for
requesting such an enhancement.

The function read-object-suppress is like read-object except that it
avoids errors and discards the value read.  See *note IO::.

A stobj may now be passed as an argument where another stobj is expected
if the two are "congruent".  See *note DEFSTOBJ::, in particular, its
discussion of the new :congruent-to keyword of defstobj.  Thanks to Sol
Swords for requesting this enhancement and for useful discussions
contributing to its design.

A new top-level utility has been provided that shows the assembly
language for a defined function symbol; see *note DISASSEMBLE$::.
Thanks to Jared Davis for requesting such a utility and to Shilpi Goel
for pointing out an inconvenience with the initial implementation.
Note that it uses the distributed book books/misc/disassemble.lisp,
which users are welcome to modify (see
`http://www.cs.utexas.edu/users/moore/acl2/').

The macro set-accumulated-persistence is an alias for
accumulated-persistence.  Thanks to Robert Krug for suggesting this
addition.

A new documentation topic lists lesser-known and advanced ACL2 features,
intended for those with prior ACL2 experience who wish to extend their
knowledge of ACL2 capabilities.  See *note ADVANCED-FEATURES::.  Thanks
to Warren Hunt and Anna Slobodova for requesting such information.

A new macro, deftheory-static, provides a variant of deftheory such
that the resulting theory is the same at include-book time as it was at
certify-book time.  Thanks to Robert Krug for helpful discussions on
this new feature and for updating his books/arithmetic-5/ distributed
books to use this feature.

A new event, defabsstobj, provides a new way to introduce
single-threaded objects (see *note STOBJ:: and see *note DEFSTOBJ::).
These so-called "abstract stobjs" permit user-provided logical
definitions for primitive operations on stobjs, for example using an
alist-based representation instead of a list-based representation for
array fields.  Moreover, the proof obligations guarantee that the
recognizer is preserved; hence the implementation avoids executing the
recognizer, which may be an arbitrarily complex invariant that
otherwise would be an expensive part of guard checks.  Thanks to Warren
Hunt for a request leading us to design and implement this new feature,
and thanks to Rob Sumners for a request leading us to implement a
related utility, defabsstobj-missing-events.  See *note DEFABSSTOBJ::.
Also thanks to Sol Swords for sending an example exhibiting a bug in
the initial implementation, which has been fixed.

A new command, :psof <filename>, is like :pso but directs proof replay
output to the specified file.  For large proofs, :psof may complete
much more quickly than :pso.  see *note PSOF::.  More generally, a new
utility, wof (an acronym for "With Output File"), directs standard
output and proofs output to a file; see *note WOF::.

The new macro defnd defines a function with :guard t and disables that
function, in analogy to how defund defines with defun and then
disables.  Thanks to Shilpi Goel for requesting this feature.

The :pl2 command now shows :linear rules; and a new proof-checker
command, show-linears (equivalently, sls), is an analogue of the
proof-checker show-rewrites (sr) command, but for linear rules.  Thanks
to Shilpi Goel for requesting this new proof-checker command.  Finally,
a corresponding new proof-checker command, apply-linear (al), is an
analogue of the proof-checker rewrite (r) command, but for linear rules.

The macros add-macro-fn and remove-macro-fn replace macros add-binop
and remove-binop, respectively, though the latter continue to work.
The new macros allow you to decide whether or not to display calls of
binary macros as flat calls for right-associated arguments, e.g.,
(append x y z) rather than (append x (append y z)).  See *note
ADD-MACRO-FN::.

It is now possible to request that the host Lisp compiler inline calls
of specified functions, or to direct that the host Lisp compiler not
inline such calls.  See *note DEFUN-INLINE:: and see *note
DEFUN-NOTINLINE::.  We thank Jared Davis for several extensive,
relevant conversations, and for finding a bug in a preliminary
implementation.  We also thank others who have engaged in discussions
with us about inlining for ACL2; besides Jared Davis, we recall such
conversations with Rob Sumners, Dave Greve, and Shilpi Goel.

*HEURISTIC IMPROVEMENTS*

Reading of ACL2 arrays (see *note AREF1::, see *note AREF2::) has been
made more efficient (as tested with CCL as the host Lisp) in the case
of consecutive repeated reads of the same named array.  Thanks to Jared
Davis and Sol Swords for contributing this improvement.

Slightly modified the induction schemes stored, so that calls of
so-called "guard-holders" (such as mbe and prog2$ -- indeed, any call
of return-last -- and the) are expanded away.  In particular, calls of
equality variants such as member are treated as their corresponding
function calls, e.g., member-equal; see *note EQUALITY-VARIANTS::.
Guard-holders are also now expanded away before storing constraints for
encapsulate events, which can sometimes result in simpler constraints.

Improved the performance of dmr (technical note: by modifying raw Lisp
code for function dmr-flush, replacing finish-output by force-output).

We now avoid certain rewriting loops.  A long comment about this change,
including an example of a loop that no longer occurs, may be found in
source function expand-permission-result.

Slightly strengthened type-set reasoning at the level of literals (i.e.,
top-level hypotheses and conclusions).  See the comment in ACL2 source
function rewrite-atm about the "use of dwp = t" for an example of a
theorem provable only after this change.

Strengthened the ability of type-set reasoning to make deductions about
terms being integers or non-integer rationals.  The following example
illustrates the enhancement: before the change, no simplification was
performed, but after the change, the conclusion simplifies to (foo t).
Thanks to Robert Krug for conveying the problem to us and outlining a
solution.

     (defstub foo (x) t)
     (thm ; should reduce conclusion to (foo t)
      (implies (and (rationalp x)
                    (rationalp y)
                    (integerp (+ x (* 1/3 y))))
               (foo (integerp (+ y (* 3 x))))))

*BUG FIXES*

Fixed a class of soundness bugs involving each of the following
functions: getenv$, get-wormhole-status, cpu-core-count, wormhole-p,
random$, file-write-date$, and serialize-read-fn, and (for the HONS
version of ACL2) clear-memoize-table and clear-memoize-tables as well
as (possible soundness bug) serialize-write-fn.  For example, we were
able to admit the following events, but that is no longer the case
(neither for getenv$ as shown, nor analogously for other functions
listed above).

     (defthm not-true
       (stringp (cadr (getenv$ "PWD" (build-state))))
       :rule-classes nil)

     (defthm contradiction
       nil
       :hints (("Goal"
                :in-theory (disable (getenv$))
                :use not-true))
       :rule-classes nil)

Fixed a soundness bug involving with-live-state, which could cause an
error in the use of add-include-book-dir or delete-include-book-dir in
a book or its portcullis commands.  See *note WITH-LIVE-STATE::, as the
documentation for this macro has been updated; in particular it is now
untouchable (see *note REMOVE-UNTOUCHABLE::) and is intended only for
system hackers.  Thanks to Jared Davis for reporting a bug in the use
of add-include-book-dir after our first attempt at a fix.

Fixed a soundness bug based on the use of skip-proofs together with the
little-used argument k=t for certify-book.  An example proof of nil
appears in a comment in the ACL2 sources, in (deflabel note-5-0 ...).

Fixed a soundness bug that allowed users to define new proof-checker
primitive commands.  Before this fix, a book proving nil could be
certified, as shown in a comment now in the introduction of the table
pc-command-table in source file proof-checker-a.lisp.

(Technical change, primarily related to make-event:) Plugged a security
hole that allowed books' certificates to be out-of-date with respect to
make-event expansions, but not recognized as such.  The change is to
include the so-called expansion-alist in the certificate's checksum.
An example appears in a comment in the ACL2 sources, in (deflabel
note-5-0 ...).

Fixed a bug in guard verification due to expanding calls of primitives
when translating user-level terms to internal form, so called
"translated terms" (see *note TERM::).  While we have not observed a
soundness hole due to this bug, we have not ruled it out.  Before the
bug fix, the following event was admissible, as guard verification
succeeded (but clearly should not have).

     (defun f ()
       (declare (xargs :guard t))
       (car (identity 3)))

For those who want details about this bug, we analyze how ACL2 generates
guard proof obligations for this example.  During that process, it
evaluates ground subexpressions.  Thus, (identity '3) is first
simplified to '3; so a term must be built from the application of car
to '3.  Guard-checking is always turned on when generating guard proof
obligations, so now, ACL2 refuses to simplify (car '3) to 'nil.
However, before this bug fix, when ACL2 was building a term by applying
car to argument '3, it did so directly without checking guards; source
code function cons-term is `smart' that way.  After the fix, such
term-building reduction is only performed when the primitive's guard is
met.

While calls of many event macros had been prohibited inside executable
code, others should have been but were not.  For example, the following
was formerly allowed.

     (defun foo (state)
       (declare (xargs :mode :program :stobjs state))
       (add-custom-keyword-hint :my-hint (identity nil)))
     (foo state) ; Caused hard raw Lisp error!

Thus, several event macros (including for example
add-custom-keyword-hint) may no longer be called inside executable code.

Fixed an assertion that could occur, for example, after reverting to
prove the original goal by induction and generating a goal of NIL.
Thanks to Jared Davis for sending us a helpful example to bring this
bug to our attention.

It was possible for defstobj to generate raw Lisp code with excessively
restrictive type declarations.  This has been fixed.  Thanks to Warren
Hunt for reporting this bug and sending an example that illustrates it.
See *note STOBJ-EXAMPLE-2:: for examples of such raw Lisp code; now,
one finds (and fixnum (integer 0 *)) where formerly the type was
restricted to (integer 0 268435455).

Fixed a bug in that was ignoring the use of :computed-hint-replacement
in certain cases involving a combination of computed hints and custom
keyword hints.  Thanks to Robert Krug for reporting this bug and
sending a very helpful example.

Fixed a bug in the output from defattach, which was failing to list
previous events in the message about "bypassing constraints that have
been proved when processing the event(s)".

(GCL only) Fixed a bug in set-debugger-enable (which was only a bug in
GCL, not an issue for other host Lisps).

Fixed ACL2 trace output to indent properly for levels above 99 (up to
9999).  Thanks to Warren Hunt for bringing this bug to our attention.

Fixed a bug in the reporting of times in event summaries -- probably one
that has been very long-standing!  The times reported had often been too
small in the case of compound events, notably include-book.  Thanks to
everyone who reported this problem (we have a record of emails from
Eric Smith and Jared Davis on this issue).

Fixed a bug in :expand hints, where the use of :lambdas could prevent
other parts of such a hint.  For example, the following invocation of
thm failed before this fix was made.

     (defund foo (x) (cons x x))
     (thm (equal (car (foo x)) x)
     :hints (("Goal" :expand (:lambdas (foo x)))))

Certain "program-only" function calls will now cause hard Lisp errors.
(The rather obscure reason for this fix is to support logical modeling
of the ACL2 evaluator.  A relevant technical discussion may be found in
source function oneify-cltl-code, at the binding of variable
fail_program-only-safe.)

There was an unnecessary restriction that FLET-bound functions must
return all stobjs among their inputs.  For example, the following
definition was rejected because state was not among the outputs of h.
This restriction has been removed.

     (defun foo (state)
       (declare (xargs :stobjs state))
       (flet ((h (state) (f-boundp-global 'x state)))
         (h state)))

We fixed a bug, introduced in the preceding release (Version  4.3), in
the check for irrelevant formals (see *note IRRELEVANT-FORMALS::).
That check had been too lenient in its handling of lambda (LET)
expressions, for example allowing the following definition to be
admitted in spite of its first formal parameter obviously being
irrelevant.

     (defun foo (x clk)
       (if (zp clk)
           :diverge
         (let ((clk (1- clk)))
           (foo x clk))))

Fixed a bug in the mini-proveall target in GNUmakefile.  The fix
includes a slight change to the :mini-proveall command (an extra event
at the end).  Thanks to Camm Maguire for reporting this bug.

Fixed a bug that occurred when certify-book was called after using
set-fmt-soft-right-margin or set-fmt-hard-right-margin to set a small
right margin.

Fixed set-inhibit-warnings so that it takes effect for a subsequent
include-book event.  Thanks to Jared Davis and David Rager for queries
that led to this fix.

Hard Lisp errors are now avoided for certain :rewrite rules: those
whose equivalence relation is other than equal when the rule is
originally processed, but is no longer a known equivalence relation
when the rule is to be stored.  Thanks to Jared Davis for sending a
useful example, a minor variant of which is included in a comment in
source function interpret-term-as-rewrite-rule (file defthm.lisp).

Fixed a bug in the ACL2 evaluator (source function raw-ev-fncall), which
was unlikely to be exhibited in practice.

Fixed a hard Lisp error that could occur for ill-formed :meta
rule-classes, e.g., (:meta :trigger-fns '(foo)).

It is now an error to include a stobj name in the :renaming alist (see
*note DEFSTOBJ::).

Some bogus warnings about non-recursive function symbols have been
eliminated for rules of class :type-prescription.

(Allegro CL host Lisp only) Fixed an obsolete setting of compiler
variable comp:declared-fixnums-remain-fixnums-switch, which may have
been responsible for intermittent (and infrequent) checksum errors
encountered while including books during certification of the
regression suite.

Fixed a proof-checker bug that could result in duplicate goal names in
the case of forced hypotheses.  An example showing this bug, before the
fix, appears in a comment in the ACL2 sources, in (deflabel note-5-0
...).

We fixed a bug in a prover routine involved in type-set computations
involving linear arithmetic.  This bug has been around since at least
as far back as Version_3.3 (released November, 2007).  We are not aware
of any resulting unsoundness, though it did have the potential to
weaken the prover.  For example, the following is proved now, but was
not proved before the bug was fixed.

     (thm
      (implies (and (rationalp x)
                    (rationalp y)
                    (integerp (+ (* 1/3 y) x)))
               (integerp (+ y (* 3 x))))
      :hints (("Goal" :in-theory (disable commutativity-of-+))))

Although all bets are off when using redefinition (see *note
LD-REDEFINITION-ACTION::), we wish to minimize negative effects of its
use, especially raw Lisp errors.  The examples below had caused raw Lisp
errors, but no longer.

     (defstobj st fld :inline t)
     (redef!)
     (defstobj st new0 fld)
     (u)
     (fld st) ; previously an error, which is now fixed

     ; Fresh ACL2 session:
     (redef!)
     (defun foo (x) x)
     (defmacro foo (x) `(quote ,x))
     (u)

     ; Fresh ACL2 session:
     (redef!)
     (defmacro foo (x) (cons 'list x))
     (defun foo (x) x)

Fixed a bug that could cause hard Lisp errors in an encapsulate event.
Thanks to Sol Swords for sending an example that exhibited this bug.
Here is a simpler such example; the bug was in how it was checked
whether the guard for a guard-verified function (here, g) depends on
some function introduced in the signature of the encapsulate (here, the
function f).

     (encapsulate
      ((f (x) t))
      (local (defun f (x) (declare (xargs :guard t)) x))
      (defun g (x)
        (declare (xargs :guard (if (integerp x) (f x) t)))
        x))

Fixed a bug in mfc-relieve-hyp that we believe could prohibit its use on
the last hypothesis.  Thanks to Sol Swords for reporting this bug and
providing a fix.

The syntax #! (see *note SHARP-BANG-READER::) was broken after a skipped
readtime conditional.  For example, the following input line caused an
error.

     #+skip #!acl2(quote 3)

This bug has been fixed.

Fixed a bug in the break-rewrite utility, which was evidenced by error
messages that could occur when dealing with free variables.  An example
of such an error message is the following; we thank Robert Krug for
sending us an example that produced this error and enabled us to
produce a fix.

     HARD ACL2 ERROR in TILDE-@-FAILURE-REASON-PHRASE1:  Unrecognized failure
     reason, ((MEM-ARRAY . X86) (ADDR QUOTE 9)).

We fixed an obscure bug that we believe could interfere with defproxy
because of an incorrect (declaim (notinline <function>)) form.

*CHANGES AT THE SYSTEM LEVEL AND TO DISTRIBUTED BOOKS*

Improvements have been made related to the reading of characters.  In
particular, checks are now done for ASCII encoding and for the expected
char-code values for Space, Tab, Newline, Page, and Rubout.  Also, an
error no longer occurs with certain uses of non-standard characters.
For example, it had caused an error to certify a book after a single
portcullis command of (make-event `(defconst *my-null* ,(code-char
0))); but this is no longer an issue.  Thanks to Jared Davis for
helpful correspondence that led us to make these improvements.

The character encoding for reading from files has been fixed at
iso-8859-1.  See *note CHARACTER-ENCODING::.  Thanks to Jared Davis for
bringing this portability issue to our attention (as this change arose
in order to deal with a change in the default character encoding for
the host Lisp, CCL), and pointing us in the right direction for dealing
with it.  In many cases, the character encoding for reading from the
terminal is also iso-8859-1; but this is not guaranteed.  In
particular, when the host Lisp is SBCL this may not be the case.

Although the HTML documentation is distributed with ACL2, it had not
been possible for users to build that documentation without omitting
graphics, for example on the ACL2 home page.  That has been fixed, as
files graphics/*.gif are now distributed.

Compiler warnings are suppressed more completely than they had been
before.  For example, the following had produced a compiler warning
when the host Lisp is CCL, but no longer does so.

     (defun f () (car 3))
     (trace$ f)

Removed support for "tainted" certificates.  One reason is that there
are rarely incremental releases.  A stronger reason is that for the
compatibility of a new release is with the previous non-incremental
release, it's not particularly relevant whether or not the new release
is incremental.

The `make' variable BOOKS can now be defined above the line that
includes Makefile-generic.  (For relevant background, see *note
BOOKS-CERTIFICATION-CLASSIC::.)

(SBCL only) ACL2 images built on SBCL now have an option,
-dynamic-space-size 2000, that can avoid space problems that could
previously have caused the session to die.

The default value for variable LISP in file GNUmakefile is now ccl.
Thus, if you use `make' in the standard way to build an ACL2
executable, the default host Lisp is ccl rather than gcl.

*EMACS SUPPORT*

*EXPERIMENTAL VERSIONS*

For the version supporting the reals, ACL2(r) (see *note REAL::), the
supporting function floor1 has been defined in raw Lisp.  This avoids
an error such as in the following case.

     (defun f () (declare (xargs :guard t)) (floor1 8/3))
     (f) ; had caused raw Lisp error, before the fix

Among the enhancements for the parallel version, ACL2(p) (see *note
PARALLELISM::), are the following.  We thank David Rager for his work
in developing ACL2(p) and these improvements in particular.

     The macro set-parallel-evaluation has been renamed
     set-parallel-execution.

     Calls of the macro set-waterfall-printing are no longer events, so
     may not be placed at the top level of books.  However, it is easy
     to create events that have these effects; see *note
     SET-WATERFALL-PRINTING::.  Note that now, :ubt and similar
     commands do not change the settings for either
     waterfall-parallelism or waterfall-printing.

     The implementation of deflock has been improved.  Now, the macro it
     defines can provide a lock when invoked inside a guard-verified or
     :program mode function.  Previously, this was only the case if the
     function definition was loaded from raw Lisp, typically via a
     compiled file.

     The underlying implementation for waterfall parallelism (see *note
     SET-WATERFALL-PARALLELISM::) has been improved.  As a result, even
     the largest proofs in the regression suite can be run efficiently
     in :resource-based waterfall parallelism mode.  Among these
     improvements is one that can prevent machines from rebooting
     because operating system limits have been exceeded; thanks to
     Robert Krug for bringing this issue to our attention.

     There is also a new flag for configuring the way waterfall
     parallelism behaves once underlying system resource limits are
     reached.  This flag is most relevant to :full waterfall
     parallelism.  see *note SET-TOTAL-PARALLELISM-WORK-LIMIT:: for
     more information.

     The dmr utility has the same behavior in ACL2(p) as it has in ACL2
     unless waterfall-parallelism has been set to a non-nil value (see
     *note SET-WATERFALL-PARALLELISM::), in which case statistics about
     parallel execution are printed instead of the usual information.

     The user can now build the regression suite using waterfall
     parallelism.  See the distributed file
     acl2-customization-files/README for details, and see *note
     UNSUPPORTED-WATERFALL-PARALLELISM-FEATURES:: for a disclaimer
     related to building the regression suite using waterfall
     parallelism.

     When building ACL2 with both the hons and parallelism extensions
     (what is called "ACL2(hp)"), the functions that are automatically
     memoized by the hons extension are now automatically unmemoized
     and memoized when the user toggles waterfall parallelism on and
     off, respectively.

     Calling set-waterfall-parallelism with a flag of t now results in
     the same settings as if it were called with a flag of
     :resource-based, which is now the recommended mode for waterfall
     parallelism.  Thanks to Shilpi Goel for requesting this feature.

     The prover now aborts in a timely way in response to interrupts
     issued during a proof with waterfall parallelism enabled.  (This
     had often not been the case.)  Thanks to Shilpi Goel for
     requesting this improvement.


Among the enhancements for the HONS extension (see *note
HONS-AND-MEMOIZATION::) are the following.

     The compact-print code has been replaced by new serialization
     routines contributed by Jared Davis.  This may improve performance
     when including books that contain make-events that expand to very
     large constants.  You can also now save objects to disk without
     going into raw lisp; see *note SERIALIZE:: for details.

     Printing of certain messages has been sped up (by using Lisp
     function force-output in place of finish-output).  Thanks to Jared
     Davis for contributing this improvement.

     Stobj array writes are perhaps twice as fast.

     It is now permitted to memoize functions that take user-defined
     stobjs as inputs, provided that no stobjs are returned.  Even if
     stobjs are returned, memoization is permitted provided the
     condition is nil, as when profiling (see *note PROFILE::).  Thanks
     to Sol Swords for an observation that led to this improvement and
     for useful conversations, including follow-up leading us to
     improve our initial implementation.

     Fixes have been made for memoizing with a non-nil value of
     :ideal-okp.  Errors had occurred when memoizing with a :condition
     other than t for a :logic mode function that had not been
     guard-verified, even with a non-nil value of :ideal-okp; and after
     successfully memoizing such a function (without such :condition),
     it had not been possible to unmemoize it.  Thanks to Sol Swords for
     reporting issues with the :ideal-okp argument of memoize.

     If a book defined a function that was subsequently memoized in that
     book, the function would no longer behaves as memoized upon
     completion of book certification (unless that certify-book command
     was undone and replaced by evaluation of a corresponding
     include-book command).  This has been fixed.  Thanks to David
     Rager for pointing out the problem by sending an example.

     We now support ACL2(h) built not only on 64-bit CCL but also on
     all supported host Ansi Common Lisps (i.e., all supported host
     Lisps except GCL).  Thanks to Jared Davis for doing much of the
     work to make this improvement.  Note that performance will likely
     be best for 64-bit CCL; for some Lisps, performance may be much
     worse, probably depending in part on the underlying implementation
     of hash tables.



File: acl2-doc-emacs.info,  Node: NOTE-6-0,  Next: NOTE-6-1,  Prev: NOTE-5-0,  Up: RELEASE-NOTES

NOTE-6-0    ACL2 Version  6.0 (December, 2012) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  5.0 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level, Emacs
support, and experimental versions.  Each change is described in just
one category, though of course many changes could be placed in more
than one category.

NOTE.  But we start with one major change that is outside the usual
categories:

*LICENSE change*

The ACL2 license has been changed from GPL Version 2 to a 3-clause BSD
license, found in the LICENSE file distributed with ACL2.

*CHANGES TO EXISTING FEATURES*

Function fmt-to-string and similar functions (see *note
PRINTING-TO-STRINGS::) now use the default right margin settings;
formerly the right margin had been set at 10,000.  If you want the
former behavior, you can use the :fmt-control-alist, as illustrated
below.

     (fmt-to-string "~x0"
                    (list (cons #\0 (make-list 30)))
                    :fmt-control-alist
                    `((fmt-soft-right-margin . 10000)
                      (fmt-hard-right-margin . 10000)))

The use of attachments (see *note DEFATTACH::) has been made more
efficient, avoiding some low-level checks (Common Lisp `boundp'
checks).  Thanks to Shilpi Goel for constructing an example that we
used to help direct us to remove inefficiency.  The following results
for that example -- a Fibonacci program run on a machine interpreter in
raw-mode (see *note SET-RAW-MODE::) -- give a sense of the potential
speedup, though we note that a full ACL2(h) regression showed no
significant speedup.

     ; Time before the change:
     ; 0.89 seconds realtime, 0.90 seconds runtime

     ; Time after the change:
     ; 0.75 seconds realtime, 0.75 seconds runtime

     ; Time when cheating to avoid the cost of attachments, by redefining a
     ; function to BE its attachment (so, this gives a lower bound on possible
     ; execution time):
     ; 0.72 seconds realtime, 0.72 seconds runtime

Functions read-acl2-oracle and read-acl2-oracle@par are no longer
untouchable (see *note REMOVE-UNTOUCHABLE::).  We reported this change
for Version_5.0 but it was not made; thanks to Jared Davis for bringing
this to our attention.  Function get-timer also is no longer
untouchable.

The function butlast now behaves more reasonably on arguments violating
its guard.  For example, (butlast '(1 2 3) -1) is now provably equal to
(1 2 3) instead of to (1 2 3 nil).  Thanks to Jared Davis for
suggesting a change to the definition of butlast.

The utilities mfc-ts and mfc-ap (see *note EXTENDED-METAFUNCTIONS::)
formerly never used forcing (see *note FORCE::).  Now, by default,
forcing is allowed during execution of these functions if and only if
it is permitted in the rewriting environment where they are called.
Moreover, these and the mfc-xx utilities -- mfc-rw, mfc-rw+, and
mfc-relieve-hyp -- are now macros that take (optional) keyword
arguments :forcep and :ttreep.  The :forcep argument is :same by
default, providing the forcing behavior inherited from the environment
(as described above); but it can be the symbol t or nil, indicating
that forcing is to be enabled or disabled, respectively.  The :ttree
argument is nil by default, but when it is t, then a second value is
returned, which is a tag-tree.  See *note EXTENDED-METAFUNCTIONS::.

Many improvements have been made to the tau-system (see *note
TAU-SYSTEM::), including support for arithmetic intervals bounded by
constants.  Thus, for example, (and (<= 0 x) (<= x 15)) is a tau
predicate.  The documentation has also been improved (see *note
INTRODUCTION-TO-THE-TAU-SYSTEM::). Also see *note TIME-TRACKER-TAU:: for
discussion of how the new time-tracker utility can help discover ways
to detect slowdown related to the tau-system.

The defthm events printed by defabsstobj, namely those that remain to
be proved, are now given with :rule-classes nil since there is probably
no intention to use them as rules.  Thanks to Robert Krug for
suggesting that we consider this change.

The formal parameters for a macro definition (see *note DEFMACRO::) may
now include state and user-defined stobjs.  (However, macro formals may
not be declared as stobjs; see *note XARGS::.)  Thanks to Jose Luis
Ruiz-Reina for raising this issue and to Rob Sumners for helpful
conversations -- both of these nearly 10 years ago!

The utilities defun-inline, defun-notinline, defund-inline, and
defund-notinline have been simplified, by taking advantage of the
lifting of restrictions on formal parameters of macro definitions
mentioned above (involving symbols that happen to be stobj names).
Now, when any of the above four utilities is called with a given set of
formal parameters, those formals will be used not only for the
generated defun event but also for the generated defmacro event.
(Previously, they had been renamed for the defmacro event in order to
respect the stobj name restriction that no longer exists.)  Thanks to
Jared Davis for pointing out the value of making this change.

The events add-invisible-fns and remove-invisible-fns now convert
arguments as appropriate using the macro-aliases-table.  For example,
the event (add-invisible-fns append car) is now legal (though probably
not a good idea), because add-invisible-fns is now sensitive to the
fact that append maps to binary-append in the macro-aliases-table.

When :pe is applied to a built-in function that does not have a
defining event, such as symbolp, :pe now gives more useful output that
points to the documentation instead of printing a call of
ENTER-BOOT-STRAP-MODE.  Thanks to Anthony Knape for bringing this issue
to our attention.

The macros memoize and unmemoize now cause a warning rather than an
error in ACL2 (and work as before in ACL2(h)).

Terms are now parsed into :type-prescription rules in a manner that
removes let bindings both at the top level and in the conclusion (but
still not in the hypotheses of the rule).  See *note
TYPE-PRESCRIPTION::.  Thanks to Jared Davis for requesting such an
enhancement.

Printing of numbers is now appropriately sensitive to the print radix;
see *note SET-PRINT-RADIX::.  Thanks to Shilpi Goel for requesting this
enhancement.

The system function explode-atom no longer includes the radix indicator.
The new function explode-atom+ may be used for that purpose.

*NEW FEATURES*

Among the new features for system hackers are analogues of system
function simple-translate-and-eval that do not return state.  (Thanks to
David Rager for requesting this feature and helpful conversations on its
implementation.)  This and other low-level changes are typically
documented in comments in the corresponding release note event, which
in this case is (deflabel note-6-0 ...).

More built-in functions are now guard-verified (and in :logic mode).
Furthermore, a mechanism exists for marking yet more built-in functions
as guard-verified based on books contributed by users; see Part II of
`http://www.cs.utexas.edu/users/moore/acl2/open-architecture/'.  The
current state of that enterprise may be viewed by evaluating the
constant *system-verify-guards-alist*, which associates a community
book name with a list of functions.  When ACL2 is built in the normal
way, each of those functions is marked as guard-verified when ACL2 is
started up; but a special developer build can be used to check that the
indicated book, together with its sub-books, proves that those
functions are guard-verified.

Metatheorems (see *note META::) may now have additional hypotheses,
called "meta-extract hypotheses", that allow metafunctions to depend on
the validity of certain terms extracted from the context or the logical
world.  See *note META-EXTRACT::.  Thanks to Sol Swords for providing
an initial implementation, together with very helpful discussions as
well as a community book,
books/clause-processors/meta-extract-user.lisp, that extends the power
of meta-extract hypotheses.

New utilities oracle-funcall, oracle-apply, and oracle-apply-raw call a
function argument on specified arguments.  Thanks to Jared Davis for
requesting this utility.

A new utility makes it convenient to track time spent inside specified
function calls or, more generally, during specified evaluation.  See
*note TIME-TRACKER::.

New runic designators make it easy to refer to macro names when building
theories.  Thus, for example, the object (:i append) may be used in
theory expressions to designate the rune (:induction binary-append).
See *note THEORIES::.  Thanks to Jared Davis for a useful discussion
leading to this enhancement.

Defabsstobj events now take an optional :congruent-to keyword argument,
much like defstobj.  Thanks to Sol Swords for requesting this feature
and for suggesting a very nice optimization that avoids the need to
prove additional lemmas.

Flet may now include inline and notinline declarations.  Thanks to
Jared Davis for requesting this feature.

The utility gc-verbose controls printing of messages by the garbage
collector, for certain host Lisps.  See *note GC-VERBOSE::.  Thanks to
Shilpi Goel for requesting this utility.

Added definitions of functions nat-listp and acl2-number-listp.  Thanks
to Harsh Raju Chamarthi for requesting these additions.  Many community
books had varying definitions of these functions; these additions
guarantee that all books must agree on how these two functions are
defined.  (Some community books have been changed in order that they
remain certifiable, given these additions.)  Note that a few built-in
:forward-chaining rules were modified in order to accommodate these
additions, and the definition of integer-listp was modified to call eq
instead of equal, like the other such definitions.

See *note GET-COMMAND-SEQUENCE:: for a new utility that returns a list
of commands between two given command descriptors.

*HEURISTIC IMPROVEMENTS*

We obtained a substantial speedup -- 13% observed for the regression
suite, and 8% observed for the ACL2(h) regression suite -- by tweaking
the break-rewrite implementation to eliminate virtually all of its
overhead when it is not in use (the default, which holds until :brr t is
evaluated).  Thanks to David Rager for a conversation involving ACL2(p)
performance statistics that suggested looking at changing break-rewrite
to boost performance.

The heuristics for automatically expanding recursive function calls
have been changed during proofs by induction.  Now, during induction,
more terms that suggested the induction scheme are automatically
expanded.  Thanks to David Rager for providing an example and having
discussions with us that spurred us to develop this heuristic
improvement.

*BUG FIXES*

Fixed a soundness bug in defabsstobj based on guards that violated
single-threadedness restrictions.  Thanks to Sol Swords for bringing
this bug to our attention and supplying a proof of nil, which we include
as a comment in source file ld.lisp, in (deflabel note-6-0 ...).  We
also thank Sol for helpful discussions about guards of functions
introduced by defabsstobj, which has led us to enhance the
documentation; see *note DEFABSSTOBJ::.

Fixed a soundness bug in defabsstobj based on interrupted updates of
abstract stobjs.  As part of the fix a new keyword, :PROTECT, has been
introduced for defabsstobj exports, along with a new top-level
defabsstobj keyword, :PROTECT-DEFAULT; see *note DEFABSSTOBJ::.  We do
some analysis that we expect will avoid the use of :PROTECT in many
cases, which is fortunate since the use of :PROTECT t may cause a slight
slowdown in (abstract) stobj updates.  Thanks to Sol Swords for
bringing this bug to our attention and supplying a proof of nil, which
we include as a comment in source file other-events.lisp, in the
definition of function set-absstobj-debug.

Fixed a raw Lisp error that occurred when tracing a stobj resize
function, thanks to an error report from Warren Hunt, Marijn Heule, and
Nathan Wetzler.

Fixed a raw Lisp error that occurred for certain ill-formed signatures,
as in the following example.

     ACL2 !>(encapsulate
                (((f (*) => * :guard t)))
                (local (defun f (x) (consp x))))

     ***********************************************
     ************ ABORTING from raw Lisp ***********
     Error:  value (F (*) => * :GUARD T) is not of the expected type SYMBOL.
     ***********************************************

The notion of "error triple" (see *note ERROR-TRIPLES::) had been
implemented ambiguously, with the result that for a stobj, st, the
result of evaluating the following two forms was the same: (mv nil st
state) and (mv t st state).  Of course, these are just examples; in
general, a result of (mv erp val state) was sometimes treated as an
error triple even when val is a stobj.  Now, (mv erp val state) is an
error triple only when erp and val are ordinary (non-stobj) values.
Thanks to Warren Hunt and Marijn Heule for bringing this problem to our
attention.

The "with-error-trace" utility, wet, now works in the non-error case
when given a form that returns multiple values.  (Note however that
STATE will be printed as REPLACED-STATE; and similarly, a user-defined
stobj, say ST, will be printed as REPLACED-ST.)

Some possible error messages for defabsstobj have been fixed that had
been ill-formed.  Thanks to Sol Swords for bringing this bug to our
attention.

Fixed a bug that sometimes caused the times displayed in the summary for
certify-book to be smaller than the actual times.

Fixed a bug in the guards to system functions fmt-char and fmt-var,
which are no longer :logic-mode, guard-verified functions.

(GCL only) Fixed a bug present in Gnu Common Lisp for #u (see *note
SHARP-U-READER::).

*CHANGES AT THE SYSTEM LEVEL*

The state global variable 'distributed-books-dir has been renamed
'system-books-dir.  On a related note, the documentation now refers to
"community books" rather than "distributed books", and there is a
corresponding new documentation topic; see *note COMMUNITY-BOOKS::.

Fixed a bug in the implementation of wet (which is actually in the
community book books/misc/wet.lisp).

A directory, interface/, is no longer part of the ACL2 distribution.
Rather, it is a subdirectory of the ACL2 community books.  Thus, if you
fetch those books in the usual way (see the installation instructions
on the ACL2 home page), you will find a directory books/interface/.
Subdirectory emacs/ of that interface directory provides Emacs support
for proof-trees as well an acl2-mode.  This change has been reflected in
ACL2 file emacs/emacs-acl2.el, so users will probably not be impacted if
they load that file into Emacs.

The community books file books/Makefile-generic now causes, by default,
a backtrace to be printed when there is a raw Lisp error.

Some changes have been made to how regressions are run, i.e., to how the
community books are certified.  (1) The standard regression now includes
community books directory books/centaur.  To skip these (for example, a
Windows system has encountered difficulty with them even after
installing Perl), include ACL2_CENTAUR=skip with your `make' command.
(2) A new `make' (or environment) variable, ACL2_JOBS, specifies the
number of parallel jobs to run, serving as a replacement for the -j
argument of `make' that works for all community books, including those
under directory centaur; see *note BOOKS-CERTIFICATION-CLASSIC::.  (3)
It is no longer necessary to do an ACL2(h) regression in order to build
a copy of the documentation generated by Jared Davis's xdoc utility at
books/xdoc-impl/manual/preview.html; a vanilla ACL2 regression will
build this manual.  (4) It is no longer necessary to set the ACL2
environment variable for ACL2(h) regressions if you want to use the
executable saved_acl2h in the ACL2 sources directory.

The ACL2 home page now has a search utility for documentation and books.
Thanks to Shilpi Goel and David Rager for feedback on a preliminary
version of this utility.

(only for SBCL with 64-bit ACL2(h)) The value of SBCL command line
option -dynamic-space-size for ACL2(h) on 64-bit platforms has been
increased from 2000 to 16000 (as explained in a comment in the ACL2
source definition of *sbcl-dynamic-space-size*).

*EMACS SUPPORT*

*EXPERIMENTAL/ALTERNATE VERSIONS*

Among the enhancements for ACL2(r) (see *note REAL::) are the following.

     Thanks to Ruben Gamboa for his helpful role in making the following
     improvements made with Ruben Gamboa in support for non-standard
     analysis in ACL2(r).

     Constrained functions can now be introduce as non-classical.  See
     *note SIGNATURE::.

     Defun-sk now takes a new keyword argument, :CLASSICALP, that
     determines whether or not the named function is classical.  See
     *note DEFUN-SK::.

     Incorporated a bug fix from Ruben Gamboa for ceiling.  The default
     (for `bad' arguments) had been 1, but now we follow normal ACL2
     practice by returning 0 in that case.


Among the enhancements for the HONS extension (see *note
HONS-AND-MEMOIZATION::) are the following.

     Macros with-fast-alist, with-stolen-alist, and
     fast-alist-free-on-exit are now defined in ACL2(h), rather than
     being defined in the community book
     "books/centaur/misc/hons-extra.lisp".  Thanks to Jared Davis and
     Sol Swords for donating this code, and thanks to Jared for helpful
     discussions leading to this change.


Among the enhancements for ACL2(p) (see *note PARALLELISM::) are the
following.  We thank David Rager for his work in developing ACL2(p) and
for his helpful role in these improvements.

     A bug has been fixed that could leave one in a wormhole, awaiting
     input, after an error, such as an error in an :in-theory hint
     during a proof.  Thanks to Shilpi Goel for bringing this bug to
     our attention.

     A key checkpoint for a given goal is now printed only once.
     Previously, if a key checkpoint led to more than one goal pushed
     for proof by induction, the key checkpoint would be printed once
     for each such goal during the proof, and also once for each such
     goal in the summary at the end.



File: acl2-doc-emacs.info,  Node: NOTE-6-1,  Next: NOTE-6-2,  Prev: NOTE-6-0,  Up: RELEASE-NOTES

NOTE-6-1    ACL2 Version  6.1 (February, 2013) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  6.0 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level, Emacs
support, and experimental versions.  Each change is described in just
one category, though of course many changes could be placed in more
than one category.

*CHANGES TO EXISTING FEATURES*

More system functions are in :logic mode, guard-verified.  Evaluate

     (strip-cars (cdr (assoc-equal "system/top" *system-verify-guards-alist*)))

for the list of functions checked to be guard-verifiable in the
community books.  Thanks to those who have contributed to this effort,
as shown in file headers in directory system/ of the community books.

The macro defund now avoids an error when :mode :program has been
specified in an xargs form of a declare form, for example: (defund f
(x) (declare (xargs :mode :program)) x).  It does this by avoiding the
generation of in-theory events in such cases.  Thanks to David Rager
and Jared Davis for requesting such a change, and for ensuing helpful
discussions.

Added a field :UNIFY-SUBST to metafunction contexts (see *note
EXTENDED-METAFUNCTIONS::), accessed with function mfc-unify-subst.
Thanks to Sol Swords for requesting this enhancement.

The functions sys-call and sys-call-status are now guard-verified
:logic-mode functions.

It had been the case that if any supporter of a dependent clause
processor (see *note DEFINE-TRUSTED-CLAUSE-PROCESSOR::) is among the
ancestors of a given formula, then it was illegal to apply functional
instantiation (see *note LEMMA-INSTANCE::) to that formula.  Now, this
is illegal only if some such supporter is in the domain of the
functional substitution.

The tau system (see *note TAU-SYSTEM::, or if you are unfamiliar with
the tau system, see *note INTRODUCTION-TO-THE-TAU-SYSTEM::) now allows
the user to define and verify functions that compute bounds on
arithmetic expressions.  See *note BOUNDERS::.

The utility print-summary-user has been replaced by
finalize-event-user, which is described below.  If you previously
attached a function to print-summary-user, say my-print-summary-user,
then you can get the effect you had previously as follows.

     (defun my-finalize-event-user (state)
       (declare (xargs :mode :logic :stobjs state))
       (prog2$ (my-print-summary-user state)
               state))
     (defattach finalize-event-user my-finalize-event-user)

It had been the case that when you LD a file, the connected book
directory (see *note CBD::) was set to the canonical pathname of that
file's directory for the duration of the LD call.  This could cause
problems, however, if the file is actually a soft link: an include-book
form in the book with a relative pathname for the book would be
resolved with respect to the absolute pathname for that link, which is
probably not what was intended.  So soft links are no longer followed
when computing the above connected book directory.  The following
example, which is how we discovered this problem, may clarify.  We
attempted to execute the form (ld "top.lisp") using ACL2(r) (see *note
REAL::) in community books directory nonstd/arithmetic/, where all of
the .lisp files are soft links to files in arithmetic/.  Thus, the form
(include-book "equalities") attempted to include arithmetic/equalities
instead of nonstd/arithmetic/equalities, which caused an error.

We no longer document the use of value :START for
with-prover-step-limit.  This value has always been used by the ACL2
implementation and may have semantics that change with new ACL2
versions.  If you have reason to use this value, please contact the
ACL2 implementors.

*NEW FEATURES*

By default, the prover now gives information about case splits.  See
*note SPLITTER::.  Thanks to many ACL2 users, most recently David
Rager, for requesting such a capability.  Also thanks to David Rager
and Jared Davis for helpful discussions, and thanks to Robert Krug for
feedback on the initial implementation and documentation that led us to
make improvements.

New utilities initialize-event-user and finalize-event-user allow the
user to run state-modifying code at the start and end of events.
Thanks to Harsh Raju Chamarthi for requesting these capabilities.  Note
that finalize-event-user replaces print-summary-user.

*HEURISTIC IMPROVEMENTS*

Several heuristic improvements have been made to the tau system, even
if you do not explicitly use the new capability for computing bounds on
arithmetic expressions, mentioned above.  See *note TAU-SYSTEM::, or if
you are unfamiliar with the tau system, see *note
INTRODUCTION-TO-THE-TAU-SYSTEM::.

*BUG FIXES*

A soundness bug has been fixed that exploited the use of expansion files
(see *note BOOK-COMPILED-FILE::) together with defstobj.  For an example
illustrating this bug, see the comment about "Expansion/Defstobj Bug" in
the form (deflabel note-6-1 ...) in ACL2 source file ld.lisp.

We fixed a soundness bug involving system function canonical-pathname
and (most likely) other functions in the former value of constant
*unattachable-primitives*.  Thanks to Jared Davis and Sol Swords for
bringing this bug to our attention by way of an example.  We include a
very slight variant of that example in a comment within the form
(deflabel note-6-1 ...) in ACL2 source file ld.lisp.

There was a soundness bug that allowed attachments to prove nil in a
consistent logical world involving defaxiom events.  This has been
fixed, by requiring that no function symbol ancestral in a defaxiom
formula is allowed to get an attachment.  See *note DEFATTACH::, in
particular discussion of "a restriction based on a notion of a function
symbol syntactically supporting an event", which concludes with a proof
of nil that is no longer possible.

(ACL2(h) only) We fixed a soundness bug in the interaction of
memoization with congruent stobjs, in cases where the :congruent-to
field of defstobj was not the canonical representative in the
congruence class.  For an example illustrating this bug, see the
comment about "memoize/congruent stobj bug" in the form (deflabel
note-6-1 ...)  in ACL2 source file ld.lisp.

Functions defined by defstobj had failed to be compiled when certifying
books, except in host Lisps that compile on-the-fly (CCL, SBCL).  This
has been fixed for all host Lisps.  A related change, probably less
significant, was made for defabsstobj.  Thanks to Sol Swords for
reporting bugs that turned out to be mistakes in a preliminary
implementation of this change.

Fixed an assertion error involving linear arithmetic.  Thanks to Sol
Swords for sending an example illustrating the bug (now appearing as a
comment in ACL2 source function linearize1).

Fixed a bug that was breaking the ACL2s build mechanism (see *note
ACL2-SEDAN::) by causing certain needless evaluation of "hidden defpkg"
forms in certificate files when executing a call of include-book.  The
bug could also affect rare error messages arising from ill-formed
certificate files.  Thanks to Harsh Raju Chamarthi for bringing this bug
to our attention by sending us an example script of the sort that was
breaking during an ACL2s build.

Fixed handling of pathnames by some low-level code (system function
our-truename) that could cause errors, for example for host-Lisp GCL on
some platforms when environment variable HOME points to a non-existent
directory.  Thanks to Camm Maguire for bringing this issue to our
attention and helping with the debugging.

Fixed a coding bug in generation of stobj resizing functions for a stobj
named OLD.  The following example illustrates the bug.

     (defstobj old
       (fld :type (array (unsigned-byte 31) (8))
             :initially 0 :resizable t))
     (resize-fld 10 old)
     ; The following returned 8 but should have returned 10:
     (fld-length old)

Fixed a bug in defabsstobj-missing-events (which macroexpanded
incorrectly).  Thanks to Sol Swords for bringing this bug to our
attention.

Fixed two bugs in the handling of step-limits.  Thanks to Hanbing Liu
for bringing the main such bug to our attention, which was that ACL2
could report a step-limit violation during certify-book (in fact,
during any compound event such as a call of encapsulate or progn), even
without direct user involvement in managing step-limits (see *note
SET-PROVER-STEP-LIMIT:: and see *note WITH-PROVER-STEP-LIMIT::).  The
other bug was that a bad argument to set-prover-step-limit could result
in a raw Lisp error, for example: (progn (set-prover-step-limit '(a
b))).

*CHANGES AT THE SYSTEM LEVEL*

The books/ directory no longer needs to exist in order to build an ACL2
executable.  Thanks to Robert Krug for pointing out that the
installation instructions had suggested that this was already the case.

Many changes have been made to the community books (see *note
COMMUNITY-BOOKS::).  For example, some community books now include
std/lists/rev.lisp, which contains the rule revappend-removal, which
may cause some proofs involving revappend to fail where they formerly
succeeded, or vice-versa.  When a proof fails that formerly succeeded,
it may be useful for you to look over the runes printed in the event
summary.

*EMACS SUPPORT*

*EXPERIMENTAL/ALTERNATE VERSIONS*

For ACL2(p), wormhole-eval is now locked by default; thanks to David
Rager for suggesting this change.  But there is a way to avoid the lock;
see *note WORMHOLE-EVAL::.  In particular, the lock is avoided in the
implementations of accumulated-persistence and
forward-chaining-reports, which are not supported in ACL2(p) (see *note
UNSUPPORTED-WATERFALL-PARALLELISM-FEATURES::).


File: acl2-doc-emacs.info,  Node: NOTE-6-2,  Next: NOTE-6-3,  Prev: NOTE-6-1,  Up: RELEASE-NOTES

NOTE-6-2    ACL2 Version  6.2 (June, 2013) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version 6.1 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level, Emacs
support, and experimental versions.  Each change is described in just
one category, though of course many changes could be placed in more
than one category.

*CHANGES TO EXISTING FEATURES*

The macro top-level has been changed, so that evaluation of a form
(top-level x) results in an error when evaluation of x results in an
error.  Thanks to Jared Davis for observing that when evaluating a file
using ld, an interrupt of a call of a top-level call in that file would
not prevent evaluation of later forms in the file.

The macro THE no longer causes an error when guard-checking is :NONE.
For example, it had been the case that evaluation of (the integer t)
always caused an error; but now, there is no error after executing
command :set-guard-checking :NONE.  Thanks to Jared Davis for asking
for a way to avoid such errors.

The error printed when attempting to "reincarnate" a package -- that is,
to define a package that is not part of the ACL2 logical world but
exists in raw Lisp because it was once part of the world -- is now much
more instructive.  In particular, it shows pathnames for the previous
and proposed defpkg events, and it shows the symbols that are imported
by one but not the other.  Thanks to Jared Davis for requesting this
improvement.

Functions open-input-channel and open-output-channel no longer cause an
error when failing to open a channel because of a permissions problem,
but instead return (mv nil state).  Thanks to Jared Davis for
requesting this change.  (Note: this change does not apply if the host
Lisp is non-ANSI, i.e., if the host Lisp is non-ANSI GCL.)

The advanced meta-extract mechanisms, provided for using facts from the
world or metafunction context, have been enhanced in the following
ways, in collaboration with Sol Swords.  See *note META-EXTRACT:: for
more details.

     It is now permissible to use calls of meta-extract-global-fact in
     hypotheses of clause-processor rules, much as they are used in
     hypotheses of meta rules.  See *note META-EXTRACT::.  Thanks to
     Sol Swords for requesting this feature.

     The utility meta-extract-global-fact is now a macro, which expands
     to a corresponding call of the new function,
     meta-extract-global-fact+.  This new function takes an alternate,
     extra state as an argument; it is not to be executed, and it
     operates on the alternate state, whose logical world is intended
     to be the same as that of the "live" (usual) state.

     A new sort of value for the obj argument is supported for
     meta-extract-global-fact (and meta-extract-global-fact+), which
     results in a term equating a function application to its result.
     See *note META-EXTRACT::, in particular the discussion of :fncall.


It is now possible for trace$ to avoid printing prefixes of the form
"n> " and "<n ", while also (optionally) avoiding indentation.  See
*note TRACE$::, in particular the discussion of :fmt!.  Thanks to
Shilpi Goel for requesting this feature.

It was possible for the guard-debug feature to generate duplicate calls
of extra-info in hypotheses generated for guard verification.  We have
eliminated duplicates of this sort.

When in-theory returns without error, it returns a value
(:NUMBER-OF-ENABLED-RUNES k), where k is the length of the new current
theory.  (Formerly, k was returned.)  This value is thus printed when
an in-theory event is submitted at the top level.  Thanks to Gisela
Rossi for feedback that led us to make this change.

A new keyword parameter for ld is :ld-missing-input-ok.  Its default
value is nil, which causes an error, as before, upon failure to open a
specified file.  Other legal values are t and :WARN; see *note
LD-MISSING-INPUT-OK:: and see *note LD::.

Extended *acl2-exports*, in particular adding UNSIGNED-BYTE-P and
SIGNED-BYTE-P (thanks to a suggestion by Jared Davis)

Even if the function f is defined to take one or more stobj arguments,
the form (ec-call (f ...)) is now legal if all arguments of the call of
f are non-stobj objects, in any context where only ordinary object
return values are expected.

When the second argument of certify-book is a symbol, that symbol
formerly needed to be ? or t, in the "ACL2" package.  Now, the
symbol-package-name of the second argument is ignored: any symbol whose
symbol-name is "?" or "T" is treated the same in that argument position
as the symbol ? or t in the "ACL2" package, respectively.  Thanks to
Warren Hunt and Nathan Wetzler for suggesting consideration of a more
relaxed criterion for that second argument.

(For system hackers, not standard ACL2 users:) Utilities
initialize-event-user and finalize-event-user now each take a list of
three arguments, (ctx body state).  Thanks to Harsh Raju Chamarthi for
requesting this change.

*NEW FEATURES*

It is now permissible to specify a stobj field that is itself either a
stobj or an array of stobjs.  A new primitive, stobj-let, is provided
in order to access or update such fields; see *note STOBJ-LET::.
Thanks to Warren Hunt and Sol Swords for requesting the ability to
specify nested stobjs.

New accessor function (mfc-world mfc) returns the world component of a
metafunction context.  See *note EXTENDED-METAFUNCTIONS::.

A new xargs keyword, :SPLIT-TYPES, can be used to "split" the type
declarations from the guard in the following sense.  By default, or
when :SPLIT-TYPES has value nil, one gets the existing behavior: the
terms corresponding to type declarations are conjoined into the guard.
However, if :SPLIT-TYPES t is specified, then that is not the case;
instead, guard verification will require that these terms are proved
under the hypothesis that the guard holds.  In this way, one can add
type declarations to assist the host Lisp compiler without cluttering
the function's guard.  See *note XARGS::.  Thanks to Jared Davis for
requesting this feature.

Advanced users may want to see *note
QUICK-AND-DIRTY-SUBSUMPTION-REPLACEMENT-STEP:: for a way to turn off a
prover heuristic.  Thanks to those who have mentioned to us potential
issues with this heuristic, most recently Dave Greve.

*HEURISTIC IMPROVEMENTS*

We made changes to the "ancestors check" heuristic (source function
ancestors-check-builtin), as follows.

     The heuristic could prevent a rewrite rule's hypothesis from being
     rewritten to true, even when that hypothesis is of the form (force
     <term>).  Now, forcing will take place as expected; see *note
     FORCE::.  Thanks to Robert Krug for bringing this issue to our
     attention and sending an example, which we include as a comment in
     the ACL2 source code (see (deflabel note-6-2 ...)).

     The heuristic is now delayed until after we check whether the
     hypothesis is already known, using type-set reasoning alone (in
     particular, not using rewriting), to be true or to be false.  We
     believe that this is now the "right" order for those two
     operations.  We saw a slight speed up in the regression tests
     (about a percent) with this change, but that might be in the noise.

     A technical change makes the heuristic slightly less aggressive in
     preventing backchaining.  Roughly speaking, ordering checks based
     on function symbol counts could suffice to permit backchaining,
     where now variable counts also suffice.  Thanks to Robert Krug for
     showing us an example where backchaining led to a term with no
     free variables that was nevertheless subject to the ancestors
     check, preventing it from being rewritten.

     (For those who use defattach to attach to ancestors-check)  We have
     used defrec to introduce an `ancestor' data structure.  A new
     function, strip-ancestor-literals, should be used to obtain the
     literals from a list of ancestors, although strip-cars will still
     work at this time.


When we rewrite the current literal of the current clause we assume the
falsity of the other literals and of the conclusions produced by forward
chaining.  We have changed the order in which those assumptions are
made, which affects the type-alist used during rewriting.  This has
three effects: the new type-alist, which is sometimes stronger than the
old one, may allow additional rules to fire, the choice of free vars
may be different, and the order of the literals in forced subgoals may
be different.  Should "legacy" proofs fail under the new type-alist, we
recommend looking for rules that are fired in the new proof that were
not fired (on that same subgoal) in the old one.  Thanks to Dave Greve
for sending us an example that led us to make this change.

*BUG FIXES*

We fixed a soundness bug that could be exploited by calling system
functions acl2-magic-mfc or acl2-magic-canonical-pathname.  Thanks to
Sol Swords for bringing this bug to our attention.

We fixed a soundness bug in the handling of stobjs, in which strings
were recognized as stobjs in raw Lisp.  Thanks to Jared Davis for
sending us a proof of nil that exploited this bug.  We now have a much
simpler example of this bug, as follows.

     (defstobj st fld)
     (defthm bad (stp "abc") :rule-classes nil)
     (defthm contradiction
       nil
       :hints (("Goal" :in-theory (disable (stp)) :use bad))
       :rule-classes nil)

We fixed bugs in extended metafunctions (see *note
EXTENDED-METAFUNCTIONS::).  The macro mfc-ap no longer takes a :TTREEP
keyword argument, because this argument could allow returning a tag
tree that does not properly account for forcing.  The remaining mfc-xx
macros -- mfc-relieve-hyp, mfc-rw+, mfc-rw, and mfc-ts -- still take a
:TTREEP keyword argument, but the corresponding functions when :TTREEP
is t -- mfc-relieve-hyp-ttree, mfc-rw+-ttree, mfc-rw-ttree, and
mfc-ts-ttree -- were introduced with incorrect output signatures.  A
complication is that mfc-relieve-hyp-ttree was improperly defined in raw
Lisp in a way that actually matched the incorrect signature!  All of
these bugs have been fixed.  Perhaps any of them could have made it
possible to prove nil, though we have not tried to do so.

(Windows only) On Windows, it had been possible for ACL2 not to
consider two pathnames to name the same file when the only difference
is the case of the drive, e.g., `C:' vs. `c:'.  This has been fixed.
Thanks to Sol Swords for reporting this issue.

Fixed a bug in the storing of rules for the tau system; see *note
TAU-SYSTEM::.  (The error message mentions
PARTITION-SIGNATURE-HYPS-INTO-TAU-ALIST-AND-OTHERS.)  Thanks to Sol
Swords for reporting this bug and sending a simple example to
illustrate it.

It had been possible to admit the missing defthm events printed by
defabsstobj, and yet get an error when subsequently submitting the same
defabsstobj event, stating: "Note discrepancy with existing formula".
The problem could occur when an expression of the form (or X Y) occurred
in one of those missing events, because ACL2 created it from the term
(if X 't Y) but then translated (or X Y) to (if X X Y), resulting in a
mismatch.  This has been fixed.  Thanks to Jared Davis for reporting
this bug using a simple example.

A hard Lisp error was possible for certain illegal functional
substitutions (see *note LEMMA-INSTANCE::).  Thanks to Sol Swords for
reporting this bug.

We fixed a bug in the case that an exported function of a defabsstobj
event had a guard of t.  Thanks to Jared Davis for sending a simple
example when reporting this bug.

We now avoid an infinite loop that could occur when attempting to close
the standard character output channel (see *note STANDARD-CO::).
Instead, an error message explains how to accomplish what was probably
intended.  Thanks to Shilpi Goel for bringing this issue to our
attention.

(Windows only) Fixed a bug that was causing a hard error on Windows
when ACL2 encountered filenames starting with the tilde character (~),
for example, (ld "~/acl2-customization.lsp").  Thanks to Sol Swords for
bringing this bug to our attention.  Also thanks to Harsh Raju
Chamarthi for a useful conversation that led to a better fix than our
first one.

*CHANGES AT THE SYSTEM LEVEL*

ACL2 may now be built on recent versions of a new host Lisp, ANSI Gnu
Common Lisp (GCL).  Traditional (non-ANSI) GCL was the original host
Lisp underlying ACL2, and we are grateful for GCL support that we
received from the late Bill Schelter and, more recently and
particularly for ANSI GCL, from Camm Maguire.

The `make' process suggested for book certification has changed
substantially, thanks in large part to contributions from Jared Davis
and Sol Swords.  We have seen the new process provide better
performance on machines with many cores, and we expect maintenance
advantages such as eliminating the need for Makefiles in individual
book directories.  The "classic" process, which was based on community
books file books/Makefile-generic, is still supported (see *note
BOOKS-CERTIFICATION-CLASSIC::) but may disappear in a future release of
ACL2.  See *note BOOKS-CERTIFICATION::.  Most changes should be
invisible to the user, other than improved `make'-level parallelism,
with the exception of the following.

     o Variable ACL2_JOBS is no longer supported, nor is it necessary;
     simply use `make' option `-j' instead.

     o Regressions now use `make' option -k by default, which causes the
     regression to keep going after errors, rather than -i, which
     ignores errors.  If you encounter problems because of this change,
     use ACL2_IGNORE=-i with your `make' command.

     o The `regression' target works for the experimental extension,
     ACL2(h) (see *note HONS-AND-MEMOIZATION::); target
     `regression-hons' no longer exists.


Please let us know if you run into problems with the new
infrastructure, as we consider the legacy infrastructure to be
deprecated and we will probably eliminate much of it in the future.  In
particular, circular dependencies were formerly prohibited at the
directory level, but that is no longer the case, and we expect such
cycles to occur in the future.

Although ACL2 users don't typically modify raw Lisp variables, we have
arranged to reset Lisp variable *default-pathname-defaults* if necessary
at startup so that it will not interfere with ACL2, in particular by
messing up the initial connected book directory (see *note CBD::).
Thanks to Jared Davis, Sol Swords, and Raymond Toy for helping us to
identify this issue.

*EMACS SUPPORT*

*EXPERIMENTAL/ALTERNATE VERSIONS*

In ACL2(h), print-object$ no longer uses the serialize printer except
in system applications as before (e.g., write out .cert files).  Thanks
to Dave Greve for bringing this issue to our attention.

Jared Davis contributed changes related to the memoize utility of
ACL2(h), including some low-level changes as well as the following.

o Never-memoize specifies that a given function should never be
memoized.

o Removed memoize-let, which may never have ever been used.

o Removed the :inline keyword option to memoize, which was just an alias
 for the :recursive option.

For ACL2(p), some anomalous behavior may no longer occur because prover
calls (more specifically, trips through the ACL2 "waterfall") will
return only after all sub-computations (threads) have finished.  Thanks
to David Rager for contributing this improvement.

ACL2(pr), which includes parallelism (as for ACL2(p)) and non-standard
analysis support for the reals (as for ACL2(r)), now builds and can
certify the community nonstd/ books.  Thanks to David Rager for his
contribution to this capability.


File: acl2-doc-emacs.info,  Node: NOTE-6-3,  Next: NOTE1,  Prev: NOTE-6-2,  Up: RELEASE-NOTES

NOTE-6-3    ACL2 Version  6.3 (October, 2013) Notes

NOTE!  New users can ignore these release notes, because the
documentation has been updated to reflect all changes that are recorded
here.

Below we roughly organize the changes since Version  6.2 into the
following categories of changes: existing features, new features,
heuristic improvements, bug fixes, changes at the system level, Emacs
support, and experimental versions.  Each change is described in just
one category, though of course many changes could be placed in more
than one category.

*CHANGES TO EXISTING FEATURES*

The evaluation of a term from a bind-free hypothesis had been expected
to produce an alist binding free variables to terms.  While that is
still legal, it is also legal for that evaluation to produce a list of
such alists: then each is considered, until one of them permits all
remaining hypotheses to be relieved.  See *note BIND-FREE::.  Thanks to
Sol Swords for requesting this enhancement.

ACL2 continues to provide a way to specify keyword command
abbreviations for the top-level loop; see *note LD-KEYWORD-ALIASES::.
However, ld-keyword-aliases is now a table rather than a state global;
it is thus no longer a so-called LD special.  The functionality of
set-ld-keyword-aliases has essentially been preserved, except that it is
now an event (see *note EVENTS::), hence it may appear in a book; it is
local to a book (or encapsulate event); and the state argument is
optional, and deprecated.  A non-local version (set-ld-keyword-aliases!)
has been added, along with corresponding utilities add-keyword-alias and
add-keyword-alias! for adding a single keyword alias.  See *note
LD-KEYWORD-ALIASES::.  Thanks to Jared Davis for correspondence that
led us to make this change.

The proof-checker command (exit t) now exits without a query (but still
prints an event to show the :INSTRUCTIONS).  Thanks to Warren Hunt for
feedback leading us to make this change.

We made the following minor changes to the behavior or dmr; see *note
DMR::.  First, if dmr monitoring is enabled, then (dmr-start) will have
no effect other than to print a corresponding observation, and if
monitoring is disabled, then (dmr-stop) will have no effect other than
to print a corresponding observation.  Second, it had been the case
that when (dmr-start) is invoked, the debugger was always automatically
enabled with value t (see *note SET-DEBUGGER-ENABLE::), and the
debugger remained enabled when (dmr-stop) was invoked.  Now, the
debugger is only enabled by (dmr-start) if it is not already enabled
and does not have setting :never.  Moreover, if such automatic enabling
takes place, then the old setting for the debugger is restored by
(dmr-stop) unless set-debugger-enable has first been called after that
automatic enabling.  Finally, if the value of state global variable
'debugger-enable is :bt, then the new value will be :break-bt, not t.

When a call of progn is executed in the ACL2 loop, its constituent
events and their results are printed, just as was already done for calls
of encapsulate.  Thanks to Jared Davis for a conversation causing us to
consider this change.

(CCL only) When set-debugger-enable is invoked with an argument that
prints a backtrace and CCL is the host Lisp, the backtrace will be
limited to 10,000 stack frames.  (We have seen more than 65,000 stack
frames before this change.)  This limit is the value of raw Lisp
variable *ccl-print-call-history-count*, which may be assigned another
positive integer value to serve as the maximum number of stack frames
to be printed.

Improvements have been made pertaining to the disabling (inhibiting) of
individual types of warning.  Now, inhibited warnings are implemented
in a straightforward way using a separate table for this purpose, the
inhibit-warnings-table, rather than using the acl2-defaults-table.  See
*note SET-INHIBIT-WARNINGS::, and see *note SET-INHIBIT-WARNINGS!:: for
a variant that is not local to an encapsulate or a book in which it
occurs.  Thanks to Sol Swords for sending examples showing how
set-inhibit-warnings did not always behave as one might reasonably
expect when books are involved.

It had been the case that lp took a single argument, 'raw.  This
argument was not documented and also caused an error, so it has been
eliminated.

The functionality of make-event has been significantly expanded.
First: if the expansion is of the form (:OR e1 e2 ...), then event forms
e1, e2, and so on are evaluated, in order, until the evaluation of some
ek completes without error.  In that case, the expansion is treated
simply as ek.  With this capability, alternative expansions can be
attempted and the successful one does not need to be evaluated again.
See the new version of community book
books/make-event/proof-by-arith.lisp for an example.  Second, an
expansion may be of the form (:DO-PROOFS e), in which case the event e
is evaluated with proofs *not* skipped; see *note LD-SKIP-PROOFSP::.
Third, new keyword :EXPANSION? can be used to avoid storing expansions
in certificate files.  See *note MAKE-EVENT::.

When a defun event prints a failure message in the summary, that
message now indicates when the failure is due to a failed proof of guard
verification or a failed proof of the measure theorem.  Thanks to
Shilpi Goel for requesting this enhancement.

*NEW FEATURES*

ACL2 can now be instructed to time activities using real time (wall
clock time) instead of run time (typically, cpu time).  See *note
GET-INTERNAL-TIME::.  Thanks to Jared Davis for asking to be able to
obtain real-time reports in event summaries.

A new utility, sys-call+, is similar to existing utility sys-call in
that it executes a command.  Unlike sys-call, however, sys-call+
returns values that include output from the command (in addition to the
exit status), rather than simply printing the command.  See *note
SYS-CALL+::.

The new macro verify-guards+ extends the functionality of verify-guards
by permitting macro-aliases (see *note MACRO-ALIASES-TABLE::).  See
*note VERIFY-GUARDS+::.  Thanks to Jared Davis for requesting this
feature and suggesting the use of make-event in its implementation.  We
have also modified verify-guards to print a friendlier error message
when its argument is a macro-alias.

See *note LAST-PROVER-STEPS:: for a new utility that returns the number
of prover steps most recently taken.

*HEURISTIC IMPROVEMENTS*

The processing of :use and :by hints has been changed in the following
two rather subtle ways, thanks to suggestions from Sol Swords.

     o For :by hints, the simplest check was an equality check, rather
     than a more general subsumption check.  That equality check was
     made after removing so-called "guard holders" (must-be-equal,
     prog2$, ec-call, the) from both the previous theorem and the
     purported theorem.  Now, guard-holder removal has been
     strengthened, so that the results are also put into so-called
     quote-normal form, for example replacing (cons '3 '4) by '(3 . 4).

     o For a lemma-instance provided to a :use or :by hint that is a
     :functional-instance, if a :do-not hint (see *note HINTS::) has
     specified that preprocess-clause is not to be used, then
     preprocessing will not be used on the constraints.

We eliminated certain warnings about being "weak" for every
:type-prescription rule whose conclusion designates that the function
call can be equal to one of its arguments, e.g., (or (integerp (foo y))
(equal (foo y) y)).  In many cases (such as the one above), such
warnings about "weak" simply aren't correct.

*BUG FIXES*

Fixed a soundness bug that was permitting a stobj to be bound by a let
or mv-let form, without being among the outputs of that form.  Thanks
to Jen Davis and Dave Greve for reporting this bug.  Their report
included an example which forms the basis for a proof of nil, included
as a comment in the form (deflabel note-6-3 ...) in ACL2 source file
ld.lisp.

(GCL only) Fixed an obscure soundness bug due to an error in the GCL
implementation of set-debugger-enable.  For details, see the relevant
comment in the ACL2 source code under (deflabel note-6-3 ...).

Fixed a bug in the case of a field of a (concrete) stobj that is an
abstract stobj (see *note NESTED-STOBJS::).  Thanks to David Rager for
bringing this bug to our attention.

Splitter output for type if-intro (see *note SPLITTER::) could formerly
occur even when at most one subgoal is generated.  This has been fixed.

Fixed a bug in wof, hence in psof (which uses wof), that was causing
the printing of a bogus error message.

A small logical bug has been fixed in the logical definition of
sys-call-status.  Formerly it always returned (mv nil state) whenever
the oracle of the state is non-empty (see *note STATE::).

Fixed a bug that was causing an error upon evaluation of the form
(set-prover-step-limit nil).  Thanks to David Russinoff for reporting
this error.

The :measure (if supplied) is now ignored when checking redundancy with
respect to a non-recursive definition that is not defined within a
mutual-recursion.  (See *note REDUNDANT-EVENTS:: and see *note
XARGS::.)  It had been possible to get a low-level ACL2 error in this
situation.  Thanks to Jared Davis for reporting this bug with a helpful
example.

Eliminated a potential error when using comp to compile an uncompiled
function defined under progn!, which we observed in LispWorks.

*CHANGES AT THE SYSTEM LEVEL*

The ACL2 sources are now publicly available between ACL2 releases,
using svn; see the new "acl2-devel" project hosted by Google code at
`http://acl2-devel.googlecode.com'.  Although such a copy of ACL2 is
likely to work well with the latest svn (trunk) revision of the ACL2
community books (see *note COMMUNITY-BOOKS::), please take seriously
the warning message printed at startup: "The authors of ACL2 consider
svn distributions to be experimental; they may be incomplete, fragile,
and unable to pass our own regression."  That message also provides
instructions for bug reports.  If you decide to use svn versions of
either the community books or ACL2, then you should use both, as they
tend to be kept in sync.  We fully expect ACL2 releases to continue
from time to time, as usual.  Thanks to Jared Davis for his efforts in
setting up the new acl2-devel project and svn repository, and to him
and David Rager for convincing us to distribute ACL2 sources via svn
between releases.

Thanks to a suggestion from Jared Davis, over 30 built-in functions are
now declared to be inline in order to boost performance.  (The list may
be found by searching ACL2 source file axioms.lisp for "(declaim
(inline".)

Better support has been provided for command line arguments, especially
those supplied directly by the user when calling ACL2.  For one,
problems with quoting have been solved using "$@" in place of $*.
Also, the function save-exec now allows specification of arguments,
both for the host Lisp as well as "inert" arguments that can be passed
along to calls of programs (as with sys-call).  A keyword argument,
:return-from-lp, specifies a form to evaluate before quitting the
read-eval-print loop at startup.  See *note SAVE-EXEC::.  Also see the
source function user-args-string and its comments, source file
acl2-init.lisp, for more information.  Thanks to Jared Davis for
suggesting the use of "$@", as well as modifications to save-exec and
helpful conversations about that.

A rather extensive overhaul has taken place for the function proclaiming
mechanism.  As before, this is only used when the host Lisp is GCL.
However, building an executable is now faster for some Lisps, including
GCL, by avoiding repeated recompilation and perhaps repeated
initialization.

(CCL only) We increased stack sizes when the host Lisp is CCL.  The
default for recent CCL versions is equivalent to specifying `-Z 2M' on
the command line, but saved ACL2 scripts (including experimental
versions ACL2(h), ACL2(p), ACL2(r), and combinations of them) to `-Z
64M', representing a 32-fold increase.  Thanks to Jared Davis for
pointing us to community books file books/centaur/ccl-config.lsp and to
Sol Swords for helpful discussions.

(SBCL only) Fixed save-exec for host Lisp SBCL to provide the same
export of variable SBCL_HOME that was provided in the original
saved_acl2 script.

(GCL only) We made changes, following suggestions from Camm Maguire
(whom we thank for these suggestions), to support ACL2 builds on recent
versions of GCL (2.6.8 and 2.6.10; we recommend against using GCL
2.6.9, since issues there were fixed in 2.6.10).  Specifically, we no
longer set the hole size, and we allocate contiguous pages sufficient
to run an ACL2 regression without failing due to memory limitations.

*EMACS SUPPORT*

Modified file emacs/emacs-acl2.el to eliminate some warnings that were
appearing in a recent Emacs version, replacing (end-of-buffer) by
(goto-char (point-max)) and next-line by forward-line.  Thanks to
Warren Hunt for bringing the warnings to our attention.

*EXPERIMENTAL/ALTERNATE VERSIONS*

(Allegro CL only) ACL2(h) now avoids blow-ups in hash table sizes that
could be caused by hons-shrink-alist.  Thanks to Jared Davis for
helping to debug this problem, and to David Rager for contributing the
community book books/parsers/earley/earley-parser.lisp, which
highlighted this problem.

(SBCL only) Fixed a bug that was causing a Lisp break after turning on
waterfall-parallelism.  Thanks to David Rager for confirming that our
proposed fix is correct.


File: acl2-doc-emacs.info,  Node: NOTE1,  Next: NOTE2,  Prev: NOTE-6-3,  Up: RELEASE-NOTES

NOTE1    Acl2 Version 1.1 Notes

The new features are extensively documented.  The relevant topics are:

* Menu:


Related topics other than immediate subtopics:
* BOOKS:: files of ACL2 event forms

* GUARD:: restricting the domain of a function

* MORE:: your response to :doc or :more's ``(type :more...)''

* REDUNDANT-EVENTS:: allowing a name to be introduced ``twice''

It is especially important to read all of of the documentation for
books before trying to use books.  However, the new :more keyword
command is so handy for reading long documentation strings that we
recommend you start with :doc more if reading at the terminal.  Some
documentation has been written for guards which you might find
interesting.


File: acl2-doc-emacs.info,  Node: NOTE2,  Next: NOTE3,  Prev: NOTE1,  Up: RELEASE-NOTES

NOTE2    Acl2 Version 1.2 Notes

Hacker mode has been eliminated and programming mode has been added.
Programming mode is unsound but does syntax checking and permits
redefinitions of names.  See :doc load-mode and :doc g-mode.

The arguments to ld have changed.  Ld is now much more sophisticated.
See *note LD::.

For those occasions on which you wish to look at a large list structure
that you are afraid to print, try (walkabout x state), where x is an
Acl2 expression that evaluates to the structure in question.  I am
afraid there is no documentation yet, but it is similar in spirit to
the Interlisp structure editor.  You are standing on an object and
commands move you around in it.  E.g., 1 moves you to its first
element, 2 to its second, etc.; 0 moves you up to its parent; nx and bk
move you to its next sibling and previous sibling; pp prettyprints it;
q exits returning nil; = exits returning the thing you're standing on;
(= symb) assigns the thing you're standing on to the state global
variable symb.

Several new hints have been implemented, including :by and :do-not.
The old :do-not-generalize has been scrapped in favor of such new hints
as :do-not (generalize elim).  :By lets you say "this goal is subsumed
by" a given lemma instance.  The :by hint also lets you say "this goal
can't be proved yet but skip it and see how the rest of the proof
goes." See *note HINTS::.


File: acl2-doc-emacs.info,  Node: NOTE3,  Next: NOTE4,  Prev: NOTE2,  Up: RELEASE-NOTES

NOTE3    Acl2 Version 1.3 Notes

Programming mode has been eliminated.  Instead, all functions have a
"color" which indicates what can be done with the function.  For
example, :red functions can be executed but have no axioms describing
them.  Thus, :red functions can be introduced after passing a simple
syntactic check and they can be redefined without undoing.  But nothing
of consequence can be proved about them.  At the other extreme are
:gold functions which can be executed and which also have passed both
the termination and the guard verification proofs.  The color of a
function can be specified with the new xargs keyword, :color, which, if
omitted defaults to the global setting of ld-color.  Ld-color replaces
load-mode.  Setting ld-color to :red causes behavior similar to the old
:g-mode.  Setting ld-color to :gold causes behavior similar to the old
:v-mode.  It is possible to prototype your system in :red and then
convert :red functions to :blue individually by calling
verify-termination on them.  They can then be converted to :gold with
verify-guards.  This allows us to undertake to verify the termination
and guards of system functions.  See :doc color for an introduction to
the use of colors.

Type prescription rules have been added.  Recall that in Nqthm, some
rewrite rules were actually stored as "type-prescriptions."  Such rules
allow the user to inform Nqthm's primitive type mechanism as to the
kinds of shells returned by a function.  Earlier versions of Acl2 did
not have an analogous kind of rule because Acl2's type mechanism is
complicated by guards.  Version 1.3 supports type-prescription rules.
See *note TYPE-PRESCRIPTION::.

Three more new rule-classes implement congruence-based rewriting.  It
is possible to identify a binary relation as an equivalence relation
(see *note EQUIVALENCE::), to show that one equivalence relation
refines another (see *note REFINEMENT::) and to show that a given
equivalence relation is maintained when rewriting a given function
call, e.g., (fn ...xk...), by maintaining another equivalence relation
while rewriting the kth argument (see *note CONGRUENCE::).  If r has
been shown to be an equivalence relation and then (implies hyps (r (foo
x) (bar x))) is proved as a :rewrite rule, then instances of (foo x)
will be replaced by corresponding instances of (bar x) provided the
instance occurs in a slot where the maintainence of r-equivalence is
known to be sufficient and hyps can be established as usual.

In Version 1.2, rule-classes were simple keywords, e.g., :rewrite or
:elim.  In Version 1.3, rule-classes have been elaborated to allow you
to specify how the theorem ought to be used as a rule.  That is, the
new rule-classes allows you to separate the mathematical statement of
the formula from its interpretation as a rule.  See *note
RULE-CLASSES::.

Rules used to be named by symbols, e.g., car and car-cons were the
names of rules.  Unfortunately, this was ambiguous because there are
three rules associated with function symbols: the symbolic definition,
the executable counterpart, and the type-prescription; many different
rules might be associated with theorems, depending on the rule classes.
In Version 1.3 rules are named by "runes" (which is just short hand for
"rule names").  Example runes are (:definition car),
(:executable-counterpart car), and (:type-prescription car . 1).  Every
rule added by an event has a different name and you can enable and
disable them independently.  See *note RUNE:: and see *note THEORIES::.

The identity function force, of one argument, has been added and given
a special interpretation by the functions responsible for establishing
hypotheses in backchaining: When the system fails to establish some
hypothesis of the form (force term), it simply assumes it is true and
goes on, delaying until later the establishment of term.  In
particular, pushes a new subgoal to prove term in the current context.
When that subgoal is attacked, all of the resources of the theorem
prover, not just rewriting, are brought to bear.  Thus, for example, if
you wish to prove the rule (implies (good-statep s) (equal (exec s n)
s')) and it is your expectation that every time exec appears its first
argument is a good-statep then you might write the rule as (implies
(force (good-statep s)) (equal (exec s n) s')).  This rule is
essentially an unconditional rewrite of (exec s n) to s' that spawns
the new goal (good-statep s).  See *note FORCE::.  Because you can now
specify independently how a theorem is used as a rule, you need not
write the force in the actual theorem proved.  See *note RULE-CLASSES::.

Version 1.3 supports a facility similar to Nqthm's break-lemma.  See
*note BREAK-REWRITE::.  You can install "monitors" on runes that will
cause interactive breaks under certain conditions.

Acl2 also provides "wormholes" which allow you to write functions that
cause interaction with the user but which do not require that you have
access to state.  See *note WORMHOLE::.

The rewriter now automatically backchains to stronger recognizers.
There is no user hook to this feature but it may simplify some proofs
with which older versions of Acl2 had trouble.  For example, if the
rewriter is trying to prove (rationalp (foo a b c)) it is now smart
enough to try lemmas that match with (integerp (foo a b c)).


File: acl2-doc-emacs.info,  Node: NOTE4,  Next: NOTE5,  Prev: NOTE3,  Up: RELEASE-NOTES

NOTE4    Acl2 Version 1.4 Notes

Once again ld only takes one required argument, as the bind-flg has
been deleted.

Three commands have been added in the spirit of :pe.  :Pe! is similar
to :pe but it prints all events with the given name, rather than just
the most recent.  The command :pf prints the corollary formula
corresponding to a name or rune.  The command :pl (print lemmas) prints
rules whose top function symbol is the given name.  See *note PE!::,
see *note PF::, and see *note PL::.

Book naming conventions have been changed somewhat.  The once-required
.lisp extension is now prohibited!  Directories are supported,
including a notion of "connected book directory".  See *note
BOOK-NAME::.  Also, the second argument of certify-book is now
optional, defaulting to 0.

Compilation is now supported inside the Acl2 loop.  See *note COMP::
and see *note SET-COMPILE-FNS::.

The default color is now part of the Acl2 world; see :doc
default-color.  Ld-color is no longer an ld special.  Instead, colors
are events; see the documentation for red, pink, blue, and gold.

A table exists for controlling whether Acl2 prints comments when it
forces hypotheses of rules; see :doc force-table.  Also, it is now
possible to turn off the forcing of assumptions by disabling the
definition of force; see *note FORCE::.

The event defconstant is no longer supported, but a very similar event,
defconst, has been provided in its place.  See *note DEFCONST::.

The event for defining congruence relations is now defcong (formerly,
defcon).

Patterns are now allowed in :expand hints.  See the documentation for
:expand inside the documentation for hints.

We have improved the way we report rules used by the simplifier.  All
runes of the same type are reported together in the running commentary
associated with each goal, so that for example, executable counterparts
are listed separately from definitions, and rewrite rules are listed
separately from linear rules.  The preprocessor now mentions "simple"
rules; see *note SIMPLE::.

The mechanism for printing warning messages for new rewrite rules,
related to subsumption, now avoids worrying about nonrecursive function
symbols when those symbols are disabled.  These messages have also been
eliminated for the case where the old rule is a :definition rule.

Backquote has been modified so that it can usually provide predictable
results when used on the left side of a rewrite rule.

Time statistics are now printed even when an event fails.

The Acl2 trace package has been modified so that it prints using the
values of the Lisp globals *print-level* and *print-length*
(respectively).

Table has been modified so that the :clear option lets you replace the
entire table with one that satisfies the val and key guards (if any);
see *note TABLE::.

We have relaxed the translation rules for :measure hints to defun, so
that the the same rules apply to these terms that apply to terms in
defthm events.  In particular, in :measure hints mv is treated just
like list, and state receives no special handling.

The loop-stopper test has been relaxed.  The old test required that
every new argument be strictly less than the corresponding old argument
in a certain term-order.  The new test uses a lexicographic order on
term lists instead.  For example, consider the following rewrite rule.

       (equal
        (variable-update var1
                         val1 (variable-update var2 val2 vs))
        (variable-update var2
                         val2 (variable-update var1 val1 vs)))

This rule is permutative.  Now imagine that we want to apply this rule
to the term

       (variable-update u y (variable-update u x vs)).

Since the actual corresponding to both var1 and var2 is u, which is not
strictly less than itself in the term-order, this rule would fail to be
applied in this situation when using the old test.  However, since the
pair (u x) is lexicographically less than the pair (u y) with respect
to our term-order, the rule is in fact applied using our new test.

Messages about events now contain a space after certain left
parentheses, in order to assist emacs users.  For example, the event

       (defthm abc (equal (+ (len x) 0) (len x)))

leads to a summary containing the line

       Form:  ( DEFTHM ABC ...)

and hence, if you search backwards for "(defthm abc", you won't stop at
this message.

More tautology checking is done during a proof; in fact, no goal
printed to the screen, except for the results of applying :use and :by
hints or the top-level goals from an induction proof, are known to Acl2
to be tautologies.

The ld-query-control-alist may now be used to suppress printing of
queries; see *note LD-QUERY-CONTROL-ALIST::.

Warning messages are printed with short summary strings, for example
the string "Use" in the following message.

       Acl2 Warning [Use] in DEFTHM:  It is unusual to :USE an enabled
       :REWRITE or :DEFINITION rule, so you may want to consider
       disabling FOO.

At the end of the event, just before the time is printed, all such
summary strings are printed out.

The keyword command :u has been introduced as an abbreviation for :ubt
:max.  Printing of query messages is suppressed by :u.

The keyword :cheat is no longer supported by any event form.

Some irrelevant formals are detected; see *note IRRELEVANT-FORMALS::.

A bug in the application of metafunctions was fixed: now if the output
of a metafunction is equal to its input, the application of the
metafunction is deemed unsuccessful and the next metafunction is tried.

An example has been added to the documentation for equivalence to
suggest how to make use of equivalence relations in rewriting.

The following Common Lisp functions have been added to Acl2:
alpha-char-p, upper-case-p, lower-case-p, char-upcase, char-downcase,
string-downcase, string-upcase, and digit-charp-p.

A documentation section called proof-checker has been added for the
interactive facility, whose documentation has been slightly improved.
See in particular the documentation for proof-checker, verify, and
macro-command.

A number of events that had been inadvertently disallowed in books are
now permitted in books.  These are:  defcong, defcor, defequiv,
defrefinement, defstub, and verify-termination.


File: acl2-doc-emacs.info,  Node: NOTE5,  Next: NOTE6,  Prev: NOTE4,  Up: RELEASE-NOTES

NOTE5    Acl2 Version 1.5 Notes

Acl2 now allows "complex rationals," which are complex numbers whose
real parts are rationals and whose imaginary parts are non-zero
rationals.  See *note COMPLEX::.

A new way of handling forced hypotheses has been implemented.  Rather
than cause a case split at the time the force occurs, we complete the
main proof and then embark on one or more "forcing rounds" in which we
try to prove the forced hypotheses.  See *note FORCING-ROUND::.  To
allow us to compare the new handling of force with the old, Version 1.5
implements both and uses a flag in state to determine which method
should be used.  Do (assign old-style-forcing t) if you want force to
be handled as it was in Version 1.4.  However, we expect to eliminate
the old-style forcing eventually because we think the new style is more
effective.  To see the difference between the two approaches to
forcing, try proving the associativity of append under both settings of
old-style-forcing.  To get the new behavior invoke:

     (thm (implies (and (true-listp a) (true-listp b))
                   (equal (append (append a b) c)
                          (append a (append b c)))))

Then (assign old-style-forcing t) and invoke the thm command above
again.

A new :cases hints allows proof by cases.  See *note HINTS::.

Include-book and encapsulate now restore the acl2-defaults-table when
they complete.  See *note INCLUDE-BOOK:: and see *note ENCAPSULATE::.

The guards on many Acl2 primitives defined in axioms.lisp have been
weakened to permit them to be used in accordance with lisp custom and
tradition.

It is possible to attach heuristic filters to :rewrite rules to limit
their applicability.  See *note SYNTAXP::.

A tutorial has been added (but as of Version_3.6.1 it has become
obsolete).

Events now print the Summary paragraph listing runes used, time, etc.,
whether they succeed or fail.  The format of the "failure banner" has
been changed but still has multiple asterisks in it.  Thm also prints a
Summary, whether it succeeds or fails; but thm is not an event.

A new event form skip-proofs has been added; see *note SKIP-PROOFS::.

A user-specific customization facility has been added in the form of a
book that is automatically included, if it exists on the current
directory.  See *note ACL2-CUSTOMIZATION::.

A facility for conditional metalemmas has been implemented; see *note
META::.

The acceptable values for ld-skip-proofsp have changed.  In the old
version (Version 1.4), a value of t meant that proofs and local events
are to be skipped.  In Version 1.5, a value of t means proofs (but not
local events) are to be skipped.  A value of 'include-book means proofs
and local events are to be skipped.  There are two other, more obscure,
acceptable values.  See *note LD-SKIP-PROOFSP::.

In order to turn off the forcing of assumptions, one should now disable
the :executable-counterpart of force (rather than the :definition of
force, as in the previous release); see *note FORCE::.

The macros enable-forcing and disable-forcing make it convenient to
enable or disable forcing.  See *note ENABLE-FORCING:: and see *note
DISABLE-FORCING::.

The new commands :pr and :pr! print the rules created by an event or
command.  See *note PR:: and see *note PR!::.

The new history commands :puff and :puff* will replace a compound
command such as an encapsulate or include-book by the sequence of
events in it.  That is, they "puff up" or "lift" the subevents of a
command to the command level, eliminating the formerly superior command
and lengthening the history.  This is useful if you want to "partially
undo" an encapsulate or book or other compound command so you can
experiment.  See *note PUFF:: and see *note PUFF*::.

Theory expressions now are allowed to use the free variable world and
prohibited from using the free variable state.  See *note THEORIES::,
although it is essentially the same as before except it mentions world
instead of state.  See *note WORLD:: for a discussion of the Acl2
logical world.  Allowing in-theory events to be state-sensitive
violated an important invariant about how books behaved.

Table keys and values now are allowed to use the free variable world
and prohibited from using the free variable state.  See the note above
about theory expressions for some explanation.

The macro for minus, -, used to expand (- x 3) to (+ x -3) and now
expands it to (+ -3 x) instead.  The old macro, if used in the
left-hand sides of rewrite rules, produced inapplicable rules because
the constant occurs in the second argument of the +, but potential
target terms generally had the constant in the first argument position
because of the effect of commutativity-of-+.

A new class of rule, :linear-alias rules, allows one to implement the
nqthm package and similar hacks in which a disabled function is to be
known equivalent to an arithmetic function.

A new class of rule, :built-in-clause rules, allows one to extend the
set of clauses proved silently by defun during measure and guard
processing.  See *note BUILT-IN-CLAUSE::.

The new command pcb! is like pcb but sketches the command and then
prints its subsidiary events in full.  See *note PCB!::.

:Rewrite class rules may now specify the :loop-stopper field.  See
*note RULE-CLASSES:: and see *note LOOP-STOPPER::.

The rules for how loop-stoppers control permutative rewrite rules have
been changed.  One effect of this change is that now when the built-in
commutativity rules for + are used, the terms a and (- a) are permuted
into adjacency.  For example, (+ a b (- a)) is now normalized by the
commutativity rules to (+ a (- a) b); in Version 1.4, b was considered
syntactically smaller than (- a) and so (+ a b (- a)) is considered to
be in normal form.  Now it is possible to arrange for unary functions
be be considered "invisible" when they are used in certain contexts.
By default, unary- is considered invisible when its application appears
in the argument list of binary-+.  See *note LOOP-STOPPER:: and see
:DOC set-invisible-fns-table.

Extensive documentation has been provided on the topic of Acl2's "term
ordering."  See *note TERM-ORDER::.

Calls of ld now default ld-error-action to :return rather than to the
current setting.

The command descriptor :x has been introduced and is synonymous with
:max, the most recently executed command.  History commands such as
:pbt print a :x beside the most recent command, simply to indicate that
it *is* the most recent one.

The command descriptor :x-23 is synonymous with (:x -23).  More
generally, every symbol in the keyword package whose first character is
#\x and whose remaining characters parse as a negative integer is
appropriately understood.  This allows :pbt :x-10 where :pbt (:max -10)
or :pbt (:here -10) were previously used.  The old forms are still
legal.

The order of the arguments to defcong has been changed.

The simplifier now reports the use of unspecified built-in type
information about the primitives with the phrase "primitive type
reasoning."  This phrase may sometimes occur in situations where
"propositional calculus" was formerly credited with the proof.

The function pairlis has been replaced in the code by a new function
pairlis$, because Common Lisp does not adequately specify its pairlis
function.

Some new Common Lisp functions have been added, including logtest,
logcount, integer-length, make-list, remove-duplicates, string, and
concatenate.  The source file /slocal/src/acl2/axioms.lisp is the
ultimate reference regarding Common Lisp functions in Acl2.

The functions defuns and theory-invariant have been documented.  See
*note DEFUNS:: and see *note THEORY-INVARIANT::.

A few symbols have been added to the list *acl2-exports*.

A new key has been implemented for the acl2-defaults-table,
:irrelevant-formals-ok.  See *note SET-IRRELEVANT-FORMALS-OK::.

The connected book directory, cbd, must be nonempty and begin and end
with a slash.  It is set (and displayed) automatically upon your first
entry to lp.  You may change the setting with set-cbd.  See *note CBD::.

:oops will undo the last :ubt.  See *note OOPS::.

Documentation has been written about the ordinals.  See :DOC e0-ordinalp
and see :DOC e0-ord-<.  [Note added later: Starting with Version_2.8,
instead see *note O-P:: and see *note O<::.

The color events -- (red), (pink), (blue), and (gold) -- may no longer
be enclosed inside calls of local, for soundness reasons.  In fact,
neither may any event that sets the acl2-defaults-table.  See *note
EMBEDDED-EVENT-FORM::.

See *note LD-KEYWORD-ALIASES:: for an example of how to change the exit
keyword from :q to something else.

The attempt to install a monitor on :rewrite rules stored as simple
abbreviations now causes an error because the application of
abbreviations is not tracked.

A new message is sometimes printed by the theorem prover, indicating
that a given simplification is "specious" because the subgoals it
produces include the input goal.  In Version 1.4 this was detected but
not reported, causing behavior some users found bizarre.  See *note
SPECIOUS-SIMPLIFICATION::.

:Definition rules are no longer always required to specify the :clique
and :controller-alist fields; those fields can be defaulted to
system-determined values in many common instances.  See *note
DEFINITION::.

A warning is printed if a macro form with keyword arguments is given
duplicate keyword values.  Execute (thm t :doc nil :doc "ignored") and
read the warning printed.

A new restriction has been placed on encapsulate.  Non-local recursive
definitions inside the encapsulate may not use, in their tests and
recursive calls, the constrained functions introduced by the
encapsulate.  See *note SUBVERSIVE-RECURSIONS::.  (Note added in
Version  2.3:  Subversive recursions were first recognized by us here
in Version 1.5, but our code for recognizing them was faulty and the
bug was not fixed until Version  2.3.)

The events defequiv, defcong, defrefinement, and defevaluator have been
reimplemented so that they are just macros that expand into appropriate
defthm or encapsulate events; they are no longer primitive events.  See
the documentation of each affected event.

The defcor event, which was a shorthand for a defthm that established a
corollary of a named, previously proved event, has been eliminated
because its implementation relied on a technique we have decided to ban
from our code.  If you want the effect of a defcor in Version 1.5 you
must submit the corresponding defthm with a :by hint naming the
previously proved event.

Error reporting has been improved for inappropriate in-theory hints and
events, and for syntax errors in rule classes, and for non-existent
filename arguments to ld.

Technical Note:  We now maintain the Third Invariant on type-alists, as
described in the Essay on the Invariants on Type-alists, and
Canonicality.  This change will affect some proofs, for example, by
causing a to rewrite more quickly to c when (equiv a b) and (equiv b c)
are both known and c is the canonical representative of the three.


File: acl2-doc-emacs.info,  Node: NOTE6,  Next: NOTE7,  Prev: NOTE5,  Up: RELEASE-NOTES

NOTE6    Acl2 Version 1.6 Notes

A new key has been implemented for the acl2-defaults-table, :ignore-ok.
See *note SET-IGNORE-OK::.

It is now legal to have color events, such as (red), in the portcullis
of a book.  More generally, it is legal to set the acl2-defaults-table
in the portcullis of a book.  For example, if you execute :red and then
certify a book, the event (red) will show up in the portcullis of that
book, and hence the definitions in that book will all be red (except
when overridden by appropriate declarations or events).  When that book
is included, then as always, its portcullis must first be "raised," and
that will cause the default color to become red before the events in
the book are executed.  As always, the value of acl2-defaults-table
immediately after execution of an include-book, certify-book, or
encapsulate form will be the same as it was immediately before
execution (and hence, so will the default color).  See *note
PORTCULLIS:: and, for more about books, see *note BOOKS::.

A theory ground-zero has been defined to contain exactly those rules
that are enabled when Acl2 starts up.  See *note GROUND-ZERO::.

The function nth is now enabled, correcting an oversight from Version
1.5.

Customization files no longer need to meet the syntactic restrictions
put on books; rather, they can contain arbitrary Acl2 forms.  See *note
ACL2-CUSTOMIZATION::.

Structured directory names and structured file names are supported; see
especially the documentation for pathname, book-name, and cbd.

Acl2 now works with some Common Lisp implementations other than akcl,
including Lucid, Allegro, and MCL.

A facility has been added for displaying proof trees, especially using
emacs; see *note PROOF-TREE::.

There is a considerable amount of new documentation, in particular for
the printing functions fmt, fmt1, and fms, and for the notion of Acl2
term (see *note TERM::).

It is possible to introduce new well-founded relations, to specify
which relation should be used by defun, and to set a default relation.
See *note WELL-FOUNDED-RELATION::.

It is possible to make functions suggest new inductions.  See *note
INDUCTION::.

It is possible to change how Acl2 expresses type-set information; in
particular, this affects what clauses are proved when forced
assumptions are generated.  See *note TYPE-SET-INVERTER::.

A new restriction has been added to defpkg, having to do with undoing.
If you undo a defpkg and define the same package name again, the
imports list must be identical to the previous imports or else an
explanatory error will occur.  See *note
PACKAGE-REINCARNATION-IMPORT-RESTRICTIONS::.

Theory-invariant and set-irrelevant-formals-ok are now embedded event
forms.

The command :good-bye may now be used to quit entirely out of Lisp,
thus losing your work forever.  This command works in akcl but may not
work in every Common Lisp.

A theory ground-zero has been added that contains exactly the enabled
rules in the startup theory.  See *note GROUND-ZERO::.

Define-pc-macro and define-pc-atomic-macro now automatically define
:red functions.  (It used to be necessary, in general, to change color
to :red before invoking these.)

For a proof of the well-foundedness of e0-ord-< on the e0-ordinalps,
see *note PROOF-OF-WELL-FOUNDEDNESS::.  [Note added later: Starting with
Version_2.8, o< and o-p replace e0-ord-< and e0-ordinalp, respectively.]

Free variables are now handled properly for hypotheses of
:type-prescription rules.

When the system is loaded or saved, state is now bound to
*the-live-state*.

Certify-book has been modified so that when it compiles a file, it
loads that object file.

Defstub has been modified so that it works when the color is hot (:red
or :pink).

Several basic, but not particularly commonly used, events have been
added or changed.  The obscure axiom symbol-name-intern has been
modified.  The definition of firstn has been changed.  Butlast is now
defined.  The definition of integer-length has been modified.  The
left-hand side of the rewrite rule rational-implies2 has been changed
from (* (numerator x) (/ (denominator x))) to (* (/ (denominator x))
(numerator x)), in order to respect the fact that unary-/ is invisible
with respect to binary-*.  See *note LOOP-STOPPER::.

The `preprocess' process in the waterfall (see *note HINTS:: for a
discussion of the :do-not hint) has been changed so that it works to
avoid case-splitting.  The `simplify' process refuses to force (see
*note FORCE::) when there are if terms, including and and or terms, in
the goal being simplified.

The function apply is no longer introduced automatically by translation
of user input to internal form when functions are called on
inappropriate explicit values, e.g., (car 3).

The choice of which variable to use as the measured variable in a
recursive definition has been very slightly changed.


File: acl2-doc-emacs.info,  Node: NOTE7,  Next: NOTE8,  Prev: NOTE6,  Up: RELEASE-NOTES

NOTE7    ACL2 Version 1.7 (released October 1994) Notes

Include-book now takes (optionally) an additional keyword argument,
indicating whether a compiled file is to be loaded.  The default
behavior is unchanged, except that a warning is printed when a compiled
file is not loaded.  See *note INCLUDE-BOOK::.

A markup language for documentation strings has been implemented, and
many of the source files have been marked up using this language
(thanks largely to the efforts of Laura Lawless).  See *note MARKUP::.
Moreover, there are translators that we have used to provide versions
of the ACL2 documentation in info (for use in emacs), html (for
Mosaic), and tex (for hardcopy) formats.

A new event defdoc has been implemented.  It is like deflabel, but
allows redefinition of doc strings and has other advantages.  See *note
DEFDOC::.

We used to ignore corollaries when collecting up the axioms introduced
about constrained functions.  That bug has been fixed.  We thank John
Cowles for bringing this bug to our attention.

The macro defstub now allows a :doc keyword argument, so that
documentation may be attached to the name being introduced.

A new command nqthm-to-acl2 has been added to help Nqthm users to make
the transition to ACL2.  See *note NQTHM-TO-ACL2::, which also includes
a complete listing of the relevant tables.

Many function names, especially of the form "foo-lst", have been
changed in order to support the following convention, for any "foo":

     (foo-listp lst) represents the notion (for x in lst always foop x).

A complete list of these changes may be found at the end of this note.
All of them except symbolp-listp and list-of-symbolp-listp have the
string "-lst" in their names.  Note also that keyword-listp has been
renamed keyword-value-listp.

Accumulated persistence has been implemented.  It is not connected to
:brr or rule monitoring.  See *note ACCUMULATED-PERSISTENCE::.

:Trigger-terms has been added for :linear rule classes, so you can hang
a linear rule under any addend you want.  See *note LINEAR::, which has
been improved and expanded.

ACL2 now accepts 256 characters and includes the Common Lisp functions
code-char and char-code.  However, ACL2 controls the lisp reader so
that #\c may only be used when c is a single standard character or one
of Newline, Space, Page, Rubout, Tab.  If you want to enter other
characters use code-char, e.g., (coerce (list (code-char 7) (code-char
240) #a) 'string).  See *note CHARACTERS::.  Note:  our current
handling of characters makes the set of theorems different under
Macintosh Common Lisp (MCL) than under other Common Lisps.  We hope to
rectify this situation before the final release of ACL2.

A new table, macro-aliases-table, has been implemented, that associates
macro names with function names.  So for example, since append is
associated with binary-append, the form (disable append) it is
interpreted as though it were (disable binary-append).  See *note
MACRO-ALIASES-TABLE::, see *note ADD-MACRO-ALIAS:: and see *note
REMOVE-MACRO-ALIAS::.

The implementation of conditional metalemmas has been modified so that
the metafunction is applied before the hypothesis metafunction is
applied.  See *note META::.

The Common Lisp functions acons and endp have been defined in the ACL2
logic.

We have added the symbol declare to the list *acl2-exports*, and hence
to the package "ACL2-USER".

A new hint, :restrict, has been implemented.  See *note HINTS::.

It used to be that if :ubt were given a number that is greater than the
largest current command number, it treated that number the same as
:max.  Now, an error is caused.

The table :force-table has been eliminated.

A command :disabledp (and macro disabledp) has been added; see *note
DISABLEDP::.

Compilation via :set-compile-fns is now suppressed during include-book.
In fact, whenever the state global variable ld-skip-proofsp has value
'include-book.

Here are some less important changes, additions, and so on.

Unlike previous releases, we have not proved all the theorems in
axioms.lisp; instead we have simply assumed them.  We have deferred
such proofs because we anticipate a fairly major changed in Version 1.8
in how we deal with guards.

We used to (accidentally) prohibit the "redefinition" of a table as a
function.  That is no longer the case.

The check for whether a corollary follows tautologically has been sped
up, at the cost of making the check less "smart" in the following
sense:  no longer do we expand primitive functions such as implies
before checking this propositional implication.

The command ubt! has been modified so that it never causes or reports
an error.  See *note UBT!::.

ACL2 now works in Harlequin LispWorks.

The user can now specify the :trigger-terms for :linear rules.  See
*note LINEAR::.

The name of the system is now "ACL2"; no longer is it "Acl2".

The raw lisp counterpart of theory-invariant is now defined to be a
no-op as is consistent with the idea that it is just a call of table.

A bug was fixed that caused proof-checker instructions to be executed
when ld-skip-proofsp was t.

The function rassoc has been added, along with a corresponding function
used in its guard, r-eqlable-alistp.

The in-theory event and hint now print a warning not only when certain
"primitive" :definition rules are disabled, but also when certain
"primitive" :executable-counterpart rules are disabled.

The modified version of trace provided by ACL2, for use in raw Lisp,
has been modified so that the lisp special variable *trace-alist* is
consulted.  This alist associates, using eq, values with their print
representations.  For example, initially *trace-alist* is a one-element
list containing the pair (cons state '|*the-live-state*|).

The system now prints an observation when a form is skipped because the
default color is :red or :pink.  (Technically:  when-cool has been
modified.)

Additional protection exists when you submit a form to raw Common Lisp
that should only be submitted inside the ACL2 read-eval-print loop.

Here is a complete list of the changes in function names described near
the top of this note, roughly of the form

     foo-lst --> foo-listp

meaning:  the name "foo-lst" has been changed to "foo-listp."

     symbolp-listp    --> symbol-listp
     list-of-symbolp-listp  --> symbol-list-listp
                            {for consistency with change to symbol-listp}
     rational-lst     --> rational-listp
                          {which in fact was already defined as well}
     integer-lst      --> integer-listp
     character-lst    --> character-listp
     stringp-lst      --> string-listp
     32-bit-integer-lst   --> 32-bit-integer-listp
     typed-io-lst     --> typed-io-listp
     open-channel-lst --> open-channel-listp
     readable-files-lst   --> readable-files-listp
     written-file-lst --> written-file-listp
     read-file-lst    --> read-file-listp
     writeable-file-lst   --> writable-file-listp
                          {note change in spelling of ``writable''}
     writeable-file-lst1  --> writable-file-listp1
     pseudo-termp-lst     --> pseudo-term-listp
     hot-termp-lst --> hot-term-listp {by analogy with pseudo-term-listp}
     weak-termp-lst   --> weak-term-listp
     weak-termp-lst-lst   --> weak-termp-list-listp
     ts-builder-case-lstp -> ts-builder-case-listp
     quotep-lst       --> quote-listp
     termp-lst        --> term-listp
     instr-lst        --> instr-listp
     spliced-instr-lst    --> spliced-instr-listp
     rewrite-fncallp-lst  --> rewrite-fncallp-listp
     every-occurrence-equiv-hittablep1-lst -->
                 every-occurrence-equiv-hittablep1-listp
     some-occurrence-equiv-hittablep1-lst  -->
                 some-occurrence-equiv-hittablep1-listp
                 {by analogy with the preceding, even though it's a
                  ``some'' instead of ``all'' predicate]
     almost-quotep1-lst   --> almost-quotep1-listp
     ffnnames-subsetp-lst --> ffnnames-subsetp-listp
     boolean-lstp     --> boolean-listp
     subst-expr1-lst-okp  --> subst-expr1-ok-listp

