anchor.diff:                                       nil))))
   
   
  -; Now we verify the semantics of programs.
  -
  -
  -(defthm atomic-prog-value-is-correct
  -  (implies (symbolp p)
  -           (equal (pdl-prog-value m p) (cdr (assoc p (get-atomic-programs
  -                                                      (get-frame m)))))))
  -
  -; complex programs are right length:
  -
  -(defthm composition-right-length
  -  (equal (len (rel-compose r1 r2))
  -         (len r1)))
  -
  -(defthm union-right-length
  -  (equal (len (rel-union r1 r2))
  -         (len r1)))
  -
  -; needed to prove star-right-length
  -(defthm rel-star-with-index-gives-proper-len
  -  (implies (and (natp i)
  -                (< i (len r)))
  -           (equal (len (rel-star-with-index i r))
  -                  (- (len r) i))))
  -
  -(defthm star-right-length
  -  (equal (len (rel-star r)) (len r)))
  -
  -
  -(defthm rel-union-behaves-like-union
  - (implies (and (natp n)
  -           (< n (len A)))
  -          (iff (member x (nth n (rel-union A B)))
  -               (or (member x (nth n A)) (member x (nth n B))))))
  -
  -(defthm union-prog-value-correct
  -  (implies (and (equal (len p) 3)
  -                (equal (first p) 'union)
  -                (natp w)
  -                (< w (len (pdl-prog-value m (second p)))))
  -           (iff (member v (prog-accessible-worlds m w p))
  -                (or (member v (prog-accessible-worlds m w (second p)))
  -                    (member v (prog-accessible-worlds m w (third p)))))))
  -
  -
  -
  -
  -
  -;here
   
   ;correctness of union semantics
   
  -
  -
  -(defthm diamond-semantics-correct
  -  (implies (and (equal (len f) 3)
  -                (equal (first f) 'diamond)
  -                (natp w)
  -                (< w (len (pdl-prog-value m (second f)))))
  -           (implies (pdl-satisfies m w f)
  -                    (and (member v (prog-accessible-worlds m w (second f)))
  -                         (pdl-satisfies m v f)))))
   
   
   
  
positive.code: ;
  ; to
  ; (defun foobar (A B C) (if C foo-body bar-body))
  
  (defun pdl-satisfies-aux (m w f worlds evaling-formula)
    (declare (xargs :well-founded-relation l<
  
negative.code:                   (list 'v
                          (list '~ (simplify-formula second))
                          (simplify-formula third)))
                   (t f))))))
               
      
  
  