[Imprint][Data Privacy Statement][E-Mail]

View long theorem info. View the proof. Back to main index. View the specification. View theorem base summary, View theorem base listing, the used properties by spec, the dependency list, the symbol table,

Proof step 68 from proof btree-clean-fwd-strong (previous step)

# asar0 = (n0 + 1) + n, # zbrar = BRANCH_SIZE, # asar1 = # asar0, # asar2 = # asar0, # asar = # asar0, # zbrar0 = BRANCH_SIZE, asar[n] = asar0[n], asar1[n] = asar2[n], zbrar[n] = mkzbranch(key, adr0, r3), zbrar0[n] = mkzbranch(key0, adr1, r4), union(asar, 0, # asar0) = alladrs0 -- adr, union(asar0, 0, # asar0) = alladrs0 -- adr, union(asar1, 0, # asar0) = alladrs1 -- adr, union(asar2, 0, # asar0) = alladrs1 -- adr, (( btree(r2, r4, adr1, height, false, key-range(zbrar0, n, # asar0, ri0), iast0, asar0[n], asar0[n], ok) * (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar0, ri0), iast0, asar[n1], asar0[n1], ok) )⊗_ (0, n ) * (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar0, ri0), iast0, asar[n1], asar0[n1], ok) )⊗_ (1 + n, n0 ) * P0) )(zh), (( ( ( btree(r, r3, adr0, height0, false, key-range(zbrar, n, # asar0, ri1), iast1, asar2[n], asar2[n], ok) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar0, ri1), iast1, asar1[n1], asar2[n1], ok) )⊗_ (0, n )) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar0, ri1), iast1, asar1[n1], asar2[n1], ok) )⊗_ (1 + n, n0 )) * P1) )(zh3), zbrar0[n].branch?, n0 + n < BRANCH_SIZE, n < BRANCH_SIZE, ((r2 => mkznode(rp0, zbrar0, false, false, # asar0)))(zh5), ((r => mkznode(rp1, zbrar, false, false, # asar0)))(zh4), disj(asar, 0, # asar0), disj(asar0, 0, # asar0), disj(asar1, 0, # asar0), disj(asar2, 0, # asar0), nsize(# asar0, nstat), sorted(zbrar, 0, n0 + n), sorted(zbrar0, 0, n0 + n), unmodified(adr, mkznode(rp1, zbrar, false, false, # asar0), iast1), unmodified(adr, mkznode(rp0, zbrar0, false, false, # asar0), iast0), adr ∈ iast1, adr ∈ alladrs1, adr ∈ iast0, adr ∈ alladrs0, alladrs1 ⊆ dom iast1, alladrs0 ⊆ dom iast0, iast0 ⊆ iast1, asar2[n] ⊆ dom iast1, asar0[n] ⊆ dom iast0, zh5 ⊥ zh, zh4 ⊥ zh3, (r0 = null ⊃ P0(zh0);r2 = r0 ∧ zh5 ∪ zh = zh0), (r1 = null ⊃ P1(zh1);r = r1 ∧ zh4 ∪ zh3 = zh1), ∀ rp1, r1, adr, height1, ri1, iast1, alladrs1, nstat, P1, zh1, rp0, r0, ri0, iast0, alladrs0, P0, zh0. ((btree(rp1, r1, adr, height1, false, ri1, iast1, alladrs1, alladrs1, nstat) * P1))(zh1) ∧ ((btree(rp0, r0, adr, height, false, ri0, iast0, alladrs0, alladrs0, nstat) * P0))(zh0) ∧ alladrs1 ⊆ dom iast1 ∧ alladrs0 ⊆ dom iast0 ∧ iast0 ⊆ iast1 → height = height1 ∧ ri0 = ri1 ∧ alladrs0 = alladrs1 ⊦ # alladrs1 = 0, # alladrs0 = 0, alladrs0 = ∅, alladrs1 = ∅, key-range(zbrar0, n, # asar0, ri0) = key-range(zbrar0, n, # asar0, ri1)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 69:
# zbrar0 = BRANCH_SIZE, # asar = # asar0, # asar2 = # asar0, # asar1 = # asar0, # zbrar = BRANCH_SIZE, # asar0 = (n0 + 1) + n, asar1[n] = asar2[n], asar[n] = asar0[n], zbrar0[n] = mkzbranch(key0, adr1, r4), zbrar[n] = mkzbranch(key0, adr1, r3), union(asar2, 0, # asar0) = alladrs1 -- adr, union(asar1, 0, # asar0) = alladrs1 -- adr, union(asar0, 0, # asar0) = alladrs0 -- adr, union(asar, 0, # asar0) = alladrs0 -- adr, (( ( ( btree(r, r3, adr1, height0, false, key-range(zbrar, n, # asar0, ri1), iast1, asar2[n], asar2[n], ok) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar0, ri1), iast1, asar1[n1], asar2[n1], ok) )⊗_ (0, n )) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar0, ri1), iast1, asar1[n1], asar2[n1], ok) )⊗_ (1 + n, n0 )) * P1) )(zh3), (( btree(r2, r4, adr1, height, false, key-range(zbrar0, n, # asar0, ri0), iast0, asar0[n], asar0[n], ok) * (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar0, ri0), iast0, asar[n1], asar0[n1], ok) )⊗_ (0, n ) * (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar0, ri0), iast0, asar[n1], asar0[n1], ok) )⊗_ (1 + n, n0 ) * P0) )(zh), n < BRANCH_SIZE, n0 + n < BRANCH_SIZE, ((r => mkznode(rp1, zbrar, false, false, # asar0)))(zh4), ((r2 => mkznode(rp0, zbrar0, false, false, # asar0)))(zh5), disj(asar2, 0, # asar0), disj(asar1, 0, # asar0), disj(asar0, 0, # asar0), disj(asar, 0, # asar0), nsize(# asar0, nstat), sorted(zbrar0, 0, n0 + n), sorted(zbrar, 0, n0 + n), unmodified(adr, mkznode(rp0, zbrar0, false, false, # asar0), iast0), unmodified(adr, mkznode(rp1, zbrar, false, false, # asar0), iast1), adr ∈ alladrs0, adr ∈ iast0, adr ∈ alladrs1, adr ∈ iast1, asar0[n] ⊆ dom iast0, asar2[n] ⊆ dom iast1, iast0 ⊆ iast1, alladrs0 ⊆ dom iast0, alladrs1 ⊆ dom iast1, zh4 ⊥ zh3, zh5 ⊥ zh, (r1 = null ⊃ P1(zh1);r = r1 ∧ zh4 ∪ zh3 = zh1), (r0 = null ⊃ P0(zh0);r2 = r0 ∧ zh5 ∪ zh = zh0), ∀ rp1, r1, adr, height1, ri1, iast1, alladrs1, nstat, P1, zh1, rp0, r0, ri0, iast0, alladrs0, P0, zh0. ((btree(rp1, r1, adr, height1, false, ri1, iast1, alladrs1, alladrs1, nstat) * P1))(zh1) ∧ ((btree(rp0, r0, adr, height, false, ri0, iast0, alladrs0, alladrs0, nstat) * P0))(zh0) ∧ alladrs1 ⊆ dom iast1 ∧ alladrs0 ⊆ dom iast0 ∧ iast0 ⊆ iast1 → height = height1 ∧ ri0 = ri1 ∧ alladrs0 = alladrs1 ⊦ # alladrs0 = 0, # alladrs1 = 0, alladrs0 = ∅, alladrs1 = ∅, key-range(zbrar0, n, # asar0, ri0) = key-range(zbrar0, n, # asar0, ri1)

Rule argument

Additional information

Used simplifier rules: nat-le-eq: ⊦ n = n0 + n1 → (n ≤ n0 ↔ n1 = 0 ∧ n = n0);%⊦ mkzbranch(key, adr, r) = mkzbranch(key0, adr0, r0) ↔ key = key0 ∧ adr = adr0 ∧ r = r0; (ws)%unmodified-clean-eq-adr-subseteq: n < nused, nused ≤ BRANCH_SIZE, # zbrar0 = # zbrar1, # zbrar0 = BRANCH_SIZE ⊦ iast0 ⊆ iast1 ∧ zbrar0[n] = mkzbranch(key0, adr0, r0) ∧ unmodified(adr, mkznode(rp0, zbrar0, bv, false, nused), iast0) ∧ unmodified(adr, mkznode(rp1, zbrar1, bv, false, nused), iast1) ∧ zbrar1[n] = mkzbranch(key1, adr1, r1) → key1 = key0 ∧ adr1 = adr0; (forward) from specification zbranch-array-ops%unmodified-clean-fwd-zbrar: n < nused, nused ≤ BRANCH_SIZE, # zbrar0 = # zbrar1, # zbrar0 = BRANCH_SIZE ⊦ zbrar0[n] = mkzbranch(key, adr0, r2) ∧ unmodified(adr, mkznode(rp0, zbrar0, bv, false, nused), iast) ∧ unmodified(adr, mkznode(rp1, zbrar1, bv, false, nused), iast) → (∃ r0. zbrar1[n] = mkzbranch(key, adr0, r0)); (forward) from specification zbranch-array-ops% ⊦ nsize(m, nstat) → ¬ BRANCH_SIZE < m; (s)% ⊦ m ≤ n ↔ ¬ n < m; (ss)% ⊦ m + 1 ≠ 0; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m < n ↔ ¬ n ≤ m; (ss)% ⊦ mkzbranch(key, adr, r).branch?; (s)