[Imprint][Data Privacy Statement][E-Mail]

View long theorem info. View the proof. Back to main index. View the specification. View theorem base summary, View theorem base listing, the used properties by spec, the dependency list, the symbol table,

Proof step 84 from proof btree-clean-fwd (previous step)

# asar2 = # asar, # asar1 = # asar, # zbrar = BRANCH_SIZE, # asar0 = # asar, # asar = (n0 + n) + 1, # zbrar0 = BRANCH_SIZE, asar1[n] = asar2[n], zbrar[n] = mkzbranch(key, adr0, r3), union(asar1, 0, # asar) = union(asar2, 0, # asar), union(asar, 0, # asar) = union(asar0, 0, # asar), (( (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar, ri0), iast, asar[n1], asar0[n1], ok) )⊗_ (0, # asar ) * P0) )(zh), (( ( ( btree(r, r3, adr0, height0, false, key-range(zbrar, n, # asar, ri1), iast, asar2[n], asar2[n], ok) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar, ri1), iast, asar1[n1], asar2[n1], ok) )⊗_ (0, n )) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar, ri1), iast, asar1[n1], asar2[n1], ok) )⊗_ (1 + n, n0 )) * P1) )(zh3), zbrar[n].branch?, n0 + n < BRANCH_SIZE, n < BRANCH_SIZE, ((r => mkznode(rp1, zbrar, false, false, # asar)))(zh4), ((r2 => mkznode(rp0, zbrar0, false, false, # asar)))(zh5), disj(asar2, 0, # asar), disj(asar1, 0, # asar), disj(asar0, 0, # asar), disj(asar, 0, # asar), nsize(# asar, nstat), sorted(zbrar, 0, n0 + n), sorted(zbrar0, 0, n0 + n), unmodified(adr, mkznode(rp0, zbrar0, false, false, # asar), iast), unmodified(adr, mkznode(rp1, zbrar, false, false, # asar), iast), adr ∈ iast, asar2[n] ⊆ dom iast, zh4 ⊥ zh3, zh5 ⊥ zh, (r1 = null ⊃ P1(zh1);r = r1 ∧ zh4 ∪ zh3 = zh1), (r0 = null ⊃ P0(zh0);r2 = r0 ∧ zh5 ∪ zh = zh0), ∀ rp0, r0, adr, ri0, iast, as0, alladrs0, nstat, P0, zh0, rp1, r1, height1, ri1, as1, alladrs1, P1, zh1. ((btree(rp0, r0, adr, height, false, ri0, iast, as0, alladrs0, nstat) * P0))(zh0) ∧ ((btree(rp1, r1, adr, height1, false, ri1, iast, as1, alladrs1, nstat) * P1))(zh1) → height = height1 ∧ as0 = as1 ∧ ri0 = ri1 ∧ alladrs0 = alladrs1, ∀ n1. ¬ n0 + n < n1 → asar2[n1] ⊆ dom iast, ∀ n1. ¬ n0 + n < n1 → asar0[n1] ⊆ dom iast ⊦ asar0[n] = asar2[n], union(asar0, 0, # asar) = union(asar2, 0, # asar), adr ∈ union(asar0, 0, # asar), adr ∈ union(asar2, 0, # asar)

Heuristic simplifier applied rule simplifier

And obtained the following new goals

Proof step 85:
# asar2 = # asar, # asar1 = # asar, # zbrar = BRANCH_SIZE, # asar0 = # asar, # asar = (n0 + n) + 1, # zbrar0 = BRANCH_SIZE, zbrar0[n] = mkzbranch(key, adr0, r4), zbrar[n] = mkzbranch(key, adr0, r3), asar1[n] = asar2[n], union(asar1, 0, # asar) = union(asar2, 0, # asar), union(asar, 0, # asar) = union(asar0, 0, # asar), (( (λ n1. ⌜zbrar0[n1].branch?⌝ ∧ btree(r2, zbrar0[n1].child, zbrar0[n1].adr, height, false, key-range(zbrar0, n1, # asar, ri0), iast, asar[n1], asar0[n1], ok) )⊗_ (0, # asar ) * P0) )(zh), (( ( ( btree(r, r3, adr0, height0, false, key-range(zbrar, n, # asar, ri1), iast, asar2[n], asar2[n], ok) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar, ri1), iast, asar1[n1], asar2[n1], ok) )⊗_ (0, n )) * (λ n1. ⌜zbrar[n1].branch?⌝ ∧ btree(r, zbrar[n1].child, zbrar[n1].adr, height0, false, key-range(zbrar, n1, # asar, ri1), iast, asar1[n1], asar2[n1], ok) )⊗_ (1 + n, n0 )) * P1) )(zh3), n0 + n < BRANCH_SIZE, n < BRANCH_SIZE, ((r => mkznode(rp1, zbrar, false, false, # asar)))(zh4), ((r2 => mkznode(rp0, zbrar0, false, false, # asar)))(zh5), disj(asar2, 0, # asar), disj(asar1, 0, # asar), disj(asar0, 0, # asar), disj(asar, 0, # asar), nsize(# asar, nstat), sorted(zbrar, 0, n0 + n), sorted(zbrar0, 0, n0 + n), unmodified(adr, mkznode(rp0, zbrar0, false, false, # asar), iast), unmodified(adr, mkznode(rp1, zbrar, false, false, # asar), iast), adr ∈ iast, asar2[n] ⊆ dom iast, zh4 ⊥ zh3, zh5 ⊥ zh, (r1 = null ⊃ P1(zh1);r = r1 ∧ zh4 ∪ zh3 = zh1), (r0 = null ⊃ P0(zh0);r2 = r0 ∧ zh5 ∪ zh = zh0), ∀ rp0, r0, adr, ri0, iast, as0, alladrs0, nstat, P0, zh0, rp1, r1, height1, ri1, as1, alladrs1, P1, zh1. ((btree(rp0, r0, adr, height, false, ri0, iast, as0, alladrs0, nstat) * P0))(zh0) ∧ ((btree(rp1, r1, adr, height1, false, ri1, iast, as1, alladrs1, nstat) * P1))(zh1) → height = height1 ∧ as0 = as1 ∧ ri0 = ri1 ∧ alladrs0 = alladrs1, ∀ n1. ¬ n0 + n < n1 → asar2[n1] ⊆ dom iast, ∀ n1. ¬ n0 + n < n1 → asar0[n1] ⊆ dom iast ⊦ asar0[n] = asar2[n], union(asar0, 0, # asar) = union(asar2, 0, # asar), adr ∈ union(asar0, 0, # asar), adr ∈ union(asar2, 0, # asar)

Rule argument

Additional information

Used simplifier rules: nat-le-eq: ⊦ n = n0 + n1 → (n ≤ n0 ↔ n1 = 0 ∧ n = n0);%⊦ mkzbranch(key, adr, r) = mkzbranch(key0, adr0, r0) ↔ key = key0 ∧ adr = adr0 ∧ r = r0; (ws)%unmodified-clean-fwd-zbrar: n < nused, nused ≤ BRANCH_SIZE, # zbrar0 = # zbrar1, # zbrar0 = BRANCH_SIZE ⊦ zbrar0[n] = mkzbranch(key, adr0, r2) ∧ unmodified(adr, mkznode(rp0, zbrar0, bv, false, nused), iast) ∧ unmodified(adr, mkznode(rp1, zbrar1, bv, false, nused), iast) → (∃ r0. zbrar1[n] = mkzbranch(key, adr0, r0)); (forward) from specification zbranch-array-ops% ⊦ nsize(m, nstat) → ¬ BRANCH_SIZE < m; (s)% ⊦ m ≤ n ↔ ¬ n < m; (ss)% ⊦ m + 1 ≠ 0; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m < n ↔ ¬ n ≤ m; (ss)% ⊦ mkzbranch(key, adr, r).branch?; (s)