| # buf0 + # buf1 ≤ # buf0 + # buf1 ⊦ (# buf0 + # buf1 ≤ # buf0 ∨ datasize(buf1, # buf0 + # buf1 - # buf0) = 0 ⊃ datasize(buf0, min(# buf0 + # buf1, # buf0)) ;# buf0 + datasize(buf1, # buf0 + # buf1 - # buf0) ) = (datasize(buf1, # buf1) = 0 ⊃ datasize(buf0, # buf0);# buf0 + datasize(buf1, # buf1)) |
⊦ (# buf1 = 0 ∨ datasize(buf1, # buf1) = 0 ⊃ datasize(buf0, # buf0);# buf0 + datasize(buf1, # buf1)) = (datasize(buf1, # buf1) = 0 ⊃ datasize(buf0, # buf0);# buf0 + datasize(buf1, # buf1))
Used simplifier rules: ⊦ m ≤ m; (s)% ⊦ m + n ≤ m + n0 ↔ n ≤ n0; (s)% ⊦ min(n0 + m, m) = m; (s)% ⊦ m + n - m = n; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m + m0 ≤ m ↔ m0 = 0; (s)