| new(adr0 + ax0, fs), ∀ fs, adr, nd. new(ax0, fs) → (new(ax0, fs[adr, nd]) ↔ ¬ adr ∈ ax0) ⊦ new(adr0 + ax0, fs[adr, nd]) ↔ ¬ adr ∈ adr0 + ax0 |
new(ax0, fs), ∀ fs, adr, nd. new(ax0, fs) → (new(ax0, fs[adr, nd]) ↔ ¬ adr ∈ ax0) ⊦ adr0 ≠ adr ∧ new(ax0, fs[adr, nd]) ↔ adr ≠ adr0 ∧ ¬ adr ∈ ax0, adr0 ∈ fs
Used simplifier rules: new-rec: ⊦ new(adr ' + log, fs) ↔ ¬ adr ∈ fs ∧ new(log, fs);% ⊦ adr ∈ adr0 ' + ax ↔ adr = adr0 ∨ adr ∈ ax; (s)%a: ⊦ (ax + ax0) + ax1 = ax + ax0 + ax1; from specification list[address-list-set]% ⊦ adr ∈ fs[adr1, nd] ↔ adr = adr1 ∨ adr ∈ fs; (s)% ⊦ adr + ax = adr ' + ax; (s)