| ⊦ (∀ n, gndx. [] = gndx ∧ n < valid-group-nodes(gndx) → n < # gndx) ∧ (∀ gndx, gnd. (∀ n, gndx1. gndx = gndx1 ∧ n < valid-group-nodes(gndx1) → n < # gndx1) → (∀ n, gndx1. gndx + gnd = gndx1 ∧ n < valid-group-nodes(gndx1) → n < # gndx1)) |
# gndx < valid-group-nodes(gndx), # gndx + 1 < valid-group-nodes(gndx), # gndx < n, n < (gnd.end ⊃ # gndx + 1;valid-group-nodes(gndx)), ∀ n. n < valid-group-nodes(gndx) → n < # gndx ⊦
Used simplifier rules: valid-group-nodes-base: ⊦ valid-group-nodes([]) = 0;%valid-group-nodes-rec: ⊦ valid-group-nodes(gndx + gnd ') = (gnd.end ⊃ # gndx + 1;valid-group-nodes(gndx));% ⊦ ¬ n < n; (s)% ⊦ m + n < m + n0 ↔ n < n0; (s)% ⊦ m +1 = m + 1; (s)% ⊦ gnd ∈ gnd0 ' ↔ gnd = gnd0; (s)% ⊦ gnd ∈ gndx + gndx0 ↔ gnd ∈ gndx ∨ gnd ∈ gndx0; (s)% ⊦ m < n → n ≠ 0; (s)%transitivity: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification oelem[nat-set]%lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic%in-15: ⊦ gndx + gnd ' = gndx0 → gnd ∈ gndx0; (forward) from specification list[group-store]%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m < n + 1 ↔ ¬ n < m; (s)% ⊦ # gnd ' = 0 +1; (s)% ⊦ #(gndx + gndx0) = # gndx + # gndx0; (s)%a: ⊦ (gndx + gndx0) + gndx1 = gndx + gndx0 + gndx1; from specification list[group-store]% ⊦ gndx + gnd = gndx + gnd '; (s)% ⊦ ¬ m < 0; (s)