| # buf2 = ENCODED_NAT_SIZE, # buf1 = ENCODED_NAT_SIZE, # ns1 = m + 1, # buf3 = m0 * ENCODED_NAT_SIZE, # ns = m0 + 1, # ns * ENCODED_NAT_SIZE = m * ENCODED_NAT_SIZE, ENCODED_NAT_SIZE + # buf3 = m * ENCODED_NAT_SIZE, is-encoded(ns -- n1, buf3), is-encoded(n1, buf2), is-encoded(ns1 -- n1, buf3 + buf1), is-encoded(n, buf1), n1 ∈ ns1, n1 ∈ ns, ∀ ns0, buf0, ns, buf1, n. # ns0 < m + 1 → # buf0 = # ns * ENCODED_NAT_SIZE ∧ # buf1 = ENCODED_NAT_SIZE ∧ is-encoded(n, buf1) ∧ is-encoded(ns, buf0) → (is-encoded(ns0, buf0 + buf1) ↔ ns0 = ns ++ n) ∨ n ∈ ns ⊦ # ns = 0, ns = ∅, ns1 = ns ++ n, ns1 = ∅, n ∈ ns |
# buf1 = ENCODED_NAT_SIZE, # buf2 = ENCODED_NAT_SIZE, # ns = m0 + 1, # buf3 = m0 * ENCODED_NAT_SIZE, # ns1 = 2 + m0, is-encoded(n, buf1), is-encoded(ns1 -- n1, buf3 + buf1), is-encoded(n1, buf2), is-encoded(ns -- n1, buf3), n1 ∈ ns, n1 ∈ ns1, ∀ ns0, buf0, ns, buf1, n. # ns0 < (m0 + 1) + 1 → # buf0 = # ns * ENCODED_NAT_SIZE ∧ # buf1 = ENCODED_NAT_SIZE ∧ is-encoded(n, buf1) ∧ is-encoded(ns, buf0) → (is-encoded(ns0, buf0 + buf1) ↔ ns0 = ns ++ n) ∨ n ∈ ns ⊦ ns = ∅, ns1 = ∅, ns1 = ns ++ n, n ∈ ns
Used simplifier rules: ⊦ m + 1 ≠ 0; (s)% ⊦ ENCODED_NAT_SIZE ≠ 0; (s)% ⊦ m * n + n = m1 * n ↔ m + 1 = m1 ∨ n = 0; (s)%mult-c: ⊦ m * n = n * m; from specification nat-mult%mult-a: ⊦ m0 * m * n = (m0 * m) * n; from specification nat-mult%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m * (n + 1) = m * n + m; (s)