| ∃ as0. as = as0 ++ adr ∧ ¬ adr ∈ as0, ∀ as0. # as0 < # as → true → (0 = as0.size ↔ (∀ adr. adr ∈ as0 → adr.size = 0)) ⊦ # as = 0, 0 = as.size ↔ (∀ adr. adr ∈ as → adr.size = 0) |
∀ as1. # as1 < #(as0 ++ adr) → true → (0 = as1.size ↔ (∀ adr. adr ∈ as1 → adr.size = 0)) ⊦ 0 = as0.size + adr.size ↔ (∀ adr0. adr0 = adr ∨ adr0 ∈ as0 → adr0.size = 0), adr ∈ as0
Used simplifier rules: size-rec: ⊦ ¬ adr ∈ as → (as ++ adr).size = as.size + adr.size;%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m + 1 ≠ 0; (s)% ⊦ ¬ adr ∈ as → #(as ++ adr) = # as + 1; (s)% ⊦ adr ∈ as ++ adr0 ↔ adr = adr0 ∨ adr ∈ as; (s)