| # buf1 = PEB_SIZE, n3 + m2 = LEB_SIZE, 2 * EB_PAGE_SIZE + m2 = (avhdr = empty ⊃ EB_PAGE_SIZE;m2 + 2 * EB_PAGE_SIZE), LEB_SIZE = (n1 + n) + m1, PEB_SIZE = n3 + 2 * EB_PAGE_SIZE + m2, pebs[m3] = mkpeb(buf1, 2 * EB_PAGE_SIZE + m2, false), apebs[m3] = mkpeb(aehdr, avhdr, subarray(buf1, 2 * EB_PAGE_SIZE, LEB_SIZE), m2, false), aehdr.valid?, avhdr.valid?, n0 < n1, m3 < # pebs, m3 < # apebs, abs(pebs, apebs), abs-echdr(subarray(buf1, 0, EB_PAGE_SIZE), aehdr), abs-vidhdr(subarray(buf1, EB_PAGE_SIZE, EB_PAGE_SIZE), avhdr), is-aligned(m2, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), is-aligned(m1, EB_PAGE_SIZE), ubi-io-inv(apebs), 2 * EB_PAGE_SIZE + m2 ≤ PEB_SIZE, n2 + n ≤ # buf, m1 ≤ LEB_SIZE, m2 ≤ LEB_SIZE, m2 ≤ m1, (m1 + 2 * EB_PAGE_SIZE) + n ≤ PEB_SIZE, m1 + n ≤ LEB_SIZE, n + m1 ≤ LEB_SIZE, (2 * EB_PAGE_SIZE + m2) + n3 ≤ # buf1, (2 * EB_PAGE_SIZE + m2) + n3 ≤ # emptypeb, ∀ n. n < n3 → buf1[(2 * EB_PAGE_SIZE + m2) + n] = (emptypeb)[(2 * EB_PAGE_SIZE + m2) + n] ⊦ buf1[(2 * EB_PAGE_SIZE + m1 + n) + n0] = empty, aehdr = empty |
# buf1 = PEB_SIZE, n3 + m2 = LEB_SIZE, 2 * EB_PAGE_SIZE + m2 = (avhdr = empty ⊃ EB_PAGE_SIZE;m2 + 2 * EB_PAGE_SIZE), LEB_SIZE = (n1 + n) + m1, PEB_SIZE = n3 + 2 * EB_PAGE_SIZE + m2, pebs[m3] = mkpeb(buf1, 2 * EB_PAGE_SIZE + m2, false), apebs[m3] = mkpeb(aehdr, avhdr, subarray(buf1, 2 * EB_PAGE_SIZE, LEB_SIZE), m2, false), aehdr.valid?, avhdr.valid?, n0 < n1, m3 < # pebs, m3 < # apebs, abs(pebs, apebs), abs-echdr(subarray(buf1, 0, EB_PAGE_SIZE), aehdr), abs-vidhdr(subarray(buf1, EB_PAGE_SIZE, EB_PAGE_SIZE), avhdr), is-aligned(m2, EB_PAGE_SIZE), is-aligned(n, EB_PAGE_SIZE), is-aligned(m1, EB_PAGE_SIZE), ubi-io-inv(apebs), 2 * EB_PAGE_SIZE + m2 ≤ PEB_SIZE, n2 + n ≤ # buf, m1 ≤ LEB_SIZE, m2 ≤ LEB_SIZE, m2 ≤ m1, (m1 + 2 * EB_PAGE_SIZE) + n ≤ PEB_SIZE, m1 + n ≤ LEB_SIZE, n + m1 ≤ LEB_SIZE, ∀ n4. n4 < n3 → buf1[(2 * EB_PAGE_SIZE + m2) + n4] = empty ⊦ buf1[(2 * EB_PAGE_SIZE + m1 + n) + n0] = empty, aehdr = empty
Used simplifier rules: ⊦ m ≤ m; (s)% ⊦ m ≤ n → (n ≤ m ↔ m = n); (s)%let: ⊦ n ≤ n0 ∧ n0 ≤ n1 → n ≤ n1; (forward) from specification nat%n < # emptypeb ⊦ (emptypeb)[n] = empty; (s)% ⊦ m = m0 + n0 ∧ n < n0 → m0 + n < m; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ # emptypeb = PEB_SIZE; (s)