| n4 = n3, vtbl2 = ∅, is-encoded(vtbl0, buf), err0 = ESUCCESS → is-encoded(n5, subarray(buf, 0, ENCODED_NAT_SIZE)) ∧ ENCODED_NAT_SIZE ≤ # buf ∧ n3 = ENCODED_NAT_SIZE, err = ESUCCESS → (∃ vtbl1. vtbl ⊥ vtbl1 ∧ # vtbl1 + # vtbl = n5 ∧ # vtbl1 = n1 ∧ # buf ≥ ENCODED_NAT_SIZE + n5 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ n0 = ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ is-encoded(n5, subarray(buf, 0, ENCODED_NAT_SIZE)) ∧ is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))) ∧ is-encoded-rec(vtbl1, subarray(buf, n0, # vtbl1 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)))), err0 = ESUCCESS ∨ ⌊err0⌋ , err = ESUCCESS ∨ ⌊err⌋ ⊦ (err = ESUCCESS ∨ ⌊err⌋ ) ∧ (err = ESUCCESS → vtbl = vtbl0), n1 ≠ 0 ∧ err = ESUCCESS |
is-encoded(vtbl0, buf), is-encoded(# vtbl, subarray(buf, 0, ENCODED_NAT_SIZE)), is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))), ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ≤ # buf, err0 = ESUCCESS → ENCODED_NAT_SIZE ≤ # buf ∧ n3 = ENCODED_NAT_SIZE, err0 = ESUCCESS ∨ ⌊err0⌋ ⊦ vtbl = vtbl0
Used simplifier rules: is-encoded-rec-size: ⊦ is-encoded-rec(vtbl, buf) → # buf = # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE);%is-encoded-base: ⊦ is-encoded-rec(∅, buf) ↔ # buf = 0;% ⊦ # mkbuf(n) = n; (s)% ⊦ subarray(buf, n, 0) = mkbuf(0); (s)%mult-c: ⊦ m * n = n * m; from specification nat-mult%mult-a: ⊦ m0 * m * n = (m0 * m) * n; from specification nat-mult% ⊦ 0 * n = 0; (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ n + 0 = n; (s)% ⊦ # ∅ = 0; (s)% ⊦ vtbl ⊥ ∅; (s)% ⊦ # vtbl = 0 ↔ vtbl = ∅; (s)% ⊦ # subarray(buf, m, n) = n; (s)%is-encoded-size: ⊦ is-encoded(n, buf) → # buf = ENCODED_NAT_SIZE; (forward) from specification encoding-fixed-size[encoding-nat]% ⊦ is-encoded(n, buf) → (is-encoded(n0, buf) ↔ n = n0); (s)% ⊦ n ≥ m ↔ m ≤ n; (s)