| ∃ ns0. ns = ns0 ++ n0 ∧ ¬ n0 ∈ ns0, ∀ ns0, n, m. # ns0 < # ns → true → (n ∈ below(ns0, m) ↔ n ∈ ns0 ∧ n < m) ⊦ # ns = 0, n ∈ below(ns, m) ↔ n ∈ ns ∧ n < m |
∀ ns1, n, m. # ns1 < #(ns0 ++ n0) → true → (n ∈ below(ns1, m) ↔ n ∈ ns1 ∧ n < m) ⊦ n ∈ (n0 < m ⊃ below(ns0, m) ++ n0;below(ns0, m)) ↔ (n = n0 ∨ n ∈ ns0) ∧ n < m, n0 ∈ ns0
Used simplifier rules: below-rec: ⊦ below(ns ++ n, m) = (n < m ⊃ below(ns -- n, m) ++ n;below(ns -- n, m));%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m + 1 ≠ 0; (s)% ⊦ ¬ n ∈ ns → #(ns ++ n) = # ns + 1; (s)% ⊦ n ∈ ns ++ n0 ↔ n = n0 ∨ n ∈ ns; (s)% ⊦ ¬ n ∈ ns → ns -- n = ns; (s)