| # lf(n0) = ii(n0), ii(0) = 0, ii(n) = ii(n0), lf(0) = [], lf(n) = lf(n0), nextli(lf(n0)) = lf(n0), nextli0(lf(n0)) = [], n0 < n, ∀ n0. ii(n0 + 1) = ii(n0) + # nextli0(lf(n0)) ∧ ¬ ii(n) < ii(n0 + 1) ∧ (lf(n) from ii(n0)) to # nextli0(lf(n0)) = nextli0(lf(n0)), ∀ n0. lf(n0) = lf(n) to ii(n0), ∀ m. n ≤ m → nextli0(lf(m)) = [] ∧ ii(m) = ii(n0), ∀ x. nextli(x) = x + nextli0(x), ∀ n. lf(n + 1) = nextli(lf(n)), ∀ m, n. m ≤ n → ii(m) ≤ ii(n), ∀ n. nextli0(lf(n)) = [] → (∀ m. n < m → lf(m) = lf(n) ∧ nextli0(lf(m)) = [] ∧ ii(m) = ii(n)), ∀ m. nextli0(lf(m)) = [] ↔ n0 ≤ m, ∀ m. n0 < m → lf(m) = lf(n0) ∧ nextli0(lf(m)) = [] ∧ ii(m) = ii(n0) ⊦ ii(m) < ii(m + 1), n0 ≤ m |
# lf(n0) = ii(n0), ii(0) = 0, ii(n) = ii(n0), lf(0) = [], lf(n) = lf(n0), nextli(lf(n0)) = lf(n0), nextli0(lf(n0)) = [], m < n, m < n0, n0 < n, m + 1 < n, ii(m + 1) ≤ ii(m), ∀ n0. ii(n0 + 1) = ii(n0) + # nextli0(lf(n0)) ∧ ¬ ii(n) < ii(n0 + 1) ∧ (lf(n) from ii(n0)) to # nextli0(lf(n0)) = nextli0(lf(n0)), ∀ n0. lf(n0) = lf(n) to ii(n0), ∀ m. n ≤ m → nextli0(lf(m)) = [] ∧ ii(m) = ii(n0), ∀ x. nextli(x) = x + nextli0(x), ∀ n. lf(n + 1) = nextli(lf(n)), ∀ m, n. m ≤ n → ii(m) ≤ ii(n), ∀ n. nextli0(lf(n)) = [] → (∀ m. n < m → lf(m) = lf(n) ∧ nextli0(lf(m)) = [] ∧ ii(m) = ii(n)), ∀ m. nextli0(lf(m)) = [] ↔ n0 ≤ m, ∀ m. n0 < m → lf(m) = lf(n0) ∧ nextli0(lf(m)) = [] ∧ ii(m) = ii(n0) ⊦
Used simplifier rules: ⊦ m +1 = m + 1; (s)% ⊦ m < n → n ≠ 0; (s)%trans: ⊦ n < n0 ∧ n0 < n1 → n < n1; (forward) from specification nat-basic%lf: ⊦ m < n ∧ n < n0 → m +1 < n0; (forward) from specification nat-basic%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ m < n ↔ ¬ n ≤ m; (ss)% ⊦ m ≤ n ↔ ¬ n < m; (ss)