| ((aP0 ∧_ s))(H), ∀ a, H. a ∈ s ∧ aP0(a)(H) → aP(a)(H), ∃ s0. s = s0 ++ a ∧ ¬ a ∈ s0, ∀ s0, aP0, H, aP. # s0 < # s → ((aP0 ∧_ s0))(H) ∧ (∀ a, H. a ∈ s0 ∧ aP0(a)(H) → aP(a)(H)) → ((aP ∧_ s0))(H) ⊦ # s = 0, ((aP ∧_ s))(H) |
aP0(a)(H), ((aP0 ∧_ s0))(H), ∀ a0, H0. (a0 = a ∨ a0 ∈ s0) ∧ aP0(a0)(H0) → aP(a0)(H0), ∀ s1, aP0, H, aP. # s1 < #(s0 ++ a) → ((aP0 ∧_ s1))(H) ∧ (∀ a, H. a ∈ s1 ∧ aP0(a)(H) → aP(a)(H)) → ((aP ∧_ s1))(H) ⊦ a ∈ s0, aP(a)(H) ∧ ((aP ∧_ s0))(H)
Used simplifier rules: And-ins: ⊦ ¬ a ∈ s → aP ∧_ (s ++ a) = (aP(a) ∧ aP ∧_ s);% ⊦ a ∈ s ++ b ↔ a = b ∨ a ∈ s; (s)%and-com: ⊦ (P0 ∧ P1) = (P1 ∧ P0); from specification heap-sep%and-ass: ⊦ ((P0 ∧ P1) ∧ P2) = (P0 ∧ P1 ∧ P2); from specification heap-sep% ⊦ ((P0 ∧ P1))(H) ↔ P0(H) ∧ P1(H); (s)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m + 1 ≠ 0; (s)% ⊦ ¬ a ∈ s → #(s ++ a) = # s + 1; (s)