| H[r2] = a × null, x1 = a1 + x, ((lls(r0, r1, x0) * r1 => a0 × r2 * lls(r2, null, x1) * P))(H) ⊦ r1 = null, r2 = null, ∃ y, b. x0 + a0 ' + x1 = y + b ' + a ' ∧ ((lls(r0, r1, y) * r1 => b × r2 * r2 => a × null * P))(H) |
((((r2 => a × null * lls(r0, r1, x0)) * r1 => a0 × r2) * P))(H) ⊦ r1 = null, r2 = null, ∃ y, b. x0 + a0 ' = y + b ' ∧ ((lls(r0, r1, y) * r1 => b × r2 * r2 => a × null * P))(H)
Used simplifier rules: lls-rec: ⊦ lls(r, r1, a ' + x) = _∃(λ r0. r => a × r0 * lls(r0, r1, x));%lls-null: ⊦ lls(null, r, x) = (emp ∧ ⌜r = null⌝ ∧ ⌜x = []⌝ );% ⊦ x + y = z + y ↔ x = z; (s)% ⊦ x + [] = x; (s)% ⊦ ⌜bv⌝ (H) ↔ bv; (s)% ⊦ ((P0 ∧ P1))(H) ↔ P0(H) ∧ P1(H); (s)% ⊦ emp * P = P; (s)% ⊦ (⌜bv⌝ ∧ P0) * P1 = (⌜bv⌝ ∧ P0 * P1); (s)%and-com: ⊦ (P0 ∧ P1) = (P1 ∧ P0); from specification heap-sep%and-ass: ⊦ ((P0 ∧ P1) ∧ P2) = (P0 ∧ P1 ∧ P2); from specification heap-sep% ⊦ (true ∧ P) = P; (s)% ⊦ ⌜true⌝ = true; (s)% ⊦ a × r = a0 × r0 ↔ a = a0 ∧ r = r0; (ws)% ⊦ ((r => ce * P))(H) → (H[r] = ce0 ↔ ce = ce0); (s)%sep-com: ⊦ P0 * P1 = P1 * P0; from specification heap-sep%sep-ass: ⊦ (P0 * P1) * P2 = P0 * P1 * P2; from specification heap-sep% ⊦ ((_∃ rP * P))(H) ↔ (∃ r. ((rP(r) * P))(H)); (s)%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ a + x = a ' + x; (s)