| ((r1 => (a ' + x0).last × r2 * lls(r0, r1, (a ' + x0).butlast) * P))(H), ∀ r1, r2, r0, P, H. ((r1 => x0.last × r2 * lls(r0, r1, x0.butlast) * P))(H) → x0 = [] ∨ ((lls(r0, r2, x0) * P))(H) ⊦ x0 = [], ∃ r. (((r0 => a × r * lls(r, r2, x0)) * P))(H) |
(((r0 => a × r * lls(r, r1, x0.butlast)) * r1 => x0.last × r2 * P))(H), ∀ r3, r4, r5, P0, H0. ((r3 => x0.last × r4 * lls(r5, r3, x0.butlast) * P0))(H0) → ((lls(r5, r4, x0) * P0))(H0) ⊦ x0 = [], ∃ r. (((r0 => a × r * lls(r, r2, x0)) * P))(H)
Used simplifier rules: lls-rec: ⊦ lls(r, r1, a ' + x) = _∃(λ r0. r => a × r0 * lls(r0, r1, x));%sep-com: ⊦ P0 * P1 = P1 * P0; from specification heap-sep%sep-ass: ⊦ (P0 * P1) * P2 = P0 * P1 * P2; from specification heap-sep% ⊦ ((_∃ rP * P))(H) ↔ (∃ r. ((rP(r) * P))(H)); (s)% ⊦ x ≠ [] → (a ' + x).butlast = a ' + x.butlast; (s)%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ x ≠ [] → (a ' + x).last = x.last; (s)