| a0 < a, ∀ m0, n. less#(a0, y) + violations(y) = m0 + 1 ∧ y[n] < (a0 ' + y)[n] ∧ n < # y → violations((a0 ' + y)[n, y[n]][n + 1, (a0 ' + y)[n]]) = m0 ⊦ violations((a0 ' + a0 ' + y)[1, a]) = less#(a, y) + less#(a0, y) + violations(y) |
⊦ n ≠ 0 → (a ' + x)[n, b] = a ' + x[n -1, b]
Used simplifier rules: violations-rec: ⊦ violations(a ' + x) = less#(a, x) + violations(x);%less-rec: ⊦ less#(a, b ' + x) = (b < a ⊃ 1;0) + less#(a, x);% ⊦ (b ' + x)[0, a] = a + x; (s)% ⊦ a + x = a ' + x; (s)%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ a < b → (b < a ↔ false); (ss)% ⊦ n + 0 = n; (s)%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic%c: ⊦ m + n = n + m; from specification nat-basic% ⊦ m + n = m + n0 ↔ n = n0; (s) Used terms: a, 1, a0 ' + y, a0