| less#(a, x0) + violations(x0) = m + 1, x0[m1 + 1] < x0[m1], m1 + 1 < # x0, ∀ m0, n0. violations(x0) = m0 + 1 ∧ x0[n0 + 1] < x0[n0] ∧ n0 + 1 < # x0 → violations(x0[n0, x0[n0 + 1]][n0 + 1, x0[n0]]) = m0 ⊦ a ' + x0[m1, x0[m1 + 1]] = [], 2 + m1 = 0, violations((a ' + x0[m1, x0[m1 + 1]]).head ' + (a ' + x0[m1, x0[m1 + 1]]).tail[(2 + m1)-1, x0[m1]]) = m, x0 = [] |
less#(a, x0) + violations(x0) = m + 1, m1 + 1 < # x0, x0[m1 + 1] < x0[m1], ∀ m0, n0. violations(x0) = m0 + 1 ∧ x0[n0 + 1] < x0[n0] ∧ n0 + 1 < # x0 → violations(x0[n0, x0[n0 + 1]][n0 + 1, x0[n0]]) = m0 ⊦ less#(a, x0) + violations(x0[m1, x0[m1 + 1]][1 + m1, x0[m1]]) = m, x0 = []
Used simplifier rules: violations-rec: ⊦ violations(a ' + x) = less#(a, x) + violations(x);%less-same: n + 1 < # x ⊦ less#(a, x[n, x[n + 1]][n + 1, x[n]]) = less#(a, x);% ⊦ a ' + x ≠ []; (s)%n < n0 ⊦ (* n) ≠ m0 + (* n0); (s)% ⊦ m < n → (n ≤ m ↔ false); (s)% ⊦ m < n ↔ ¬ n ≤ m; (ss)%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ n ≤ m → m + n0 - n = (m - n) + n0; (s)% ⊦ n -1 = n - 1; (s)% ⊦ (a ' + x).tail = x; (s)%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ (a ' + x).head = a; (s)