| # xs = xs_len, h0 = h, prefixn(h0, xs + ys) = prefixn(h0, xs0), # xs < h, #(xs + ys) ≤ # xs0, # ys = 0 ∨ # ys = h ⊦ ⟪tree_buffer_add#(a; xs0)⟫ ⟨caterpillar_add#(a, h; xs, xs_len, ys)⟩ (prefixn(h0, xs + ys) = prefixn(h0, xs0) ∧ #(xs + ys) ≤ # xs0 ∧ h0 = h) |
prefixn(h, xs + ys) = prefixn(h, xs0), # xs < h, # xs + # ys ≤ # xs0, ys = [] ∨ # ys = h ⊦ ⟪tree_buffer_add#(a; xs0)⟫ ⟨xs_len := # xs; caterpillar_add#(a, h; xs, xs_len, ys)⟩ (prefixn(h, xs + ys) = prefixn(h, xs0) ∧ # xs + # ys ≤ # xs0)
Used simplifier rules: ⊦ m < n → n ≠ 0; (s)%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ # x = 0 ↔ x = []; (s)%a: ⊦ (x + y) + z = x + y + z; from specification list% ⊦ #(x + y) = # x + # y; (s)