Used simplifier rules: Butmin: ⊦ s ≠ ∅ → s.butmin = s -- s.min;%delsw-02: ⊦ s -- b -- a = s -- a -- b ↔ true; from specification set-union