Used simplifier rules: Butmin: ⊦ s ≠ ∅ → s.butmin = s -- s.min;%del-d: ⊦ s -- a -- a = s -- a; from specification set-union