Used simplifier rules: Butmin: ⊦ s ≠ ∅ → s.butmin = s -- s.min;%Delete: ⊦ a ∈ s -- b ↔ a ≠ b ∧ a ∈ s; from specification set-union