Used simplifier rules: Butmin: ⊦ s ≠ ∅ → s.butmin = s -- s.min;%sub-del-03: ⊦ s ⊆ s0 → s -- a ⊆ s0; from specification set-union