| s1 = s ++ a1 ∧ s1 ≠ s, a ∈ s0, # s1 + 1 < # s0, ∀ s0. # s1 < # s0 → (∃ a. a ∈ s0 ∧ ¬ a ∈ s1) ⊦ # s0 = 0, a ∈ s1, ∃ a0. a0 ∈ s0 ∧ a0 ≠ a ∧ ¬ a0 ∈ s1 |
a ∈ s0, 2 + # s < # s0, ∀ s1. # s + 1 < # s1 → (∃ a0. a0 ∈ s1 ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s) ⊦ # s0 = 0, a = a1, a1 ∈ s, a ∈ s, ∃ a0. a0 ∈ s0 ∧ a0 ≠ a ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s
Used simplifier rules: eq-03: ⊦ s ++ a = s ↔ a ∈ s;%Size-insert: ⊦ ¬ a ∈ s → #(s ++ a) = # s + 1;%add: ⊦ ¬ a ∈ s ++ b ↔ a ≠ b ∧ ¬ a ∈ s;%rax: ⊦ a ∈ s ++ b ↔ ¬ ¬(a = b ∨ a ∈ s);%c: ⊦ m + n = n + m; from specification nat-basic2%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic2