| ∃ s1. s0 = s1 ++ a ∧ ¬ a ∈ s1, 2 + # s < # s0, ∀ s1. # s + 1 < # s1 → (∃ a0. a0 ∈ s1 ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s) ⊦ # s0 = 0, a = a1, a1 ∈ s, a ∈ s, ∃ a0. a0 ∈ s0 ∧ a0 ≠ a ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s |
# s + 1 < # s1, ∀ s1. # s + 1 < # s1 → (∃ a0. a0 ∈ s1 ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s) ⊦ # s1 = 0, a = a1, s1 = ∅, a ∈ s1, a ∈ s, a1 ∈ s, ∃ a0. a0 ∈ s1 ∧ a0 ≠ a1 ∧ ¬ a0 ∈ s
Used simplifier rules: Size-insert: ⊦ ¬ a ∈ s → #(s ++ a) = # s + 1;%in-02: ⊦ a ≠ b → (a ∈ s ++ b ↔ a ∈ s);%size-zero: ⊦ # s ≠ 0 → s ≠ ∅;%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic1%l-num-02: n0 < n ⊦ m + (* n) < m0 + (* n0) ↔ m + (n - n0) < m0; from specification nat%c: ⊦ m + n = n + m; from specification nat-basic2%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic2%oz: ⊦ m + 1 ≠ 0; from specification nat-basic2