| #(s0 \ s) = # s0 - # s, a ∈ s ++ a → a ∈ s0, ∀ a0. a0 ∈ s ++ a → a0 ∈ s0 ⊦ # s0 - # s = # s0 - #(s ++ a), a ∈ s0 \ s |
Used simplifier rules: Difference: ⊦ a ∈ s1 \ s2 ↔ a ∈ s1 ∧ ¬ a ∈ s2;%eq: ⊦ a ∈ s → s ++ a = s; from specification set-basic%rax: ⊦ a ∈ s ++ b ↔ ¬ ¬(a = b ∨ a ∈ s); from specification set-basic