enrich
   nat, 
   polyref
with
   sorts Heap[A];
   constants 
       ∅ : Heap[A];
   
   functions 
       # . : Heap[A] → Nat;
   
   predicates 
       . ∈ . : Ref[A] × Heap[A];
   
   procedures alloc#  : Heap[A] → Ref[A] nonfunctional nondeterministic;
   variables 
       h : Heap[A];
       r : Ref[A];
       o : A;
       d : A;
       hP : Heap[A] → Bool;
       n : Nat;
   
   partial functions 
       . ++ . : Heap[A] × Ref[A] → Heap[A] prio 9 left with λ h, r. r ≠ null ∧ ¬ r ∈ h;
       . -- . : Heap[A] × Ref[A] → Heap[A] prio 9 left with λ h, r. r ≠ null ∧ r ∈ h;
       . ( . ) : Heap[A] × Ref[A] → A with λ h, r. r ≠ null ∧ r ∈ h;
       . ( . := . ) : Heap[A] × Ref[A] × A → Heap[A] with λ h, r, o. r ≠ null ∧ r ∈ h;
   
   
   induction 
      Heap[A] generated by ∅ : Heap[A],  . ++ .  : (Heap[A] × Ref[A] → Heap[A]),  . (. := .) : (Heap[A] × Ref[A] × A → Heap[A]) ;
   
   axioms 
      ext: h0 = h1 ↔ (∀ r. (r ∈ h0 ↔ r ∈ h1) ∧ (r ∈ h0 → h0(r) = h1(r)));
      
      sanity: ¬ null ∈ h;
      used for: s, ls;
      
      in-emp: ¬ r ∈ ∅;
      used for: s, ls;
      
      in-alloc: r0 ≠ null, ¬ r0 ∈ h ⊦ r ∈ h ++ r0 ↔ r = r0 ∨ r ∈ h;
      used for: s, ls;
      
      in-write: r ∈ h(r0 := o) ↔ r ∈ h;
      used for: s, ls;
      
      at-alloc: r ∈ h, r0 ≠ null, ¬ r0 ∈ h ⊦ (h ++ r0)(r) = h(r);
      used for: s, ls;
      
      at-write: h(r0 := o)(r) = (r = r0 ∧ r0 ∈ h ⊃ o;h(r));
      used for: s, ls;
      
      in-del: r ∈ h -- r0 ↔ r ≠ r0 ∧ r ∈ h;
      used for: s, ls;
      
      at-del: r ∈ h ⊦ r ≠ r0 → (h -- r0)(r) = h(r);
      used for: s, ls;
      
      size-emp: # ∅ = 0;
      used for: s, ls;
      
      size-alloc: ¬ r ∈ h, r ≠ null ⊦ #(h ++ r) = # h + 1;
      used for: s, ls;
      
      size-write: r ∈ h ⊦ # h(r := o) = # h;
      used for: s, ls;
   
   declarations 
      alloc: 
      alloc#(; h){choose r0 with ¬ r0 ∈ h ∧ r0 ≠ null in {h := h ++ r0; r0} ifnone null};
      
      
   
   
end enrich