Function vstd::multiset::lemma_multiset_properties
source · pub proof fn lemma_multiset_properties<V>()
Expand description
ensures
forall |m: Multiset<V>, v: V, mult: nat| #[trigger] m.update(v, mult).count(v) == mult,
forall |m: Multiset<V>, v1: V, mult: nat, v2: V| {
v1 != v2 ==> #[trigger] m.update(v1, mult).count(v2) == m.count(v2)
},
forall |m: Multiset<V>| {
(#[trigger] m.len() == 0 <==> m =~= Multiset::empty())
&& (#[trigger] m.len() > 0 ==> exists |v: V| 0 < m.count(v))
},
forall |m: Multiset<V>, x: V, y: V| {
0 < #[trigger] m.insert(x).count(y) <==> x == y || 0 < m.count(y)
},
forall |m: Multiset<V>, x: V| #[trigger] m.insert(x).count(x) == m.count(x) + 1,
forall |m: Multiset<V>, x: V, y: V| {
0 < m.count(y) ==> 0 < #[trigger] m.insert(x).count(y)
},
forall |m: Multiset<V>, x: V, y: V| {
x != y ==> #[trigger] m.count(y) == #[trigger] m.insert(x).count(y)
},
forall |m: Multiset<V>, x: V| #[trigger] m.insert(x).len() == m.len() + 1,
forall |a: Multiset<V>, b: Multiset<V>, x: V| {
#[trigger] a.intersection_with(b).count(x)
== min(a.count(x) as int, b.count(x) as int)
},
forall |a: Multiset<V>, b: Multiset<V>| {
#[trigger] a.intersection_with(b).intersection_with(b) == a.intersection_with(b)
},
forall |a: Multiset<V>, b: Multiset<V>| {
#[trigger] a.intersection_with(a.intersection_with(b)) == a.intersection_with(b)
},
forall |a: Multiset<V>, b: Multiset<V>, x: V| {
#[trigger] a.difference_with(b).count(x) == clip(a.count(x) - b.count(x))
},
forall |a: Multiset<V>, b: Multiset<V>, x: V| {
#[trigger] a.count(x) <= #[trigger] b.count(x)
==> (#[trigger] a.difference_with(b)).count(x) == 0
},
Properties of multisets from the Dafny prelude (which were axioms in Dafny, but proven here in Verus)