Function vstd::set::axiom_set_difference

pub broadcast proof fn axiom_set_difference<A>(s1: Set<A>, s2: Set<A>, a: A)

Expand description

ensures

#[trigger] s1.difference(s2).contains(a) == (s1.contains(a) && !s2.contains(a)),

The set difference between s1 and s2 contains element a if and only if s1 contains a and s2 does not contain a.