Struct Nat 

pub struct Nat(/* private fields */);

Natural numbers, i.e., integers that are greater or equal to 0.

Implementations

impl Nat

pub fn to_int(self) -> Int

ensures

result >= 0

pub fn new(n: Int) -> Nat

requires

n >= 0

ensures

result.to_int() == n

pub fn ext_eq(self, other: Self) -> bool

(open)

let _ = Subset::<NatInner>::inner_inj;
self.to_int() == other.to_int()

ensures

result == (self == other)

Trait Implementations

impl AddLogic for Nat

fn add(self, other: Self) -> Self

ensures

result.to_int() == self.to_int() + other.to_int()

type Output = Nat

impl MulLogic for Nat

fn mul(self, other: Self) -> Self

ensures

result.to_int() == self.to_int() * other.to_int()

type Output = Nat

impl RA for Nat

fn op(self, other: Self) -> Option<Nat>

(open, inline)

Some(self + other)

fn factor(self, factor: Self) -> Option<Self>

(open, inline)

let _ = Nat::ext_eq;
if self.to_int() >= factor.to_int() {
    Some(Nat::new(self.to_int() - factor.to_int()))
} else {
    None
}

ensures

match result {
        Some(c) => factor.op(c) == Some(self),
        None => forall<c: Self> factor.op(c) != Some(self),
    }

fn eq(self, other: Self) -> bool

(open, inline)

self.ext_eq(other)

ensures

result == (self == other)

fn commutative(a: Self, b: Self)

(law)

ensures

a.op(b) == b.op(a)

fn associative(a: Self, b: Self, c: Self)

ensures

a.op(b).and_then_logic(|ab: Self| ab.op(c)) == b.op(c).and_then_logic(|bc| a.op(bc))

fn core(self) -> Option<Self>

(open, inline)

Some(Nat::new(0))

fn core_idemp(self)

ensures

let c = self.core().unwrap_logic();
c.op(c) == Some(c)

ensures

self.core().unwrap_logic().op(self) == Some(self)

fn core_is_maximal_idemp(self, i: Self)

requires

i.op(i) == Some(i)

requires

i.op(self) == Some(self)

ensures

match self.core() {
        Some(c) => i.incl(c),
        None => false,
    }

fn incl(self, other: Self) -> bool

Inclusion of RA.

fn incl_op(self, other: Self, comb: Self)

(law)

fn incl_eq(self, other: Self) -> bool

(open, sealed)

fn incl_eq_op(a: Self, b: Self, x: Self) -> bool

(open, sealed)

fn update(self, x: Self) -> bool

Ensures that we can go from self to x without making composition with the frame invalid.

fn update_nondet(self, s: Set<Self>) -> bool

This is used in Resource::update_nondet.

fn associative_none(a: Self, b: Self, c: Self, bc: Self)

Specialized version of Self::associative, in the case where a.op(b) == None.

fn associative_some(a: Self, b: Self, c: Self, ab: Self, bc: Self)

Specialized version of Self::associative, in the case where a.op(b) and b.op(c) are both valid.

fn incl_transitive(a: Self, b: Self, c: Self)

RA::incl is transitive.

impl UnitRA for Nat

fn unit() -> Self

(open, inline)

let _ = Nat::ext_eq;
Nat::new(0)

ensures

forall<x: Self> #[trigger(x.op(result))] x.op(result) == Some(x)

fn core_total(self) -> Self

(open, inline)

Nat::new(0)

ensures

self.core() == Some(result)

fn core_total_idemp(self)

ensures

self.core_total().op(self.core_total()) == Some(self.core_total())

ensures

self.core_total().op(self) == Some(self)

fn incl_refl()

In unitary RAs, the inclusion relation is reflexive

fn unit_core()

The unit is its own core