Definition cond2_correct n s x g h0 h1 vnl vsl :
  length vnl = n ->
  length vsl = s ->
  sem (cond2 n s x g h0 h1) vnl vsl =
  match sem x vnl vsl with
  | nil => sem g vnl vsl
  | true  :: _ => sem h0 vnl (tl (sem x vnl vsl) :: vsl)
  | false :: _ => sem h1 vnl (tl (sem x vnl vsl) :: vsl)
  end.

(* Specifications: *)
Lemma sem_rec_false g h0 h1 vnl vsl v : sem (rec g h0 h1) ((false :: v) :: vnl) vsl = sem h0 (v :: vnl) (sem (rec g h0 h1) (v :: vnl) vsl :: vsl).
Lemma sem_rec_true g h0 h1 vnl vsl v : sem (rec g h0 h1) ((true :: v) :: vnl) vsl = sem h1 (v :: vnl) (sem (rec g h0 h1) (v :: vnl) vsl :: vsl).
Lemma rec1_arities n s g h (Hg : arities g = ok_arities n s) (Hh : arities h = ok_arities (S n) (S s)) : arities (rec1 n s g h) = ok_arities (S n) s.