Fixpoint list_nat (n:nat) (x:value) {struct n} :=
  match n, x with
  | 0, value_label 1%positive => True
  | S n', value_cons (value_label 1%positive) x' => list_nat n' x'
  | _, _ => False
  end.Fixpoint list_length (x:value) :=
  match x with
  | value_cons _ x' => S (list_length x')
  | _ => 0
  end.Definition add_P' n m st :=
    list_nat_var n (V 1) st /\
    list_nat_var m (V 2) st.Definition add_Q' n m st := list_nat_var (n+m) (V 2) st.Definition add_P (nm:nat*nat) := store_op (add_P' (fst nm) (snd nm)).Definition add_Q (nm:nat*nat) := store_op (add_Q' (fst nm) (snd nm)).

(* Specifications: *)
Lemma add_verify : verify_prog add_term_measure (funptr (L 0) _ add_P add_Q && TT) add_phi (funptr (L 0) _ add_P add_Q && TT).