Definition cond2_correct n s x g h0 h1 vnl vsl :
  length vnl = n ->
  length vsl = s ->
  sem (cond2 n s x g h0 h1) vnl vsl =
  match sem x vnl vsl with
  | nil => sem g vnl vsl
  | true  :: _ => sem h0 vnl (tl (sem x vnl vsl) :: vsl)
  | false :: _ => sem h1 vnl (tl (sem x vnl vsl) :: vsl)
  end.

Lemma sem_rec_true g h0 h1 vnl vsl v : sem (rec g h0 h1) ((true :: v) :: vnl) vsl = sem h1 (v :: vnl) (sem (rec g h0 h1) (v :: vnl) vsl :: vsl).