function rev(xs: seq): seq { if xs == [] then [] else rev(xs[1..]) + [xs[0]] } lemma revlen(xs:seq) ensures |rev(xs)| == |xs| { } lemma revapp(xs:seq,ys:seq) ensures rev(xs + ys) == rev(ys) + rev(xs) { } lemma revrev(xs:seq) ensures rev(rev(xs)) == xs { }