Abstraction function
%a(a,t) =
Representation invariant
I(a,t,s) == t = length(s) /\ t >= 0 /\ s = %a(a,t)
slide
:
Abstraction function and representation invariant