Something like that might work, but it is quite hard to follow - and we are writing a specification, so it helps if it is clear. The following was my first thought. It cheats slightly by using two functions, but I hope it is relatively clear:
seq_min: seq of nat -> nat
seq_min(s) ==
minrec(tl s, hd s)
pre len s > 0;
minrec: seq of nat * nat -> nat
minrec(s, min) ==
if s = []
then min
else if hd s < min
then minrec(tl s, hd s)
else minrec(tl s, min);
Note that this does not try to use pairs of values in the comparison, so there is no "tl tl seq" expression etc. The following tests are with VDMJ again:
> p seq_min([])
Error 4055: Precondition failure: pre_seq_min in 'DEFAULT' (z.vdm) at line 5:15
Stopped in 'DEFAULT' (z.vdm) at line 5:15
5: pre len s > 0;
>
> p seq_min([1])
= 1
Executed in 0.002 secs.
> p seq_min([2,1])
= 1
Executed in 0.014 secs.
> p seq_min([5,2,3,7,6,9,8,3,5,5,2,7,2])
= 2
Executed in 0.004 secs.
>