| ii(0) = 0, ii((m - 1) + 1) = ii(m - 1) + # lf(m - 1), (nf from ii(m - 1)) to # lf(m - 1) = lf(m - 1), m0 < m, ii(m) < ii(m0), ∀ m0. m0 < m → ii(m0 + 1) = ii(m0) + # lf(m0) ∧ (nf from ii(m0)) to # lf(m0) = lf(m0) ∧ (∀ m1. m1 ≤ m0 → ii(m1) ≤ ii(m0)), ∀ m1. m1 < m → ii(m1) ≤ ii(m - 1) ⊦ m0 = m + 1, m0 = m |
ii(m2 + 1) = ii(m2) + # lf(m2), ii(0) = 0, m = m2 + 1, (nf from ii(m2)) to # lf(m2) = lf(m2), ii(m) < ii(m0), m0 < m, ∀ m1. m1 < m → ii(m1) ≤ ii(m2), ∀ m0. m0 < m → ii(m0 + 1) = ii(m0) + # lf(m0) ∧ (nf from ii(m0)) to # lf(m0) = lf(m0) ∧ (∀ m1. m1 ≤ m0 → ii(m1) ≤ ii(m0)) ⊦ m = 0, m0 = m, m0 = m + 1
Used simplifier rules: a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic%c: ⊦ m + n = n + m; from specification nat-basic% ⊦ ¬ m < 0; (s)%n ≠ 0 ⊦ m = n - 1 ↔ n = m + 1; (elim) Used terms: m, m2