| ii(m + 1) = ii(m) + # lf(m), ii(0) = 0, (nf from ii(m)) to # lf(m) = lf(m), m < n0, m0 ≤ m, ∀ m0. m0 ≤ m → ii(m0) ≤ ii(m), ∀ m. m < n0 → ii(m + 1) = ii(m) + # lf(m) ∧ (nf from ii(m)) to # lf(m) = lf(m) ∧ (∀ m0. m0 ≤ m → ii(m0) ≤ ii(m)) ⊦ m = n0 + 1, n0 = m, (m0 = n0 + 1 ⊃ ii(n0) + # lf(n0);ii(m0)) ≤ ii(m) |
ii(m + 1) = ii(m) + # lf(m), ii(0) = 0, (nf from ii(m)) to # lf(m) = lf(m), m0 < n0, ii(m) < (m0 = n0 + 1 ⊃ ii(n0) + # lf(n0);ii(m0)), m < n0, m0 ≤ m, ∀ m0. m0 ≤ m → ii(m0) ≤ ii(m), ∀ m. m < n0 → ii(m + 1) = ii(m) + # lf(m) ∧ (nf from ii(m)) to # lf(m) = lf(m) ∧ (∀ m0. m0 ≤ m → ii(m0) ≤ ii(m)) ⊦ m = n0 + 1, n0 = m
Used simplifier rules: ⊦ m < n → n ≠ 0; (s)%fle-01: ⊦ m ≤ n ∧ n < n0 → m < n0; (forward) from specification nat%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ m ≤ n ↔ ¬ n < m; (ss)