| nσ[n0] = n + 1, leninv(nσ) = ∞, ⌜n0⌝ < # nσ, stutf(nσ), n0 ≤ max∞(λ n0. ⌜n0⌝ < # nσ ∧ nσ[n0] = n).n, ∀ n0. ∃ n1. n0 < n1 ∧ ⌜n1⌝ < # nσ ∧ nσ[n1] = n, ∀ m. ⌜m⌝ < # nσ ∧ nσ[m] = n + 1 → ¬ n0 < m, ∃ n1. n0 < n1 ∧ ⌜n1⌝ < # nσ ∧ nσ[n1] = n ⊦ |
nσ[n0] = nσ[n1] + 1, leninv(nσ) = ∞, ⌜n0⌝ < # nσ, ⌜n1⌝ < # nσ, n0 < n1, stutf(nσ), n0 ≤ max∞(λ n0. ⌜n0⌝ < # nσ ∧ nσ[n0] = nσ[n1]).n, ∀ n0. ∃ n2. n0 < n2 ∧ ⌜n2⌝ < # nσ ∧ nσ[n2] = nσ[n1], ∀ m. ⌜m⌝ < # nσ ∧ nσ[m] = nσ[n0] → ¬ n0 < m ⊦
Used simplifier rules: ⊦ m < n → n ≠ 0; (s)%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic