| □ (R1(pm, S', S'') ∧ R2(pm, S', S'')), □ (N = N' ∧ ¬ N' < N''), [:S | Boolvar ::- [PL N = n16 ∧ true ∧ N' = N'' + 1 until ¬ R1(pm, S', S'') ∧ R1(pm, S', S'') -+-> (last ⊃ Post1(pm, s, S);G1(pm, S, S'))] ∥nf false ::- [PL □ ¬ N' < N'' ∧ R2(pm, S', S'') -+-> (last ⊃ Post2(pm, s, S);G2(pm, S, S')) ∧ (□ R2(pm, S', S'') → ◇ last)] ], INDHYP-nat(n16 + 1) ∧ INDHYP-nat0(n16 + 1), N = n16 + 1, R2(pm, s3, S), R1(pm, s3, S), I(pm, s2), Pre2(pm, s), Pre1(pm, s), RG-restr(pm, R1, G1, Pre1, Post1, I, R2, G2, Pre2, Post2), I(pm, s3), R2(pm, s2, S), I(pm, S), I(pm, s24), R2(pm, s2, s3), R1(pm, s3, s24), G1(pm, s2, s3), I(pm, s) ⊦ ◇ last |
□ (R1(pm, S', S'') ∧ R2(pm, S', S'')), □ (N = N' ∧ ¬ N' < N''), [:S | Boolvar ::- [PL N = n16 ∧ N' = N'' + 1 until ¬ R1(pm, S', S'') ∧ R1(pm, S', S'') -+-> (last ⊃ Post1(pm, s, S);G1(pm, S, S'))] ∥nf false ::- [PL □ ¬ N' < N'' ∧ R2(pm, S', S'') -+-> (last ⊃ Post2(pm, s, S);G2(pm, S, S')) ∧ (□ R2(pm, S', S'') → ◇ last)] ], INDHYP-nat(n16 + 1) ∧ INDHYP-nat0(n16 + 1), N = n16 + 1, R2(pm, s3, S), R1(pm, s3, S), I(pm, s2), Pre2(pm, s), Pre1(pm, s), RG-restr(pm, R1, G1, Pre1, Post1, I, R2, G2, Pre2, Post2), I(pm, s3), R2(pm, s2, S), I(pm, S), I(pm, s24), R2(pm, s2, s3), R1(pm, s3, s24), G1(pm, s2, s3), I(pm, s) ⊦ ◇ last