| □ (Rton(n)(S', S'') ∧ GInv(S) ∧ GInv(S')), N = N'' + 1 until ¬ GInv(S''), INDHYP-nat0(n0), Rton(n)(s0, S), GInv(s), GInv(s0), boolvar → s = s0 ∧ n0 = n1, n0 = N + 1 ⊦ ◇ last |
□ (Rton(n)(S', S'') ∧ GInv(S) ∧ GInv(S')), N = N'' + 1 until ¬ GInv(S''), INDHYP-nat0(N + 1), Rton(n)(s0, S), GInv(s), GInv(s0), boolvar → s = s0 ∧ N + 1 = n1 ⊦ ◇ last