reserve s for State of SCM+FSA,
  I for MacroInstruction of SCM+FSA,
  a for read-write Int-Location;
reserve i,j,k,n for Nat;
reserve P,P1,P2,Q for Instruction-Sequence of SCM+FSA;

theorem Th9:
  for I be MacroInstruction of SCM+FSA,a be read-write Int-Location, s be
  State of SCM+FSA,k,n be Nat st
   IC StepWhile>0(a,P,s,I).k = 0 &
   StepWhile>0(a,P,s,I).k
    = Comput(P +* while>0(a,I),Initialized s,n) &
    StepWhile>0(a,P,s,I).k.intloc 0=1
  holds
   StepWhile>0(a,P,s,I).k
    = Initialized StepWhile>0(a,P,s,I).k &
   StepWhile>0(a,P,s,I).(k+1)
    = Comput(P +* while>0(a,I), Initialized s,
           n +(LifeSpan(P +* while>0(a,I) +* I,
       Initialized StepWhile>0(a,P,s,I).k) + 2))
proof
  let I be MacroInstruction of SCM+FSA,a be read-write Int-Location,
      s be State of SCM+FSA,k,n be Nat;
  set D = Data-Locations SCM+FSA;
  set s1 = Initialized s, P1 = P +* while>0(a,I);
  set sk=StepWhile>0(a,P,s,I).k, s0k=Initialized sk,
      s2=Initialize s0k, s3=Initialized sk;
  assume
A1: IC sk = 0;
  assume
A2: sk = Comput(P1,s1,n);
  assume
A3: sk.intloc 0=1;
  thus s3 = Initialized sk
         .= sk by A3,A1,SCMFSA_M:8;
  hence
  StepWhile>0(a,P,s,I).(k+1)
    = Comput(P1, sk,LifeSpan(P1 +* I,Initialized sk) + 2) by Def1
   .= Comput(P1, s1, n +(LifeSpan(P1 +* I,Initialized sk) + 2))
       by A2,EXTPRO_1:4;
end;
