reserve s for State of SCM+FSA,
  a, c for read-write Int-Location,
  aa, bb, cc,
  dd, x for Int-Location,
  f for FinSeq-Location,
  I, J for MacroInstruction of SCM+FSA,
  Ig for good MacroInstruction of SCM+FSA,
  i, k for Nat,
  p for Instruction-Sequence of SCM+FSA;
reserve I for MacroInstruction of SCM+FSA;

theorem Th21:
  a <> aa & aa <> 1-stRWNotIn ({a, bb, cc} \/ UsedILoc I) & I
  does not destroy aa implies for-up(a, bb, cc, I) does not destroy aa
proof
  assume that
A1: a <> aa and
A2: aa <> 1-stRWNotIn ({a, bb, cc} \/ UsedILoc I) and
A3: I does not destroy aa;
  set aux = 1-stRWNotIn ({a, bb, cc} \/ UsedILoc I);
  set i2 = AddTo(aux, intloc 0);
A4: i2 does not destroy aa by A2,SCMFSA7B:7;
  set i3 = a := bb;
  set i1 = SubFrom(aux, bb);
  set i0 = aux := cc;
  set I03 = i0 ";" i1 ";" i2 ";" i3;
  i0 does not destroy aa & i1 does not destroy aa by A2,SCMFSA7B:6,8;
  then i0 ";" i1 ";" i2 does not destroy aa by A4,SCMFSA8C:54,55;
  then
A5: I03 does not destroy aa by A1,SCMFSA7B:6,SCMFSA8C:54;
  set IB = I ";" AddTo(a, intloc 0) ";" SubFrom(aux, intloc 0);
  set I4 = while>0( aux, IB);
  I ";" AddTo(a, intloc 0) does not destroy aa by A1,A3,SCMFSA7B:7,SCMFSA8C:54;
  then IB does not destroy aa by A2,SCMFSA7B:8,SCMFSA8C:54;
  then I4 does not destroy aa by SCMFSA8C:92;
  hence thesis by A5,SCMFSA8C:52;
end;
