Rodin Handbook





 

4.3.3 Witness Xyz must be a disappearing abstract variable or parameter in the INITIALISATION event

The witness is for the after value of the abstract variable, hence you should use the primed variable. The witness label should be Xyz’, and the predicate should refer to Xyz’ too.