inductive verif in alloy