Forgot a negations when checking inductive invariant