property HasNext
  prefix "Iterator"
  prefix "List"
  prefix "Scanner"
  nondet (start)
  start -> start: *
  start -> invalid: iterator(Ignore, RetIter) => i := RetIter
  start -> invalid: Scanner(Iter, IgnoreA, IgnoreB) => i := Iter // For constructors, "this" is first argument, and there's a dummy return
  invalid -> valid: hasNext(Iter, Ret) when Ret != 0 && Iter == i // in SIL, "true" is encoded as "not 0"
  valid -> invalid: next(Iter, IgnoreRet) when Iter == i
  invalid -> error: next(Iter, IgnoreRet) when Iter == i