Definition measure (st: state) : nat :=
  match st with
  | State mu sigma tau => 2 * List.length mu + List.length sigma
  end.

(* Specifications: *)
Lemma measure_decreasing_1: forall st st', dtransition st st' -> measure st' < measure st.
Lemma measure_decreasing_2: forall st, final_state st = false -> measure (parmove_step st) < measure st.