Section while_do.
Variable St : Set. (* states *)
Variable postcond : St -> Prop.
Variable precond : St -> Prop.
Variable Invar : St -> Prop.
Variable term_order : St -> St -> Prop.
Variable LoopExit : St -> Prop.
Hypothesis
LoopExit_dec : forall s : St, Invar s -> {LoopExit s} + {~ LoopExit s}.
Hypothesis
Onestep :
forall s : St,
~ LoopExit s -> Invar s -> {s' : St | Invar s' /\ term_order s' s}.
Hypothesis LoopExit_ok : forall s : St, LoopExit s -> Invar s -> postcond s.
Hypothesis loopstart : forall s : St, precond s -> Invar s.
Hypothesis Termi : well_founded term_order.
Remark loopexec :
forall s : St, Invar s -> {s' : St | Invar s' /\ LoopExit s'}.

Lemma while_not : forall s : St, precond s -> {s' : St | postcond s'}.