Section sss_loop.
(* P contains a loop that modifies the data (in a way computable by f) when condition C1 is satisfied and otherwise stops somewhere outside of P when condition C2 is satisfied.  Then P stops iff exists n, C2 (iter f x n) *)
Variable (P : code) (pre : data -> Prop) (spec : data -> data -> Prop)
(f : data -> data) (Hf : forall x, x <> f x)
(C1 C2 : data -> Prop) (HC : forall x, pre x -> { C1 x } + { C2 x })
(i : nat) (p : nat) (Hp : out_code p P)
(HP1 : forall x, pre x -> C1 x -> P // (i,x) ->> (i,f x) /\ pre (f x))
(HP2 : forall x, pre x -> C2 x -> exists y, P // (i,x) ->> (p,y) /\ spec x y).

Theorem sss_loop_sound x : pre x
-> (exists n, C2 (iter f x n))
-> exists n y, P // (i,x) ->> (p,y) /\ spec (iter f x n) y.