(** * Correctness of the transformation with respect to the relational specification *)
(** Correctness of the dependency graph traversal. *)
Section ANALYSIS.
Variable p: program.
Let pm := prog_defmap p.
Definition workset_invariant (w: workset) : Prop :=
forall id gd id',
IS.In id w -> ~List.In id (w_todo w) -> pm!id = Some gd -> ref_def gd id' ->
IS.In id' w.
Definition used_set_closed (u: IS.t) : Prop :=
forall id gd id',
IS.In id u -> pm!id = Some gd -> ref_def gd id' -> IS.In id' u.

(* Specifications: *)
Lemma iter_step_invariant:
forall w,
workset_invariant w ->
match iter_step pm w with
| inl u => used_set_closed u
| inr w' => workset_invariant w'
end.
Theorem used_globals_sound:
forall u, used_globals p pm = Some u -> used_set_closed u.
Theorem used_globals_incl:
forall u, used_globals p pm = Some u -> IS.Subset (initial_workset p) u.
Corollary used_globals_valid:
forall u,
used_globals p pm = Some u ->
IS.for_all (global_defined p pm) u = true ->
valid_used_set p u.