(** * Auxiliary lemmas for completeness  The proof of completeness requires to exhibit a variant. The purpose of the following lemmas is to build this variant. *)
(** ** A technical issue: the inversion of [exec]  If your are not interested in Coq details, you may skip this part which only explains how to avoid the assumption of a (consistent and standard) axiom to prove the completeness.  Because the use of dependent types in constructor [exec_Iset], the standard inversion of Coq may fail on [exec] (see [exec_test_inversion] below).  This comes from the fact the following property is not provable in the core theory of Coq (although it is consistent with it) :  [forall A (x1 x2:E.Var A) e1 e2, (Iset x1 e1)=(Iset x2 e2) -> x1=x2 /\ e1=e2.]  To deal with this problem, we may assume a (consistent) axiom given in #<a href=http://coq.inria.fr/V8.1/stdlib/Coq.Logic.EqdepFacts.html># [EqdepFacts]#</a>#. But here, we can avoid this axiom.  Indeed, I define an ad-hoc inversion lemma for [exec] called [exec_inversion] below. This lemma is directly derived from the notion of weakest liberal precondition: [aux_wlp] is an other alternative definition of [wlp].  *)

(* Specifications: *)
(** This lemma is my inversion lemma of [exec]. It expresses the "soundness" of [aux_wlp]. *)
Lemma exec_inversion:
forall prog e e', (exec e prog e') -> forall post, (aux_wlp prog post e) -> post e'.
(** Here is the case, where the previous lemma is better than the standard inversion of Coq. *)
Lemma exec_test_inversion:
forall A (x:E.Var A) expr e e',
(exec e (Iset x expr) e') -> e'=(E.upd x (E.eval expr e) e).