Hint Resolve synt_wp_monotonic: hoare.
(** Below, a little tactic to decompose a pair in hypothesis [H] by giving the name [n] to the first component. *)
Ltac dec2 n H := case H; clear H; intros n H.

(* Specifications: *)
(** The property below is also satisfied by [wp] (using the fact that the language is deterministic). We need it here to prove the soundness. *)
Lemma synt_wp_conj:
forall (p: ImpProg) (post1 post2: Pred) e,
(synt_wp p post1 e) -> (synt_wp p post2 e)
-> (synt_wp p (fun e => post1 e /\ post2 e) e).
(** The proof of soundness proceeds by induction over [prog]. *)
Lemma wp_sound: forall prog post, synt_wp prog post |= prog [=post=].
Definition aux_wlp (prog: ImpProg) : Pred -> Pred
:= fun post e =>
match prog with
| Iskip => post e
| (Iset A x expr) => post (E.upd x (E.eval expr e) e)
| (Iif cond p1 p2) =>
forall e', exec e (if E.eval cond e then p1 else p2) e'
-> post e'
| (Iseq p1 p2) => forall e1 e2, exec e p1 e1 -> exec e1 p2 e2 -> post e2
| (Iwhile cond p) => forall e', exec e (Iif cond (Iseq p (Iwhile cond p)) Iskip) e' -> post e'
end.