(** Invariance property. *)
Variable P: A -> Prop.
Variable Q: B -> Prop.
Hypothesis step_prop:
forall a : A, P a ->
match step a with inl b => Q b | inr a' => P a' end.

(* Specifications: *)
Lemma iter_prop:
forall n a b, P a -> iter n a = Some b -> Q b.
Lemma iterate_prop:
forall a b, iterate a = Some b -> P a -> Q b.