(** * Correctness of the transformation with respect to the relational specification *)
(** Correctness of the dependency graph traversal. *)
Section ANALYSIS.
Variable p: program.
Let pm := prog_defmap p.
Definition workset_invariant (w: workset) : Prop :=
forall id gd id',
IS.In id w -> ~List.In id (w_todo w) -> pm!id = Some gd -> ref_def gd id' ->
IS.In id' w.
Definition used_set_closed (u: IS.t) : Prop :=
forall id gd id',
IS.In id u -> pm!id = Some gd -> ref_def gd id' -> IS.In id' u.

Lemma iter_step_invariant:
forall w,
workset_invariant w ->
match iter_step pm w with
| inl u => used_set_closed u
| inr w' => workset_invariant w'
end.