(** ** Correctness invariant *)
(** The invariant over the state is as follows: - Points with several predecessors are mapped to [L.top] - Points not in the worklist satisfy their inequations (as in Kildall's algorithm). *)
Definition state_invariant (st: state) : Prop :=
(forall n, basic_block_map n = true -> st.(aval)!!n = L.top)
/\
(forall n,
In n st.(worklist) \/
(forall instr s, code!n = Some instr -> In s (successors instr) ->
L.ge st.(aval)!!s (transf n st.(aval)!!n))).

Lemma propagate_successors_invariant:
forall pc instr res rem,
code!pc = Some instr ->
state_invariant (mkstate res (pc :: rem)) ->
state_invariant
(propagate_successors basic_block_map (successors instr)
(transf pc res!!pc)
(mkstate res rem)).