(** ** Correctness of the solution returned by [fixpoint]. *)
(** As a consequence of the [good_state] invariant, the result of [fixpoint], if defined, is a solution of the dataflow inequations. This assumes that the transfer function maps [L.bot] to [L.bot]. *)

Theorem fixpoint_solution:
forall ep ev res n instr s,
fixpoint ep ev = Some res ->
code!n = Some instr ->
In s (successors instr) ->
(forall n, L.eq (transf n L.bot) L.bot) ->
L.ge res!!s (transf n res!!n).