(** * Correctness of the transformation with respect to the relational specification *)
(** Correctness of the dependency graph traversal. *)
Section ANALYSIS.
Variable p: program.
Let pm := prog_defmap p.
Definition workset_invariant (w: workset) : Prop :=
forall id gd id',
IS.In id w -> ~List.In id (w_todo w) -> pm!id = Some gd -> ref_def gd id' ->
IS.In id' w.
Definition used_set_closed (u: IS.t) : Prop :=
forall id gd id',
IS.In id u -> pm!id = Some gd -> ref_def gd id' -> IS.In id' u.

Theorem used_globals_incl:
forall u, used_globals p pm = Some u -> IS.Subset (initial_workset p) u.