The while loop

This module has to be used with the imperative module.

Let St be a Set of states, and precond,postcond:St->Prop.

In order to prove a result of the form:

(s:St)(precond s)->{s':St | (postcond s')}
you may define and build terms: Since only the 3 first of these 5 terms have an informative content, the usage we propose for the while loop is the following:

If the current goal is {s':St|(postcond s')}, and if precond,invar,term_order, loop_exit are correctly defined, x:St is a variable, then the following command will leave you only unresolved logical subgoals:

Apply while_not with precond invar term_order loopexit x;
    [ Realizer loopexit_dec |
      Realizer one_step |
      Auto or Idtac |
      Auto or Idtac |
      Auto or Idtac |
      Auto or Idtac ].
where the arguments of the two Realizer are respectively of type St->Prop and St->St.

An example can be found in the implementation of the logarithm of base 2

Apologies

We had no time to build a user-friendly "imperative" package, dealing with all sorts of loops, and control structures, breaks, and so on, with macros allowing to write directly commands of the form
Realizer {nat x y; while (zerop x) { ... }; return y;} 
We hope this will be done in few weeks.