reserve A for preIfWhileAlgebra,
  C,I,J for Element of A;
reserve S for non empty set,
  T for Subset of S,
  s for Element of S;
reserve f for ExecutionFunction of A,S,T;

theorem
  for P being set for C,I,J being Element of A
  st C is_terminating_wrt f,P & I is_terminating_wrt f,P &
  J is_terminating_wrt f,P & P is_invariant_wrt C,f
  holds if-then-else(C,I,J) is_terminating_wrt f,P
proof
  let P be set;
  let C,I,J be Element of A such that
A1: for s being Element of S st s in P
  holds [s,C] in TerminatingPrograms(A, S, T, f) and
A2: for s being Element of S st s in P
  holds [s,I] in TerminatingPrograms(A, S, T, f) and
A3: for s being Element of S st s in P
  holds [s,J] in TerminatingPrograms(A, S, T, f) and
A4: for s being Element of S st s in P holds f.(s, C) in P;
  let s be Element of S;
  assume
A5: s in P;
A6: f.(s,C) in T or f.(s,C) nin T;
A7: [s,C] in TerminatingPrograms(A,S,T,f ) by A1,A5;
A8: [f.(s,C),I] in TerminatingPrograms(A,S,T,f) by A2,A4,A5;
  [f.(s,C),J] in TerminatingPrograms(A,S,T,f) by A3,A4,A5;
  hence thesis by A6,A7,A8,Def35;
end;
