reserve
  S for (4,1) integer bool-correct non empty non void BoolSignature,
  X for non-empty ManySortedSet of the carrier of S,
  T for vf-free integer all_vars_including inheriting_operations free_in_itself
  (X,S)-terms VarMSAlgebra over S,
  C for (4,1) integer bool-correct non-empty image of T,
  G for basic GeneratorSystem over S,X,T,
  A for IfWhileAlgebra of the generators of G,
  I for integer SortSymbol of S,
  x,y,z,m for pure (Element of (the generators of G).I),
  b for pure (Element of (the generators of G).the bool-sort of S),
  t,t1,t2 for Element of T,I,
  P for Algorithm of A,
  s,s1,s2 for Element of C-States(the generators of G);
reserve
  f for ExecutionFunction of A, C-States(the generators of G),
  (\falseC)-States(the generators of G, b);
reserve u for ManySortedFunction of FreeGen T, the Sorts of C;

theorem
  for A being elementary IfWhileAlgebra of the generators of G
  for f being ExecutionFunction of A, C-States(the generators of G),
  (\falseC)-States(the generators of G,b) holds
  G is C-supported & f in C-Execution(A,b,\falseC) &
  (ex d being Function st d.x = 1 & d.y = 2 & d.m = 3) implies
         y:=(\1(T,I),A)\;
         while(b gt(@m, \0(T,I), A),
           if-then(@m is_odd(b,A), y:=(@y*@x,A))\;
           m:=(@m div \2(T,I),A)\; x:=(@x*@x,A))
  is_terminating_wrt f, {s: s.I.m >= 0}
proof
  let A be elementary IfWhileAlgebra of the generators of G;
  let f be ExecutionFunction of A, C-States(the generators of G),
  (\falseC)-States(the generators of G,b);
  assume
A1: G is C-supported & f in C-Execution(A,b,\falseC);
  set ST = C-States(the generators of G);
  set TV = (\falseC)-States(the generators of G,b);
  set P = {s: s.I.m >= 0};
  given d being Function such that
A2: d.x = 1 and
A3: d.y = 2 and
A4: d.m = 3;
A5: I <> the bool-sort of S by AOFA_A00:53;
  set W = b gt(@m, \0(T,I),A);
A6: y:=(\1(T,I),A) is_terminating_wrt f, P by AOFA_000:107;
  deffunc F(Element of ST) = In($1.I.m, NAT);
  defpred R[Element of ST] means $1.I.m > 0;
  set K = if-then(@m is_odd(b,A), y:=(@y*@x,A));
  set J = K\; m:=(@m div \2(T,I),A)\; x:=(@x*@x,A);
A7: f complies_with_if_wrt TV by AOFA_000:def 32;
A8: P is_invariant_wrt W,f
  proof
    let s be Element of ST;
    assume s in P;
    then
A9: ex s1 being Element of ST st s = s1 & s1.I.m >= 0;
    f.(s, W).I.m = s.I.m by A1,Th66;
    hence f.(s, W) in P by A9;
  end;
A10: for s being Element of ST st s in P & f.(f.(s,J),W) in TV
    holds f.(s,J) in P
  proof
    let s be Element of ST such that
    s in P;
A11: \0(T,I) value_at(C,f.(s,J)) = 0 by Th36;
    assume f.(f.(s,J),W) in TV;
    then @m value_at(C,f.(s,J)) > \0(T,I) value_at(C,f.(s,J)) by A1,Th66;
    then f.(s,J).I.m > 0 by A11,Th61;
    hence thesis;
  end;
A12: m <> y by A4,A3;
A13: P is_invariant_wrt y:=(\1(T,I),A), f
  proof
    let s;
    assume s in P;
    then
A14: ex s9 being Element of ST st s = s9 & s9.I.m >= 0;
    f.(s, y:=(\1(T,I),A)).I.m = s.I.m by A12,A1,Th65;
    hence f.(s, y:=(\1(T,I),A)) in P by A14;
  end;
A15: m <> x by A4,A2;
A16: for s st f.(s,W) in P holds f iteration_terminates_for J\;W, f.(s,W)
  proof
A17: for s being Element of ST st R[s] holds (R[f.(s,J\;W)] iff f.(s,J\;W)
    in TV) & F(f.(s,J\;W)) < F(s)
    proof
      let s be Element of ST such that
A18:  s.I.m > 0;
A19:  F(s) = s.I.m by A18,SUBSET_1:def 8,INT_1:3;
      set q1 = f.(s,K);
      set q0 = f.(s, @m is_odd(b,A));
      set sJ = f.(s,J);
      set sC = f.(sJ,W);
A20:  f.(s,J\;W) = sC by AOFA_000:def 29;
A21:   sC.I.m = sJ.I.m & \0(T,I) value_at(C,sC) = 0 by Th36,A5,A1,Th65;
A22:   @m value_at(C,sJ) = sJ.I.m & \0(T,I) value_at(C,sJ) = 0 by Th36,Th61;
      thus R[f.(s,J\;W)] iff f.(s,J\;W) in TV by A21,A20,A22,A1,Th66;
      set q2 = f.(q1,m:=(@m div \2(T,I),A));
      set q3 = f.(q2,x:=(@x*@x,A));
A23:  q1 = f.(q0, y:=(@y*@x,A)) or q1 = f.(q0, EmptyIns A)
      by A7;
A24:   @m value_at(C,q1) = q1.I.m by Th61;
A25:   \2(T,I) value_at(C,q1) = 2 by Th40;
      q2 = f.(s,K\;m:=(@m div \2(T,I),A)) by AOFA_000:def 29;
      then q3 = f.(s,J) by AOFA_000:def 29;
      then
A26:  sJ.I.m = q2.I.m by A15,A1,Th65
        .= (@m div \2(T,I)) value_at(C,q1) by A1,Th65
        .= (@m value_at(C,q1)) div (\2(T,I) value_at(C,q1)) by Th43
        .= (q1.I.m) div 2 by A24,A25,AOFA_A00:55
        .= (q0.I.m) div 2 by A12,A23,A1,Th65,AOFA_000:def 28
        .= (s.I.m) div 2 by A5,Th65,A1;
A27:  sC.I.m = sJ.I.m by A1,Th66;
      then sC.I.m in NAT by A18,A26,INT_1:3,61;
      then F(sC) = sC.I.m by SUBSET_1:def 8;
      hence thesis by A18,A27,A20,A26,A19,INT_1:56;
    end;
    let s0 be Element of ST such that
    f.(s0,W) in P;
    set s1 = f.(s0,W);
A28: s0.I.m = @m value_at(C,s0) & \0(T,I) value_at(C,s0) = 0 by Th36,Th61;
    then
A29: s0.I.m <= 0 implies s1 nin TV by A1,Th66;
    s0.I.m > 0 implies s1 in TV by A28,A1,Th66;
    then
A30: f.(s0,W) in TV iff R[f.(s0,W)] by A29,A1,Th66;
    thus f iteration_terminates_for J\;W, f.(s0,W) from AOFA_000:sch 3(A30,A17
    );
  end;
  J is_terminating_wrt f,P by AOFA_000:107;
  then while(b gt(@m, \0(T,I), A), if-then(@m is_odd(b,A), y:=(@y*@x,A))\;
  m:=(@m div \2(T,I),A)\; x:=(@x*@x,A) )
  is_terminating_wrt f, P by A8,A10,A16,AOFA_000:104,118;
  hence thesis by A6,A13,AOFA_000:111;
end;
