reserve
  S for (4,1) integer bool-correct non empty non void BoolSignature,
  X for non-empty ManySortedSet of the carrier of S,
  T for vf-free integer all_vars_including inheriting_operations free_in_itself
  (X,S)-terms VarMSAlgebra over S,
  C for (4,1) integer bool-correct non-empty image of T,
  G for basic GeneratorSystem over S,X,T,
  A for IfWhileAlgebra of the generators of G,
  I for integer SortSymbol of S,
  x,y,z,m for pure (Element of (the generators of G).I),
  b for pure (Element of (the generators of G).the bool-sort of S),
  t,t1,t2 for Element of T,I,
  P for Algorithm of A,
  s,s1,s2 for Element of C-States(the generators of G);
reserve
  f for ExecutionFunction of A, C-States(the generators of G),
  (\falseC)-States(the generators of G, b);
reserve u for ManySortedFunction of FreeGen T, the Sorts of C;

theorem
  G is C-supported &
  (ex d being Function st d.b = 0 & d.x = 1 & d.y = 2 & d.m = 3) implies
  for s being Element of C-States(the generators of G)
  for n being Nat st n = s.I.m holds
   f in C-Execution(A,b,\falseC) implies
   f.(s, y:=(\1(T,I),A)\;
         while(b gt(@m, \0(T,I), A),
           if-then(@m is_odd(b,A), y:=(@y*@x,A))\;
           m:=(@m div \2(T,I),A)\; x:=(@x*@x,A)) ).I.y
   = (s.I.x)|^n
   proof
     assume
A1:  G is C-supported;
     given d being Function such that
A2:  d.b = 0 & d.x = 1 & d.y = 2 & d.m = 3;
     let s;
     let n be Nat;
     assume that
A3:  n = s.I.m and
A4:  f in C-Execution(A,b,\falseC);
     set Q = S;
     set S = C-States(the generators of G);
     set W = T; set g = f;
     set T = (\falseC)-States(the generators of G, b);
     set s0 = f.(s, y:=(\1(W,I),A));
A5:  f complies_with_if_wrt T by AOFA_000:def 32;
     defpred R[Element of S] means $1.I.m > 0;
     set Z = C;
     set C = b gt(@m, \0(W,I), A);
     defpred P[Element of S] means
     (s.I.x)|^n = ($1.I.y)*(($1.I.x)to_power($1.I.m)) &
     $1.I.m >= 0;
     deffunc F(Element of S) = In($1.I.m, NAT);
     set Y = I;
     set I = if-then(@m is_odd(b,A), y:=(@y*@x,A));
     set J = I\; m:=(@m div \2(W,Y),A)\; x:=(@x*@x,A);
A6:  m <> y by A2;
     then
A7:  s0.Y.m = s.Y.m by A1,A4,Th65;
A8:  for s being Element of S st P[s] holds P[g.(s,C) qua Element of S] &
     (g.(s,C) in T iff R[g.(s,C) qua Element of S])
     proof
       let s be Element of S such that
A9:    P[s];
       set s1 = g.(s, C);
A10:   s1.Y.x = s.Y.x by A1,A4,Th66;
       s1.Y.m = s.Y.m by A1,A4,Th66;
       hence P[g.(s,C) qua Element of S] by A1,A4,A9,A10,Th66;
A11:    \0(W,Y) value_at(Z,s) = 0 & @m value_at(Z,s) = s.Y.m by Th36,Th61;
       then
A12:   s.Y.m <= 0 implies s1 nin T by A1,A4,Th66;
       s.Y.m > 0 implies s1 in T by A11,A1,A4,Th66;
       hence thesis by A1,A4,A12,Th66;
     end;
A13: s0.Y.y = \1(W,Y) value_at(Z,s) by A1,A4,Th65 .= 1 by Th37;
     set fs = g.(s0, while(C,J));
     set s1 = g.(s0,C);
A14: (fs.Y.x) to_power 0 = 1 by POWER:24;
A15: m <> x by A2;
A16: for s being Element of S st R[s] holds (R[g.(s,J\;C) qua Element of S] iff
     g.(s,J\;C) in T) & F(g.(s,J\;C) qua Element of S) < F(s)
     proof
       let s be Element of S such that
A17:   s.Y.m > 0;
A18:   F(s) = s.Y.m by A17,SUBSET_1:def 8,INT_1:3;
       set q1 = g.(s,I);
       set q0 = g.(s, @m is_odd(b,A));
       set sJ = g.(s,J);
       set sC = g.(sJ,C);
A19:   g.(s,J\;C) = sC by AOFA_000:def 29;
A20:    \0(W,Y) value_at(Z,sJ) = 0 & @m value_at(Z,sJ) = sJ.Y.m by Th36,Th61;
       then
A21:   sJ.Y.m <= 0 implies sC nin T by A1,A4,Th66;
       sJ.Y.m > 0 implies sC in T by A20,A1,A4,Th66;
       hence R[g.(s,J\;C) qua Element of S] iff g.(s,J\;C) in T
       by A21,A19,A1,A4,Th66;
       set q2 = g.(q1,m:=(@m div \2(W,Y), A));
       set q3 = g.(q2,x:=(@x*@x,A));
A22:   q1 = g.(q0, y:=(@y*@x,A)) or q1 = g.(q0, EmptyIns A)
       by A5;
A23:    @m value_at(Z,q1) = q1.Y.m & \2(W,Y)value_at(Z,q1) = 2 by Th61,Th40;
       q2 = g.(s,I\;m:=(@m div \2(W,Y), A)) by AOFA_000:def 29;
       then q3 = g.(s,J) by AOFA_000:def 29;
       then
A24:   sJ.Y.m = q2.Y.m by A1,A4,A15,Th65
       .= (@m div \2(W,Y))value_at(Z,q1) by A1,A4,Th65
       .= (@m value_at(Z,q1)) div (\2(W,Y)value_at(Z,q1)) by Th43
       .= (q1.Y.m) div 2 by A23,AOFA_A00:55
       .= (q0.Y.m) div 2 by A1,A4,A6,A22,Th65,AOFA_000:def 28
       .= (s.Y.m) div 2 by A1,A4,Th67;
A25:   sC.Y.m = sJ.Y.m by A1,A4,Th66;
       then sC.Y.m in NAT by A17,A24,INT_1:3,61;
       then F(sC qua Element of S) = sC.Y.m by SUBSET_1:def 8;
       hence thesis by A17,A25,A19,A24,A18,INT_1:56;
     end;
     set q = s;
A26: x <> y by A2;
A27: for s being Element of S st P[s] & s in T & R[s]
     holds P[g.(s,J) qua Element of S]
     proof
       let s be Element of S such that
A28:   P[s] and
       s in T and
       R[s];
       reconsider sm = s.Y.m as Element of NAT by A28,INT_1:3;
       s.Y.m = ((sm) div 2)*2+((sm) mod 2) by NEWTON:66;
       then
A29:   (q.Y.x)|^n = (s.Y.y)*(((s.Y.x)to_power((sm div 2)*2))*
       ((s.Y.x)to_power(sm mod 2))) by A28,FIB_NUM2:5
       .= (s.Y.y)*((s.Y.x)to_power(sm mod 2))*((s.Y.x)to_power((sm div 2)*2))
       .= (s.Y.y)*((s.Y.x)to_power(sm mod 2))*
       (((s.Y.x)to_power 2) to_power (sm div 2)) by NEWTON:9
       .= (s.Y.y)*((s.Y.x)to_power(sm mod 2))*
       (((s.Y.x)*(s.Y.x)) to_power (sm div 2)) by NEWTON:81;
       set q1 = g.(s,I);
       set q0 = g.(s, @m is_odd(b,A));
       set sJ = g.(s,J);
       set q2 = g.(q1,m:=(@m div \2(W,Y), A));
       set q3 = g.(q2,x:=(@x*@x,A));
A30:   q1 = g.(q0, y:=(@y*@x,A)) or q1 = g.(q0, EmptyIns A)
       by A5;
A31:   q2.Y.x = q1.Y.x by A1,A4,A15,Th65
       .= q0.Y.x by A1,A4,A26,A30,Th65,AOFA_000:def 28;
A32:   q2.Y.y = q1.Y.y by A1,A4,A6,Th65;
A33:   q0.Y.y = s.Y.y by A1,A4,Th67;
A34:   q0.Y.x = s.Y.x by A1,A4,Th67;
       q2 = g.(s,I\;m:=(@m div \2(W,Y), A)) by AOFA_000:def 29;
       then
A35:   q3 = g.(s,J) by AOFA_000:def 29;
       then
A36:   sJ.Y.y = q2.Y.y by A1,A4,A26,Th65;
A37:   sm div 2 = s.Y.m div 2;
A38:   now
A39:      @m value_at(Z,s) = s.Y.m by Th61;
         then
A40:     q0.(the bool-sort of Q).b = (s.Y.m) mod 2 by A1,A4,Th67;
         per cases by A37,A40,NAT_D:12;
         suppose
A41:       q0.(the bool-sort of Q).b = FALSE;
           q0 is ManySortedFunction of the generators of G, the Sorts of Z &
           \falseZ = FALSE by Th10,AOFA_A00:48;
           then q0 nin T by A41,AOFA_A00:def 20;
           then q1 = g.(q0, EmptyIns A) by A5;
           then
A42:       q1.Y.y = q0.Y.y by AOFA_000:def 28;
A43:       (s.Y.y)*1 = s.Y.y;
           (s.Y.x)to_power 0 = 1 by POWER:24;
           hence (s.Y.y)*((s.Y.x)to_power(sm mod 2)) = sJ.Y.y
           by A1,A4,A39,A36,A32,A33,A41,A42,A43,Th67;
         end;
         suppose
A44:       q0.(the bool-sort of Q).b = TRUE;
A45:        @y value_at(Z,q0) = q0.Y.y & @x value_at(Z,q0) = q0.Y.x by Th61;
           q0 is ManySortedFunction of the generators of G, the Sorts of Z &
           \falseZ = FALSE by Th10,AOFA_A00:48;
           then q0 in T by A44,AOFA_A00:def 20;
           then q1 = g.(q0, y:=(@y*@x,A)) by A5;
           then
A46:       q1.Y.y = (@y*@x) value_at(Z,q0) by A1,A4,Th65
           .= (@y value_at(Z,q0))*(@x value_at(Z,q0)) by Th42
           .= (q0.Y.y)*(q0.Y.x) by A45,AOFA_A00:55;
           (s.Y.x)to_power 1 = s.Y.x & @m value_at(Z,s) = s.Y.m
           by Th61,POWER:25;
           hence (s.Y.y)*((s.Y.x)to_power(sm mod 2)) = sJ.Y.y
           by A1,A4,A34,A36,A32,A33,A44,A46,Th67;
         end;
       end;
A47:    @m value_at(Z,q1) = q1.Y.m & \2(W,Y) value_at(Z,q1) = 2 by Th61,Th40;
A48:    sJ.Y.m = q2.Y.m by A1,A4,A15,A35,Th65
       .= (@m div \2(W,Y)) value_at(Z,q1) by A1,A4,Th65
       .= (@m value_at(Z,q1))div(\2(W,Y) value_at(Z,q1)) by Th43
       .= (q1.Y.m) div 2 by A47,AOFA_A00:55
       .= (q0.Y.m) div 2 by A1,A4,A6,A30,Th65,AOFA_000:def 28
       .= (s.Y.m) div 2 by A1,A4,Th67;
A49:    @x value_at(Z,q2) = q2.Y.x by Th61;
       sJ.Y.x = (@x*@x) value_at(Z,q2) by A1,A4,A35,Th65
       .= (@x value_at(Z,q2))*(@x value_at(Z,q2)) by Th42
       .= (q2.Y.x)*(q2.Y.x) by A49,AOFA_A00:55;
       hence thesis by A48,A29,A31,A34,A38;
     end;
     @m value_at(Z,s0) = s0.Y.m & \0(W,Y) value_at(Z,s0) = 0 &
     s1.Y.m = s0.Y.m by A1,A4,Th36,Th61,Th66;
     then
A50: g.(s0,C) in T iff R[g.(s0,C) qua Element of S] by A1,A4,Th66;
A51: g iteration_terminates_for J\;C, g.(s0,C) from AOFA_000:sch 3(A50, A16);
     s0.Y.x = s.Y.x by A1,A4,A26,Th65;
     then
A52: P[s0 qua Element of S] by A3,A7,A13,POWER:41;
A53: P[g.(s0,while(C,J)) qua Element of S] &
     not R[g.(s0,while(C,J)) qua Element of S]
     from AOFA_000:sch 5(A52,A51,A27,A8);
     then fs.Y.m = 0;
     hence thesis by A53,A14,AOFA_000:def 29;
   end;
