The loop rule proves safety of a loop [a*]P by a loop invariant J:
[a*]P
J
P
a*
See also
Learning resources