answer: First I propose a loop invariant:

x >= 0 y == y0 prod == (x0 - x)*y0

I notice that this invariant, coupled with the exit condition: x <= 0, implies the output condition: prod == x0*y0. I must now show that the proposed invariant really is invariant. This is done by transition induction:

basis: The first time the invariant is encountered, it is true, since

a) x == x0 x0 >= 0 implies x >= 0

b) y == y0

c) x == x0 and prod == 0 implies prod == (x0 - x)*y0

induction step: Assume the invariant true at the current point, to show it is true the next time, if there is a next time. If there is a next time, then x > 0 from the test condition and, using primes to designate the values at that time:

x' == x - 1

y' == y

prod' == prod + y

To show x' >= 0 y' == y0 prod' == (x0 - x')*y0, we substitute for the primed quantities, which gives us that is sufficient to show:

x - 1 >= 0 y == y0 prod + y == (x0 - (x-1))*y0

The first conjunct follows from x > 0, the second follows from the induction hypothesis, and the third is equivalent to:

prod + y0 == (x0 - x + 1)*y0

which also follows from the induction hypothesis prod == (x0 - x)*y0