EXAMPLE (continued)

Now we take the invariant,
L1: {input1 = div * y + x}

and the negation of the loop condition,
{ x < y}, their conjunction is

{input1 = div * y + x and x < y}

which does NOT imply,

{input1 = div * input2 + x and 0 =< x < input2}

We need to add {y = input2} and { x >= o}.

So we formulate a stronger invariant:

L2: {input1 = div * y + x and x >= 0 and y = input2}