ANOTHER EXAMPLE (end)

Now let us introduce the stronger invariant
L2 { x = z ** (j-1) and z = input1 and y = input2}

The conjunction of L2 with {y < j} yields
{x = z ** (j-1) and z = input1 and y = input2
and j = y+1} ( j=y+1 is implied by j> y )
leading to
{ x = input1 ** input2}

Finally, we verify the segment

{input1 > 0 and input2 > 0}
read(z); read(y);
x := 1;
j := 1;
{ x = z ** (j-1) and z = input1 and y = input2}

and this completes the proof.