a>=asqrV0c0F
empty_shape
a<=asqrV1asqrV2Ia<=V1V2Aa<=c0V1F
a=asqra+V3V4a+a+asqrV3a*a*c2V3V4asqrV4F
iaisqrt_specV0V2a=V4asqra+V3c1Aa>=V0asqrV3Aa>=V3c0Aa<a-V0V3a-V0V2Aa<=c0a-V0V2Ia=V4a+V1a+a*c2V3c1FIa=V3a+V2c1Fa<=V1V0Ia=V1asqra+V2c1Aa>=V0asqrV2Aa>=V2c0FAa=c1asqra+c0c1Aa>=V0asqrc0Aa>=c0c0Ia>=V0c0F
VC for isqrt
a=V0c4Iaisqrt_specc17V0FAa>=c17c0
VC for main
aisqrt_specV0c0Ia=V0c0Ia>=V0c0F
postcondition
aisqrt_specV0c1Ia<=V0c3INa=V0c0Ia>=V0c0F
Na=c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
check division by zero
a>adiva+c1V0c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
loop invariant init
a>V0c0Ia>adiva+c1V0c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
a=adiva+c1V0c2adiva+adivV0V0V0c2Ia>V0c0Ia>adiva+c1V0c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+V0c1Ia=adiva+c1V0c2adiva+adivV0V0V0c2Ia>V0c0Ia>adiva+c1V0c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+adiva+c1V0c2c1Ia<V0asqra+V0c1Ia=adiva+c1V0c2adiva+adivV0V0V0c2Ia>V0c0Ia>adiva+c1V0c2c0INa<=V0c3INa=V0c0Ia>=V0c0F
Na=V1c0Ia=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
Na=c2c0Ia=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
VC for sqrt
a<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a=a*c4a-asqra+V4c1V0a-asqra+a*c2V4c2a*c4V0Ia<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a>=a-asqra+a*c2V4c2a*c4V0a-asqra+a+V5V3c1a*c4V0Ia<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a>a-asqra+a+V5V3c1a*c4V0a-asqra+a+V5V3c1a*c4a+a*V5V3V3Ia<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a=a-asqra+a+V5V3c1a*c4a+a*V5V3V3asqra-a+V5c1V3Ia<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a>=asqra-a+V5c1V3c0Ia<=asqra+a+V5V3c1asqra+a*c2V4c2Ia<=a+V5V3a+a*c2V4c1Ia<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+V4c1Ia>=asqra-a+V5c1V3c0Aa=a-asqra+a+V5V3c1a*c4a+a*V5V3V3asqra-a+V5c1V3Aa>a-asqra+a+V5V3c1a*c4V0a-asqra+a+V5V3c1a*c4a+a*V5V3V3Aa>=a-asqra+a*c2V4c2a*c4V0a-asqra+a+V5V3c1a*c4V0Aa=a*c4a-asqra+V4c1V0a-asqra+a*c2V4c2a*c4V0Aa<=asqra+a+V5V3c1asqra+a*c2V4c2Aa<=a+V5V3a+a*c2V4c1Aa<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+V4c1ItOtOtOtOa>=asqra-a+V5c1V3c0Aa=a-asqra+a+V5V3c1a*c4a+a*V5V3V3asqra-a+V5c1V3Aa>a-asqra+a+V5V3c1a*c4V0a-asqra+a+V5V3c1a*c4a+a*V5V3V3Aa>=a-asqra+a*c2V4c2a*c4V0a-asqra+a+V5V3c1a*c4V0Aa=a*c4a-asqra+V4c1V0a-asqra+a*c2V4c2a*c4V0Aa<=asqra+a+V5V3c1asqra+a*c2V4c2Aa<=a+V5V3a+a*c2V4c1Aa<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
assertion
a<V3V2Aa<=c0V2Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
loop variant decrease
a>V4c0Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
loop invariant preservation
a>V3c0Ia>V4c0Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a=V4adiva+adivV0V3V3c2Ia>V3c0Ia>V4c0Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+V3c1Ia=V4adiva+adivV0V3V3c2Ia>V3c0Ia>V4c0Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<V0asqra+V4c1Ia<V0asqra+V3c1Ia=V4adiva+adivV0V3V3c2Ia>V3c0Ia>V4c0Ia<V0asqra+V4c1Ia=V4adiva+adivV0V1V1c2FIa=V3V1FIa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
a<=a*V2V2a*adivV0V2V2ItOa<=V2adivV0V2INa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
aisqrt_specV0V2Ia<=a*V2V2a*adivV0V2V2INa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FINa<=V0c3INa=V0c0Ia>=V0c0F
iiiaisqrt_specV0V2Aa<=a*V2V2a*adivV0V2V2ItOa<=V2adivV0V2a<V0asqra+V4c1Aa<V0asqra+V3c1Aa=V4adiva+adivV0V3V3c2Aa>V3c0Aa>V4c0Aa<V3V2Aa<=c0V2Aa<V0asqra+V4c1ItOtOtOtOa>=asqra-a+V5c1V3c0Aa=a-asqra+a+V5V3c1a*c4a+a*V5V3V3asqra-a+V5c1V3Aa>a-asqra+a+V5V3c1a*c4V0a-asqra+a+V5V3c1a*c4a+a*V5V3V3Aa>=a-asqra+a*c2V4c2a*c4V0a-asqra+a+V5V3c1a*c4V0Aa=a*c4a-asqra+V4c1V0a-asqra+a*c2V4c2a*c4V0Aa<=asqra+a+V5V3c1asqra+a*c2V4c2Aa<=a+V5V3a+a*c2V4c1Aa<V0a+a*V5V3V3LadivV0V3Ia=V4adiva+adivV0V1V1c2FANa=c2c0ANa=V1c0Ia=V3V1Fa<V1V2Ia<V0asqra+V1c1Aa<V0asqra+V2c1Aa=V1adiva+adivV0V2V2c2Aa>V2c0Aa>V1c0FAa<V0asqra+adiva+c1V0c2c1Aa<V0asqra+V0c1Aa=adiva+c1V0c2adiva+adivV0V0V0c2Aa>V0c0Aa>adiva+c1V0c2c0ANa=c2c0aisqrt_specV0c1a<=V0c3aisqrt_specV0c0a=V0c0Ia>=V0c0F

90348073133e5b6aa1f534b1b39a04f2 1H0
0da047f2772315702a6913fcb405b592 1H2H0
0194134a261dff7e0f0ca7d665440bc6 1H3H2H0
8451814bfea31fa584b37b8b05d6b671 5H4
c748ef8eee8f76c7a45be2149293aac1 7H6
c80c3791e759e1f2edea0702d6022b53 22H43
de611b6070160489dbec39b890478b04 9H8
68772b8c8f2161db9605b556211489c6 9H10
155724424ff6af95dd829e78c06bc1cd 12H11
13c16fd174bbaca582e07ba362abb75b 14H13
c9dc905572b5c113aea587204377266d 14H15
8939025fdea4bfeeeacf41439c6b7f11 14H16
387caa0f61a0b57b77e609e96ac68a36 14H17
92d10651f067fdeecaad7a36eabe30e3 14H18
29c9e90ad88007d9d3eba8a5f4ea3337 12H19
8114ed854962ddd5d919b2da31dcd723 12H20
d58d6edb4b84f255d9ccabaa40e015c0 32H31
537d675ee4b10b3301e7146e0bd0cd8a 22H21
df38bcbb4b794c3dce952d28b4a0282e 22H23
4a4f7a3ec0c870745e1b88d511360eb1 22H24
4273b67f106d8be53397f2cf7bd6a5fe 22H25
c40522e74dd46bef039d30aeb86f02be 22H26
680c062b54bbe76599e6bf57f16673e1 22H27
d93f0dc7d6bcefa5b8aed54cf5b2e477 22H28
f9707a5529ea8fa5dc77534d6c9384e4 22H29
3dda806fe0025416a68ff32fc2c011da 22H30
edc5d851e39899b6c4ddca57dd154fac 34H33
e131d1e51ff5f760b18a89764080a565 36H35
3841597962b5212c1e880af678348d20 36H37
d1027fedd978f47eab88554e19ae5785 36H38
94e6832eaf1fca97afcf68de4b8ab193 36H39
805ef6a7e0a814374f446360883333ff 36H40
f73474de994f9e4440ce3bba7952aa7a 32H41
0687850b08b736a49efed0433320f486 9H42
