use int.Int

type t = { mutable c : int }

let f ()
  ensures { result = 2 }
= let x = { c = 0 } in
    for i = 0 to 1 do
      invariant { x.c >= 0 }
      x.c <- x.c + 1
    done;
    x.c

(*
counterexamle: `x = 0`, `i = 2` at beggining of loop.

The execution of `f` with the counterexample:
- terminates normally if executed concretly;
- terminates in error if executed abstractly (postcondition fails)

It is a real counterexample due to underspecification (weak loop
invariant).
*)
