
module R

use real.Real

type t = { mutable c : real }

val a : t

val b : t

let f () : real
  diverges
  ensures { result < a.c }
  =
  a.c <- 1.0;
  b.c <- 2.0;
  while b.c < 10.0 do
    invariant { b.c < a.c + 5.0 }
    b.c <- a.c + b.c
  done;
  b.c

end
