
use int.Int

type t = { mutable c : int }

let f (z: int) =
  let x1 = { c = z } in
  let x2 = { c = 0 } in
  let i = { c = 0 } in
  while i.c < 2 do
    variant { 2 - i.c }
    invariant { i.c > 0 -> x1.c >= 0 }
    if i.c = 0 then
      x1.c <- x1.c + 1
    else
      x2.c <- x2.c + 1;
    i.c <- i.c + 1
  done

(*
counterexample: `x1 = -2`, `i = 0` at the beginning of the loop.

The execution of `f` with the counterexample:
- terminates normally if executed concretely;
- terminates in error if executed abstractly (invariant preservation
  fails)

It is a real counterexample due to underspecification (weak loop
invariant).
*)
