extern unsigned int __VERIFIER_nondet_uint(); void abort() { }; unsigned int id(unsigned int x); unsigned int id2(unsigned int x); /*@ requires (1); ensures ((\result < 3)); @*/ unsigned int id(unsigned int x) { if (x==0) return 0; unsigned int ret = id2(x-1) + 1; if (ret > 2) return 2; return ret; } unsigned int id2(unsigned int x) { if (x==0) return 0; unsigned int ret = id(x-1) + 1; if (ret > 2) return 2; return ret; } int main() { unsigned int input = __VERIFIER_nondet_uint(); unsigned int result = id(input); if (result == 3) { ERROR: {/*@ assert(0); */;abort();} } }