Specify, implement, and prove the correctness of a program that
swaps the array values a['x] and a['y].
In the precondition, you can either specify the initial values
of a['x] and a['y]:
var S : Store .
vars X Y : Int .
eq pre(S,X,Y) = (S[[ a['x] ]]) is X and (S[[ a['y] ]]) is Y .
or you can specify the inital value of the array variable a:
var S : Store .
var A : Array .
eq pre(S,A,X,Y) = (S[[ a ]]) == A and (S[['x]]) is X and ...
(in which case, the postcondition should state that,
in the store S that results from running the program,
S[[ a['x] ]] is A[Y], etc.).