Proof: Quotient Program

Specification:

    r(X,Y,Q,R) = { ( X, Y, X/Y, X mod Y ) | X >= 0 and Y > 0 }

   [Q := 0] o           compose functions computed
   [R := X] o           by each program statement
   [while R>=Y do
       Q := Q + 1
       R := R - Y
    end]