proposition: Lemma newSensorOk : forall sensor trueLevel, refine (p <- (if Z.abs (sensor - trueLevel) <? sensorAccuracy then ret (trueLevel, ()) else trueLevel' <- {_ | True}; ret (trueLevel', ())); sensor' <- {nr' : Z | Z.abs (nr' - fst p) <= sensorAccuracy}; ret (sensor', snd p)) (ret (sensor, ())).
proof: Proof. implement; try match goal with | [ H : _ = ?sensor - ?E |- _ ] => unify E sensor; generalize sensorAccuracy_positive end; implement. Qed.
imports: Fiat.Common.Coq__8_4__8_5__Compat Ics