# $Id$
def int_division(x, y):
"""Requires: x >= 0 and y > 0
Ensures, result is a pair (quot, rem) such that
0 <= rem and rem < y and quot*y+rem == x."""
assert x >= 0 and y > 0
#initialization
quot = 0
rem = x
# the loop invariant follows
assert 0 <= rem and quot*y+rem == x
while rem >= y:
# decrease rem while maintaining the invariant
rem = rem-y
quot = quot+1
assert 0 <= rem and quot*y+rem == x
# now the negation of the guard and the invariant hold
assert 0 <= rem and rem < y and quot*y+rem == x
return (quot, rem)