---------------------------

{goal[x -> e]} x = e {goal}

{pre} S1 {pre-S2}     {pre-S2} S2 {goal}

----------------------------------------

          {pre} S1; S2 {goal}

    {pre-S1} S1 {goal}       {pre-S2} S2 {goal}

----------------------------------------------------

{(b ⇒ pre-S1) ∧ (~b ⇒ pre-S2)} (if (b) S1 S2) {goal}

    obligations = pre(f, AE ...)       assumptions = post(f, AE ...)

-------------------------------------------------------------------------

{obligations ∧ (assumptions ⇒ goal[x -> f(AE ...)])} x = f(AE ...) {goal}

where pre(f, AE ...) substitutes each argument AE

                     into the precondition of f

     post(f, AE ...) substitutes each argument AE

                     into the postcondition of f, and

                     replaces `result` in the

                     postcondition with f(AE ...)