Sorry, got that wrong (it is late), meant to do this:
lowercase(str){ if(...){ assume(str=='format'); // wrong theorem } ... } action1(cmd){ cmd = lowercase( cmd ); if(cmd=='format') format_harddisk() } action2(cmd) // the same with assert() instead of assume() release: action1(cmd){ cmd = lowercase(cmd); if(cmd=='format') format_harddisk() } action2(cmd){ cmd = lowercase(cmd); format_harddisk() }