// Bali version of corral
public int corral( int low, int value, int high )
   {
   // precondition on caller
   require low <= high;
   // postcondition guarantee of performance
   ensure low <= result && result <= high;
   if value <= low then return low; fi;
   if value >= high then return high; fi;
   return value;
   } end corral