Verified ifthenelse