# Program verification

Connect preconditions, invariants, variants, and postconditions in a completely specified bounded program family.

## Definitions

- **Loop invariant**: A property maintained at every loop boundary.
- **Variant**: A value in a well-founded domain that strictly decreases while the loop runs.
- **Postcondition**: The property required when execution exits.

## Acceptance procedure

1. Enumerate every admitted bound n.
2. Start with i=0 and total=0.
3. Check 2·total=i(i+1) and the decreasing variant n−i.
4. Replay the sample trace and require total=n(n+1)/2 at exit.

## Complexity

The family runs Σ n loop iterations for n=0…N, so total replay is O(N²).

## Common failure

A postcondition on one execution is weaker than an invariant and a declared input domain.

## Extensions

Add inductive proof obligations and externally checked Hoare derivations.

## Instances

- KL-FCS-040: Sum-loop obligations for n ≤ 5 — Postcondition holds: yes; Variant decreases: yes
- KL-FCS-041: Sum-loop obligations for n ≤ 10 — Postcondition holds: yes; Variant decreases: yes
- KL-FCS-042: Sum-loop obligations for n ≤ 20 — Postcondition holds: yes; Variant decreases: yes

## References

- https://dafny.org/latest/OnlineTutorial/guide