[Proof of Smallintset] 7.3 Insert  What we must prove is: … The invariant of the loop is:  … (6) as may be verified by the proof … That (6) is true before the loop follows … We must now prove that the truth of … final condition. 
     Google-1
     Google-2
   
   Copyright clearance needed for quotation.