Such an argument takes the form of a mathematical induction, which asserts that the state after each repetition is a suitable starting state for the next repetition. An invariant assertion is not enough, by itself, to assure a solution. To rule out the possibility of a program running forever without giving an answer, one must also show that the postcondition will eventually be reached. This can be done by showing that each repetition makes a definite increment of progress toward the postcondition, and that only a finite number of such increments are possible. Although notionally straightforward, the formal verification of everyday programs poses a daunting challenge.
Familiar programs repeat thousands of elementary steps millions of times.
To carry mathematical arguments through on this scale requires automation in the form of verification tools. Nevertheless, it is possible for these few pages to describe complex or subtle behavior. In these cases, verification tools come in handy.