fix errors
make postcondition more precise
work on invariants