proving s_correct