Correctness and the Loop Invariant