I learnt dafny recently and I was trying to prove correctness for merge sort but I am facing errors related to loop invariants. Here is link to my dafny implementation - http://rise4fun.com/Dafny/JgOb. Here is a link to same code on pastebin as rise4fun doesn't keep the code around for long time: http://pastebin.com/xZRi8ZzT. I am unable to figure out what's that I am doing wrong. I can't understand why are these invariants failing:
invariant forall x,y:: i <= x <= m && 0 <= y < k < u-l+1 ==> buf[y] <= a[x]
invariant forall x,y:: j <= x <= u && 0 <= y < k < u-l+1 ==> buf[y] <= a[x]
invariant forall x,y:: i <= x <= m && 0 <= y < k < u-l+1 ==> buf[y] <= a[x]
invariant forall x,y:: j <= x <= u && 0 <= y < k < u-l+1 ==> buf[y] <= a[x]