correctness and the loop invariant - Search