how to prove loop invariant - Search