proof by loop invariant - Search