loop invariant contract