correctness and the loop invariant