Exercise 1.16: basic algorithm / loop invariant