(5.5.9) Proving Correctness with Loop Invariants