at least one assert that holds in the body of the loop. You can choose what the invariant is