generated at
structural induction
Loop invariant, analog for loops