inductive invariants