Restore Invariant Approach; 2.2 Behavioural Guarantees; Verification of the Functional