invariant checked