new design by contract wih invariants