protected against invalid moves