Inductive Invariant + Deadlock Freedom