check invariant / post cond