Verifying Invariants in Object-Oriented Programs