Abstract: Software verification using two-state invariants is described. In an embodiment a verifier represents an annotated program to be verified as a plurality of atomic transitions between global program states, each state comprising a plurality of objects. For example, the verifier accesses the annotations which specify a two-state invariant for each object. A two-state invariant is a predicate that relates a global program state before a state transition to the state after that state transition. In an example some of the two-state invariants are cross-object in that they refer to other objects. For example, a verification system checks that only the two-state invariants of the objects which changed in each transition are preserved; this modularity enables the verifier to work for large code bases and concurrent software. In an example the modularity is possible since the two-state invariants meet an admissibility requirement which is independent of the functionality of the program.