Guarded commands, non-determinacy and a calculus for the derivation of programs