Guarded commands, non-determinacy and formal derivation of programs