Verification of object-oriented programs: A transformational approach