Proving Correctness with Respect to Nondeterministic Safety Specifications