An axiomatic basis for proving total correctness of goto-programs