Using Algebraic Specification in Floyd-Hoare Assertions