Guarded commands, nondeterminacy and formal derivation of programs | Synapse