Predicate transformer semantics