A Logic for Abstract State Machines