static proof method for verifying programs running on tso