Abstract: A computer-implemented method, apparatus, and article of manufacture for verifying the total correctness of a computer program with mutually recursive procedures. A computer program is received into the computer as a series of source statements, wherein the source statements include annotations indicating the intended behavior of the source statements. The source statements are translated into an abstract syntax tree and a call graph of the program in the computer, wherein the call graph includes nodes representing procedures and directed arcs between the nodes representing procedure calls. The abstract syntax tree and call graph are analyzed for correctness by invoking a Verification Condition Generator in the computer to generate a set of verification conditions from the abstract syntax tree and call graph. The set of verification conditions are outputted as conditions to be proven to complete a proof of total correctness of the program.