Building systems that are correct by design has always been a major challenge of software development. Typical software development approaches (and in particular interactive systems development approaches) are based around the notion of prototyping and testing. However, except for simple systems, testing cannot guarantee absence of errors, and, in the case of interactive systems, testing with r...