The spine of software : designing provably correct software, theory and practice :