Correctness by construction: Better can also be cheaper
Is Proof More Cost Effective Than Testing