correct by construction