High-Integrity System Specification and Design