Email Record: Rigorous development of complex fault-tolerant systems /