The program and the correctness proof grow hand in hand.