Deductive Program Design