When we build systems to operate in hazardous or remote environments, and especially when we expect them to cooperate with others in support of a goal, we rely on them to operate as correctly as ...