Formal methods are necessary in achieving correct software: that is, software that can be proven to fulfil its requirements. Formal specifications are unambiguous and analysable. Building a formal model improves understanding. The modelling of nondeterminism, and its subsequent removal in formal steps, allows design and implementation decisions to be made when most suitable. Formal models are amenable to mathematical manipulation and reasoning, and facilitate rigorous testing procedures. However, formal methods are not widely used in software development. In most cases, this is because they are not suitably supported with development tools. Further, many software developers do not recognise the need for rigour. Object oriented techniques are successful in the production of large, complex software systems. The methods are based on simple mathematical models of abstraction and classification. Further, the object oriented approach offers a conceptual consistency across all stages of soft...

. The search for a language which combines both functional and object-oriented features has a long and distinguished history [15, 16, 10, 8, 9, 34, 6, 17, 33, 39, 19]. The aim is to integrate the formal methods benefits of functional programming with the software engineering benefits of both paradigms. However, to date we know of no language which can claim to be both purely functional and purely object-oriented (and retains complete type safety). We present CLOVER, a new language which is 100% functional and 99% object-oriented. It is also completely type safe. We explain the design issues and how CLOVER achieves its aim. We also explain the "missing" 1%, discuss its relevance, and illustrate how its loss can be extenuated through the use of a new visual programming notation. 1 Introduction The object-oriented (OO) paradigm, together with an appropriate methodology, has successfully delivered many large projects. OO design (OOD) is used extensively in industry since it provides good ...