Workflows for robotics programmes

Robotics teams ship fast and still owe a safety argument and a specification. These generate both from the model, and say plainly which parts the model cannot yet support.