1. An analytical software design system comprising: a verified specification generator including a processor arranged to enable received informal design specifications of a software system to be developed for each component of the software system into: (i) formal design specifications; and (ii) formal interface specifications of required run-time interface behavior which capture run-time behavior present at respective interfaces of the each component with all other components with which the component interacts, the verified specification generator comprising: a model generator arranged to generate automatically, for each of the components, a mathematical model of run-time system behavior for the component with all other components with which the component interacts from the formal design specifications and the formal interface specifications; and a model verifier arranged to analyze the mathematical models to determine if the mathematical models have required run-time system behavior for the corresponding components, to identify errors in the formal interface specifications and the formal design specifications, and to feedback the errors into at least one of the informal or formal design specifications; wherein the verified specification generator is arranged to enable user adjustment of the formal interface specifications and the formal design specifications to generate corrected mathematical models respectively for the components, to analyze the corrected mathematical models, to identify errors, to feedback the errors until the required run-time system behavior for the corresponding component is achieved, and to derive the verified design specifications from error-free mathematical models.