  Safety supervisors are controllers enforcing safety properties by keeping a
system in (or returning it to) a safe state. The development of such
high-integrity components can benefit from a rigorous workflow integrating
formal design and verification. In this paper, we present a workflow for the
sound development of safety supervisors combining the best of two worlds,
verified synthesis and complete testing. Synthesis allows one to focus on
problem specification and model validation. Testing compensates for the
crossing of abstraction, formalism, and tool boundaries and is a key element to
obtain certification credit before entry into service. We establish soundness
of our workflow through a rigorous argument. Our approach is tool-supported,
aims at modern autonomous systems, and is illustrated with a collaborative
robotics example.
