Thanks for your example. I am not very familiar with it, so I learned a few things. I guess I see the point of OPs question now. The formal verification can o

Thanks for your example. I am not very familiar with it, so I learned a few things. I guess I see the point of OPs question now. The formal verification can only prove that something works according to a specification, not that it (or the specification) does what x stakeholder wanted. In this sense, it makes the error surface smaller, but does not remove it.