We could paraphrase Dijkstra --- with some liberty -- to say, "Formal verification of programs can only show the specification is fulfilled, not that the specif

We could paraphrase Dijkstra --- with some liberty -- to say, "Formal verification of programs can only show the specification is fulfilled, not that the specification is adequate."