formal_proof