formal spec