formal_spec