“The job of formal methods is to elucidate the assumptions upon which formal correctness depends.”