“The job of formal methods is to elucidate the assumptions upon which formal correctness depends.” C.A.R. Hoare