formal specification