Formal correctness prover
