[mejutoco]

Thanks for your example. I am not very familiar with it, so I learned a few things.

I guess I see the point of OPs question now.

The formal verification can only prove that something works according to a specification, not that it (or the specification) does what x stakeholder wanted.

In this sense, it makes the error surface smaller, but does not remove it.