formal model