formal analysis