However a formal method cannot prove that a formal specification captures a
user’s intuitive understanding of a system and furthermore cannot prove that
an implementation runs correctly on every physical machine. As restated by
Barry W. Boehm, [102] formal methods are sometimes useful for verifying a