use on large systems at any but the highest level of abstraction.
Formal methods also have limitations in principle. A formal verification
can prove that an abstract description of an implementation satisfies a formal
specification or that some formal property is satisfied in the implementation.