What formal verification system did they use? Did they even execute it?