I rather go with formal specifications, and proofs.