formal verification IXL