formally

If some hardware fails, a redundant system can still succeed, while a formally verified system is likely to fail.

But then the programmer becomes merely a human compiler, doing a provably-formally-equivalent transform to a formal specification.

Given some model of the way circuits work, it's possible to formally verify hardware as well.

Incidentally, the City of Vancouver formally ranks the priority of transportation modes in its planning: 1.

Another factor is that voice isn't very desirable for things that involve only formally specifying something.

But it seems like there would be consequences to being so formally (and publicly) ranked second, or lower, by your wife.

It's hard to talk abstractly about this for so long--until of course someone gets to building out these ideas more formally.

Is designing several independent systems (at least three, for voting to work) more or less expensive than formally verifying a single system?

We also rely on assumptions about TLB coherence in our virtual memory systems (TLBs are probably not formally assured, given the errata).

Maybe there was reason that the practice was formally dropped in Europe centuries ago...

There's an important difference between a formally verified system and redundant systems however.

I also found the 2012 edition of a ritual book[3] that his group used to formally mark the winter solstice.

Or at least something formally equivalent to source code, even if there is not a "compiler" for it.

A formally verified system is verified "software".