Formal correct module