Comment by eru

> where with formal verification, the specifications are lower-level, so validation is extra-important.

Specifications don't need to be lower-level. They also compose nicely. Ie you can figure out how to formally specify a 'this doesn't crash' requirement once, and then re-use it on all your projects.