Formal models