Even perfect program verification can only establish that a program meets its specification. … Much of the essence of building a program is in fact the debugging of the specification.

Fred Brooks, No Silver Bullet (1986)