formal models