Formal Verification versus Simulation