Sort of. We haven&#x27;t proven a <i>single thing</i> beyond certain size and complexity. That was true when it started back in Orange Book days. Even when Dijkstra came up with the stuff and the method of dealing witg it: composition w&#x2F; preconditions, postconditions, and invariants.<p>You code in a functional style and&#x2F;or with state machines composed. They composed stuff hierarchically and loopfree where possible to facilitate analysis. Each component is small enough to analyze for all success or failure states. The results of each become &quot;verification conditions&quot; for things that build on it. With such methods, one can build things that are as large as you want so long as each component (primitive or composite) can be analyzed.<p>Not clear at what point this breaks down. I used it for drivers, protocols, algorithms, systems, networks, and so one. I brute forced it with more manual analysis because Im not mathematical or trained enough for proofs. However, what holds it back on large things is usually just lack of effort far as I can tell.