Formal Control