Xen is formally verified?

No.