A variety of industry standards for critical systems, such as RTCA DO-178C and ISO 26262, refer to the possibility of using formal methods to produce verification results for the purpose of certification. However, satisfying the expectations of a certification authority using verification results obtained by means of formal methods can be a formidable challenge. Dr. Joyce will describe some reasonable doubts that might be raised by a certification authority about a plan to use formal methods as a source of verification results in place of test-based results. He will explain how such doubts influenced guidance developed by the aerospace industry for use of formal methods in the certification of airborne software. Anticipating these doubts can be the basis of an effective strategy to use formal methods as part of the certification of a critical system.