Formal verification of control software