Formal Verification of Control System Software