Formal Verification of Control System Software, Pi