Formal For Safety-Critical Designs