Formal Verification for DO-254 (and Other Safety-Critical) Designs