Formal Verification of Medical CPS