Text this: A Formal Verification Methodology for DDD Mode Pacemaker Control Programs