SPARK: Formal Verification and Proving Program Correctness in Ada