Formal Methods for the Security of Medical Devices