Proving safety properties for embedded control systems