Formal patterns for medical device safety