hierarchical testing implied intent magellan model checking gps formal methods garmin verification navigation