From Verified Models to Verified Code for Safe Medical Devices