Using theorem provers to guarantee closed-loop system properties | IEEE Conference Publication | IEEE Xplore