SafetySharp formal specification updated