KeYmaera: A Hybrid Theorem Prover for Hybrid Systems