Formal model and verification of FTLs