As far as I know, critical systems like reactor control software is mathematically proven first and verified after implementation. I don’t think you can go beyond that.