Driving safety and trust: Why formal methods are the next step for automotive software