Closed-loop Verification of Pacemaker Software