Robotic surgery: formal verification of plans