Linking abstract analysis to concrete design: A hierarchical approach to verify medical CPS safety