Proving SIFA protection of masked redundant circuits