Using Formal Models to Plan Control System Testing