Under Consideration for Publication in Formal Aspects of Computing Assuring Property Conformance of Code Generators via Model Checking