Formal Verification of a Superscalar Execution Unit 1