Formal Analysis and Verification of Redundancy Management Logic for Inertial Navigation Processing Systems