Medical Device Interoperability With Provable Safety Properties