Formally Proved Anti|tearing Properties of Embedded C Code