What’s wrong with Simulink? It is better than the average C developers code in terms of safety and correctness