Coverage Models for Formal Verification