Coverage of Formal Properties based on a High-Level Fault Model and Functional ATPG