Formally verifying a floating-point division routine with Gappa – part 1