Deriving a simulation input generator and a coverage metric from a formal specification