From MC/DC to RC/DC: Formalization and Analysis of Control-Flow Testing Criteria