Which of the following applications used formal methods for a safety-critical system in the railway industry?