An Experience in Formal Verification of Safety Properties of a Railway Signalling Control System