Hierarchical Modelling of Complex Control Systems: Dependability Analysis of a Railway Interlocking