Model-in-the-Loop Testing of a Railway Interlocking System