Modeling railway control systems in promela