Validation and real-life demonstration of ETCS hybrid level 3 principles using a formal B model