Hazard Analysis of Complex Distributed Railway Systems