APPLICATION OF FORMAL METHODS TO RAILWAY SIGNALLING