The Application of Formal Methods to the Development of an ATP (Automatic Train Protection) System - Simpson, A (1995)