Text this: The Application of Formal Methods to the Development of an ATP (Automatic Train Protection) System