A Formal Specification of an Automatic Train Protection System - Simpson, A (1994)