Verification of a Safety-Critical Railway Interlocking System with Real-Time Constraints