Formal Specification and Development of a Safety-Critical Train Management