An Automatic SPIN Validation of a Safety Critical Railway Control System