A Formal Approach to Railways Interlocking Design