Signal & Draht: Using model checking for interlocking software verification