Formal Modeling and Verification of RBC Handover of ETCS Using Differential Dynamic Logic | IEEE Conference Publication | IEEE Xplore