subway models- formal verification and simulation