Proving Safety of a Railway Signalling System Incorporating Geographic Data