A Formal Methodology For Engineering Heterogeneous Railway Signalling Systems