System safety assessment based on STPA and model checking · Study