A formal approach to support the identification of unsafe control actions of STPA for nuclear protection systems · Study