System safety analysis