Safety assessment of closed-loop level crossing control systems by means of STAMP (systems-theoretic accident model and processes)