BFL: a Logic to Reason about Fault Trees