How to design, verify and validate emergency shutdown systems