The propagation of faults in process. IX : Trip systems in fault tree synthesis