Assessing Air Traffic Control System Safety with System Controllability