Resolving the differences between system development and system operation using STAMP: a road safety case study in a low-income setting