On the safety assessment of an automatic train operation system