Email Record: Defining and reasoning about model-based safety analysis :