Safety Shutdown Systems: Design, Analysis, and Justification