Sequential application of heterogeneous models for the safety analysis of a control system: a case study