A practical framework for eliciting and modeling system dependability requirements: Experience from the NASA high dependability