Towards Formal Fault Injection for Safety Assessment of Automated Systems