Recursive Operability Analysis of systems with multiple protection devices