Verification of Failure Impact by Model checking