A key idea followed in the software and system safety
community is that an identified hazard is best dealt with
by changing the requirements of the system so that the
hazard does not even occur. This modus operandi creates
a serious dilemma. The hazard identification, that is
needed in order to know what hazards to avoid, is best
done after the code has been written, because only then
are the potential effects of any particular stimulus, event,
etc. deducible. However, if the response to the identified
hazard is to change the requirements, then this requirements
change will happen only after the code is written.
Such changes are both expensive and dangerous. So, a
means to identify all hazards at requirements analysis
time is needed.