Hazard elimination is best done early in the lifecycle,
early enough to affect the requirements specification. The
hazard identification that is needed in order to know what
hazards to avoid is best done after the code has been written,
because only then are the potential effects of any particular
stimulus, event, etc. deducible. However, if the
response to the identified hazard is to change the requirements,
then these requirements change will happen only
after the code is written. Such changes are both expensive