The safety requirements engineering dilemma

A key idea followed in the software and system safety community is that an identified hazard is best dealt with by changing the requirements of the system so that the hazard does not even occur. This modus operandi creates a serious dilemma. The hazard identification, that is needed in order to know what hazards to avoid, is best done after the code has been written, because only then are the potential effects of any particular stimulus, event, etc. deducible. However, if the response to the identified hazard is to change the requirements, then this requirements change will happen only after the code is written. Such changes are both expensive and dangerous. So, a means to identify all hazards at requirements analysis time is needed