validity. Second, the safety properties often cause performance, flexibility, or other
constraints thatrequire trade-offs with otherrequirements.This is particularly true
forreal-time applications, and embedded control systems. Secure coding practices
as a whole need to be traded off against otherrequirements.