demonstrates, [209] even when the final specification is expressed in a natural
language (e.g., English) rather than a formal language.
Security concerns are sometimes introduced into formal specifications in
a manner similar to the introduction of safety concerns. For example, a formal