The same is true of both security and safety properties, which are both a form of
universal statement that “nothing bad will happen.”
Formal methods for design have been mandated for software that must
meet high assurance levels, for example, at CC EAL 7 and above. Formal