Data Flow Control Systems: an Example of Safety Validation