Allowing Flexibility in Critical Systems: The EPOC Framework