If risks are not identified, they are unlikely to be addressed, possibly resulting in undesirable consequences, such as fatal accidents or even loss of human lives.Furthermore, risks should be considered not only in terms of system behavior but also events occurring in the system environment -i.e., in a collaborative setting in which the system and its environment work together towards certain goals the system is intended to help achieve.In this paper, we present a goal-oriented risk analysis framework, Murphy+G, in which non-functional requirements (hereafter, NFRs) are treated as softgoals to be achieved and systematically addressed in terms of both the system and its environment during requirements engineering, by adopting what is called the Reference Model.A study of a smartphone app, Theia, which is intended to help blind people navigate indoors, is used for the purpose of both illustration and experimentation.In this study, NFRs (e.g., safety, reliability, timeliness, etc.) are treated as softgoals, and risks (e.g., fall down, injury, etc.) are identified, along with risk-mitigation strategies for both the system and its environment, with the help of an activity-oriented ontology.To see both the strengths and weaknesses of Murphy+G, a systematic methodology for risk analysis for collaborative systems, a controlled experiment has been carried out, in terms of three different versions of Theia implementations.Feedback from students show improvements on the accuracy of the risk analysis and the risk mitigation strategies devised, as well as enhanced users' experience with respect to increased confidence in navigating indoors, in a safe, timely, and reliable manner.

A risk is an undesirable event that can result in mishaps if not identified early on during requirements engineering adequately.However, identifying risks can be challenging, and requirements engineers may not always be aware if risks are ignored.In this paper, we present Murphy -a framework for performing risk analysis.Murphy adopts the Reference Model, in which requirements are supposed to be met not by the projected software system behavior alone but through collaboration between the system and events occurring in its environment, hence the term Collaborative System.Murphy provides risk analysis facilities that include an activity-oriented ontology for carrying out risk analysis by systematically identifying risky activities in the system and in the environment, thereby obtaining a Risk Analysis Graph (RAG) and towards devising risk mitigation strategies later.In order to see both the strengths and weaknesses of Murphy, we experimented on developing a smartphone app involving a group of Ph.D. and senior-level graduate students -one group using Murphy and the other not using Murphy.Our observation, we feel, shows that the risks identified by the group using Murphy were able to identify more critical risks and those risks were comprehensive and relevant as.well.The results also showed that incorporating risk mitigation strategies for the risks identified can indeed help avoid them to some extent.

Risk, a potential occurrence of some undesirable event, can be dangerous if not adequately identified and dealt with early on during software development.However, identifying risks can be difficult, hence oftentimes resulting in a particular software system that is unable to address risks, especially critical ones adequately.This paper proposes an ontology-based framework for performing risk analysis with the Augmented Reference Model -The Reference Model augmented with risk analysis.The Reference Model emphasizes that the user requirements are met through the collaboration between the system and the events occurring in its environment -i.e., not by the system alone, hence the term "collaborative system."We also offer an activity-oriented ontology to carry out risk analysis by identifying risks from negating the events in the environment and system. Such negations of the requirements, specifications, and domain events generate a graph-like representation, called Risk Analysis Graph (RAG), to help perform risk analysis.To validate our framework, we have performed two experiments using questionnaires to identify risks and use the risk analysis tool to generate RAG for performing risk analysis.We feel that at least these experiments show that RAG helps identify risks -especially the critical and uncommon ones that we would not have thought of.