A picture is worth a thousand words. Non-Functional Requirements (NFRs), such as security and usability, are modeled using Softgoal Interdependency Graphs (SIGs) to capture potential conflicts and synergies. However, the practice of NFR modeling remains limited, partly due to unfamiliarity with modeling languages like SIG and insufficient understanding of relevant NFRs. Large Language Models (LLMs) show some knowledge of NFRs and SIG concepts, such as goal decomposition and operationalization, but often lack precise knowledge of formal SIG syntax. We introduce SIG-GPT, a GPT-4-based LLM augmented with SIG knowledge using text-based grammar supplied and Retrieval Augmented Generation (RAG). RAG enhancs LLM responses by retrieving relevant external knowledge, while the grammar enforces correct syntax, guiding the LLM to generate SIGs align with formal notation. To help practitioners better understand SIG modeling, reduce time and effort, and enhance NFR proficiency, we apply textual grammar to SIG-GPT, ensuring it is ready for seamless integration with visual modeling tools like RE- Tool, enabling the LLM to generate correct SIG structures without requiring a large dataset of SIG examples. Results show that SIG-GPT with grammar and RAG achieves 100% syntactic accuracy, 95% semantic accuracy, and 98% cohesion (CCR) while aligning with Bloom's Taxonomy to enhance structured reasoning in SIG modeling.

Nonfunctional requirements (NFRs), such as security and usability, address how well a software system does its intended functions.Automatic NFR classification using machine learning (ML) has been proposed to address the potential problem of faulty manual classification of NFRs.In order for ML to be effective, however, we need large, relevant datasets for training.Training data shortage has been identified as a limiting factor for these approaches.Even when available, procuring proprietary NFR data is challenging and time-consuming.In this paper, we propose a process to generate synthetic labeled NFR datasets using GPT-4o, a large language model (LLM), to alleviate the data shortage issue.This process consists of a set of prompt templates, iterative contextualization of definition, and NFR generation by class.We produced 2 new labeled NFR datasets, one from synthetic generation and the other from real documents for validation.To determine both the strengths and weaknesses of the synthetic dataset, we used it to train ML models using 3 different algorithms for the multi-class NFR classification task.Although limited, we feel our experimental results show that synthetic data as well as augmented data perform better than just real data alone.

Manufacturing medical devices is a costly and com-plex operation. The Original Equipment Manufacturer (OEM) must enforce United States Food and Drug Administration (FDA) design control regulations during the entire medical device manufacturing life cycle. To lower the costs, the OEMs often out-sources device manufacturing to a Contract Manufacturer (CM). Usually, the OEMs and CMs use incompatible software tools to manage requirements, design documents, and manufacturing data, leading to information silos that makes business process orchestration, and maintaining traceability across documents mandated by FDA challenging. To our best knowledge, existing commercial software vendors still need to address these issues adequately. This paper presents a blockchain-based framework for implementing FDA design control regulations by achieving cross-organizational reviews, document traceability, and tamper-resistant storage and verification of records while allowing the OEM and CM to continue using incompatible software tools. The framework provides an FDA design control ontology, smart contract data model, architecture and a prototype to validate the framework and its applicability using Hyperledger Fabric. Our experimentation shows the framework achieved it's goals with satisfactory performance.

If risks are not identified, they are unlikely to be addressed, possibly resulting in undesirable consequences, such as fatal accidents or even loss of human lives.Furthermore, risks should be considered not only in terms of system behavior but also events occurring in the system environment -i.e., in a collaborative setting in which the system and its environment work together towards certain goals the system is intended to help achieve.In this paper, we present a goal-oriented risk analysis framework, Murphy+G, in which non-functional requirements (hereafter, NFRs) are treated as softgoals to be achieved and systematically addressed in terms of both the system and its environment during requirements engineering, by adopting what is called the Reference Model.A study of a smartphone app, Theia, which is intended to help blind people navigate indoors, is used for the purpose of both illustration and experimentation.In this study, NFRs (e.g., safety, reliability, timeliness, etc.) are treated as softgoals, and risks (e.g., fall down, injury, etc.) are identified, along with risk-mitigation strategies for both the system and its environment, with the help of an activity-oriented ontology.To see both the strengths and weaknesses of Murphy+G, a systematic methodology for risk analysis for collaborative systems, a controlled experiment has been carried out, in terms of three different versions of Theia implementations.Feedback from students show improvements on the accuracy of the risk analysis and the risk mitigation strategies devised, as well as enhanced users' experience with respect to increased confidence in navigating indoors, in a safe, timely, and reliable manner.

A risk is an undesirable event that can result in mishaps if not identified early on during requirements engineering adequately.However, identifying risks can be challenging, and requirements engineers may not always be aware if risks are ignored.In this paper, we present Murphy -a framework for performing risk analysis.Murphy adopts the Reference Model, in which requirements are supposed to be met not by the projected software system behavior alone but through collaboration between the system and events occurring in its environment, hence the term Collaborative System.Murphy provides risk analysis facilities that include an activity-oriented ontology for carrying out risk analysis by systematically identifying risky activities in the system and in the environment, thereby obtaining a Risk Analysis Graph (RAG) and towards devising risk mitigation strategies later.In order to see both the strengths and weaknesses of Murphy, we experimented on developing a smartphone app involving a group of Ph.D. and senior-level graduate students -one group using Murphy and the other not using Murphy.Our observation, we feel, shows that the risks identified by the group using Murphy were able to identify more critical risks and those risks were comprehensive and relevant as.well.The results also showed that incorporating risk mitigation strategies for the risks identified can indeed help avoid them to some extent.

Risk, a potential occurrence of some undesirable event, can be dangerous if not adequately identified and dealt with early on during software development.However, identifying risks can be difficult, hence oftentimes resulting in a particular software system that is unable to address risks, especially critical ones adequately.This paper proposes an ontology-based framework for performing risk analysis with the Augmented Reference Model -The Reference Model augmented with risk analysis.The Reference Model emphasizes that the user requirements are met through the collaboration between the system and the events occurring in its environment -i.e., not by the system alone, hence the term "collaborative system."We also offer an activity-oriented ontology to carry out risk analysis by identifying risks from negating the events in the environment and system. Such negations of the requirements, specifications, and domain events generate a graph-like representation, called Risk Analysis Graph (RAG), to help perform risk analysis.To validate our framework, we have performed two experiments using questionnaires to identify risks and use the risk analysis tool to generate RAG for performing risk analysis.We feel that at least these experiments show that RAG helps identify risks -especially the critical and uncommon ones that we would not have thought of.

Since its beginnings in the late 1960s, the IT services industry has signed long-term (10 to 20 year) contracts to maintain software and operate a system for a fixed decreasing price. The motivation for this paper stems from forty years of watching software maintenance artifacts and operations artifacts continue to diverge down two separate paths filled with duplication and unused information. Occasionally, a well-annotated simulation model has been used effectively to bring these two artifact-paths together and efficiently maintain the software and operate the system within contracted performance goals, called service level agreements. This paper proposes an architecture simulation model hybrid, built from existing software development artifacts and operations artifacts, which can endure for the operational life of a system (an average of eighteen years). In order to show the relevance of the hybrid approach, the complete development and maintenance lifecycle of a large-scale customer order system case is studied. The services industry case high-lights the gaps contained in current simulation models and presents modeling extensions to fill the breaches.

Non-functional requirements (NFRs), such as security and cost, are generally subjective and oftentimes synergistic or conflicting with each other. Properly dealing with such NFRs requires a large body of knowledge – goals to be achieved, problems or obstacles to be avoided, alternative solutions to mitigate the problems, and the best compromising alternative solution to be selected. However, few patterns exist for dealing with these kinds of knowledge of NFRs. In this paper, we present four kinds of NFR patterns for capturing and reusing knowledge of NFRs – objective pattern, problem pattern, alternatives pattern and selection pattern. NFR patterns may be visually represented, and organized by rules of specialization to create more specific patterns, of composition to build larger patterns, and of instantiation to create new patterns using existing patterns as templates. We have applied the NFR pattern approach to the TJX incident, one of the largest credit card theft in history, as a realistic case study.