Initial industrial experience of misuse cases in trade-off analysis

Negative scenarios have long been applied in e.g. military and commercial operations planning. The negative form of the use case is the ´misuse case´. Experience has been gained in applying misuse cases to analyse requirement/design option trade-offs in a railway case study. In a trade-off workshop, a diagram is constructed showing use cases for goals held by system designers, and misuse cases for goals of hostile agents. Relationships between these goals are elicited and documented on the diagram. Experience in a railway trade-off study led to the devising of a set of relationships suited to trade-off analysis: ´threatens´, ´mitigates´, ´aggravates´, and ´conflicts with´, as well as the more general ´includes´. The result is a graphic that makes clear to nontechnical stakeholders how their requirements may conflict in the design domain. This contributed to the success of the trade-off workshop. The approach taken for the railway workshop is simple. It could be applied in other domains, and with other participative methods.