Building an Experience Factory for a Model-based Risk Analysis Framework

This paper describes the integration of an experience factory in a modelbased risk analysis framework called CORAS. CORAS aims at developing a new model-based risk analysis framework for security critical application. The framework’s cornerstone of combining methods for risk analysis of critical systems and semiformal modelling methods in a tool-supported environment targeting openness and interoperability has not been tried before. We adapted the experience factory concept to fit our needs in documenting and exploiting the risk analysis results, as well as to support the structured process of risk management. Our internet-enabled experience factory takes advantage of XML as the vehicle for data exchange within an environment that involves heterogeneous tools. The effectiveness of the framework will be reviewed and measured against the objectives of the project during planned future trials.