## Materials and Methods
### Conceptual Model of Requirement Change Risk Factors
The change request can be triggered by an exogenous change cause or by change propagation. The change behavior depends on a range of individual factors like the permissible range of requirement parameters or the experts' decision on change implementation. It results in a local change impact and potentially in an outgoing change request (change propagation). From a risk assessment point of view, change requests from exogenous change causes as well as change behavior are context-specific. In contrast, endogenous change requests resulting from change propagation can be estimated at least approximately by means of generic dependency analysis; for instance, by identifying causal requirement dependencies based on physical laws like weight, stiffness and material. For this reason, a distinction is made between context-specific risk factors and partly context-independent risk factors. The initial change request and the local impact of a change related to a single requirement are context-specific. Propagation effect is partly context-independent. This differentiation is useful because context-specific risk factors usually need to be assessed by experts or based on specific datasets, whilst context-independent risk factors might be assessable by generic sources (for instance, formulas or open access datasets). The differentiation of initial and subsequent changes from a change propagation perspective is illustrated in Figure 3.  
The risk factors of change likelihood as well as change impact are merged into a conceptual model. This model combines all relevant risk factors and can be used as a starting point to develop methods, enable the assessment of one or more risk factors and to merge those into an overall risk  
Figure 3: Differentiation of initial and subsequent changes from a change propagation perspective. Figure 2: Overview of exogenous and endogenous change causes. assessment of requirement changes. Within the model, the two aforementioned dimensions of change risk are separated. Looking at the change likelihood, an analysis of exogenous change causes enables to assess the chance of an initial change request. For requirements not directly affected by this initial change request, the endogenous change likelihood can be estimated based on change propagation. This enables an assessment of change likelihood for directly as well as indirectly affected requirements. To assess the overall change impact, the local change impacts need to be added up for all requirements affected by change propagation. It starts with the initial change request as the trigger and the change behavior of the affected requirement. From then on, a chain effect might be activated, consisting of requirement change behavior sending out subsequent change requests to interconnected requirements, potentially leading to further changes (change propagation). The overall conceptual model of risk factors for requirement change is illustrated in Figure 4.  
The concept covers risk factors for all kinds of changes in the requirement set: New, changed or deleted requirements (Figure 1). Still, the following approach to assess the change risk is focused on requirement changes solely. This is because the risk assessment and the subsequent risk management might have a different focus for new or deleted requirements. For example, to perform risk management on requirements added to the requirement set later on, activities that improve requirement elicitation process, and thereby lower the number of new requirements added, will play a major role. Risk management regarding changes made to formal requirements will most likely put a higher weight on change propagation instead of improving the elicitation process.