The paper presents a methodology for risk assessment in complex real time software systems at the early stages of development, namely the analysis/design phase. A heuristic risk assessment technique is described based on colored Petri net (CPN) models. The technique uses complexity metrics and severity measures in developing a heuristic risk factor from software functional specifications. The objective of risk assessment is to classify the software components according to their relative importance in terms of such factors as severity and complexity. Both traditional static and dynamic complexity measures are supported. Concurrency complexity is presented as a new dynamic complexity metric. This metric measures the added dynamic complexity due to concurrency in the system. Severity analysis is conducted using failure mode and effect analysis (FMEA). The methodology presented here is applied to a large scale software system as presented in a companion paper (H. Ammar et al., 1997).