Exposing the susceptibility of off-nominal behaviors in reactive system requirements