@memoarchitect/ontology 0.10.9 → 0.11.2

package/examples/ui-screen-regions/model/catalog/assurance/requirements/requirements.sysml

@@ -21,7 +21,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
     // ── The spec side ───────────────────────────────────────────
     requirement reqRateEntry : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-001"; } attribute :>> name = "RateEntryConfirmation";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "When the clinician enters a new infusion rate, the pump shall display the entered rate for explicit confirmation before applying it.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::eventDriven;
@@ -34,7 +34,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqRateLegibility : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-002"; } attribute :>> name = "RateLegibility";
-        attribute :>> requirementKind = RequirementKind::system;
+        attribute :>> requirementType = RequirementTypeKind::system;
         attribute :>> statement = "The pump shall display the active infusion rate legibly at 1 m under 100–1000 lux ambient illumination.";
         attribute :>> notation = RequirementNotationKind::sophist;
         attribute :>> obligation = ObligationKind::shall;
@@ -48,7 +48,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqVolumeDisplay : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-003"; } attribute :>> name = "VolumeDeliveredDisplay";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "The pump shall display cumulative volume delivered for the active infusion, updated at least once per second.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::stateDriven;
@@ -60,7 +60,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqDrugLibrarySelection : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-004"; } attribute :>> name = "DrugLibrarySelection";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "The pump shall permit selection only from drug and concentration entries enabled for the active care area.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::stateDriven;
@@ -73,7 +73,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqDisplayFreshness : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-005"; } attribute :>> name = "InfusionStatusFreshness";
-        attribute :>> requirementKind = RequirementKind::system;
+        attribute :>> requirementType = RequirementTypeKind::system;
         attribute :>> statement = "The pump shall refresh the displayed active rate and cumulative delivered volume at least once per second while an infusion is running.";
         attribute :>> notation = RequirementNotationKind::sophist;
         attribute :>> obligation = ObligationKind::shall;
@@ -87,7 +87,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqActiveRateDisplay : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-006"; } attribute :>> name = "ActiveInfusionRateDisplay";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "While an infusion is running, the pump shall display the active infusion rate value and its mL/h unit.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::stateDriven;
@@ -100,7 +100,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqDrugIdentityDisplay : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-007"; } attribute :>> name = "ActiveDrugIdentityDisplay";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "Where a drug-library entry is active, the pump shall display the selected drug name and concentration on the running-infusion screen.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::optionalFeature;
@@ -113,7 +113,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqTimeDisplay : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-008"; } attribute :>> name = "LocalTimeDisplay";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "While the running-infusion screen is visible, the pump shall display synchronized local time in 24-hour HH:mm format.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::stateDriven;
@@ -125,7 +125,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqTimeAccuracy : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-009"; } attribute :>> name = "DisplayedTimeAccuracy";
-        attribute :>> requirementKind = RequirementKind::system;
+        attribute :>> requirementType = RequirementTypeKind::system;
         attribute :>> statement = "The running-infusion display shall present local time within 2 seconds of the synchronized device clock and refresh the visible minute within 1 second of rollover.";
         attribute :>> notation = RequirementNotationKind::sophist;
         attribute :>> obligation = ObligationKind::shall;
@@ -139,7 +139,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqBatteryStatusDisplay : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-010"; } attribute :>> name = "BatteryStatusDisplay";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "While the pump is operating, the pump shall display battery state of charge as a percentage and graphical icon.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::stateDriven;
@@ -152,7 +152,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqBatteryWarningPerformance : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-011"; } attribute :>> name = "LowBatteryStatusLatency";
-        attribute :>> requirementKind = RequirementKind::system;
+        attribute :>> requirementType = RequirementTypeKind::system;
         attribute :>> statement = "When estimated battery operating time falls below 30 minutes, the pump shall present a visually prominent low-battery state within 1 second.";
         attribute :>> notation = RequirementNotationKind::sophist;
         attribute :>> obligation = ObligationKind::shall;
@@ -166,7 +166,7 @@ package memo_examples_ui_screen_regions_assurance_requirements {
 
     requirement reqDrugSelectionPerformance : Requirement {
         @MemoIdentity { :>> providedId = "UIR-REQ-012"; } attribute :>> name = "DrugSelectorResponseTime";
-        attribute :>> requirementKind = RequirementKind::software;
+        attribute :>> requirementType = RequirementTypeKind::software;
         attribute :>> statement = "When the clinician activates the drug selector, the pump shall display the enabled drug list within 250 milliseconds.";
         attribute :>> notation = RequirementNotationKind::ears;
         attribute :>> earsPattern = EarsPatternKind::eventDriven;

package/extensions/aadl/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-aadl'
-version: 0.8.24
+version: 0.11.2
 description: AADL (SAE AS5506) correspondence profile and runtime component families
 license: MIT
 tags:

package/extensions/cloud/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-cloud'
-version: 0.8.24
+version: 0.11.2
 description: Networked services and managed data stores
 license: MIT
 tags:

package/extensions/container/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-container'
-version: 0.8.24
+version: 0.11.2
 description: OCI container images and container runtimes as deployment content
 license: MIT
 tags:

package/extensions/messaging/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-messaging'
-version: 0.8.24
+version: 0.11.2
 description: Publish/subscribe messaging — topics, brokers, and delivery semantics
 license: MIT
 tags:

package/extensions/ros/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/extension-ros'
-version: 0.8.24
+version: 0.11.2
 description: ROS 2 nodes, messages, topic/service/action interfaces, QoS, and containerized deployment
 license: MIT
 tags:

package/methodologies/default/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/methodology-default'
-version: 0.8.24
+version: 0.11.2
 description: "MEMO default medical-device methodology \u2014 selects viewpoints/views/DHF documents from @memoarchitect/ontology and adds rules, gates, patterns, profiles, and workflow."
 license: MIT
 tags:

package/methodologies/gpca/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/methodology-gpca'
-version: 0.8.24
+version: 0.11.2
 description: "GPCA infusion pump methodology \u2014 subtraction-based tailoring of @memoarchitect/methodology-default for the non-networked prototype variant. Excludes cybersecurity and SOUP."
 license: MIT
 tags:

package/ontology/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/ontology'
-version: 0.8.24
+version: 0.11.2
 description: "MEMO \u2014 the single canonical medical-device ontology: core semantics, the Arcadia-inspired architecture layers (context, requirements, behavior, structure, interfaces, risk, cybersecurity,\
   \ assurance, \u2026), compliance, viewpoints, views, and invariant rules. One namespace (memo::), one src/ tree."
 license: MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memoarchitect/ontology",
-  "version": "0.10.9",
+  "version": "0.11.2",
   "packageManager": "pnpm@9.15.0",
   "description": "MEMO — Medical Engineering Modelling Ontology. Pure SysML v2 medical-device ontology with native constraints, portable to any conformant SysML v2 tool (SysIDE, SysON, sysand).",
   "scripts": {

package/profile/memo.package.yaml

@@ -7,7 +7,7 @@
 # (`type`, `extends`, `usage`, `ontologies`, `methodology`, `modules`) were
 # removed at the native semantic flip and are now rejected if present.
 name: '@memoarchitect/medical-modeling-profile'
-version: 0.8.24
+version: 0.11.2
 description: Closure rules and viewpoints for medical device modeling
 license: MIT
 tags:

package/src/architecture/operational/scenarios/memo_scenarios.sysml

@@ -42,13 +42,12 @@ package memo_architecture_operational_scenarios {
         attribute assumptionSummary : String;
         attribute guaranteeSummary : String;
         attribute securityObjective : String;
-        attribute abuseCaseReference : String;
+        ref abuseCase : OperativeScenario[0..1];
         attribute defaultCategory : ThreatCategoryKind[0..1];
         // verification scenario
         attribute verificationEnvironment : String;
         attribute stimulusSummary : String;
         // hazard-related use scenario (IEC 62366-1 3.9)
-        attribute hazardReference : String;
         attribute selectionRationale : String;
     }
 

package/src/artifacts/templates/dhf/iec-60601/hrs.md

@@ -16,7 +16,7 @@ required_for: ["CE", "FDA_510k", "MDR"]
 
 This Hardware Requirements Specification (HRS) defines the safety, construction, and performance requirements for the **{{project.product}}** physical equipment, ensuring compliance with IEC 60601-1 (general safety) and applicable collateral standards (IEC 60601-1-2 for electromagnetic compatibility).
 
-Hardware requirements are identified by the model's `requirementKind` attribute. Per-topic sections — construction, electrical, EMC, mechanical — are **not** name filters: each is the set of elements claiming the clause that governs that topic, selected by traversing `ConformsTo` to that clause. A clause is named by its element id rather than by its number, because a clause number is not unique across standards: "8" is a clause of IEC 60601-1, of IEC 60601-1-2 and of IEC 62304.
+Hardware requirements are identified by the model's `requirementType` attribute. Per-topic sections — construction, electrical, EMC, mechanical — are **not** name filters: each is the set of elements claiming the clause that governs that topic, selected by traversing `ConformsTo` to that clause. A clause is named by its element id rather than by its number, because a clause number is not unique across standards: "8" is a clause of IEC 60601-1, of IEC 60601-1-2 and of IEC 62304.
 
 ---
 
@@ -26,7 +26,7 @@ Summary metrics for the hardware requirements captured in the model:
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::hardware"
+where: requirementType == "RequirementTypeKind::hardware"
 display: count
 label: Total hardware requirements
 ```
@@ -35,11 +35,11 @@ label: Total hardware requirements
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::hardware"
+where: requirementType == "RequirementTypeKind::hardware"
 display: table
-columns: name, requirementKind, electricalSafetyRelevant, doc
+columns: name, requirementType, electricalSafetyRelevant, doc
 sort: name
-empty: "No hardware requirements defined. Add Requirement elements with requirementKind = hardware."
+empty: "No hardware requirements defined. Add Requirement elements with requirementType = hardware."
 ```
 
 ---
@@ -142,7 +142,7 @@ Hardware requirements traced to the elements that satisfy them:
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::hardware"
+where: requirementType == "RequirementTypeKind::hardware"
 traverse: outgoing satisfiedBy
 display: table
 columns: name, kind, layer, doc

package/src/artifacts/templates/dhf/iec-62304/srs.md

@@ -16,7 +16,7 @@ required_for: ["CE", "FDA_510k", "MDR"]
 
 This Software Requirements Specification (SRS) defines the software requirements for **{{project.product}}** in accordance with IEC 62304:2006+AMD1:2015 §5.2.
 
-Software, hardware and system requirements are distinguished by the model's own `requirementKind` attribute, never by which layer directory a file sits in and never by what a requirement is called. There is no "software layer": hardware and software are sibling directories inside `implementation`.
+Software, hardware and system requirements are distinguished by the model's own `requirementType` attribute, never by which layer directory a file sits in and never by what a requirement is called. There is no "software layer": hardware and software are sibling directories inside `implementation`.
 
 ---
 
@@ -26,14 +26,14 @@ Summary metrics for the requirements captured in the model:
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::software"
+where: requirementType == "RequirementTypeKind::software"
 display: count
 label: Total software requirements
 ```
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::system"
+where: requirementType == "RequirementTypeKind::system"
 display: count
 label: System requirements
 ```
@@ -48,7 +48,7 @@ Requirements carrying a `shall` obligation — the binding ones:
 kind: Requirement
 where: obligation == "ObligationKind::shall"
 display: table
-columns: name, requirementKind, safetyClass, doc
+columns: name, requirementType, safetyClass, doc
 sort: name
 empty: "No requirements carry a `shall` obligation. Set `obligation` on Requirement elements."
 ```
@@ -57,11 +57,11 @@ empty: "No requirements carry a `shall` obligation. Set `obligation` on Requirem
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::software"
+where: requirementType == "RequirementTypeKind::software"
 display: table
-columns: name, requirementKind, safetyClass, doc
+columns: name, requirementType, safetyClass, doc
 sort: name
-empty: "No software requirements defined. Add Requirement elements with requirementKind = software."
+empty: "No software requirements defined. Add Requirement elements with requirementType = software."
 ```
 
 ---
@@ -97,9 +97,9 @@ System requirements allocated to software per IEC 62304 §5.2, drawn from the mo
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::system"
+where: requirementType == "RequirementTypeKind::system"
 display: table
-columns: name, requirementKind, safetyClass, doc
+columns: name, requirementType, safetyClass, doc
 sort: name
 empty: "No system requirements defined."
 ```
@@ -155,7 +155,7 @@ empty: "No SOUP identified. Add DependsOnSoup links from software items to the S
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::software"
+where: requirementType == "RequirementTypeKind::software"
 traverse: outgoing verifiedBy
 display: table
 columns: name, kind, layer, doc

package/src/artifacts/templates/dhf/system/syrs.md

@@ -26,7 +26,7 @@ Summary metrics for the system requirements captured in the model:
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::system"
+where: requirementType == "RequirementTypeKind::system"
 display: count
 label: Total system requirements
 ```
@@ -41,7 +41,7 @@ Binding system requirements — those carrying a `shall` obligation:
 kind: Requirement
 where: obligation == "ObligationKind::shall"
 display: table
-columns: name, requirementKind, doc
+columns: name, requirementType, doc
 sort: name
 empty: "No requirements carry a `shall` obligation. Set `obligation` on Requirement elements."
 ```
@@ -50,11 +50,11 @@ empty: "No requirements carry a `shall` obligation. Set `obligation` on Requirem
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::system"
+where: requirementType == "RequirementTypeKind::system"
 display: table
-columns: name, requirementKind, safetyClass, doc
+columns: name, requirementType, safetyClass, doc
 sort: name
-empty: "No system requirements defined. Add Requirement elements with requirementKind = system."
+empty: "No system requirements defined. Add Requirement elements with requirementType = system."
 ```
 
 ---
@@ -67,7 +67,7 @@ How system requirements are allocated down to hardware and software.
 
 ```memo-query
 kind: Requirement
-where: requirementKind == "RequirementKind::system"
+where: requirementType == "RequirementTypeKind::system"
 traverse: outgoing satisfiedBy
 display: table
 columns: name, kind, layer, doc

package/src/assurance/cybersecurity/memo_cybersecurity.sysml

@@ -46,6 +46,11 @@ package memo_assurance_cybersecurity {
         attribute affectedLayer : String;
         attribute cweReference : String;
         attribute remediable : Boolean;
+        // CVSS v3.1 quantitative rating — the core output of a vulnerability
+        // analysis (e.g. RSK-00058). `cvssBaseScore` is the 0.0-10.0 numeric
+        // score; `cvssVector` the source vector string (AV:.../AC:.../...).
+        attribute cvssBaseScore : Real;
+        attribute cvssVector : String;
     }
 
     item def CyberHazard specializes Hazard {
@@ -53,7 +58,6 @@ package memo_assurance_cybersecurity {
         attribute safetyImpact : String;
         attribute privacyImpact : String;
         attribute operationalImpact : String;
-        attribute linkedSafetyHazardId : String;
     }
 
     part def CyberRisk specializes Risk {

package/src/assurance/human_factors/memo_human_factors.sysml

@@ -15,7 +15,6 @@ package memo_assurance_human_factors {
 
     part def UseError specializes MemoPart {
         attribute errorCategory : UseErrorCategoryKind;
-        attribute taskReference : String;
         attribute severity : SeverityKind;
         attribute rootCauseType : String;
     }

package/src/assurance/requirements/memo_requirements.sysml

@@ -7,25 +7,32 @@ package memo_assurance_requirements {
     private import memo_assurance_requirements_needs::*;
     part def RiskDriver specializes RequirementDriver { attribute driverKind : String; }
 
-    // The kind of requirement. Was a subclass branch (SystemRequirement /
-    // SoftwareRequirement / HardwareRequirement) plus a parallel design-control
-    // specification hierarchy (DesignControlSpecification / System- / Software- /
-    // HardwareSpecification); now one attribute. The role-specific attributes
-    // below are all optional so a requirement carries only the ones its kind
-    // needs. IEC 62304 / design-control classification is preserved as the
-    // enum value, not lost.
-    enum def RequirementKind {
+    // What a requirement is about: the system, the software, the hardware, or
+    // the instructions for use. One axis, and the members are its values.
+    //
+    // It carried a second axis until now. `systemSpecification`,
+    // `softwareSpecification`, `hardwareSpecification` and `designControl` are
+    // the design-control ROLE — input versus output, 21 CFR 820.30(c)/(d) and
+    // ISO 13485 §7.3.3/§7.3.4 — multiplied into the subject. A requirement then
+    // could not say "software" without also committing to a role, the grid was
+    // incomplete by construction (there is no `ifuSpecification`, and there
+    // would have to be one for every future pairing), and nothing ever used the
+    // four: 250 requirements across the examples say system, software or
+    // hardware. A role, if a project needs one, is its own attribute.
+    //
+    // The instructions for use are neither hardware nor software: the device
+    // satisfies such a requirement with words rather than with a part or a
+    // module, and it is verified by reviewing the IFU rather than by testing a
+    // build (EU MDR Annex I §23.4, ISO 20417, IEC 62366-1 §7.2).
+    enum def RequirementTypeKind {
         enum system;
         enum software;
         enum hardware;
-        enum systemSpecification;
-        enum softwareSpecification;
-        enum hardwareSpecification;
-        enum designControl;
+        enum ifu;
     }
 
     requirement def Requirement specializes MemoRequirement {
-        attribute requirementKind : RequirementKind;
+        attribute requirementType : RequirementTypeKind;
         attribute :>> statement : String;
         attribute sourceKind : RequirementSourceKind;
         attribute concernKind : ConcernKind;
@@ -53,9 +60,6 @@ package memo_assurance_requirements {
         // design-control specification (ISO 13485 design output)
         attribute specificationDomain : String;
         attribute sourceFolder : String;
-        attribute linkedUserNeeds : String;
-        attribute linkedRisks : String;
-        attribute linkedTests : String;
     }
     // Named constant defined by a source requirements document (e.g. CriSys
     // GPCA App. A.4) and referenced from requirement statements.

package/src/assurance/requirements/needs/memo_needs.sysml

@@ -6,8 +6,15 @@
 package memo_assurance_requirements_needs {
     private import ScalarValues::*;
 
+    private import Metaobjects::SemanticMetadata;
+
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
+    private import memo_core_relationships::*;
+    // A need is held by someone and arises in a context, and both are modelled
+    // elements. Assurance may depend on architecture; the reverse may not.
+    private import memo_architecture_operational_context_actors::*;
+    private import memo_architecture_operational_context_use_context::*;
 
     // The kind of need. Was a subclass branch (StakeholderNeed / UserNeed /
     // ClinicalUserNeed / PatientUserNeed / BusinessNeed / ServiceNeed /
@@ -29,15 +36,36 @@ package memo_assurance_requirements_needs {
 
     requirement def Need specializes MemoNeed {
         attribute needKind : NeedKind;
-        // user need (IEC 62366-1)
-        attribute userPopulationReference : String;
+        // A user need (IEC 62366-1) says WHOSE need it is with HeldBy, and the
+        // user's characteristics live on the User: `userPopulation`,
+        // `impairmentConsiderations`, `intendedTraining`, `intendedQualification`.
+        // A `userPopulationReference` string stood here and held prose — "ward
+        // nurses, including those wearing corrective lenses" — which is two
+        // typed attributes of a user profile written as one sentence nothing
+        // could read, on the wrong element.
         // regulatory need
         attribute jurisdiction : String;
         attribute regulationReference : String;
-        // operational need
-        attribute operationalContextReference : String;
+        // The context an operational need arises in. Typed, because UseContext
+        // carries the care setting, environment and jurisdiction that an
+        // `operationalContextReference` string could only describe.
+        ref useContext : UseContext[0..1];
         // design-control need (ISO 13485 design input)
         attribute sourceFolder : String;
-        attribute linkedDesignControls : String;
+    }
+
+    // Whose need this is. The holder is a modelled participant — a User, with
+    // the profile IEC 62366-1 asks for, or another operational participant —
+    // so "which users does this need serve" is a question the model answers
+    // rather than a sentence a reader interprets.
+    connection def HeldBy :> MemoRelationship {
+        end need : MemoNeed :>> source;
+        end holder : OperationalParticipant :>> target;
+    }
+    abstract connection heldByLinks : HeldBy[*];
+    metadata def <heldBy> HeldByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = heldByLinks meta SysML::Usage;
     }
 }

package/src/assurance/safety_risk/memo_risk.sysml

@@ -6,6 +6,9 @@ package memo_assurance_safety_risk {
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
     private import memo_assurance_requirements::*;
+    // For HazardRelatedScenario below. Assurance may depend on architecture;
+    // the reverse is what the string on the scenario was avoiding.
+    private import memo_architecture_operational_scenarios::*;
 
     // ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards,
     // scenarios, requirements, and DHF records can trace to the foreseeable
@@ -36,22 +39,10 @@ package memo_assurance_safety_risk {
         attribute riskLevelMapping : String;
         attribute acceptabilityThresholds : String;
     }
-    part def DesignControlRiskRow specializes Risk {
-        attribute rowTitle : String;
-        attribute hazardAnalysis : String;
-        attribute hazardCategory : String;
-        attribute hazardSubcategory : String;
-        attribute causeSequenceOfEventsFailure : String;
-        attribute harmText : String;
-        attribute probabilityBeforeRaw : String;
-        attribute severityBeforeRaw : String;
-        attribute riskBeforeMeasureRaw : String;
-        attribute probabilityAfterRaw : String;
-        attribute severityAfterRaw : String;
-        attribute riskAfterMitigationRaw : String;
-        attribute cannotReduceFurther : Boolean;
-        attribute linkSummary : String;
-    }
+    // `DesignControlRiskRow` was a denormalized spreadsheet transcription.
+    // Risk rows now decompose into the ISO 14971 chain below: Risk owns its
+    // Hazard, SequenceOfEvents, HazardousSituation, and Harm items, linked by
+    // TracesRisk / LeadsToHarm, with ResidualRisk after mitigation.
     // A device characteristic whose implementation, failure, or misuse can
     // affect safety. This is the modelable output of ISO 14971 §5.3.
     part def SafetyRelatedCharacteristic specializes MemoPart {
@@ -99,6 +90,8 @@ package memo_assurance_safety_risk {
     item def HazardousSituation specializes RiskItem {
         attribute exposedPersons : String;
         attribute operatingCondition : String;
+        // ISO 14971 P1: probability that the hazardous situation occurs.
+        attribute probabilityOfOccurrence : ProbabilityKind;
     }
     item def Harm specializes RiskItem {
         attribute clinicalImpact : String;
@@ -135,6 +128,36 @@ package memo_assurance_safety_risk {
         :> annotatedElement : SysML::ConnectionUsage;
         :>> baseType = tracesRiskLinks meta SysML::Usage;
     }
+    // The final ISO 14971 chain edge. P2 is the conditional probability that
+    // the hazardous situation results in the harm.
+    connection def LeadsToHarm :> MemoRelationship {
+        attribute conditionalProbability : ProbabilityKind;
+        end hazardousSituation : HazardousSituation :>> source;
+        end resultingHarm : Harm :>> target;
+    }
+    abstract connection leadsToHarmLinks : LeadsToHarm[*];
+    metadata def <leadsToHarm> LeadsToHarmMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = leadsToHarmLinks meta SysML::Usage;
+    }
+    // IEC 62366-1 3.9's hazard-related use scenario: the scenario a hazard can
+    // arise in. It is declared HERE rather than as a `hazardReference` string
+    // on the scenario, which is what stood in for it: a string names nothing a
+    // consumer can follow, and the layering is why it was written that way —
+    // assurance may depend on architecture, and the scenario package cannot
+    // see `Hazard`. On this side both ends are visible and the dependency runs
+    // the direction it already runs.
+    connection def HazardRelatedScenario :> MemoRelationship {
+        end hazard : RiskItem :>> source;
+        end scenario : OperativeScenario :>> target;
+    }
+    abstract connection hazardRelatedScenarioLinks : HazardRelatedScenario[*];
+    metadata def <hazardRelatedScenario> HazardRelatedScenarioMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = hazardRelatedScenarioLinks meta SysML::Usage;
+    }
     connection def AssessedAgainst :> MemoRelationship {
         end risk : Risk :>> source;
         end riskMatrix : RiskMatrix :>> target;

package/src/assurance/verification_validation/memo_assurance.sysml

@@ -21,10 +21,28 @@ package memo_assurance_verification_validation {
     // a second spelling of `status`.
     // Specializes the standard library verification case as well as MEMO's
     // base, rather than shadowing it — see the note on UseCase.
+    // Reusable test action, distinct from a case's pass/fail criteria.
+    action def TestStep specializes MemoAction {
+        attribute stepAction : String;
+        attribute expectedResult : String;
+        attribute referencedItem : String;
+    }
     verification def VerificationCase :> MemoVerificationCase, VerificationCases::VerificationCase {
         attribute methodKind : MemoVerificationMethodKind;
         attribute acceptanceCriteria : String;
     }
+    // Orders a reusable TestStep within a verification or validation case.
+    connection def PerformsStep :> MemoRelationship {
+        attribute sequence : Integer;
+        end verificationCase : MemoVerificationCase :>> source;
+        end testStep : TestStep :>> target;
+    }
+    abstract connection performsStepLinks : PerformsStep[*];
+    metadata def <performsStep> PerformsStepMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = performsStepLinks meta SysML::Usage;
+    }
     verification def ValidationCase :> MemoVerificationCase {
         attribute validationMethod : ValidationMethodKind;
         attribute userParticipation : String;