@memoarchitect/ontology 0.12.1 → 0.15.0

package/examples/gpca-pump/model/catalog/gpca_behavior_subsystems.sysml

@@ -11,8 +11,8 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     private import memo_core_common::MemoIdentity;
     // ── Logical functions ───────────────────────────────────────
     action fnAcquireSensors : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-001"; }
-        attribute :>> name = "AcquireSensorData";
+        @MemoIdentity { :>> providedId = "FUNC-001"; :>> label = "AcquireSensorData"; }
+        out sensorVectorOut : InterfaceItem;
         attribute :>> functionCategory = "sensing";
         attribute :>> trigger = "every 20 ms execution step";
         attribute :>> outputSummary = "Debounced, range-checked sensor status vector";
@@ -28,8 +28,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         // requires — a component function allocated nowhere is a
         // responsibility nobody has accepted.
         action cfnMeasureFlowRate : ComponentFunction {
-            @MemoIdentity { :>> providedId = "CFUN-001"; }
-            attribute :>> name = "MeasureFlowRate";
+            @MemoIdentity { :>> providedId = "CFUN-001"; :>> label = "MeasureFlowRate"; }
             attribute :>> functionCategory = "sensing";
             attribute :>> actionKind = ActionKind::sense;
             attribute :>> trigger = "continuous, sampled every 20 ms execution step";
@@ -38,8 +37,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
             attribute :>> criticality = CriticalityKind::catastrophic;
         }
         action cfnDetectAirInLine : ComponentFunction {
-            @MemoIdentity { :>> providedId = "CFUN-002"; }
-            attribute :>> name = "DetectAirInLine";
+            @MemoIdentity { :>> providedId = "CFUN-002"; :>> label = "DetectAirInLine"; }
             attribute :>> functionCategory = "protection";
             attribute :>> actionKind = ActionKind::sense;
             attribute :>> trigger = "continuous, sampled every 20 ms execution step";
@@ -49,8 +47,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         }
         // The subassembly case: a component function need not sit on a leaf part.
         action cfnAggregateSensorStatus : ComponentFunction {
-            @MemoIdentity { :>> providedId = "CFUN-003"; }
-            attribute :>> name = "AggregateSensorStatus";
+            @MemoIdentity { :>> providedId = "CFUN-003"; :>> label = "AggregateSensorStatus"; }
             attribute :>> functionCategory = "sensing";
             attribute :>> actionKind = ActionKind::transform;
             attribute :>> trigger = "every 20 ms execution step";
@@ -61,8 +58,8 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
 
     action fnValidatePrescription : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-002"; }
-        attribute :>> name = "ValidatePrescription";
+        @MemoIdentity { :>> providedId = "FUNC-002"; :>> label = "ValidatePrescription"; }
+        in prescriptionIn : InterfaceItem;
         attribute :>> functionCategory = "configuration";
         attribute :>> trigger = "prescription entry or edit";
         attribute :>> outputSummary = "Prescription accepted (within drug-library hard/soft limits) or rejected with reason";
@@ -70,8 +67,9 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
     action fnMonitorAlarm : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-003"; }
-        attribute :>> name = "MonitorExceptionalConditions";
+        @MemoIdentity { :>> providedId = "FUNC-003"; :>> label = "MonitorExceptionalConditions"; }
+        in sensorVectorIn : InterfaceItem;
+        out alarmSignalOut : InterfaceItem;
         attribute :>> functionCategory = "alarm";
         attribute :>> trigger = "every 20 ms execution step";
         attribute :>> outputSummary = "Alarm outputs and inhibition conditions";
@@ -79,8 +77,8 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
     action fnAnnunciate : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-004"; }
-        attribute :>> name = "AnnunciateAlarms";
+        @MemoIdentity { :>> providedId = "FUNC-004"; :>> label = "AnnunciateAlarms"; }
+        in alarmSignalIn : InterfaceItem;
         attribute :>> functionCategory = "alarm";
         attribute :>> trigger = "alarm raised, escalated, or cleared";
         attribute :>> outputSummary = "Priority-coded audible tone and visual message";
@@ -88,8 +86,8 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::high;
     }
     action fnManageInfusion : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-005"; }
-        attribute :>> name = "ManageInfusion";
+        @MemoIdentity { :>> providedId = "FUNC-005"; :>> label = "ManageInfusion"; }
+        out flowCommandOut : InterfaceItem;
         attribute :>> functionCategory = "infusion";
         attribute :>> trigger = "mode transitions and each execution step while therapy active";
         attribute :>> outputSummary = "Commanded flow and mode transitions";
@@ -97,8 +95,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
     action fnEnforceLimits : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-006"; }
-        attribute :>> name = "EnforceDoseLimits";
+        @MemoIdentity { :>> providedId = "FUNC-006"; :>> label = "EnforceDoseLimits"; }
         attribute :>> functionCategory = "infusion";
         attribute :>> trigger = "patient bolus request or clinician square bolus command";
         attribute :>> outputSummary = "Bolus authorized or rejected against lockout interval and hourly maximum";
@@ -106,8 +103,8 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
     action fnCommandPump : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-007"; }
-        attribute :>> name = "CommandPumpMotor";
+        @MemoIdentity { :>> providedId = "FUNC-007"; :>> label = "CommandPumpMotor"; }
+        in flowCommandIn : InterfaceItem;
         attribute :>> functionCategory = "actuation";
         attribute :>> trigger = "flow command update";
         attribute :>> outputSummary = "Motor step rate with enable interlock; FlowRate_Mode_macro per mode, KVO floor in PAUSED (REQ 43), zero flow in OFF/IDLE (REQ 6/14)";
@@ -115,8 +112,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
     action fnLogEvents : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-008"; }
-        attribute :>> name = "LogTherapyEvents";
+        @MemoIdentity { :>> providedId = "FUNC-008"; :>> label = "LogTherapyEvents"; }
         attribute :>> functionCategory = "logging";
         attribute :>> trigger = "dose delivered, mode change, alarm, or configuration change";
         attribute :>> outputSummary = "Timestamped append-only event records";
@@ -124,8 +120,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::medium;
     }
     action fnManagePower : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-009"; }
-        attribute :>> name = "ManagePower";
+        @MemoIdentity { :>> providedId = "FUNC-009"; :>> label = "ManagePower"; }
         attribute :>> functionCategory = "platform";
         attribute :>> trigger = "mains-loss signal or battery level change";
         attribute :>> outputSummary = "Power source selection, low/depleted battery conditions";
@@ -133,8 +128,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::high;
     }
     action fnPresentStatus : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-010"; }
-        attribute :>> name = "PresentStatus";
+        @MemoIdentity { :>> providedId = "FUNC-010"; :>> label = "PresentStatus"; }
         attribute :>> functionCategory = "user-interface";
         attribute :>> trigger = "state or prescription change";
         attribute :>> outputSummary = "Mode, prescription, delivered dose, and alarm text on display";
@@ -142,8 +136,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> criticality = CriticalityKind::high;
     }
     action fnSelfTest : SystemFunction {
-        @MemoIdentity { :>> providedId = "FUNC-011"; }
-        attribute :>> name = "ExecuteSelfTest";
+        @MemoIdentity { :>> providedId = "FUNC-011"; :>> label = "ExecuteSelfTest"; }
         attribute :>> functionCategory = "platform";
         attribute :>> trigger = "power-on and periodic in-service checks";
         attribute :>> outputSummary = "POST pass/fail; CPU, RAM, ROM, and sensor plausibility results";
@@ -152,51 +145,48 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
 
     // ── Logical flows ───────────────────────────────────────────
-    part lfSensorAcquisition : FunctionalExchange {
-        @MemoIdentity { :>> providedId = "LF-001"; }
-        attribute :>> name = "SensorAcquisitionFlow";
+    // Each exchange is the flow itself, from one function's `out` parameter
+    // to another's `in`. LF-004 starts outside the system: the prescription is
+    // what the clinician's ProgramPrescription activity (OA-003) produces, and
+    // CE-004 carries it from the operator keypad.
+    flow lfSensorAcquisition : FunctionalExchange
+        from fnAcquireSensors.sensorVectorOut to fnMonitorAlarm.sensorVectorIn {
+        @MemoIdentity { :>> providedId = "LF-001"; :>> label = "SensorAcquisitionFlow"; }
         attribute :>> flowKind = FlowKind::measurement;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 40.0;
         attribute :>> integrityLevel = "class C data path";
-        ref :>> sourceFunction = fnAcquireSensors;
-        ref :>> targetFunction = fnMonitorAlarm;
     }
-    part lfFlowCommand : FunctionalExchange {
-        @MemoIdentity { :>> providedId = "LF-002"; }
-        attribute :>> name = "FlowCommandFlow";
+    flow lfFlowCommand : FunctionalExchange
+        from fnManageInfusion.flowCommandOut to fnCommandPump.flowCommandIn {
+        @MemoIdentity { :>> providedId = "LF-002"; :>> label = "FlowCommandFlow"; }
         attribute :>> flowKind = FlowKind::command;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C command path";
-        ref :>> sourceFunction = fnManageInfusion;
-        ref :>> targetFunction = fnCommandPump;
     }
-    part lfAlarmSignal : FunctionalExchange {
-        @MemoIdentity { :>> providedId = "LF-003"; }
-        attribute :>> name = "AlarmSignalFlow";
+    flow lfAlarmSignal : FunctionalExchange
+        from fnMonitorAlarm.alarmSignalOut to fnAnnunciate.alarmSignalIn {
+        @MemoIdentity { :>> providedId = "LF-003"; :>> label = "AlarmSignalFlow"; }
         attribute :>> flowKind = FlowKind::alarm;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C alarm path; same-step delivery to infusion manager";
-        ref :>> sourceFunction = fnMonitorAlarm;
-        ref :>> targetFunction = fnAnnunciate;
     }
-    part lfPrescriptionEntry : FunctionalExchange {
-        @MemoIdentity { :>> providedId = "LF-004"; }
-        attribute :>> name = "PrescriptionEntryFlow";
+    flow lfPrescriptionEntry : FunctionalExchange
+        from memo_examples_gpca_pump_gpca_operational::oaProgram.prescriptionOut
+        to fnValidatePrescription.prescriptionIn {
+        @MemoIdentity { :>> providedId = "LF-004"; :>> label = "PrescriptionEntryFlow"; }
         attribute :>> flowKind = FlowKind::configuration;
         attribute :>> latencyBudgetMs = 500.0;
         attribute :>> staleAfterMs = 0.0;
         attribute :>> integrityLevel = "confirmed double-entry path";
-        ref :>> targetFunction = fnValidatePrescription;
     }
 
     // ── Exchange item definitions ───────────────────────────────
     item ddPrescription : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::data;
-        @MemoIdentity { :>> providedId = "DD-001"; }
-        attribute :>> name = "PrescriptionRecord";
+        @MemoIdentity { :>> providedId = "DD-001"; :>> label = "PrescriptionRecord"; }
         attribute :>> semantics = "patient id, drug name, concentration, VTBI total, duration total, basal flow rate, square bolus rate/duration/interval, patient bolus rate/duration/lockout period, max boluses per hour (DD-005..DD-017)";
         attribute :>> unit = "ml/hr, ml, minutes, mg/ml, per hour";
         attribute :>> minValue = "pharmacy-database safe-value lower bounds (lo_hd)";
@@ -210,8 +200,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
     item ddBolusRequest : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::data;
-        @MemoIdentity { :>> providedId = "DD-002"; }
-        attribute :>> name = "BolusRequestSignal";
+        @MemoIdentity { :>> providedId = "DD-002"; :>> label = "BolusRequestSignal"; }
         attribute :>> semantics = "debounced patient pendant press event";
         attribute :>> encoding = "edge event with 50 ms debounce";
         attribute :>> timestampRequired = true;
@@ -221,8 +210,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
     item ddSensorVector : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::data;
-        @MemoIdentity { :>> providedId = "DD-003"; }
-        attribute :>> name = "SensorStatusVector";
+        @MemoIdentity { :>> providedId = "DD-003"; :>> label = "SensorStatusVector"; }
         attribute :>> semantics = "air-in-line, occlusion pressure, reservoir volume, door state, flow measurement, battery level, CPU/memory status";
         attribute :>> encoding = "fixed-layout status word per 20 ms step";
         attribute :>> timestampRequired = true;
@@ -232,8 +220,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
     item ddEventRecord : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::data;
-        @MemoIdentity { :>> providedId = "DD-004"; }
-        attribute :>> name = "TherapyEventRecord";
+        @MemoIdentity { :>> providedId = "DD-004"; :>> label = "TherapyEventRecord"; }
         attribute :>> semantics = "timestamped dose, alarm, mode, and configuration events";
         attribute :>> encoding = "append-only sequenced records";
         attribute :>> timestampRequired = true;
@@ -243,16 +230,14 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     }
     item cdFlowCommand : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::command;
-        @MemoIdentity { :>> providedId = "CD-001"; }
-        attribute :>> name = "FlowCommand";
+        @MemoIdentity { :>> providedId = "CD-001"; :>> label = "FlowCommand"; }
         attribute :>> controlType = "commanded flow rate with enable interlock";
         attribute :>> timeoutMs = 40.0;
         attribute :>> retryPolicy = "no retry; missing command forces zero flow";
     }
     item cdAlarmSignal : InterfaceItem {
         attribute :>> itemKind = InterfaceItemKind::command;
-        @MemoIdentity { :>> providedId = "CD-002"; }
-        attribute :>> name = "AlarmSignal";
+        @MemoIdentity { :>> providedId = "CD-002"; :>> label = "AlarmSignal"; }
         attribute :>> controlType = "priority-coded alarm assertion (level 1 stops infusion, level 2 warns)";
         attribute :>> timeoutMs = 20.0;
         attribute :>> retryPolicy = "latched until acknowledged and condition cleared";

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -13,11 +13,10 @@ package memo_examples_gpca_pump_gpca_context {
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
     // ── Intended use (ISO 14971 §5.2, IEC 62366-1) ──────────────
-    part gpcaIntendedUse : IntendedUse {
+    requirement gpcaIntendedUse : IntendedUse {
         @MemoIdentity { :>> providedId = "IU-001"; }
-        attribute :>> name = "GPCA_IntendedUse";
         @MemoIdentity { :>> shortDescription = "Patient-controlled analgesia infusion of prescribed opioid analgesics."; }
-        attribute :>> description = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
+        doc /* The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits. */
         attribute :>> indication = "Management of acute post-operative or chronic pain requiring titrated intravenous opioid analgesia.";
         attribute :>> contraindication = "Patients unable to comprehend or operate the bolus request mechanism; drugs without safe-value records in the hospital pharmacy database.";
         attribute :>> patientPopulation = "Adult in-patients under clinical supervision.";
@@ -29,10 +28,9 @@ package memo_examples_gpca_pump_gpca_context {
         @MemoIdentity { :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §2.1-2.3 (GPCA overview, system functions, user characteristics)"; }
     }
     part bolusByProxyMisuse : ReasonablyForeseeableMisuse {
-        @MemoIdentity { :>> providedId = "RFM-001"; }
-        attribute :>> name = "BolusRequestBySomeoneOtherThanPatient";
+        @MemoIdentity { :>> providedId = "RFM-001"; :>> label = "BolusRequestBySomeoneOtherThanPatient"; }
         @MemoIdentity { :>> shortDescription = "A caregiver or visitor presses the patient bolus control."; }
-        attribute :>> description = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
+        doc /* A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior. */
         attribute :>> misuseContext = "Patient-controlled analgesia in a supervised hospital setting.";
         attribute :>> foreseeableBasis = "Known PCA use pattern represented in the GPCA hazard analysis.";
         attribute :>> affectedUseContext = "UC-001";
@@ -41,8 +39,7 @@ package memo_examples_gpca_pump_gpca_context {
 
     // ── Use contexts ────────────────────────────────────────────
     part hospitalWardContext : UseContext {
-        @MemoIdentity { :>> providedId = "UC-001"; }
-        attribute :>> name = "HospitalWardUseContext";
+        @MemoIdentity { :>> providedId = "UC-001"; :>> label = "HospitalWardUseContext"; }
         attribute :>> careSetting = "acute-care hospital ward and post-anesthesia care unit";
         attribute :>> environment = "indoor clinical environment, mains power with battery backup, pole or bed-rail mounted";
         attribute :>> jurisdiction = "generic (FDA/EU reference model)";
@@ -54,18 +51,16 @@ package memo_examples_gpca_pump_gpca_context {
     // ── Actors ──────────────────────────────────────────────────
     part actorPatient : User {
         attribute :>> actorKind = ActorKind::patient;
-        @MemoIdentity { :>> providedId = "ACT-001"; }
-        attribute :>> name = "Patient";
+        @MemoIdentity { :>> providedId = "ACT-001"; :>> label = "Patient"; }
         attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
-        attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
+        doc /* Receives the infusion and requests bolus doses via the patient pendant. */
         perform oaRequestBolus;
     }
     part actorNurse : User {
         attribute :>> actorKind = ActorKind::clinician;
-        @MemoIdentity { :>> providedId = "ACT-002"; }
-        attribute :>> name = "ClinicianNurse";
+        @MemoIdentity { :>> providedId = "ACT-002"; :>> label = "ClinicianNurse"; }
         attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
-        attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
+        doc /* Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms. */
         perform oaProgram;
         perform oaStartTherapy;
         perform oaRespondAlarm;
@@ -73,64 +68,57 @@ package memo_examples_gpca_pump_gpca_context {
     }
     part actorPrescriber : User {
         attribute :>> actorKind = ActorKind::clinician;
-        @MemoIdentity { :>> providedId = "ACT-003"; }
-        attribute :>> name = "PrescribingPhysician";
+        @MemoIdentity { :>> providedId = "ACT-003"; :>> label = "PrescribingPhysician"; }
         attribute :>> trainingLevel = "licensed prescriber";
-        attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
+        doc /* Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits. */
         perform oaPrescribe;
     }
     part actorPharmacist : User {
         attribute :>> actorKind = ActorKind::clinician;
-        @MemoIdentity { :>> providedId = "ACT-004"; }
-        attribute :>> name = "Pharmacist";
+        @MemoIdentity { :>> providedId = "ACT-004"; :>> label = "Pharmacist"; }
         attribute :>> trainingLevel = "licensed pharmacist";
-        attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
+        doc /* Prepares the drug reservoir and verifies drug and concentration against the prescription. */
         perform oaLoadReservoir;
     }
     part actorTechnician : User {
         attribute :>> actorKind = ActorKind::technician;
-        @MemoIdentity { :>> providedId = "ACT-005"; }
-        attribute :>> name = "BiomedicalTechnician";
+        @MemoIdentity { :>> providedId = "ACT-005"; :>> label = "BiomedicalTechnician"; }
         attribute :>> trainingLevel = "service-trained; authenticated service access";
-        attribute :>> description = "Performs maintenance, battery replacement, and calibration through the service interface.";
+        doc /* Performs maintenance, battery replacement, and calibration through the service interface. */
         perform oaMaintain;
     }
 
     // ── Foreseeable use errors (IEC 62366-1, AAMI TIR PCA) ──────
     part ueMisprogrammedRate : UseError {
-        @MemoIdentity { :>> providedId = "UE-001"; }
-        attribute :>> name = "MisprogrammedInfusionParameters";
+        @MemoIdentity { :>> providedId = "UE-001"; :>> label = "MisprogrammedInfusionParameters"; }
         attribute :>> errorCategory = UseErrorCategoryKind::actionCategory;
         attribute :>> severity = SeverityKind::catastrophic;
         attribute :>> rootCauseType = "decimal-point / unit entry slip during prescription programming";
-        attribute :>> description = "Clinician enters a basal rate or bolus volume an order of magnitude off (e.g. mg vs mL, misplaced decimal).";
+        doc /* Clinician enters a basal rate or bolus volume an order of magnitude off (e.g. mg vs mL, misplaced decimal). */
         @MemoIdentity { :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.8 Use Hazards (incorrect dose settings)"; }
     }
     part ueBolusByProxy : UseError {
-        @MemoIdentity { :>> providedId = "UE-002"; }
-        attribute :>> name = "PCAByProxy";
+        @MemoIdentity { :>> providedId = "UE-002"; :>> label = "PCAByProxy"; }
         attribute :>> errorCategory = UseErrorCategoryKind::cognition;
         attribute :>> severity = SeverityKind::catastrophic;
         attribute :>> rootCauseType = "family member or caregiver presses bolus button on behalf of a sedated patient";
-        attribute :>> description = "Bolus doses requested by someone other than the patient defeat the inherent safety of patient-limited dosing.";
+        doc /* Bolus doses requested by someone other than the patient defeat the inherent safety of patient-limited dosing. */
         @MemoIdentity { :>> sourceReference = "illustrative — no source"; }
     }
     part ueWrongDrugLoaded : UseError {
-        @MemoIdentity { :>> providedId = "UE-003"; }
-        attribute :>> name = "WrongDrugOrConcentrationLoaded";
+        @MemoIdentity { :>> providedId = "UE-003"; :>> label = "WrongDrugOrConcentrationLoaded"; }
         attribute :>> errorCategory = UseErrorCategoryKind::cognition;
         attribute :>> severity = SeverityKind::catastrophic;
         attribute :>> rootCauseType = "reservoir containing wrong drug or concentration mounted without verification";
-        attribute :>> description = "Loaded drug or concentration differs from the programmed prescription, so delivered dose differs from intended dose.";
+        doc /* Loaded drug or concentration differs from the programmed prescription, so delivered dose differs from intended dose. */
         @MemoIdentity { :>> sourceReference = "illustrative — no source"; }
     }
     part ueAlarmDisregard : UseError {
-        @MemoIdentity { :>> providedId = "UE-004"; }
-        attribute :>> name = "AlarmSilencedAndForgotten";
+        @MemoIdentity { :>> providedId = "UE-004"; :>> label = "AlarmSilencedAndForgotten"; }
         attribute :>> errorCategory = UseErrorCategoryKind::memoryRecall;
         attribute :>> severity = SeverityKind::serious;
         attribute :>> rootCauseType = "alarm silenced during high workload and the underlying condition never resolved";
-        attribute :>> description = "Clinician silences an alarm and does not return to resolve the underlying condition (e.g. occlusion), interrupting therapy.";
+        doc /* Clinician silences an alarm and does not return to resolve the underlying condition (e.g. occlusion), interrupting therapy. */
         @MemoIdentity { :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.8 Use Hazards (attentional/memory failure)"; }
     }
     // Which task each use error is committed during (IEC 62366-1). This was

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -18,81 +18,75 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
     private import memo_core_common::MemoIdentity;
     part therapyConfigurationAsset : CybersecurityAsset {
         @MemoIdentity { :>> providedId = "AST-CYB-001"; }
-        attribute :>> name = "TherapyConfigurationAsset";
         attribute :>> assetKind = AssetKind::configuration;
-        attribute :>> confidentialityNeed = "medium";
-        attribute :>> integrityNeed = "very high";
-        attribute :>> availabilityNeed = "high";
+        attribute :>> confidentialityNeed = SecurityNeedKind::medium;
+        attribute :>> integrityNeed = SecurityNeedKind::veryHigh;
+        attribute :>> availabilityNeed = SecurityNeedKind::high;
         attribute :>> privacyRelevant = false;
         attribute :>> safetyRelevant = true;
-        attribute :>> owningLayer = "software_structure";
+        ref :>> holder = gpcaSoftware.config;
     }
 
     part patientEventLogAsset : CybersecurityAsset {
         @MemoIdentity { :>> providedId = "AST-CYB-002"; }
-        attribute :>> name = "PatientEventLogAsset";
         attribute :>> assetKind = AssetKind::auditRecord;
-        attribute :>> confidentialityNeed = "high";
-        attribute :>> integrityNeed = "high";
-        attribute :>> availabilityNeed = "medium";
+        attribute :>> confidentialityNeed = SecurityNeedKind::high;
+        attribute :>> integrityNeed = SecurityNeedKind::high;
+        attribute :>> availabilityNeed = SecurityNeedKind::medium;
         attribute :>> privacyRelevant = true;
         attribute :>> safetyRelevant = false;
-        attribute :>> owningLayer = "software_structure";
+        ref :>> holder = gpcaSoftware.logging;
     }
 
     part maintenancePortBoundary : TrustBoundary {
         @MemoIdentity { :>> providedId = "TB-001"; }
-        attribute :>> name = "MaintenancePortBoundary";
         attribute :>> boundaryType = "service-access";
         attribute :>> crossingConstraint = "Boundary between service tooling and therapy controller runtime.";
         attribute :>> trustAssumption = "Service tooling on the untrusted side requires authentication before any crossing is permitted.";
     }
 
+    // --8<-- [start:threat]
     part unauthorizedConfigChangeThreat : Threat {
-        @MemoIdentity { :>> providedId = "TH-001"; }
-        attribute :>> name = "UnauthorizedTherapyConfigurationChange";
+        @MemoIdentity { :>> providedId = "TH-001"; :>> label = "UnauthorizedTherapyConfigurationChange"; }
         attribute :>> driverKind = "cybersecurity";
         attribute :>> threatCategory = ThreatCategoryKind::tampering;
         attribute :>> attackVector = "maintenance port";
         attribute :>> threatSource = "unauthorized actor with local access";
         attribute :>> precondition = "maintenance interface exposed without strong authentication";
         attribute :>> affectedConcern = ConcernKind::cybersecurity;
-        attribute :>> defaultTechnique = "STRIDE tampering";
+    // --8<-- [end:threat]
     }
 
     part eventLogTamperingThreat : Threat {
-        @MemoIdentity { :>> providedId = "TH-002"; }
-        attribute :>> name = "PatientEventLogTampering";
+        @MemoIdentity { :>> providedId = "TH-002"; :>> label = "PatientEventLogTampering"; }
         attribute :>> driverKind = "cybersecurity";
         attribute :>> threatCategory = ThreatCategoryKind::repudiation;
         attribute :>> attackVector = "maintenance port";
         attribute :>> threatSource = "unauthorized actor with local access";
         attribute :>> precondition = "audit log writable without integrity protection";
         attribute :>> affectedConcern = ConcernKind::cybersecurity;
-        attribute :>> defaultTechnique = "STRIDE repudiation";
     }
 
-    part weakServiceAuthentication : Vulnerability {
+    // --8<-- [start:vulnerability]
+    item weakServiceAuthentication : Vulnerability {
         @MemoIdentity { :>> providedId = "VULN-001"; }
-        attribute :>> name = "WeakServiceAuthentication";
         attribute :>> weakness = "service mode relies on shared default credential";
         attribute :>> exploitability = "moderate";
         attribute :>> discoveryMethod = "architecture review";
-        attribute :>> affectedLayer = "software_structure";
+        ref :>> affectedElement = gpcaSoftware.config;
         attribute :>> cweReference = "CWE-798";
+    // --8<-- [end:vulnerability]
     }
 
     action tamperedConfigurationScenario : OperativeScenario {
-        @MemoIdentity { :>> providedId = "SCN-001"; }
-        attribute :>> name = "TamperedTherapyConfigurationScenario";
-        attribute :>> description = "An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards.";
+        @MemoIdentity { :>> providedId = "SCN-001"; :>> label = "TamperedTherapyConfigurationScenario"; }
+        doc /* An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards. */
         attribute :>> actorDescription = "unauthorized actor with local access to the maintenance port";
         attribute :>> defaultCategory = ThreatCategoryKind::tampering;
     }
 
-    part unsafeDoseCyberHazard : CyberHazard {
-        @MemoIdentity { :>> providedId = "CHZ-001"; }
-        attribute :>> name = "UnsafeTherapyConfigurationHazard";
+    item unsafeDoseCyberHazard : CyberHazard {
+        @MemoIdentity { :>> providedId = "CHZ-001"; :>> label = "UnsafeTherapyConfigurationHazard"; }
         attribute :>> hazardType = HazardTypeKind::drugDeliveryError;
         attribute :>> foreseeable = true;
         attribute :>> securityImpact = "loss of configuration integrity";
@@ -103,7 +97,6 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
 
     part configurationTamperingRisk : CyberRisk {
         @MemoIdentity { :>> providedId = "CRISK-001"; }
-        attribute :>> name = "ConfigurationTamperingRisk";
         attribute :>> driverKind = "cyber risk";
         attribute :>> probabilityEstimate = ProbabilityKind::occasional;
         attribute :>> severityEstimate = SeverityKind::catastrophic;
@@ -116,8 +109,7 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
     }
 
     part strongServiceAuthentication : CyberMitigation {
-        @MemoIdentity { :>> providedId = "CMIT-001"; }
-        attribute :>> name = "StrongServiceAuthenticationAndAudit";
+        @MemoIdentity { :>> providedId = "CMIT-001"; :>> label = "StrongServiceAuthenticationAndAudit"; }
         attribute :>> controlKind = RiskControlKind::protectiveMeasure;
         attribute :>> implementationKind = RiskControlImplementationKind::softwareDesign;
         attribute :>> verificationStatus = "planned";
@@ -127,8 +119,7 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
     }
 
     requirement reqAuthenticatedServiceAccess : SecurityRequirement {
-        @MemoIdentity { :>> providedId = "SREQ-001"; }
-        attribute :>> name = "AuthenticatedServiceAccess";
+        @MemoIdentity { :>> providedId = "SREQ-001"; :>> label = "AuthenticatedServiceAccess"; }
         attribute :>> statement = "The system shall require authenticated and authorized service access before any therapy configuration parameter can be modified.";
         attribute :>> sourceKind = RequirementSourceKind::risk;
         attribute :>> concernKind = ConcernKind::cybersecurity;
@@ -139,14 +130,11 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
         attribute :>> assumptionSummary = "cryptographic identity available";
         attribute :>> guaranteeSummary = "only authorized service access can change therapy configuration";
         attribute :>> securityObjective = "integrity";
-        attribute :>> derivedFromThreat = "TH-001";
-        attribute :>> defaultConcern = ConcernKind::cybersecurity;
         attribute :>> safetyClass = SafetyClassKind::C;
     }
 
     verification vcAuthenticatedServiceAccess : VerificationCase {
-        @MemoIdentity { :>> providedId = "CVER-001"; }
-        attribute :>> name = "VerifyAuthenticatedServiceAccess";
+        @MemoIdentity { :>> providedId = "CVER-001"; :>> label = "VerifyAuthenticatedServiceAccess"; }
         attribute :>> methodKind = MemoVerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Only authenticated and authorized service sessions may modify therapy configuration; all attempts are logged.";
         attribute :>> status = ElementStatusKind::approved;
@@ -154,21 +142,26 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
         objective { verify reqAuthenticatedServiceAccess; }
     }
 
-    connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to realizedThreat ::> unauthorizedConfigChangeThreat;
+    // --8<-- [start:chain]
+    connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to threat ::> unauthorizedConfigChangeThreat;
 
-    connection : ThreatenedBy connect protectedAsset ::> patientEventLogAsset to realizedThreat ::> eventLogTamperingThreat;
+    connection : ThreatenedBy connect protectedAsset ::> patientEventLogAsset to threat ::> eventLogTamperingThreat;
 
-    connection : Exploits connect realizedThreat ::> unauthorizedConfigChangeThreat to enablingVulnerability ::> weakServiceAuthentication;
+    connection : Exploits connect threat ::> unauthorizedConfigChangeThreat to enablingVulnerability ::> weakServiceAuthentication;
 
     connection : RealizedByScenario connect realizedThreat ::> unauthorizedConfigChangeThreat to scenario ::> tamperedConfigurationScenario;
+    // --8<-- [end:chain]
 
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::vulnerability; connect control ::> strongServiceAuthentication to mitigatedElement ::> weakServiceAuthentication; }
+    connection : Mitigates connect control ::> strongServiceAuthentication to mitigatedElement ::> weakServiceAuthentication { attribute :>> mitigationKind = MitigationKind::vulnerability; }
 
     connection : DerivesCyberRequirement connect sourceThreatOrRisk ::> unauthorizedConfigChangeThreat to targetRequirement ::> reqAuthenticatedServiceAccess;
 
     connection : DerivesCyberRequirement connect sourceThreatOrRisk ::> eventLogTamperingThreat to targetRequirement ::> reqAuthenticatedServiceAccess;
 
-    connection : ImpactsSafety connect cyberElement ::> configurationTamperingRisk to safetyElement ::> riskBefore;
+    // A security risk feeds safety risk management at the hazard it can
+    // cause (AAMI TIR57), not at another risk's estimate: tampered therapy
+    // configuration is a route to over-infusion.
+    connection : ImpactsSafety connect cyberElement ::> configurationTamperingRisk to safetyElement ::> overdoseHazard;
 
     connection : CrossesTrustBoundary connect boundary ::> maintenancePortBoundary to crossingItem ::> therapyConfigurationAsset;