@memoarchitect/ontology 0.13.2 → 0.15.1

package/examples/gpca-pump/model/catalog/gpca_trace.sysml

@@ -34,6 +34,8 @@ package memo_examples_gpca_pump_gpca_trace {
     private import memo_architecture_operational_use_cases::*;
     private import memo_architecture_operational_workflows::*;
     private import memo_architecture_realization_deployment::*;
+    private import memo_core_enumerations::DeploymentKind;
+    private import memo_core_common::MemoIdentity;
     private import memo_assurance_human_factors::*;
     private import memo_assurance_safety_risk::*;
     private import memo_assurance_safety_risk_analysis::*;
@@ -48,19 +50,20 @@ package memo_examples_gpca_pump_gpca_trace {
     connection connect actorPharmacist to entityPharmacy;
 
     // ── Fig 2.1 context flows (CriSys §2.1) ─────────────────────
-    // Data flows
-    flow from entityPrescription to actorNurse;
-    flow from actorNurse to entityGpcaPump;
-    flow from entityGpcaPump to actorNurse;
-    flow from actorPatient to entityGpcaPump;
-    flow from entityPharmacyDb to entityGpcaPump;
+    // Data exchanges: who exchanges data with whom (the figure names no item),
+    // so each is a connection from the source to the receiver.
+    connection entityPrescriptionToActorNurse connect entityPrescription to actorNurse;
+    connection actorNurseToEntityGpcaPump connect actorNurse to entityGpcaPump;
+    connection entityGpcaPumpToActorNurse connect entityGpcaPump to actorNurse;
+    connection actorPatientToEntityGpcaPump connect actorPatient to entityGpcaPump;
+    connection entityPharmacyDbToEntityGpcaPump connect entityPharmacyDb to entityGpcaPump;
     // Physical connections (drug path)
     connection connect source ::> entityDrugReservoir to target ::> entityGpcaPump;
     connection connect source ::> entityGpcaPump to target ::> entityNeedle;
     connection connect source ::> entityNeedle to target ::> actorPatient;
     connection connect source ::> entityPowerInfrastructure to target ::> entityGpcaPump;
     // Intended use and use context anchoring (no floating context nodes)
-    connection : Governs { attribute :>> governKind = GovernKind::'use'; connect governor ::> gpcaIntendedUse to governedElement ::> entityGpcaPump; }
+    connection : Governs connect governor ::> gpcaIntendedUse to governedElement ::> entityGpcaPump { attribute :>> governKind = GovernKind::'use'; }
     connection : AppliesInContext connect useContext ::> hospitalWardContext to subjectElement ::> entityGpcaPump;
     connection : AppliesInContext connect useContext ::> hospitalWardContext to subjectElement ::> entityHospital;
 
@@ -77,10 +80,10 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : DerivesFrom connect sourceDriver ::> oaRespondAlarm to targetRequirement ::> reqCs59;
 
     // ── Functional chains ───────────────────────────────────────
-    // fcPatientBolus/fcAlarmStop already name every one of these functions
-    // via their step chain (perform fcsBolusSense; ... ref :>> function =
-    // fnAcquireSensors;) in gpca_system.sysml — InvolvesFunction was a
-    // flattened restatement of that two-hop path, not new information.
+    // fcPatientBolus/fcAlarmStop already name every one of these functions:
+    // each step subsets the function it performs (`action fcsBolusSense :>
+    // fnAcquireSensors`) in gpca_system.sysml — InvolvesFunction was a
+    // flattened restatement of that, not new information.
     // fcStartup declares no steps, so its two functions are native `perform`
     // statements directly on fcStartup in gpca_system.sysml instead.
     #refinement dependency fcPatientBolus to ssBolusDuringBasal;
@@ -92,15 +95,17 @@ package memo_examples_gpca_pump_gpca_trace {
     // The nine refinement statements themselves live in gpca_operational.sysml,
     // inside wsRequestBolus's/wsRespondAlarm's own owning scope — the
     // `#refinement dependency ... to ...` shorthand's target end does not
-    // accept a qualified path, and both steps are nested now.
+    // accept a qualified path, and the operative actions are nested.
 
     // ── Requirement derivation ──────────────────────────────────
     // MEMO extension requirements (REQ-X) derive from needs and risks.
+    // --8<-- [start:derives]
     connection : DerivesFrom connect sourceDriver ::> needSafeTherapy to targetRequirement ::> reqPost;
     connection : DerivesFrom connect sourceDriver ::> needEffectiveAnalgesia to targetRequirement ::> reqPumpAccuracy;
     connection : DerivesFrom connect sourceDriver ::> needEffectiveAnalgesia to targetRequirement ::> reqBatteryBackup;
     connection : DerivesFrom connect sourceDriver ::> needTimelyAlarms to targetRequirement ::> reqAlarmLoudness;
     connection : DerivesFrom connect sourceDriver ::> needAuditableRecord to targetRequirement ::> reqEventLogging;
+    // --8<-- [end:derives]
     connection : DerivesFrom connect sourceDriver ::> overdoseHazard to targetRequirement ::> reqCs25;
     connection : DerivesFrom connect sourceDriver ::> underdoseHazard to targetRequirement ::> reqOcclusion;
     connection : DerivesFrom connect sourceDriver ::> airEmbolismHazard to targetRequirement ::> reqCs21;
@@ -329,23 +334,43 @@ package memo_examples_gpca_pump_gpca_trace {
 
     // ── Function allocation ─────────────────────────────────────
     allocate fnAcquireSensors to gpcaDevice.gpcaDeviceSensors;
-    allocate fnAcquireSensors to gpcaDevice.gpcaSoftware.systemStatus;
-    allocate fnPresentStatus to gpcaDevice.gpcaSoftware.outputBus;
-    allocate fnValidatePrescription to gpcaDevice.gpcaSoftware.config;
-    allocate fnMonitorAlarm to gpcaDevice.gpcaSoftware.alarm;
+    allocate fnAcquireSensors to gpcaSoftware.systemStatus;
+    allocate fnPresentStatus to gpcaSoftware.outputBus;
+    allocate fnValidatePrescription to gpcaSoftware.config;
+    allocate fnMonitorAlarm to gpcaSoftware.alarm;
     allocate fnAnnunciate to audibleAlarm;
-    allocate fnManageInfusion to gpcaDevice.gpcaSoftware.infusionMgr;
-    allocate fnEnforceLimits to gpcaDevice.gpcaSoftware.infusionMgr;
+    allocate fnManageInfusion to gpcaSoftware.infusionMgr;
+    allocate fnEnforceLimits to gpcaSoftware.infusionMgr;
     allocate fnCommandPump to pumpMotorAssembly;
-    allocate fnLogEvents to gpcaDevice.gpcaSoftware.logging;
-    allocate fnManagePower to gpcaDevice.gpcaSoftware.systemMonitor;
+    allocate fnLogEvents to gpcaSoftware.logging;
+    allocate fnManagePower to gpcaSoftware.systemMonitor;
     allocate fnPresentStatus to operatorDisplay;
-    allocate fnSelfTest to gpcaDevice.gpcaSoftware.systemMonitor;
+    allocate fnSelfTest to gpcaSoftware.systemMonitor;
     // ── Deployment, hosting, and interface realization ──────────
-    allocation gpcaSoftwareDeployment : DeploysTo allocate gpcaDevice.gpcaSoftware to controllerBoard;
+    // Software reaches the hardware as a built image on the processor that
+    // runs it: modules build into the image, the image deploys to the MCU.
+    // This edge used to deploy the software system onto the circuit board,
+    // which DeploysTo's ends reject — a system is not a deployment unit and a
+    // board is not a processing node (mainController, hosted by the board).
+    // --8<-- [start:deployment]
+    part gpcaFirmwareImage : SoftwareDeploymentUnit {
+        @MemoIdentity { :>> providedId = "DU-001"; :>> label = "GPCAFirmwareImage"; }
+        attribute :>> unitKind = "firmware image";
+        attribute :>> version = "2.0";
+    }
+    allocation : BuildsInto allocate gpcaSoftware.tlm to gpcaFirmwareImage;
+    allocation : BuildsInto allocate gpcaSoftware.config to gpcaFirmwareImage;
+    allocation : BuildsInto allocate gpcaSoftware.alarm to gpcaFirmwareImage;
+    allocation : BuildsInto allocate gpcaSoftware.logging to gpcaFirmwareImage;
+    allocation : BuildsInto allocate gpcaSoftware.infusionMgr to gpcaFirmwareImage;
+    allocation : BuildsInto allocate gpcaSoftware.systemMonitor to gpcaFirmwareImage;
+    allocation gpcaSoftwareDeployment : DeploysTo allocate gpcaFirmwareImage to mainController {
+        attribute :>> deploymentKind = DeploymentKind::embedded;
+    }
     allocation : HostedBy allocate mainController to controllerBoard;
     #refinement dependency sensorInputInterface to hwSoftwareBus;
     #refinement dependency actuatorCommandInterface to pumpMotorDrive;
+    // --8<-- [end:deployment]
     connection : BindsToInterface connect portElement ::> portPatientPendant to boundInterface ::> bolusButtonLine;
     connection : BindsToInterface connect portElement ::> portMotorDrive to boundInterface ::> pumpMotorDrive;
     connection : BindsToInterface connect portElement ::> portSensorHarness to boundInterface ::> occlusionAnalogLine;
@@ -369,33 +394,33 @@ package memo_examples_gpca_pump_gpca_trace {
     // recorded exactly, at port granularity, as `bind` statements in
     // gpca_interfaces.sysml — so nothing is lost by not restating them
     // here in a granularity that cannot express them.
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.infusionMgr to gpcaDevice.gpcaSoftware.systemStatus;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.systemStatus;
-    flow from gpcaDevice.gpcaSoftware.config to gpcaDevice.gpcaSoftware.systemStatus;
-    flow from gpcaDevice.gpcaSoftware.systemStatus to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.infusionMgr to gpcaDevice.gpcaSoftware.alarm;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.alarm;
-    flow from gpcaDevice.gpcaSoftware.systemMonitor to gpcaDevice.gpcaSoftware.alarm;
-    flow from gpcaDevice.gpcaSoftware.systemStatus to gpcaDevice.gpcaSoftware.alarm;
-    flow from gpcaDevice.gpcaSoftware.config to gpcaDevice.gpcaSoftware.alarm;
-    flow from gpcaDevice.gpcaSoftware.alarm to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.config;
-    flow from gpcaDevice.gpcaSoftware.systemStatus to gpcaDevice.gpcaSoftware.config;
-    flow from gpcaDevice.gpcaSoftware.config to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.infusionMgr;
-    flow from gpcaDevice.gpcaSoftware.config to gpcaDevice.gpcaSoftware.infusionMgr;
-    flow from gpcaDevice.gpcaSoftware.alarm to gpcaDevice.gpcaSoftware.infusionMgr;
-    flow from gpcaDevice.gpcaSoftware.systemStatus to gpcaDevice.gpcaSoftware.infusionMgr;
-    flow from gpcaDevice.gpcaSoftware.infusionMgr to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.systemMonitor;
-    flow from gpcaDevice.gpcaSoftware.systemMonitor to gpcaDevice.gpcaSoftware.outputBus;
-    flow from gpcaDevice.gpcaSoftware.tlm to gpcaDevice.gpcaSoftware.logging;
-    flow from gpcaDevice.gpcaSoftware.config to gpcaDevice.gpcaSoftware.logging;
-    flow from gpcaDevice.gpcaSoftware.alarm to gpcaDevice.gpcaSoftware.logging;
-    flow from gpcaDevice.gpcaSoftware.systemStatus to gpcaDevice.gpcaSoftware.logging;
-    flow from gpcaDevice.gpcaSoftware.infusionMgr to gpcaDevice.gpcaSoftware.logging;
-    flow from gpcaDevice.gpcaSoftware.logging to gpcaDevice.gpcaSoftware.outputBus;
+    flow tlmToOutputBus from gpcaSoftware.tlm to gpcaSoftware.outputBus;
+    flow infusionMgrToSystemStatus from gpcaSoftware.infusionMgr to gpcaSoftware.systemStatus;
+    flow tlmToSystemStatus from gpcaSoftware.tlm to gpcaSoftware.systemStatus;
+    flow configToSystemStatus from gpcaSoftware.config to gpcaSoftware.systemStatus;
+    flow systemStatusToOutputBus from gpcaSoftware.systemStatus to gpcaSoftware.outputBus;
+    flow infusionMgrToAlarm from gpcaSoftware.infusionMgr to gpcaSoftware.alarm;
+    flow tlmToAlarm from gpcaSoftware.tlm to gpcaSoftware.alarm;
+    flow systemMonitorToAlarm from gpcaSoftware.systemMonitor to gpcaSoftware.alarm;
+    flow systemStatusToAlarm from gpcaSoftware.systemStatus to gpcaSoftware.alarm;
+    flow configToAlarm from gpcaSoftware.config to gpcaSoftware.alarm;
+    flow alarmToOutputBus from gpcaSoftware.alarm to gpcaSoftware.outputBus;
+    flow tlmToConfig from gpcaSoftware.tlm to gpcaSoftware.config;
+    flow systemStatusToConfig from gpcaSoftware.systemStatus to gpcaSoftware.config;
+    flow configToOutputBus from gpcaSoftware.config to gpcaSoftware.outputBus;
+    flow tlmToInfusionMgr from gpcaSoftware.tlm to gpcaSoftware.infusionMgr;
+    flow configToInfusionMgr from gpcaSoftware.config to gpcaSoftware.infusionMgr;
+    flow alarmToInfusionMgr from gpcaSoftware.alarm to gpcaSoftware.infusionMgr;
+    flow systemStatusToInfusionMgr from gpcaSoftware.systemStatus to gpcaSoftware.infusionMgr;
+    flow infusionMgrToOutputBus from gpcaSoftware.infusionMgr to gpcaSoftware.outputBus;
+    flow tlmToSystemMonitor from gpcaSoftware.tlm to gpcaSoftware.systemMonitor;
+    flow systemMonitorToOutputBus from gpcaSoftware.systemMonitor to gpcaSoftware.outputBus;
+    flow tlmToLogging from gpcaSoftware.tlm to gpcaSoftware.logging;
+    flow configToLogging from gpcaSoftware.config to gpcaSoftware.logging;
+    flow alarmToLogging from gpcaSoftware.alarm to gpcaSoftware.logging;
+    flow systemStatusToLogging from gpcaSoftware.systemStatus to gpcaSoftware.logging;
+    flow infusionMgrToLogging from gpcaSoftware.infusionMgr to gpcaSoftware.logging;
+    flow loggingToOutputBus from gpcaSoftware.logging to gpcaSoftware.outputBus;
 
     // ── GPCA_SW boundary features (AADL GPCA_SW.aadl; CITE-002) ──
     // The seven top-level ports are features of GPCA_Software, so
@@ -409,13 +434,13 @@ package memo_examples_gpca_pump_gpca_trace {
     bind gpcaDevice.devDbIn = gpcaDevice.gpcaDeviceSensors.snsDbIn;
     bind gpcaDevice.devPresIn = gpcaDevice.gpcaDeviceSensors.snsPresIn;
     bind gpcaDevice.devPatientIn = gpcaDevice.gpcaDeviceSensors.snsPatientIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsOpCmdOut to gpcaDevice.gpcaSoftware.portOpCmdIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsPresOut to gpcaDevice.gpcaSoftware.portPresIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsPatientOut to gpcaDevice.gpcaSoftware.portPatientIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsSensorOut to gpcaDevice.gpcaSoftware.portSensorIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsConstOut to gpcaDevice.gpcaSoftware.portConstIn;
-    flow from gpcaDevice.gpcaDeviceSensors.snsDbOut to gpcaDevice.gpcaSoftware.portDbIn;
-    flow from gpcaDevice.gpcaSoftware.portGpcaSwOut to gpcaDevice.gpcaActuators.actGpcaSwIn;
+    flow snsOpCmdOutToPortOpCmdIn from gpcaDevice.gpcaDeviceSensors.snsOpCmdOut to gpcaSoftware.portOpCmdIn;
+    flow snsPresOutToPortPresIn from gpcaDevice.gpcaDeviceSensors.snsPresOut to gpcaSoftware.portPresIn;
+    flow snsPatientOutToPortPatientIn from gpcaDevice.gpcaDeviceSensors.snsPatientOut to gpcaSoftware.portPatientIn;
+    flow snsSensorOutToPortSensorIn from gpcaDevice.gpcaDeviceSensors.snsSensorOut to gpcaSoftware.portSensorIn;
+    flow snsConstOutToPortConstIn from gpcaDevice.gpcaDeviceSensors.snsConstOut to gpcaSoftware.portConstIn;
+    flow snsDbOutToPortDbIn from gpcaDevice.gpcaDeviceSensors.snsDbOut to gpcaSoftware.portDbIn;
+    flow portGpcaSwOutToActGpcaSwIn from gpcaSoftware.portGpcaSwOut to gpcaDevice.gpcaActuators.actGpcaSwIn;
     bind gpcaDevice.gpcaActuators.actGpcaOut = gpcaDevice.devGpcaOut;
 
     // ── Risk chains (ISO 14971, GIIP causal-tree structure) ─────
@@ -429,15 +454,15 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : TracesRisk connect sourceRiskElement ::> overdoseHazard to targetRiskElement ::> seqFrequentBolus;
     connection : TracesRisk connect sourceRiskElement ::> seqFrequentBolus to targetRiskElement ::> hsExcessInfusion;
     connection : TracesRisk connect sourceRiskElement ::> hsExcessInfusion to targetRiskElement ::> harmRespiratoryDepression;
-    connection : TracesRisk connect sourceRiskElement ::> harmRespiratoryDepression to targetRiskElement ::> riskBefore;
+    connection : EstimatedFor connect risk ::> riskBefore to riskElement ::> harmRespiratoryDepression;
     connection : AssessedAgainst connect risk ::> riskBefore to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> lockoutControl to mitigatedElement ::> overdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> drugLibraryControl to mitigatedElement ::> overdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> watchdogControl to mitigatedElement ::> overdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> flowCrossCheckControl to mitigatedElement ::> overdoseHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> lockoutControl to targetRiskElement ::> riskAfter;
+    connection : Mitigates connect control ::> lockoutControl to mitigatedElement ::> overdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> drugLibraryControl to mitigatedElement ::> overdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> watchdogControl to mitigatedElement ::> overdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> flowCrossCheckControl to mitigatedElement ::> overdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfter to control ::> lockoutControl;
     connection : AssessedAgainst connect risk ::> riskAfter to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfter;
+    connection : EvaluatedIn connect residualRisk ::> riskAfter to evaluation ::> residualEval;
     // HZ-002 under-infusion
     connection : TracesRisk connect sourceRiskElement ::> causeOcclusion to targetRiskElement ::> underdoseHazard;
     connection : TracesRisk connect sourceRiskElement ::> causeReservoirEmpty to targetRiskElement ::> underdoseHazard;
@@ -447,14 +472,14 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : TracesRisk connect sourceRiskElement ::> underdoseHazard to targetRiskElement ::> seqOcclusion;
     connection : TracesRisk connect sourceRiskElement ::> seqOcclusion to targetRiskElement ::> hsInterruptedTherapy;
     connection : TracesRisk connect sourceRiskElement ::> hsInterruptedTherapy to targetRiskElement ::> harmUntreatedPain;
-    connection : TracesRisk connect sourceRiskElement ::> harmUntreatedPain to targetRiskElement ::> riskBeforeUnderdose;
+    connection : EstimatedFor connect risk ::> riskBeforeUnderdose to riskElement ::> harmUntreatedPain;
     connection : AssessedAgainst connect risk ::> riskBeforeUnderdose to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> occlusionAlarmControl to mitigatedElement ::> underdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> reservoirMonitorControl to mitigatedElement ::> underdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> flowCrossCheckControl to mitigatedElement ::> underdoseHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> occlusionAlarmControl to targetRiskElement ::> riskAfterUnderdose;
+    connection : Mitigates connect control ::> occlusionAlarmControl to mitigatedElement ::> underdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> reservoirMonitorControl to mitigatedElement ::> underdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> flowCrossCheckControl to mitigatedElement ::> underdoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterUnderdose to control ::> occlusionAlarmControl;
     connection : AssessedAgainst connect risk ::> riskAfterUnderdose to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterUnderdose;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterUnderdose to evaluation ::> residualEval;
     // HZ-003 air embolism (shares the air-in-line and empty-reservoir causes)
     connection : TracesRisk connect sourceRiskElement ::> causeAirInLine to targetRiskElement ::> airEmbolismHazard;
     connection : TracesRisk connect sourceRiskElement ::> causeReservoirEmpty to targetRiskElement ::> airEmbolismHazard;
@@ -464,12 +489,12 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : TracesRisk connect sourceRiskElement ::> airEmbolismHazard to targetRiskElement ::> seqAirInLine;
     connection : TracesRisk connect sourceRiskElement ::> seqAirInLine to targetRiskElement ::> hsAirTowardPatient;
     connection : TracesRisk connect sourceRiskElement ::> hsAirTowardPatient to targetRiskElement ::> harmAirEmbolism;
-    connection : TracesRisk connect sourceRiskElement ::> harmAirEmbolism to targetRiskElement ::> riskBeforeAir;
+    connection : EstimatedFor connect risk ::> riskBeforeAir to riskElement ::> harmAirEmbolism;
     connection : AssessedAgainst connect risk ::> riskBeforeAir to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> airDetectionControl to mitigatedElement ::> airEmbolismHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> airDetectionControl to targetRiskElement ::> riskAfterAir;
+    connection : Mitigates connect control ::> airDetectionControl to mitigatedElement ::> airEmbolismHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterAir to control ::> airDetectionControl;
     connection : AssessedAgainst connect risk ::> riskAfterAir to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterAir;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterAir to evaluation ::> residualEval;
     // HZ-004 misprogramming / wrong drug
     connection : TracesRisk connect sourceRiskElement ::> causeWrongPrescriptionEntered to targetRiskElement ::> wrongDoseHazard;
     connection : TracesRisk connect sourceRiskElement ::> causeWrongDoseUnits to targetRiskElement ::> wrongDoseHazard;
@@ -479,56 +504,56 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : TracesRisk connect sourceRiskElement ::> wrongDoseHazard to targetRiskElement ::> seqMisprogram;
     connection : TracesRisk connect sourceRiskElement ::> seqMisprogram to targetRiskElement ::> hsWrongTherapy;
     connection : TracesRisk connect sourceRiskElement ::> hsWrongTherapy to targetRiskElement ::> harmRespiratoryDepression;
-    connection : TracesRisk connect sourceRiskElement ::> hsWrongTherapy to targetRiskElement ::> riskBeforeWrongDose;
+    connection : EstimatedFor connect risk ::> riskBeforeWrongDose to riskElement ::> hsWrongTherapy;
     connection : AssessedAgainst connect risk ::> riskBeforeWrongDose to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> drugLibraryControl to mitigatedElement ::> wrongDoseHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> drugLibraryControl to targetRiskElement ::> riskAfterWrongDose;
+    connection : Mitigates connect control ::> drugLibraryControl to mitigatedElement ::> wrongDoseHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterWrongDose to control ::> drugLibraryControl;
     connection : AssessedAgainst connect risk ::> riskAfterWrongDose to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterWrongDose;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterWrongDose to evaluation ::> residualEval;
     // HZ-005 free flow
     connection : TracesRisk connect sourceRiskElement ::> causeSetDisengaged to targetRiskElement ::> freeFlowHazard;
     connection : TracesRisk connect sourceRiskElement ::> causeDoorOpenedDuringInfusion to targetRiskElement ::> freeFlowHazard;
     connection : TracesRisk connect sourceRiskElement ::> freeFlowHazard to targetRiskElement ::> seqFreeFlow;
     connection : TracesRisk connect sourceRiskElement ::> seqFreeFlow to targetRiskElement ::> hsFreeFlow;
     connection : TracesRisk connect sourceRiskElement ::> hsFreeFlow to targetRiskElement ::> harmRespiratoryDepression;
-    connection : TracesRisk connect sourceRiskElement ::> hsFreeFlow to targetRiskElement ::> riskBeforeFreeFlow;
+    connection : EstimatedFor connect risk ::> riskBeforeFreeFlow to riskElement ::> hsFreeFlow;
     connection : AssessedAgainst connect risk ::> riskBeforeFreeFlow to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> freeFlowValveControl to mitigatedElement ::> freeFlowHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> doorInterlockControl to mitigatedElement ::> freeFlowHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> freeFlowValveControl to targetRiskElement ::> riskAfterFreeFlow;
+    connection : Mitigates connect control ::> freeFlowValveControl to mitigatedElement ::> freeFlowHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> doorInterlockControl to mitigatedElement ::> freeFlowHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterFreeFlow to control ::> freeFlowValveControl;
     connection : AssessedAgainst connect risk ::> riskAfterFreeFlow to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterFreeFlow;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterFreeFlow to evaluation ::> residualEval;
     // HZ-006 reverse delivery (CriSys REQ 22; GIP HID 1.14)
     connection : TracesRisk connect sourceRiskElement ::> causeBleedBack to targetRiskElement ::> reverseDeliveryHazard;
     connection : TracesRisk connect sourceRiskElement ::> reverseDeliveryHazard to targetRiskElement ::> seqReverseDelivery;
     connection : TracesRisk connect sourceRiskElement ::> seqReverseDelivery to targetRiskElement ::> hsReverseFlow;
     connection : TracesRisk connect sourceRiskElement ::> hsReverseFlow to targetRiskElement ::> harmUntreatedPain;
-    connection : TracesRisk connect sourceRiskElement ::> harmUntreatedPain to targetRiskElement ::> riskBeforeReverse;
+    connection : EstimatedFor connect risk ::> riskBeforeReverse to riskElement ::> harmUntreatedPain;
     connection : AssessedAgainst connect risk ::> riskBeforeReverse to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> reverseDeliveryPauseControl to mitigatedElement ::> reverseDeliveryHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> antiRefluxDesignControl to mitigatedElement ::> reverseDeliveryHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> reverseDeliveryPauseControl to targetRiskElement ::> riskAfterReverse;
+    connection : Mitigates connect control ::> reverseDeliveryPauseControl to mitigatedElement ::> reverseDeliveryHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> antiRefluxDesignControl to mitigatedElement ::> reverseDeliveryHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterReverse to control ::> reverseDeliveryPauseControl;
     connection : AssessedAgainst connect risk ::> riskAfterReverse to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterReverse;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterReverse to evaluation ::> residualEval;
     // HZ-007 VTBI over-infusion (CriSys REQ 20/28; GIP use hazard 8.1)
     connection : TracesRisk connect sourceRiskElement ::> causeVtbiTooHigh to targetRiskElement ::> vtbiOverInfusionHazard;
     connection : TracesRisk connect sourceRiskElement ::> causeStaleDrugLibrary to targetRiskElement ::> vtbiOverInfusionHazard;
     connection : TracesRisk connect sourceRiskElement ::> vtbiOverInfusionHazard to targetRiskElement ::> seqVtbiExceeded;
     connection : TracesRisk connect sourceRiskElement ::> seqVtbiExceeded to targetRiskElement ::> hsVtbiExceeded;
     connection : TracesRisk connect sourceRiskElement ::> hsVtbiExceeded to targetRiskElement ::> harmRespiratoryDepression;
-    connection : TracesRisk connect sourceRiskElement ::> harmRespiratoryDepression to targetRiskElement ::> riskBeforeVtbi;
+    connection : EstimatedFor connect risk ::> riskBeforeVtbi to riskElement ::> harmRespiratoryDepression;
     connection : AssessedAgainst connect risk ::> riskBeforeVtbi to riskMatrix ::> riskMatrix;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> vtbiLimitPauseControl to mitigatedElement ::> vtbiOverInfusionHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> infusionCompleteControl to mitigatedElement ::> vtbiOverInfusionHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::hazard; connect control ::> drugLibraryControl to mitigatedElement ::> vtbiOverInfusionHazard; }
-    connection : TracesRisk connect sourceRiskElement ::> vtbiLimitPauseControl to targetRiskElement ::> riskAfterVtbi;
+    connection : Mitigates connect control ::> vtbiLimitPauseControl to mitigatedElement ::> vtbiOverInfusionHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> infusionCompleteControl to mitigatedElement ::> vtbiOverInfusionHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : Mitigates connect control ::> drugLibraryControl to mitigatedElement ::> vtbiOverInfusionHazard { attribute :>> mitigationKind = MitigationKind::hazard; }
+    connection : ReducedBy connect residualRisk ::> riskAfterVtbi to control ::> vtbiLimitPauseControl;
     connection : AssessedAgainst connect risk ::> riskAfterVtbi to riskMatrix ::> riskMatrix;
-    connection : TracesRisk connect sourceRiskElement ::> residualEval to targetRiskElement ::> riskAfterVtbi;
+    connection : EvaluatedIn connect residualRisk ::> riskAfterVtbi to evaluation ::> residualEval;
     // Use errors feeding the risk chains (IEC 62366-1 §5.3)
-    connection : TracesRisk connect sourceRiskElement ::> ueMisprogrammedRate to targetRiskElement ::> seqMisprogram;
-    connection : TracesRisk connect sourceRiskElement ::> ueWrongDrugLoaded to targetRiskElement ::> seqMisprogram;
-    connection : TracesRisk connect sourceRiskElement ::> ueBolusByProxy to targetRiskElement ::> causeFrequentBolus;
-    connection : TracesRisk connect sourceRiskElement ::> ueAlarmDisregard to targetRiskElement ::> seqOcclusion;
+    connection : Causes connect cause ::> ueMisprogrammedRate to effect ::> seqMisprogram { attribute :>> causeKind = CauseKind::useErrorLeadsToHazard; }
+    connection : Causes connect cause ::> ueWrongDrugLoaded to effect ::> seqMisprogram { attribute :>> causeKind = CauseKind::useErrorLeadsToHazard; }
+    connection : Causes connect cause ::> ueBolusByProxy to effect ::> causeFrequentBolus { attribute :>> causeKind = CauseKind::useErrorLeadsToHazard; }
+    connection : Causes connect cause ::> ueAlarmDisregard to effect ::> seqOcclusion { attribute :>> causeKind = CauseKind::useErrorLeadsToHazard; }
 
     // ── FMEA and fault tree integration ─────────────────────────
     // Was `AnalyzedBy`: a zero-attribute edge from an element to the
@@ -539,23 +564,23 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : HasFailureMode connect element ::> occlusionSensor to failureMode ::> fmOcclusionDrift;
     connection : HasFailureMode connect element ::> bolusButton to failureMode ::> fmStuckBolusButton;
     connection : HasFailureMode connect element ::> batteryPack to failureMode ::> fmBatteryEarlyDepletion;
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausesEffect; connect cause ::> fmMotorRunaway to effect ::> feOverdose; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausesEffect; connect cause ::> fmStuckBolusButton to effect ::> feOverdose; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausesEffect; connect cause ::> fmAirSensorSilent to effect ::> feAirDelivered; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausesEffect; connect cause ::> fmOcclusionDrift to effect ::> feTherapyInterrupted; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausedBy; connect cause ::> fcMotorDriverFault to effect ::> fmMotorRunaway; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausedBy; connect cause ::> fcTransducerAging to effect ::> fmAirSensorSilent; }
-    connection : Causes { attribute :>> causeKind = CauseKind::failureCausedBy; connect cause ::> fcPendantAbuse to effect ::> fmStuckBolusButton; }
+    connection : Causes connect cause ::> fmMotorRunaway to effect ::> feOverdose { attribute :>> causeKind = CauseKind::failureCausesEffect; }
+    connection : Causes connect cause ::> fmStuckBolusButton to effect ::> feOverdose { attribute :>> causeKind = CauseKind::failureCausesEffect; }
+    connection : Causes connect cause ::> fmAirSensorSilent to effect ::> feAirDelivered { attribute :>> causeKind = CauseKind::failureCausesEffect; }
+    connection : Causes connect cause ::> fmOcclusionDrift to effect ::> feTherapyInterrupted { attribute :>> causeKind = CauseKind::failureCausesEffect; }
+    connection : Causes connect cause ::> fcMotorDriverFault to effect ::> fmMotorRunaway { attribute :>> causeKind = CauseKind::failureCausedBy; }
+    connection : Causes connect cause ::> fcTransducerAging to effect ::> fmAirSensorSilent { attribute :>> causeKind = CauseKind::failureCausedBy; }
+    connection : Causes connect cause ::> fcPendantAbuse to effect ::> fmStuckBolusButton { attribute :>> causeKind = CauseKind::failureCausedBy; }
     connection : DetectedBy connect failureMode ::> fmMotorRunaway to detectionMethod ::> dmFlowCrossCheck;
     connection : DetectedBy connect failureMode ::> fmAirSensorSilent to detectionMethod ::> dmPostSensorCheck;
     connection : DetectedBy connect failureMode ::> fmStuckBolusButton to detectionMethod ::> dmStuckInputMonitor;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::fmeaAction; connect control ::> fmeaActionAirSensor to mitigatedElement ::> fmAirSensorSilent; }
-    connection : Causes { attribute :>> causeKind = CauseKind::contributesToHazard; connect cause ::> fmMotorRunaway to effect ::> overdoseHazard; }
-    connection : Causes { attribute :>> causeKind = CauseKind::contributesToHazard; connect cause ::> fmStuckBolusButton to effect ::> overdoseHazard; }
-    connection : Causes { attribute :>> causeKind = CauseKind::contributesToHazard; connect cause ::> fmAirSensorSilent to effect ::> airEmbolismHazard; }
-    connection : Causes { attribute :>> causeKind = CauseKind::contributesToHazard; connect cause ::> fmOcclusionDrift to effect ::> underdoseHazard; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::failureMode; connect control ::> flowCrossCheckControl to mitigatedElement ::> fmMotorRunaway; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::failureMode; connect control ::> lockoutControl to mitigatedElement ::> fmStuckBolusButton; }
+    connection : Mitigates connect control ::> fmeaActionAirSensor to mitigatedElement ::> fmAirSensorSilent { attribute :>> mitigationKind = MitigationKind::fmeaAction; }
+    connection : Causes connect cause ::> fmMotorRunaway to effect ::> overdoseHazard { attribute :>> causeKind = CauseKind::contributesToHazard; }
+    connection : Causes connect cause ::> fmStuckBolusButton to effect ::> overdoseHazard { attribute :>> causeKind = CauseKind::contributesToHazard; }
+    connection : Causes connect cause ::> fmAirSensorSilent to effect ::> airEmbolismHazard { attribute :>> causeKind = CauseKind::contributesToHazard; }
+    connection : Causes connect cause ::> fmOcclusionDrift to effect ::> underdoseHazard { attribute :>> causeKind = CauseKind::contributesToHazard; }
+    connection : Mitigates connect control ::> flowCrossCheckControl to mitigatedElement ::> fmMotorRunaway { attribute :>> mitigationKind = MitigationKind::failureMode; }
+    connection : Mitigates connect control ::> lockoutControl to mitigatedElement ::> fmStuckBolusButton { attribute :>> mitigationKind = MitigationKind::failureMode; }
     connection : InputToGate connect input ::> fteMotorRunaway to gate ::> ftgMotorAnd;
     connection : InputToGate connect input ::> fteCrossCheckFails to gate ::> ftgMotorAnd;
     connection : InputToGate connect input ::> fteLockoutFault to gate ::> ftgBolusAnd;
@@ -563,15 +588,15 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : InputToGate connect input ::> ftgMotorAnd to gate ::> ftgOverdoseOr;
     connection : InputToGate connect input ::> ftgBolusAnd to gate ::> ftgOverdoseOr;
     connection : ProducesEvent connect gate ::> ftgOverdoseOr to eventElement ::> fteOverdoseTop;
-    connection : Causes { attribute :>> causeKind = CauseKind::leadsToHazard; connect cause ::> fteOverdoseTop to effect ::> overdoseHazard; }
-    connection : Causes { attribute :>> causeKind = CauseKind::originatesFrom; connect cause ::> pumpMotorAssembly to effect ::> fteMotorRunaway; }
-    connection : Causes { attribute :>> causeKind = CauseKind::originatesFrom; connect cause ::> bolusButton to effect ::> fteStuckButtonUndetected; }
+    connection : Causes connect cause ::> fteOverdoseTop to effect ::> overdoseHazard { attribute :>> causeKind = CauseKind::leadsToHazard; }
+    connection : Causes connect cause ::> pumpMotorAssembly to effect ::> fteMotorRunaway { attribute :>> causeKind = CauseKind::originatesFrom; }
+    connection : Causes connect cause ::> bolusButton to effect ::> fteStuckButtonUndetected { attribute :>> causeKind = CauseKind::originatesFrom; }
     connection : ContainsEvent connect cutSet ::> mcsMotorPath to eventElement ::> fteMotorRunaway;
     connection : ContainsEvent connect cutSet ::> mcsMotorPath to eventElement ::> fteCrossCheckFails;
     connection : ContainsEvent connect cutSet ::> mcsBolusPath to eventElement ::> fteLockoutFault;
     connection : ContainsEvent connect cutSet ::> mcsBolusPath to eventElement ::> fteStuckButtonUndetected;
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::cutSet; connect control ::> flowCrossCheckControl to mitigatedElement ::> mcsMotorPath; }
-    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::cutSet; connect control ::> lockoutControl to mitigatedElement ::> mcsBolusPath; }
+    connection : Mitigates connect control ::> flowCrossCheckControl to mitigatedElement ::> mcsMotorPath { attribute :>> mitigationKind = MitigationKind::cutSet; }
+    connection : Mitigates connect control ::> lockoutControl to mitigatedElement ::> mcsBolusPath { attribute :>> mitigationKind = MitigationKind::cutSet; }
 
     // ── Verification coverage (IEC 62304 §5.7) ──────────────────
 
@@ -639,6 +664,12 @@ package memo_examples_gpca_pump_gpca_trace {
     connection : TestedByUsability connect uiElementOrTask ::> ueWrongDrugLoaded to usabilityTest ::> valSummativeUsability;
     connection : TestedByUsability connect uiElementOrTask ::> ueAlarmDisregard to usabilityTest ::> valSummativeUsability;
     connection : TestedByUsability connect uiElementOrTask ::> oaProgram to usabilityTest ::> valSummativeUsability;
+    // VAL-002's acceptance criteria name UE-001..UE-004, and each of those is
+    // committed during one task (CommitsUseError, gpca_context). Only the
+    // programming task was linked; the other three are the same evaluation.
+    connection : TestedByUsability connect uiElementOrTask ::> oaRequestBolus to usabilityTest ::> valSummativeUsability;
+    connection : TestedByUsability connect uiElementOrTask ::> oaLoadReservoir to usabilityTest ::> valSummativeUsability;
+    connection : TestedByUsability connect uiElementOrTask ::> oaRespondAlarm to usabilityTest ::> valSummativeUsability;
 
     // ── Evidence production and document inclusion ──────────────
     connection : ProducesEvidence connect producer ::> vcLockout to producedEvidence ::> evidenceLockout;