@memoarchitect/ontology 0.13.2 → 0.15.1

package/src/artifacts/templates/dhf/system/standards-checklist.md

@@ -30,7 +30,7 @@ A **Gap** is not a defect in the model. Coverage is profile-dependent — that i
 
 **Scope.** The clauses below are those of the standards the project's `regulatoryRegime` declaration pulls in. Method and reference standards that no regime mandates — the FMEA method, the architecture-description standard — are listed separately in §4; their clauses are claimable but not required, so they have no gap count.
 
-`memo standards check` prints the same numbers at the command line, from the same computation.
+`memo validate --standards` prints the same numbers at the command line, from the same computation.
 
 ---
 
@@ -38,7 +38,7 @@ A **Gap** is not a defect in the model. Coverage is profile-dependent — that i
 
 ```memo-standards
 display: summary
-empty: "No standards are in scope. Declare `regulatoryRegime` on the project's ProjectMethodBinding."
+empty: "No standards are in scope. Declare `regulatoryRegime` on the model's ModelMethodBinding."
 ```
 
 ---

package/src/artifacts/templates/dhf/system/standards-traceability.md

@@ -20,7 +20,7 @@ This Standards Traceability Matrix cross-references the requirements and archite
 
 Each section is scoped to one standard by the clause's declaring package — the standards library is one package per standard, which makes `target.package` an exact per-standard selector. A clause *number* is not one: "5" is a clause of seven of the standards MEMO ships, so a matrix filtered on clause number would silently mix IEC 62304 §5 with ISO 14971 §5.
 
-A clause with no `ConformsTo` link is a gap. Enumerating the gaps is `memo standards check`, not this document — this document shows what the project *does* claim.
+A clause with no `ConformsTo` link is a gap. Enumerating the gaps is `memo validate --standards`, not this document — this document shows what the project *does* claim.
 
 ---
 

package/src/assurance/cybersecurity/memo_cybersecurity.sysml

@@ -1,3 +1,11 @@
+// Cybersecurity (FDA premarket cybersecurity guidance 2023, AAMI TIR57).
+// What an element is linked to is a relation, not a string naming it: a
+// security requirement's source threat is `DerivesCyberRequirement`, not a
+// `derivedFromThreat` id, and an asset's threats are `ThreatenedBy`. Which
+// layer an element belongs to is its package; an asset or a vulnerability
+// that lives in the architecture points at that element with a typed ref.
+// `ThreatenedBy` lives here rather than in memo_core_relationships because
+// its ends are typed against CybersecurityAsset and Threat.
 package memo_assurance_cybersecurity {
     private import Metaobjects::SemanticMetadata;
     private import ScalarValues::*;
@@ -9,17 +17,19 @@ package memo_assurance_cybersecurity {
     private import memo_assurance_safety_risk::*;
     private import memo_assurance_verification_validation::*;
     private import memo_architecture_operational_scenarios::*;
+    private import memo_architecture_implementation_software_structure::SBOMEntry;
 
     part def CybersecurityAsset specializes MemoPart {
         attribute assetKind : AssetKind;
-        attribute confidentialityNeed : String;
-        attribute integrityNeed : String;
-        attribute availabilityNeed : String;
+        attribute confidentialityNeed : SecurityNeedKind;
+        attribute integrityNeed : SecurityNeedKind;
+        attribute availabilityNeed : SecurityNeedKind;
         attribute privacyRelevant : Boolean;
         attribute safetyRelevant : Boolean;
-        attribute owningLayer : String;
         attribute assetOwner : String;
         attribute classification : String;
+        // The architecture elements that store, process or are this asset.
+        ref holder : MemoPart[0..*];
     }
 
     part def AttackSurface specializes MemoPart {
@@ -35,22 +45,23 @@ package memo_assurance_cybersecurity {
         attribute threatSource : String;
         attribute precondition : String;
         attribute affectedConcern : ConcernKind;
-        attribute defaultTechnique : String;
-        attribute strideCategory : ThreatCategoryKind;
     }
 
     item def Vulnerability specializes RiskItem {
         attribute weakness : String;
         attribute exploitability : String;
         attribute discoveryMethod : String;
-        attribute affectedLayer : String;
         attribute cweReference : String;
+        attribute cveReference : String;
         attribute remediable : Boolean;
+        attribute vulnerabilityDisposition : VulnerabilityDispositionKind;
         // CVSS v3.1 quantitative rating — the core output of a vulnerability
         // analysis (e.g. RSK-00058). `cvssBaseScore` is the 0.0-10.0 numeric
         // score; `cvssVector` the source vector string (AV:.../AC:.../...).
         attribute cvssBaseScore : Real;
         attribute cvssVector : String;
+        // The architecture elements the weakness is in.
+        ref affectedElement : MemoPart[0..*];
     }
 
     item def CyberHazard specializes Hazard {
@@ -77,9 +88,6 @@ package memo_assurance_cybersecurity {
 
     requirement def SecurityRequirement :> Requirement {
         attribute securityObjective : String;
-        attribute derivedFromThreat : String;
-        attribute derivedFromRisk : String;
-        attribute defaultConcern : ConcernKind;
     }
 
     part def TrustBoundary specializes InterfaceElement {
@@ -88,11 +96,184 @@ package memo_assurance_cybersecurity {
         attribute trustAssumption : String;
     }
 
+    // ── Product-security and threat-intelligence extensions ─────────
+    enum def ThreatActorKind {
+        enum insider;
+        enum serviceTechnician;
+        enum opportunistic;
+        enum cybercriminal;
+        enum nationState;
+        enum supplyChain;
+    }
+    enum def ThreatCapabilityKind {
+        enum low;
+        enum moderate;
+        enum high;
+        enum advanced;
+    }
+    enum def ThreatAccessKind {
+        enum physical;
+        enum local;
+        enum network;
+        enum remote;
+        enum supplyChain;
+    }
+    enum def AttackTechniqueFrameworkKind {
+        enum mitreAttackIcs;
+        enum mitreEmb3d;
+        enum capec;
+        enum other;
+    }
+    enum def SecurityObjectiveKind {
+        enum confidentiality;
+        enum integrity;
+        enum availability;
+        enum authenticity;
+        enum accountability;
+        enum privacy;
+        enum safety;
+    }
+    enum def CyberAssumptionValidityKind {
+        enum valid;
+        enum reviewDue;
+        enum invalid;
+        enum retired;
+    }
+    enum def VulnerabilityDispositionKind {
+        enum open;
+        enum mitigated;
+        enum accepted;
+        enum closed;
+    }
+    enum def SecurityFindingStatusKind {
+        enum open;
+        enum inRemediation;
+        enum accepted;
+        enum closed;
+    }
+    enum def PostmarketProcessKind {
+        enum monitoring;
+        enum vulnerabilityDisclosure;
+        enum patching;
+        enum incidentResponse;
+    }
+    enum def CyberRiskAssessmentStageKind {
+        enum inherent;
+        enum residual;
+    }
+
+    part def ThreatActor specializes MemoPart {
+        attribute actorKind : ThreatActorKind;
+        attribute motivation : String;
+        attribute capability : ThreatCapabilityKind;
+        attribute accessMode : ThreatAccessKind;
+        attribute organization : String;
+    }
+
+    part def AttackTechnique specializes MemoPart {
+        attribute framework : AttackTechniqueFrameworkKind;
+        attribute externalId : String;
+        attribute tactic : String;
+        attribute platform : String;
+        attribute techniqueVersion : String;
+    }
+
+    part def SecurityProperty specializes MemoPart {
+        attribute objectiveKind : SecurityObjectiveKind;
+        attribute impactLevel : CriticalityKind;
+        attribute propertyRationale : String;
+    }
+
+    part def CybersecurityAssumption specializes MemoPart {
+        attribute statement : String;
+        attribute owner : String;
+        attribute reviewDate : String;
+        attribute expirationDate : String;
+        attribute validity : CyberAssumptionValidityKind;
+    }
+
+    // The path's narrative is the inherited `pathSummary`.
+    action def AttackPath specializes OperativeScenario {
+        attribute entryPoint : String;
+        attribute attackGoal : String;
+    }
+
+    // Security assessment: a case is the planned activity (penetration test,
+    // static or dynamic analysis, composition analysis), a report is the
+    // evidence it produced, and a finding is one result in the report.
+    // The case is a verification case: it checks the security requirements,
+    // and `ProducesEvidence` already links a verification case to what it
+    // produced. The method is stated once, on the case; a finding is one
+    // type whose method-specific descriptors are optional, as Interface's
+    // are. A finding is traced to its vulnerability by
+    // `IdentifiesVulnerability`, and from there to the SBOM entry by
+    // `AffectsSBOMEntry`.
+    enum def SecurityAssessmentMethodKind {
+        enum penetrationTest;
+        enum sast;
+        enum dast;
+        enum sca;
+    }
+    verification def SecurityAssessmentCase :> VerificationCase {
+        attribute assessmentMethod : SecurityAssessmentMethodKind;
+        attribute assessmentScope : String;
+        attribute toolName : String;
+        attribute toolVersion : String;
+    }
+    part def SecurityFinding specializes MemoEvidence {
+        attribute findingIdentifier : String;
+        attribute severity : CriticalityKind;
+        attribute cvssBaseScore : Real;
+        attribute cvssVector : String;
+        attribute findingStatus : SecurityFindingStatusKind;
+        attribute retestDate : String;
+        // method-specific (optional)
+        attribute weaknessReference : String[0..1];   // CWE identifier (SAST)
+        attribute sourceLocation : String[0..1];      // file and line (SAST)
+        attribute testedEndpoint : String[0..1];      // URL or interface (DAST)
+    }
+    part def SecurityAssessmentReport specializes MemoEvidence {
+        attribute reportDate : String;
+        attribute assessor : String;
+        part finding : SecurityFinding[0..*];
+    }
+
+    action def PostmarketProcess specializes MemoAction {
+        attribute processKind : PostmarketProcessKind;
+        attribute owner : String;
+        attribute cadence : String;
+        attribute serviceLevelTarget : String;
+    }
+
+    // A CyberRisk remains the stable risk identity. Assessments record its
+    // pre-control (inherent) and post-control (residual) states without
+    // duplicating the risk itself.
+    part def CyberRiskAssessment specializes MemoPart {
+        attribute assessmentStage : CyberRiskAssessmentStageKind;
+        attribute probabilityEstimate : ProbabilityKind;
+        attribute severityEstimate : SeverityKind;
+        attribute riskLevel : CriticalityKind;
+        attribute acceptability : RiskAcceptabilityKind;
+        attribute controlsAppliedSummary : String;
+        attribute assessmentDate : String;
+        attribute assessor : String;
+        attribute approver : String;
+    }
+
     // ── Relations owned by this package ─────────────────────────────
-    // Moved out of memo_core_relationships: their ends are typed against
-    // types declared here, and core must not depend on a domain package.
+    connection def ThreatenedBy :> MemoRelationship {
+        attribute threatRole : String;
+        end protectedAsset : CybersecurityAsset :>> source;
+        end threat : Threat :>> target;
+    }
+    abstract connection threatenedByLinks : ThreatenedBy[*];
+    metadata def <threatenedBy> ThreatenedByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = threatenedByLinks meta SysML::Usage;
+    }
     connection def Exploits :> MemoRelationship {
-        end realizedThreat : RequirementDriver :>> source;
+        end threat : Threat :>> source;
         end enablingVulnerability : Vulnerability :>> target;
     }
     abstract connection exploitsLinks : Exploits[*];
@@ -122,4 +303,149 @@ package memo_assurance_cybersecurity {
         :> annotatedElement : SysML::ConnectionUsage;
         :>> baseType = impactsSafetyLinks meta SysML::Usage;
     }
+
+    // ── Product-security and threat-intelligence relations ──────────
+
+    connection def HasSecurityProperty :> MemoRelationship {
+        end characterizedAsset : CybersecurityAsset :>> source;
+        end securityProperty : SecurityProperty :>> target;
+    }
+    abstract connection hasSecurityPropertyLinks : HasSecurityProperty[*];
+    metadata def <hasSecurityProperty> HasSecurityPropertyMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = hasSecurityPropertyLinks meta SysML::Usage;
+    }
+
+    connection def ExposesAsset :> MemoRelationship {
+        end attackSurface : AttackSurface :>> source;
+        end exposedAsset : CybersecurityAsset :>> target;
+    }
+    abstract connection exposesAssetLinks : ExposesAsset[*];
+    metadata def <exposesAsset> ExposesAssetMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = exposesAssetLinks meta SysML::Usage;
+    }
+
+    connection def AttributedToThreatActor :> MemoRelationship {
+        end attributedThreat : Threat :>> source;
+        end threatActor : ThreatActor :>> target;
+    }
+    abstract connection attributedToThreatActorLinks : AttributedToThreatActor[*];
+    metadata def <attributedToThreatActor> AttributedToThreatActorMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = attributedToThreatActorLinks meta SysML::Usage;
+    }
+
+    connection def UsesAttackTechnique :> MemoRelationship {
+        end realizedThreat : Threat :>> source;
+        end attackTechnique : AttackTechnique :>> target;
+    }
+    abstract connection usesAttackTechniqueLinks : UsesAttackTechnique[*];
+    metadata def <usesAttackTechnique> UsesAttackTechniqueMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = usesAttackTechniqueLinks meta SysML::Usage;
+    }
+
+    connection def IncludesAttackTechnique :> MemoRelationship {
+        end attackPath : AttackPath :>> source;
+        end attackTechnique : AttackTechnique :>> target;
+    }
+    abstract connection includesAttackTechniqueLinks : IncludesAttackTechnique[*];
+    metadata def <includesAttackTechnique> IncludesAttackTechniqueMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = includesAttackTechniqueLinks meta SysML::Usage;
+    }
+
+    connection def RealizesCyberHazard :> MemoRelationship {
+        end realizedThreat : Threat :>> source;
+        end resultingCyberHazard : CyberHazard :>> target;
+    }
+    abstract connection realizesCyberHazardLinks : RealizesCyberHazard[*];
+    metadata def <realizesCyberHazard> RealizesCyberHazardMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = realizesCyberHazardLinks meta SysML::Usage;
+    }
+
+    connection def AssessesCyberRisk :> MemoRelationship {
+        end assessment : CyberRiskAssessment :>> source;
+        end assessedRisk : CyberRisk :>> target;
+    }
+    abstract connection assessesCyberRiskLinks : AssessesCyberRisk[*];
+    metadata def <assessesCyberRisk> AssessesCyberRiskMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = assessesCyberRiskLinks meta SysML::Usage;
+    }
+
+    connection def IdentifiesVulnerability :> MemoRelationship {
+        end finding : SecurityFinding :>> source;
+        end identifiedVulnerability : Vulnerability :>> target;
+    }
+    abstract connection identifiesVulnerabilityLinks : IdentifiesVulnerability[*];
+    metadata def <identifiesVulnerability> IdentifiesVulnerabilityMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = identifiesVulnerabilityLinks meta SysML::Usage;
+    }
+
+    connection def AffectsSBOMEntry :> MemoRelationship {
+        end vulnerability : Vulnerability :>> source;
+        end affectedComponent : SBOMEntry :>> target;
+    }
+    abstract connection affectsSBOMEntryLinks : AffectsSBOMEntry[*];
+    metadata def <affectsSBOMEntry> AffectsSBOMEntryMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = affectsSBOMEntryLinks meta SysML::Usage;
+    }
+
+    connection def DemonstratesAttackPath :> MemoRelationship {
+        end finding : SecurityFinding :>> source;
+        end demonstratedPath : AttackPath :>> target;
+    }
+    abstract connection demonstratesAttackPathLinks : DemonstratesAttackPath[*];
+    metadata def <demonstratesAttackPath> DemonstratesAttackPathMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = demonstratesAttackPathLinks meta SysML::Usage;
+    }
+
+    connection def SupportsMitigationEffectiveness :> MemoRelationship {
+        end supportingEvidence : MemoEvidence :>> source;
+        end supportedMitigation : CyberMitigation :>> target;
+    }
+    abstract connection supportsMitigationEffectivenessLinks : SupportsMitigationEffectiveness[*];
+    metadata def <supportsMitigationEffectiveness> SupportsMitigationEffectivenessMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = supportsMitigationEffectivenessLinks meta SysML::Usage;
+    }
+
+    connection def ConditionsCyberElement :> MemoRelationship {
+        end governingAssumption : CybersecurityAssumption :>> source;
+        end conditionedElement :>> target;
+    }
+    abstract connection conditionsCyberElementLinks : ConditionsCyberElement[*];
+    metadata def <conditionsCyberElement> ConditionsCyberElementMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = conditionsCyberElementLinks meta SysML::Usage;
+    }
+
+    connection def MonitorsSBOMEntry :> MemoRelationship {
+        end postmarketProcess : PostmarketProcess :>> source;
+        end monitoredComponent : SBOMEntry :>> target;
+    }
+    abstract connection monitorsSBOMEntryLinks : MonitorsSBOMEntry[*];
+    metadata def <monitorsSBOMEntry> MonitorsSBOMEntryMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = monitorsSBOMEntryLinks meta SysML::Usage;
+    }
 }

package/src/assurance/human_factors/memo_human_factors.sysml

@@ -43,9 +43,13 @@ package memo_assurance_human_factors {
     // ── Relations owned by this package ─────────────────────────────
     // Moved out of memo_core_relationships: their ends are typed against
     // types declared here, and core must not depend on a domain package.
+    // The source end is untyped for the reason `Validates`' is: a UI element
+    // is a part and a task is an action (Track A0), so no one type spans both.
+    // The target is the usability TEST — a validation case — and not the
+    // evidence it produces; `ProducesEvidence` links the two.
     connection def TestedByUsability :> MemoRelationship {
-        end uiElementOrTask : MemoPart :>> source;
-        end usabilityTest : MemoEvidence :>> target;
+        end uiElementOrTask :>> source;
+        end usabilityTest : MemoVerificationCase :>> target;
     }
     abstract connection testedByUsabilityLinks : TestedByUsability[*];
     metadata def <testedByUsability> TestedByUsabilityMetadata :> SemanticMetadata {

package/src/assurance/safety_risk/analysis/memo_fmea.sysml

@@ -74,7 +74,6 @@ package memo_assurance_safety_risk_analysis {
         attribute probability : Real;
         attribute failureRate : Real;
         attribute exposureTime : Real;
-        attribute :>> description : String;
         attribute gateKind : FaultTreeGateKind;
         attribute kValue : Integer;
         attribute nValue : Integer;
@@ -124,8 +123,13 @@ package memo_assurance_safety_risk_analysis {
     }
     connection def Causes :> MemoRelationship {
         attribute causeKind : CauseKind;
-        end cause : MemoPart :>> source;
-        end effect : RiskItem :>> target;
+        // Untyped both ways, because CauseKind spans metaclasses: a failure
+        // mode or cause (items) causes an effect, a component or use error
+        // (parts) originates one, and `originatesFrom` ends at a fault-tree
+        // node, which is a part. No single type covers either end; the
+        // admissible kinds are CR-ONT-082 and CR-ONT-083.
+        end cause :>> source;
+        end effect :>> target;
     }
     abstract connection causesLinks : Causes[*];
     metadata def <causes> CausesMetadata :> SemanticMetadata {

package/src/assurance/safety_risk/memo_risk.sysml

@@ -42,7 +42,8 @@ package memo_assurance_safety_risk {
     // `DesignControlRiskRow` was a denormalized spreadsheet transcription.
     // Risk rows now decompose into the ISO 14971 chain below: Risk owns its
     // Hazard, SequenceOfEvents, HazardousSituation, and Harm items, linked by
-    // TracesRisk / LeadsToHarm, with ResidualRisk after mitigation.
+    // TracesRisk / LeadsToHarm, with ResidualRisk after mitigation. The risk
+    // itself is reached by EstimatedFor / ReducedBy / EvaluatedIn below.
     // A device characteristic whose implementation, failure, or misuse can
     // affect safety. This is the modelable output of ISO 14971 §5.3.
     part def SafetyRelatedCharacteristic specializes MemoPart {
@@ -168,6 +169,43 @@ package memo_assurance_safety_risk {
         :> annotatedElement : SysML::ConnectionUsage;
         :>> baseType = assessedAgainstLinks meta SysML::Usage;
     }
+    // A risk is not a link in the chain (see RiskItem), so TracesRisk cannot
+    // reach it — and until these three nothing else could either. A model had
+    // no way to say which hazardous situation or harm a risk was estimated for
+    // (ISO 14971 §5.5), which control reduced it to a residual risk (§7), or
+    // which overall evaluation covered that residual (§8), so gpca-pump wrote
+    // all three as TracesRisk into a Risk and the builder rejected every one.
+    // Named from the risk's side, like AssessedAgainst.
+    connection def EstimatedFor :> MemoRelationship {
+        end risk : Risk :>> source;
+        end riskElement : RiskItem :>> target;
+    }
+    abstract connection estimatedForLinks : EstimatedFor[*];
+    metadata def <estimatedFor> EstimatedForMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = estimatedForLinks meta SysML::Usage;
+    }
+    connection def ReducedBy :> MemoRelationship {
+        end residualRisk : ResidualRisk :>> source;
+        end control : RiskControlMeasure :>> target;
+    }
+    abstract connection reducedByLinks : ReducedBy[*];
+    metadata def <reducedBy> ReducedByMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = reducedByLinks meta SysML::Usage;
+    }
+    connection def EvaluatedIn :> MemoRelationship {
+        end residualRisk : ResidualRisk :>> source;
+        end evaluation : OverallResidualRiskEvaluation :>> target;
+    }
+    abstract connection evaluatedInLinks : EvaluatedIn[*];
+    metadata def <evaluatedIn> EvaluatedInMetadata :> SemanticMetadata {
+        :> annotatedElement : SysML::ConnectionDefinition;
+        :> annotatedElement : SysML::ConnectionUsage;
+        :>> baseType = evaluatedInLinks meta SysML::Usage;
+    }
     // Mitigates unifies the control/action → risk-element edges of the
     // ISO 14971 / FMEA / FTA / cyber chains — MitigatesHazard,
     // MitigatesVulnerability, MitigatedByControl, BrokenByControl,