@memoarchitect/ontology 0.4.4

package/LICENSE

@@ -0,0 +1,19 @@
+MIT License
+
+Copyright (c) 2026 memoarchitect
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE.

package/README.md

@@ -0,0 +1,70 @@
+# @memoarchitect/ontology
+
+**MEMO — Medical Engineering Modelling Ontology** — the pure SysML v2 content layer.
+
+A standalone, tool-portable SysML v2 / KerML ontology for medical-device architecture
+per **ISO 14971**, **IEC 62304**, and **ISO/IEC/IEEE 42010**. Consistency rules ship as
+native `constraint def` / `requirement def` bodies (no engine plug-ins), so the ontology
+is portable *content* consumable by any conformant SysML v2 tool — SysIDE, SysON, or
+[`sysand`](https://docs.sysand.org/).
+
+The published package contains **no JavaScript, TypeScript, or engine code**. The MEMO
+engine and CLI live in `memo-tools`; the web app lives in `memo-architect`.
+
+## Documentation
+
+Start with the [user guide](docs/index.md) to learn MEMO's layer model, choose
+elements and relationships, and follow the GPCA pump example. The reference
+section describes packages, source layout, and maintenance. Build the site with:
+
+```bash
+python3 -m pip install "mkdocs>=1.6" "mkdocs-material>=9.5" "pymdown-extensions>=10.0"
+pnpm run docs:build
+```
+
+## Layout
+
+The package exposes four logical MEMO packages through `memo.manifest.yaml`.
+The manifest maps package identifiers to package subpaths.
+
+```
+memo.manifest.yaml           logical package, init, and example map
+ontology/                    @memoarchitect/ontology descriptor
+profile/                     @memoarchitect/medical-modeling-profile + archetypes/templates
+methodologies/default/       @memoarchitect/methodology-default descriptor
+methodologies/gpca/          @memoarchitect/methodology-gpca descriptor
+template/                    complete starter project copied by memo init
+examples/gpca-pump/          reference model (not a scaffold template)
+src/                         all reusable .sysml content (namespace = directory)
+  medical_device_library.sysml   public import surface
+  core/                          common/ enumerations/ relationships/
+                                 dimensions/ semantics/ + stdlib/* (KerML wrapper)
+  architecture/                  one folder per layer: context/ requirements/ functions/ behavior/
+                                 logical_structure/ software_structure/ … risk/ cybersecurity/ assurance/ …
+  compliance/                    artifacts/ change/ document_views/ postmarket/ iso14971/
+  viewpoints/                    reusable viewpoint and view definitions
+  rules/                         closure/ coverage/ crosslayer/ lifecycle/ quantitative/ (native constraint defs)
+  artifacts/                     artifact kinds (memo::artifacts)
+  methodology/                   default methodology
+```
+
+## Build / verify
+
+Requires [`sysand`](https://docs.sysand.org/) on `PATH`.
+
+```bash
+pnpm run build        # or: ./scripts/build-kpar.sh
+```
+
+Builds transient SysAnd projects for the core ontology and methodology into `.kpar`
+archives and fails on any external-parser error. The transient project descriptors and
+build products are not included in the npm package.
+
+```bash
+pnpm test             # manifest/layout tests + npm pack content gate
+npm pack              # produces the single @memoarchitect/ontology content tarball
+```
+
+## License
+
+MIT

package/examples/gpca-pump/dhf/documents/DOC-RMP-001.md

@@ -0,0 +1,210 @@
+---
+id: DOC-RMP-001
+title: Risk Management Plan
+template: iso-14971/rmp
+group: Risk Management
+created: 1784072756971
+---
+
+
+
+| Field | Value |
+| --- | --- |
+| **Product** | {{project.product}} |
+| **Company** | {{project.company}} |
+| **Device Type** | {{project.device_type}} |
+| **Document Version** | {{project.version}} |
+| **Development Phase** | {{project.phase}} |
+| **Date** | — |
+| **Confidentiality** | Confidential — {{project.company}} |
+
+
+
+{{toc}}
+
+---
+
+## 1. Purpose and Scope
+
+This Risk Management Plan (RMP) defines the risk management activities for **{{project.product}}** developed by **{{project.company}}**. This plan is maintained throughout the product lifecycle in accordance with ISO 14971:2019.
+
+### 1.1 Intended Use
+
+<!-- [GUIDANCE] Describe the intended use of the device, intended users, and intended use environment. -->
+
+_[TODO: Describe intended use, intended users, and intended use environment]_
+
+### 1.2 Scope of Risk Management
+
+This plan applies to all phases of the product lifecycle: design, development, manufacture, post-market surveillance, and eventual decommission.
+
+---
+
+## 2. Regulatory Context
+
+Complete the table below for **{{project.product}}**:
+
+| Requirement | Reference |
+| --- | --- |
+| Risk Management Process | ISO 14971:2019 §4.1 |
+| Risk Management Plan | ISO 14971:2019 §4.4 |
+| Risk Estimation | ISO 14971:2019 §5 |
+| Risk Evaluation | ISO 14971:2019 §6 |
+| Risk Control | ISO 14971:2019 §7 |
+| Overall Residual Risk | ISO 14971:2019 §8 |
+| Risk Management Review | ISO 14971:2019 §9 |
+| Post-production | ISO 14971:2019 §10 |
+
+---
+
+## 3. Risk Management Team
+
+<!-- [GUIDANCE] List all personnel involved in risk management activities. -->
+
+| Role | Name | Responsibilities |
+| --- | --- | --- |
+| Risk Management Lead | | Overall RM coordination |
+| Clinical Representative | | Clinical risk input |
+| Software Engineer | | Software FMEA and SOUP risk |
+| Regulatory Affairs | | Standards compliance |
+| Quality Engineer | | Process compliance |
+
+---
+
+## 4. Risk Acceptability Criteria
+
+### 4.1 Severity Levels
+
+```memo-query
+kind: RiskAcceptabilityCriteria
+display: table
+columns: name, doc, layer
+empty: "No risk acceptability criteria defined. Add RiskAcceptabilityCriteria elements to the model."
+```
+
+### 4.2 Risk Policy
+
+<!-- [GUIDANCE] Define the risk policy: ALARP, broadly acceptable, or unacceptable regions. -->
+
+_[TODO: Define risk acceptability matrix — probability vs. severity]_
+
+Residual risk is acceptable when:
+- All individual risks are reduced to ALARP or broadly acceptable level
+- Overall residual risk is acceptable per §8 of ISO 14971:2019
+- Unmitigated hazards:
+
+```memo-query
+kind: Hazard
+where: layer == "risk"
+display: count
+label: Total hazards in model
+```
+
+---
+
+## 5. Risk Management Activities
+
+### 5.1 Hazard Identification
+
+All hazard identification activities are documented in the Hazard Analysis Report (HAR).
+
+```memo-query
+kind: Hazard
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No hazards defined. Add Hazard elements to model/risk/*.sysml."
+```
+
+### 5.2 Risk Estimation and Evaluation
+
+Risk estimation is performed for each hazardous situation per ISO 14971:2019 §5–6.
+
+```memo-query
+kind: HazardousSituation
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No hazardous situations defined."
+```
+
+### 5.3 Risk Control Measures
+
+```memo-query
+kind: RiskControl
+display: table
+columns: name, layer, doc
+sort: name
+empty: "No risk controls defined."
+```
+
+### 5.4 Residual Risk Evaluation
+
+Unmitigated hazards (hazards without associated risk controls):
+
+```memo-query
+kind: Hazard
+display: table
+columns: name, doc
+empty: "All hazards have associated risk controls."
+```
+
+---
+
+## 6. Risk Management Documentation
+
+Complete the table below for **{{project.product}}**:
+
+| Document | Purpose | Reference |
+| --- | --- | --- |
+| Hazard Analysis Report (HAR) | Hazard identification and estimation | HAR |
+| FMEA | Failure mode analysis | FMEA |
+| Risk Benefit Analysis | Benefit-risk justification | N/A |
+| Risk Management Report | Overall residual risk summary | N/A |
+
+---
+
+## 7. Plan Maintenance
+
+This plan shall be reviewed:
+- At each major design change
+- Following post-market surveillance findings
+- Prior to each design review gate
+- At least annually during active development
+
+---
+
+
+## Revision History
+
+| Version | Date | Author | Description of Change |
+| --- | --- | --- | --- |
+| 1.0 | {{project.version}} | {{project.authors}} | Initial release |
+
+
+
+
+## Approvals
+
+This document has been reviewed and approved by the following personnel:
+
+| Name | Role | Signature | Date |
+| --- | --- | --- | --- |
+| | Quality Assurance | | |
+| | Regulatory Affairs | | |
+| | Engineering Lead | | |
+| | Clinical Affairs | | |
+
+
+
+
+## References
+
+| Standard | Title |
+| --- | --- |
+| ISO 14971:2019 | Medical devices — Application of risk management to medical devices |
+| IEC 62304:2006+AMD1:2015 | Medical device software — Software life cycle processes |
+| IEC 62366-1:2015+AMD1:2020 | Medical devices — Usability engineering |
+| ISO 13485:2016 | Medical devices — Quality management systems |
+| 21 CFR Part 820 | Quality System Regulation |
+| IEC 81001-5-1:2021 | Health software and health IT systems safety, effectiveness and security |

package/examples/gpca-pump/memo.config.yaml

@@ -0,0 +1,9 @@
+# GPCA Infusion Pump — submission-grade reference model
+# Based on University of Minnesota CriSys GPCA project
+projectName: gpca-pump
+projectType: device
+
+# Phase H: project pins the GPCA-specific methodology.
+# @memo/methodology-gpca extends @memo/methodology-default and subtracts
+# cybersecurity and SOUP for the non-networked prototype variant.
+methodology: "@memo/methodology-gpca@^0.4.3"

package/examples/gpca-pump/methodology/gpca_methodology.sysml

@@ -0,0 +1,11 @@
+package memo_examples_gpca_pump_methodology_gpca_methodology {
+    private import ScalarValues::*;
+
+    private import memo_methodology_profiles::*;
+    private import memo_examples_gpca_pump_methodology_gpca_profiles::*;
+    private import memo_core_relationships::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_requirements::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
+
+    connection : ResolvesToMethodology connect boundModelElement ::> tlm to resolvedMethodology ::> gpcaMethodResolved;
+}

package/examples/gpca-pump/methodology/gpca_profiles.sysml

@@ -0,0 +1,25 @@
+package memo_examples_gpca_pump_methodology_gpca_profiles {
+    private import ScalarValues::*;
+
+    private import memo_methodology_core::*;
+    private import memo_methodology_profiles::*;
+    private import memo_core_enumerations::*;
+
+    part gpcaMethodDefinition : MethodologyDefinition {
+        attribute :>> id = "METH-GPCA-001";
+        attribute :>> name = "GPCAPrototypeMethodology";
+        attribute :>> version = "1.0";
+        attribute :>> domain = "medical device modeling";
+        attribute :>> description = "GPCA infusion pump methodology — subtraction-based tailoring for non-networked prototype. Excludes cybersecurity layer and SOUPComponent.";
+        attribute :>> baseMethodName = "MedicalDeviceLightDefault";
+    }
+
+    part gpcaMethodResolved : ResolvedMethodology {
+        attribute :>> id = "RMETH-GPCA-001";
+        attribute :>> name = "GPCAPrototypeResolved";
+        attribute :>> version = "1.0";
+        attribute :>> safetyClassification = SafetyClassKind::C;
+        attribute :>> lifecycleStage = LifecycleStateKind::development;
+        attribute :>> resolutionSummary = "GPCA infusion pump — IEC 62304 Class C at development stage. Default scope minus cybersecurity and SOUP, as the prototype is non-networked.";
+    }
+}

package/examples/gpca-pump/methodology/gpca_scope.sysml

@@ -0,0 +1,25 @@
+package memo_examples_gpca_pump_methodology_gpca_scope {
+    private import ScalarValues::*;
+
+    private import memo_methodology_core::*;
+    private import memo_core_methodology_scope::*;
+    private import memo_core_enumerations::*;
+
+    part gpcaCoverageScope : MethodologyScope {
+        attribute :>> id = "SCOPE-GPCA-001";
+        attribute :>> name = "GPCACoverageScope";
+        attribute :>> scopeName = "coverage";
+
+        attribute :>> includedArchLayer = "context; requirements; functions; logical_structure; interfaces; software_structure; hardware_structure; behavior; risk; assurance; constraints";
+
+        attribute :>> includedStandard = "ISO 14971; IEC 62304; 21 CFR 820; ISO 13485; ISO 14155; IEC 62366; IEC 60601-1";
+
+        attribute :>> includedArtifactKind = "RiskManagementPlan";
+
+        attribute :>> includedViewpointType = "VP-CTX; VP-LOG; VP-RISK";
+
+        attribute :>> excludedKind = "CybersecurityAsset; AttackSurface; Threat; Vulnerability; ThreatScenario; CyberHazard; CyberRisk; CyberMitigation; SecurityRequirement; TrustBoundary; SecurityClaim; SOUPComponent";
+
+        attribute :>> description = "GPCA prototype methodology — subtracts cybersecurity layer (non-networked device) and SOUPComponent (no SOUP in prototype). Derived from default methodology by exclusion.";
+    }
+}

package/examples/gpca-pump/model/catalog/gpca_analysis.sysml

@@ -0,0 +1,231 @@
+package memo_examples_gpca_pump_model_catalog_gpca_analysis {
+    private import ScalarValues::*;
+
+    private import memo_architecture_analysis::*;
+    private import memo_core_enumerations::*;
+
+    // ── FMEA (IEC 60812) ────────────────────────────────────────
+    part fmeaDelivery : FMEAWorksheet {
+        attribute :>> id = "FMEA-001";
+        attribute :>> name = "DrugDeliveryFMEA";
+        attribute :>> analysisScope = "Fluid path, pump mechanism, delivery sensors, and patient pendant";
+        attribute :>> standardReference = "IEC 60812";
+        attribute :>> analysisBasis = "UMN CriSys GPCA architecture v2.0";
+        attribute :>> revisionDate = "2026-07-03";
+        attribute :>> reviewer = "Safety review board";
+    }
+    part fmMotorRunaway : FailureMode {
+        attribute :>> id = "FM-001";
+        attribute :>> name = "PumpMotorRunaway";
+        attribute :>> failureModeKind = FailureModeKind::unintendedFunction;
+        attribute :>> severityRating = 10;
+        attribute :>> occurrenceRating = 2;
+        attribute :>> detectionRating = 3;
+        attribute :>> rpn = 60;
+        attribute :>> criticality = CriticalityKind::catastrophic;
+        attribute :>> description = "Motor steps faster than commanded, delivering more drug than prescribed.";
+    }
+    part fmAirSensorSilent : FailureMode {
+        attribute :>> id = "FM-002";
+        attribute :>> name = "AirSensorFailsSilent";
+        attribute :>> failureModeKind = FailureModeKind::lossOfFunction;
+        attribute :>> severityRating = 10;
+        attribute :>> occurrenceRating = 3;
+        attribute :>> detectionRating = 4;
+        attribute :>> rpn = 120;
+        attribute :>> criticality = CriticalityKind::catastrophic;
+        attribute :>> description = "Air-in-line sensor reports 'no air' regardless of actual line state.";
+    }
+    part fmOcclusionDrift : FailureMode {
+        attribute :>> id = "FM-003";
+        attribute :>> name = "OcclusionSensorDrift";
+        attribute :>> failureModeKind = FailureModeKind::degradedFunction;
+        attribute :>> severityRating = 7;
+        attribute :>> occurrenceRating = 4;
+        attribute :>> detectionRating = 4;
+        attribute :>> rpn = 112;
+        attribute :>> criticality = CriticalityKind::high;
+        attribute :>> description = "Pressure sensor drifts so occlusions are detected late or not at all.";
+    }
+    part fmStuckBolusButton : FailureMode {
+        attribute :>> id = "FM-004";
+        attribute :>> name = "BolusButtonStuckClosed";
+        attribute :>> failureModeKind = FailureModeKind::unintendedFunction;
+        attribute :>> severityRating = 9;
+        attribute :>> occurrenceRating = 3;
+        attribute :>> detectionRating = 2;
+        attribute :>> rpn = 54;
+        attribute :>> criticality = CriticalityKind::high;
+        attribute :>> description = "Pendant switch shorted, continuously asserting bolus requests.";
+    }
+    part fmBatteryEarlyDepletion : FailureMode {
+        attribute :>> id = "FM-005";
+        attribute :>> name = "BatteryDepletesEarly";
+        attribute :>> failureModeKind = FailureModeKind::prematureFunction;
+        attribute :>> severityRating = 6;
+        attribute :>> occurrenceRating = 4;
+        attribute :>> detectionRating = 3;
+        attribute :>> rpn = 72;
+        attribute :>> criticality = CriticalityKind::medium;
+        attribute :>> description = "Aged battery sustains less than the specified backup duration during transport.";
+    }
+    part feOverdose : FailureEffect {
+        attribute :>> id = "FE-001";
+        attribute :>> name = "ExcessDrugDelivered";
+        attribute :>> effectLevel = FailureEffectLevelKind::endEffect;
+        attribute :>> effectOnPatient = "opioid overdose, respiratory depression";
+        attribute :>> effectOnOperator = "emergency intervention required";
+        attribute :>> effectOnSystem = "therapy stopped by cross-check or clinician";
+        attribute :>> severity = SeverityKind::catastrophic;
+    }
+    part feAirDelivered : FailureEffect {
+        attribute :>> id = "FE-002";
+        attribute :>> name = "AirReachesPatientLine";
+        attribute :>> effectLevel = FailureEffectLevelKind::endEffect;
+        attribute :>> effectOnPatient = "risk of vascular air embolism";
+        attribute :>> effectOnOperator = "line re-prime and incident report";
+        attribute :>> effectOnSystem = "undetected hazardous state";
+        attribute :>> severity = SeverityKind::catastrophic;
+    }
+    part feTherapyInterrupted : FailureEffect {
+        attribute :>> id = "FE-003";
+        attribute :>> name = "TherapyInterruptedUnnoticed";
+        attribute :>> effectLevel = FailureEffectLevelKind::endEffect;
+        attribute :>> effectOnPatient = "untreated pain; possible post-occlusion bolus";
+        attribute :>> effectOnOperator = "delayed response";
+        attribute :>> effectOnSystem = "under-delivery until detected";
+        attribute :>> severity = SeverityKind::serious;
+    }
+    part fcMotorDriverFault : FailureCause {
+        attribute :>> id = "FCA-001";
+        attribute :>> name = "MotorDriverElectronicsFault";
+        attribute :>> causeCategory = FailureCauseCategoryKind::design;
+        attribute :>> causeDescription = "Driver stage latch-up or firmware step-rate computation fault";
+        attribute :>> occurrenceRating = ProbabilityKind::remote;
+        attribute :>> preventionMethod = "independent flow cross-check; watchdog";
+    }
+    part fcTransducerAging : FailureCause {
+        attribute :>> id = "FCA-002";
+        attribute :>> name = "UltrasonicTransducerAging";
+        attribute :>> causeCategory = FailureCauseCategoryKind::wear;
+        attribute :>> causeDescription = "Air sensor transducer sensitivity degrades with age";
+        attribute :>> occurrenceRating = ProbabilityKind::occasional;
+        attribute :>> preventionMethod = "POST sensor plausibility check; periodic maintenance";
+    }
+    part fcPendantAbuse : FailureCause {
+        attribute :>> id = "FCA-003";
+        attribute :>> name = "PendantCableAbuse";
+        attribute :>> causeCategory = FailureCauseCategoryKind::misuse;
+        attribute :>> causeDescription = "Cable crushed in bed rail shorts the switch line";
+        attribute :>> occurrenceRating = ProbabilityKind::occasional;
+        attribute :>> preventionMethod = "stuck-input detection (REQ-X-09); strain-relieved cable";
+    }
+    part dmFlowCrossCheck : DetectionMethod {
+        attribute :>> id = "DM-001";
+        attribute :>> name = "CommandedVsMeasuredFlowComparison";
+        attribute :>> methodKind = DetectionMethodKind::monitoring;
+        attribute :>> detectionPoint = "every execution step during ACTIVE therapy";
+        attribute :>> confidence = DetectionKind::high;
+    }
+    part dmPostSensorCheck : DetectionMethod {
+        attribute :>> id = "DM-002";
+        attribute :>> name = "POSTSensorPlausibilityCheck";
+        attribute :>> methodKind = DetectionMethodKind::selfDiagnostic;
+        attribute :>> detectionPoint = "power-on and periodic in-service test";
+        attribute :>> confidence = DetectionKind::moderate;
+    }
+    part dmStuckInputMonitor : DetectionMethod {
+        attribute :>> id = "DM-003";
+        attribute :>> name = "StuckInputMonitor";
+        attribute :>> methodKind = DetectionMethodKind::monitoring;
+        attribute :>> detectionPoint = "bolus input asserted beyond 60 s";
+        attribute :>> confidence = DetectionKind::high;
+    }
+    part fmeaActionAirSensor : FMEAAction {
+        attribute :>> id = "FMA-001";
+        attribute :>> name = "AddRedundantAirDetectionWindow";
+        attribute :>> actionKind = FMEAActionKind::designChange;
+        attribute :>> responsible = "hardware lead";
+        attribute :>> targetCompletionDate = "2026-09-30";
+        attribute :>> revisedRpn = 40;
+        attribute :>> description = "Add second sensing window downstream so a single silent transducer cannot mask air.";
+    }
+
+    // ── Fault tree (overdose top event) ─────────────────────────
+    part ftaOverdose : FaultTree {
+        attribute :>> id = "FTA-001";
+        attribute :>> name = "OverdoseFaultTree";
+        attribute :>> standardReference = "IEC 61025";
+        attribute :>> analysisScope = "Drug over-delivery during ACTIVE therapy";
+        attribute :>> topEventDescription = "Drug delivered in excess of prescription limits";
+        attribute :>> cutSetSummary = "All minimal cut sets are order 2 or higher after mitigation";
+        attribute :>> revisionDate = "2026-07-03";
+    }
+    part fteOverdoseTop : FaultTreeEvent {
+        attribute :>> id = "FTE-001";
+        attribute :>> name = "ExcessDrugDeliveredTopEvent";
+        attribute :>> eventKind = FaultTreeEventKind::topEvent;
+        attribute :>> description = "Delivered volume exceeds prescribed limits";
+    }
+    part fteMotorRunaway : FaultTreeEvent {
+        attribute :>> id = "FTE-002";
+        attribute :>> name = "MotorRunawayBasicEvent";
+        attribute :>> eventKind = FaultTreeEventKind::basicEvent;
+        attribute :>> failureRate = 0.000001;
+        attribute :>> exposureTime = 100.0;
+        attribute :>> description = "Pump motor delivers faster than commanded (FM-001)";
+    }
+    part fteCrossCheckFails : FaultTreeEvent {
+        attribute :>> id = "FTE-003";
+        attribute :>> name = "FlowCrossCheckUnavailable";
+        attribute :>> eventKind = FaultTreeEventKind::basicEvent;
+        attribute :>> failureRate = 0.00001;
+        attribute :>> exposureTime = 100.0;
+        attribute :>> description = "Independent flow sensor or comparison logic fails (FM-003 family)";
+    }
+    part fteLockoutFault : FaultTreeEvent {
+        attribute :>> id = "FTE-004";
+        attribute :>> name = "LockoutEnforcementFault";
+        attribute :>> eventKind = FaultTreeEventKind::basicEvent;
+        attribute :>> failureRate = 0.0000001;
+        attribute :>> exposureTime = 100.0;
+        attribute :>> description = "Infusion manager authorizes bolus despite active lockout";
+    }
+    part fteStuckButtonUndetected : FaultTreeEvent {
+        attribute :>> id = "FTE-005";
+        attribute :>> name = "StuckBolusButtonUndetected";
+        attribute :>> eventKind = FaultTreeEventKind::basicEvent;
+        attribute :>> failureRate = 0.000001;
+        attribute :>> exposureTime = 100.0;
+        attribute :>> description = "Pendant stuck closed and stuck-input monitor fails (FM-004)";
+    }
+    part ftgOverdoseOr : FaultTreeGate {
+        attribute :>> id = "FTG-001";
+        attribute :>> name = "OverdelivryPathOrGate";
+        attribute :>> gateKind = FaultTreeGateKind::orGate;
+    }
+    part ftgMotorAnd : FaultTreeGate {
+        attribute :>> id = "FTG-002";
+        attribute :>> name = "MotorRunawayAndCrossCheckGate";
+        attribute :>> gateKind = FaultTreeGateKind::andGate;
+    }
+    part ftgBolusAnd : FaultTreeGate {
+        attribute :>> id = "FTG-003";
+        attribute :>> name = "UnauthorizedBolusAndGate";
+        attribute :>> gateKind = FaultTreeGateKind::andGate;
+    }
+    part mcsMotorPath : MinimalCutSet {
+        attribute :>> id = "MCS-001";
+        attribute :>> name = "MotorRunawayWithLostCrossCheck";
+        attribute :>> cutSetOrder = 2;
+        attribute :>> involvedEvents = "FTE-002, FTE-003";
+        attribute :>> significance = "dominant contributor; controlled by RC-008 independence";
+    }
+    part mcsBolusPath : MinimalCutSet {
+        attribute :>> id = "MCS-002";
+        attribute :>> name = "StuckButtonWithLockoutFault";
+        attribute :>> cutSetOrder = 2;
+        attribute :>> involvedEvents = "FTE-004, FTE-005";
+        attribute :>> significance = "requires simultaneous software and detection failure; controlled by RC-001 and REQ-X-09";
+    }
+}