@memoarchitect/ontology 0.4.4

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -0,0 +1,113 @@
+package memo_examples_gpca_pump_model_catalog_gpca_context {
+    private import ScalarValues::*;
+
+    private import memo_architecture_context::*;
+    private import memo_core_enumerations::*;
+
+    // ── Intended use (ISO 14971 §5.2, IEC 62366-1) ──────────────
+    part gpcaIntendedUse : IntendedUse {
+        attribute :>> id = "IU-001";
+        attribute :>> name = "GPCA_IntendedUse";
+        attribute :>> title = "GPCA Pump Intended Use";
+        attribute :>> shortDescription = "Patient-controlled analgesia infusion of prescribed opioid analgesics.";
+        attribute :>> longDescription = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
+        attribute :>> indication = "Management of acute post-operative or chronic pain requiring titrated intravenous opioid analgesia.";
+        attribute :>> contraindication = "Patients unable to comprehend or operate the bolus request mechanism; drugs without safe-value records in the hospital pharmacy database.";
+        attribute :>> patientPopulation = "Adult in-patients under clinical supervision.";
+        attribute :>> clinicalBenefit = "Timely, patient-titrated analgesia with lower total opioid consumption than fixed-schedule dosing.";
+        attribute :>> regulatoryClassification = "FDA Class II infusion pump (21 CFR 880.5725); IEC 62304 software safety class C.";
+        attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §2.1-2.3 (GPCA overview, system functions, user characteristics)";
+    }
+
+    // ── Use contexts ────────────────────────────────────────────
+    part hospitalWardContext : UseContext {
+        attribute :>> id = "UC-001";
+        attribute :>> name = "HospitalWardUseContext";
+        attribute :>> careSetting = "acute-care hospital ward and post-anesthesia care unit";
+        attribute :>> environment = "indoor clinical environment, mains power with battery backup, pole or bed-rail mounted";
+        attribute :>> jurisdiction = "generic (FDA/EU reference model)";
+        attribute :>> connectedUse = true;
+        attribute :>> intendedUseReference = "IU-001";
+    }
+    // UC-002 (intra-hospital transport) removed: CriSys §2.4 states the
+    // system is used in a fixed location and is not ambulatory.
+
+    // ── Actors ──────────────────────────────────────────────────
+    part actorPatient : Actor {
+        attribute :>> id = "ACT-001";
+        attribute :>> name = "Patient";
+        attribute :>> actorKind = ActorKind::patient;
+        attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
+        attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
+    }
+    part actorNurse : Actor {
+        attribute :>> id = "ACT-002";
+        attribute :>> name = "ClinicianNurse";
+        attribute :>> actorKind = ActorKind::clinician;
+        attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
+        attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
+    }
+    part actorPrescriber : Actor {
+        attribute :>> id = "ACT-003";
+        attribute :>> name = "PrescribingPhysician";
+        attribute :>> actorKind = ActorKind::clinician;
+        attribute :>> trainingLevel = "licensed prescriber";
+        attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
+    }
+    part actorPharmacist : Actor {
+        attribute :>> id = "ACT-004";
+        attribute :>> name = "Pharmacist";
+        attribute :>> actorKind = ActorKind::clinician;
+        attribute :>> trainingLevel = "licensed pharmacist";
+        attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
+    }
+    part actorTechnician : Actor {
+        attribute :>> id = "ACT-005";
+        attribute :>> name = "BiomedicalTechnician";
+        attribute :>> actorKind = ActorKind::technician;
+        attribute :>> trainingLevel = "service-trained; authenticated service access";
+        attribute :>> description = "Performs maintenance, battery replacement, and calibration through the service interface.";
+    }
+
+    // ── Foreseeable use errors (IEC 62366-1, AAMI TIR PCA) ──────
+    part ueMisprogrammedRate : UseError {
+        attribute :>> id = "UE-001";
+        attribute :>> name = "MisprogrammedInfusionParameters";
+        attribute :>> errorCategory = UseErrorCategoryKind::actionCategory;
+        attribute :>> taskReference = "OA-003: Program prescription";
+        attribute :>> severity = SeverityKind::catastrophic;
+        attribute :>> rootCauseType = "decimal-point / unit entry slip during prescription programming";
+        attribute :>> description = "Clinician enters a basal rate or bolus volume an order of magnitude off (e.g. mg vs mL, misplaced decimal).";
+        attribute :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.8 Use Hazards (incorrect dose settings)";
+    }
+    part ueBolusByProxy : UseError {
+        attribute :>> id = "UE-002";
+        attribute :>> name = "PCAByProxy";
+        attribute :>> errorCategory = UseErrorCategoryKind::cognition;
+        attribute :>> taskReference = "OA-005: Request patient bolus";
+        attribute :>> severity = SeverityKind::catastrophic;
+        attribute :>> rootCauseType = "family member or caregiver presses bolus button on behalf of a sedated patient";
+        attribute :>> description = "Bolus doses requested by someone other than the patient defeat the inherent safety of patient-limited dosing.";
+        attribute :>> sourceReference = "illustrative — no source";
+    }
+    part ueWrongDrugLoaded : UseError {
+        attribute :>> id = "UE-003";
+        attribute :>> name = "WrongDrugOrConcentrationLoaded";
+        attribute :>> errorCategory = UseErrorCategoryKind::cognition;
+        attribute :>> taskReference = "OA-002: Load drug reservoir";
+        attribute :>> severity = SeverityKind::catastrophic;
+        attribute :>> rootCauseType = "reservoir containing wrong drug or concentration mounted without verification";
+        attribute :>> description = "Loaded drug or concentration differs from the programmed prescription, so delivered dose differs from intended dose.";
+        attribute :>> sourceReference = "illustrative — no source";
+    }
+    part ueAlarmDisregard : UseError {
+        attribute :>> id = "UE-004";
+        attribute :>> name = "AlarmSilencedAndForgotten";
+        attribute :>> errorCategory = UseErrorCategoryKind::memoryRecall;
+        attribute :>> taskReference = "OA-006: Respond to alarm";
+        attribute :>> severity = SeverityKind::serious;
+        attribute :>> rootCauseType = "alarm silenced during high workload and the underlying condition never resolved";
+        attribute :>> description = "Clinician silences an alarm and does not return to resolve the underlying condition (e.g. occlusion), interrupting therapy.";
+        attribute :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.8 Use Hazards (attentional/memory failure)";
+    }
+}

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -0,0 +1,172 @@
+package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
+    private import ScalarValues::*;
+
+    private import memo_architecture_cybersecurity::*;
+    private import memo_architecture_requirements::*;
+    private import memo_architecture_risk_risk::*;
+    private import memo_architecture_assurance::*;
+    private import memo_core_enumerations::*;
+    private import memo_core_relationships::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_risk::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_requirements::*;
+    private import memo_examples_gpca_pump_model_catalog_gpca_verification::*;
+
+    part therapyConfigurationAsset : CybersecurityAsset {
+        attribute :>> id = "AST-CYB-001";
+        attribute :>> name = "TherapyConfigurationAsset";
+        attribute :>> assetKind = AssetKind::configuration;
+        attribute :>> confidentialityNeed = "medium";
+        attribute :>> integrityNeed = "very high";
+        attribute :>> availabilityNeed = "high";
+        attribute :>> privacyRelevant = false;
+        attribute :>> safetyRelevant = true;
+        attribute :>> owningLayer = "software_structure";
+    }
+
+    part patientEventLogAsset : CybersecurityAsset {
+        attribute :>> id = "AST-CYB-002";
+        attribute :>> name = "PatientEventLogAsset";
+        attribute :>> assetKind = AssetKind::auditRecord;
+        attribute :>> confidentialityNeed = "high";
+        attribute :>> integrityNeed = "high";
+        attribute :>> availabilityNeed = "medium";
+        attribute :>> privacyRelevant = true;
+        attribute :>> safetyRelevant = false;
+        attribute :>> owningLayer = "software_structure";
+    }
+
+    part maintenancePortBoundary : TrustBoundary {
+        attribute :>> id = "TB-001";
+        attribute :>> name = "MaintenancePortBoundary";
+        attribute :>> boundaryType = "service-access";
+        attribute :>> crossingConstraint = "Boundary between service tooling and therapy controller runtime.";
+        attribute :>> trustAssumption = "Service tooling on the untrusted side requires authentication before any crossing is permitted.";
+    }
+
+    part unauthorizedConfigChangeThreat : Threat {
+        attribute :>> id = "TH-001";
+        attribute :>> name = "UnauthorizedTherapyConfigurationChange";
+        attribute :>> driverKind = "cybersecurity";
+        attribute :>> threatCategory = ThreatCategoryKind::tampering;
+        attribute :>> attackVector = "maintenance port";
+        attribute :>> threatSource = "unauthorized actor with local access";
+        attribute :>> precondition = "maintenance interface exposed without strong authentication";
+        attribute :>> affectedConcern = ConcernKind::cybersecurity;
+        attribute :>> defaultTechnique = "STRIDE tampering";
+    }
+
+    part eventLogTamperingThreat : Threat {
+        attribute :>> id = "TH-002";
+        attribute :>> name = "PatientEventLogTampering";
+        attribute :>> driverKind = "cybersecurity";
+        attribute :>> threatCategory = ThreatCategoryKind::repudiation;
+        attribute :>> attackVector = "maintenance port";
+        attribute :>> threatSource = "unauthorized actor with local access";
+        attribute :>> precondition = "audit log writable without integrity protection";
+        attribute :>> affectedConcern = ConcernKind::cybersecurity;
+        attribute :>> defaultTechnique = "STRIDE repudiation";
+    }
+
+    part weakServiceAuthentication : Vulnerability {
+        attribute :>> id = "VULN-001";
+        attribute :>> name = "WeakServiceAuthentication";
+        attribute :>> weakness = "service mode relies on shared default credential";
+        attribute :>> exploitability = "moderate";
+        attribute :>> discoveryMethod = "architecture review";
+        attribute :>> affectedLayer = "software_structure";
+        attribute :>> cweReference = "CWE-798";
+    }
+
+    part tamperedConfigurationScenario : ThreatScenario {
+        attribute :>> id = "SCN-001";
+        attribute :>> name = "TamperedTherapyConfigurationScenario";
+        attribute :>> description = "An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards.";
+        attribute :>> actorDescription = "unauthorized actor with local access to the maintenance port";
+        attribute :>> defaultCategory = ThreatCategoryKind::tampering;
+    }
+
+    part unsafeDoseCyberHazard : CyberHazard {
+        attribute :>> id = "CHZ-001";
+        attribute :>> name = "UnsafeTherapyConfigurationHazard";
+        attribute :>> hazardType = HazardTypeKind::drugDeliveryError;
+        attribute :>> foreseeable = true;
+        attribute :>> securityImpact = "loss of configuration integrity";
+        attribute :>> safetyImpact = "unsafe dose delivery";
+        attribute :>> privacyImpact = "none";
+        attribute :>> operationalImpact = "therapy interruption or unsafe continuation";
+    }
+
+    part configurationTamperingRisk : CyberRisk {
+        attribute :>> id = "CRISK-001";
+        attribute :>> name = "ConfigurationTamperingRisk";
+        attribute :>> driverKind = "cyber risk";
+        attribute :>> probabilityEstimate = ProbabilityKind::occasional;
+        attribute :>> severityEstimate = SeverityKind::catastrophic;
+        attribute :>> riskLevel = CriticalityKind::high;
+        attribute :>> acceptability = RiskAcceptabilityKind::unacceptable;
+        attribute :>> exploitabilityEstimate = "moderate";
+        attribute :>> detectability = DetectionKind::low;
+        attribute :>> attackComplexity = "moderate with local access";
+        attribute :>> patientSafetyContribution = "Potential overdose if therapy limits are changed.";
+    }
+
+    part strongServiceAuthentication : CyberMitigation {
+        attribute :>> id = "CMIT-001";
+        attribute :>> name = "StrongServiceAuthenticationAndAudit";
+        attribute :>> controlKind = RiskControlKind::protectiveMeasure;
+        attribute :>> implementationKind = RiskControlImplementationKind::softwareDesign;
+        attribute :>> verificationStatus = "planned";
+        attribute :>> cyberControlKind = CyberControlKind::authentication;
+        attribute :>> securityMechanism = "authenticate, authorize, audit";
+        attribute :>> verificationExpectation = "verify only authenticated and integrity-protected configuration changes are accepted";
+    }
+
+    requirement reqAuthenticatedServiceAccess : SecurityRequirement {
+        attribute :>> id = "SREQ-001";
+        attribute :>> name = "AuthenticatedServiceAccess";
+        attribute :>> statement = "The system shall require authenticated and authorized service access before any therapy configuration parameter can be modified.";
+        attribute :>> sourceKind = RequirementSourceKind::risk;
+        attribute :>> concernKind = ConcernKind::cybersecurity;
+        attribute :>> status = RequirementStatusKind::approved;
+        attribute :>> acceptanceCriteria = "Unauthenticated or unauthorized attempts to modify therapy configuration are rejected and logged.";
+        attribute :>> subjectDescription = "maintenance and configuration path";
+        attribute :>> actorDescription = "service personnel";
+        attribute :>> assumptionSummary = "cryptographic identity available";
+        attribute :>> guaranteeSummary = "only authorized service access can change therapy configuration";
+        attribute :>> securityObjective = "integrity";
+        attribute :>> derivedFromThreat = "TH-001";
+        attribute :>> defaultConcern = ConcernKind::cybersecurity;
+        attribute :>> safetyClass = SafetyClassKind::C;
+    }
+
+    part vcAuthenticatedServiceAccess : VerificationCase {
+        attribute :>> id = "CVER-001";
+        attribute :>> name = "VerifyAuthenticatedServiceAccess";
+        attribute :>> methodKind = VerificationMethodKind::test;
+        attribute :>> acceptanceCriteria = "Only authenticated and authorized service sessions may modify therapy configuration; all attempts are logged.";
+        attribute :>> status = "planned";
+    }
+
+    connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to realizedThreat ::> unauthorizedConfigChangeThreat;
+
+    connection : ThreatenedBy connect protectedAsset ::> patientEventLogAsset to realizedThreat ::> eventLogTamperingThreat;
+
+    connection : Exploits connect realizedThreat ::> unauthorizedConfigChangeThreat to enablingVulnerability ::> weakServiceAuthentication;
+
+    connection : RealizedByScenario connect realizedThreat ::> unauthorizedConfigChangeThreat to scenario ::> tamperedConfigurationScenario;
+
+    connection : MitigatesVulnerability connect enablingVulnerability ::> weakServiceAuthentication to mitigation ::> strongServiceAuthentication;
+
+    connection : DerivesCyberRequirement connect sourceThreatOrRisk ::> unauthorizedConfigChangeThreat to targetRequirement ::> reqAuthenticatedServiceAccess;
+
+    connection : DerivesCyberRequirement connect sourceThreatOrRisk ::> eventLogTamperingThreat to targetRequirement ::> reqAuthenticatedServiceAccess;
+
+    connection : ImpactsSafety connect cyberElement ::> configurationTamperingRisk to safetyElement ::> riskBefore;
+
+    connection : CrossesTrustBoundary connect boundary ::> maintenancePortBoundary to crossingItem ::> therapyConfigurationAsset;
+
+    connection : VerifiedBy connect verificationTarget ::> reqAuthenticatedServiceAccess to verificationCase ::> vcAuthenticatedServiceAccess;
+
+    connection : ProducesEvidence connect producer ::> vcAuthenticatedServiceAccess to producedEvidence ::> evidenceLockout;
+}

package/examples/gpca-pump/model/catalog/gpca_formal_behavior.sysml

@@ -0,0 +1,173 @@
+package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
+    private import ScalarValues::*;
+
+    private import memo_architecture_behavior::*;
+    private import memo_core_enumerations::*;
+
+    // ═════════════════════════════════════════════════════════════
+    // Formal assume/guarantee properties translated 1:1 from the
+    // CriSys AADL AGREE annexes (GPCA_SW.aadl composite contract;
+    // CITE-002) and the compositional verification package
+    // (CITE-003). Alarm responses bound flow to FlowRate_KVO —
+    // keep-vein-open — except empty reservoir, where the source
+    // guarantees zero flow.
+    // ═════════════════════════════════════════════════════════════
+    part gpcaSwContract : Contract {
+        attribute :>> id = "CTR-000";
+        attribute :>> name = "GpcaSwCompositeContract";
+        attribute :>> contractScope = "GPCA_SW (composite, verified compositionally over the 8 subcomponents)";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part topLevelContract : Contract {
+        attribute :>> id = "CTR-001";
+        attribute :>> name = "TopLevelModeContract";
+        attribute :>> contractScope = "Top_Level_Mode";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, Top_Level_Mode.aadl AGREE annex";
+    }
+    part infusionManagerContract : Contract {
+        attribute :>> id = "CTR-002";
+        attribute :>> name = "InfusionManagerContract";
+        attribute :>> contractScope = "Infusion_Manager";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, Infusion_Manager.aadl AGREE annex";
+    }
+    part alarmContract : Contract {
+        attribute :>> id = "CTR-003";
+        attribute :>> name = "AlarmContract";
+        attribute :>> contractScope = "Alarm";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, Alarm.aadl AGREE annex";
+    }
+
+    // ── Assumptions (GPCA_SW.aadl) ──────────────────────────────
+    part assumeVtbiHighPositive : AssumeProperty {
+        attribute :>> id = "AP-002";
+        attribute :>> name = "VtbiHighPositive";
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "assume DB_IN.VTBI_High > 0";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part assumeEmptyReservoirPositive : AssumeProperty {
+        attribute :>> id = "AP-003";
+        attribute :>> name = "EmptyReservoirConstPositive";
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "assume CONST_IN.Empty_Reservoir > 0";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part assumeValidPrescriptionSaved : AssumeProperty {
+        attribute :>> id = "AP-001";
+        attribute :>> name = "ValidPrescriptionSavedBeforeTherapy";
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "assume a saved prescription is available before infusion initiation";
+        attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.3.1 (REQ 7)";
+    }
+
+    // ── Guarantees (GPCA_SW.aadl AGREE annex, 1:1) ──────────────
+    part guaranteeExclusiveMode : GuaranteeProperty {
+        attribute :>> id = "GP-001";
+        attribute :>> name = "ModeRange";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee mode_range: GPCA_SW_OUT.Current_System_Mode in {0, 1, 2, 3, 4, 6, 7, 8} (source enumeration omits 5)";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 1)";
+    }
+    part guaranteeOffMode : GuaranteeProperty {
+        attribute :>> id = "GP-004";
+        attribute :>> name = "NotStartImpliesModeZero";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee not(OP_CMD_IN.System_Start) => GPCA_SW_OUT.Current_System_Mode = 0";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part guaranteeInitialStart : GuaranteeProperty {
+        attribute :>> id = "GP-005";
+        attribute :>> name = "InitialSystemStartImpliesModeOne";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee sys_initial and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4 allocation: TLM System_Start -> System_On; IM System_On -> mode 1)";
+    }
+    part guaranteeOffToOn : GuaranteeProperty {
+        attribute :>> id = "GP-006";
+        attribute :>> name = "OffToOnImpliesModeOne";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee not(sys_initial) and pre(GPCA_SW_OUT.Current_System_Mode) = 0 and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4)";
+    }
+    part guaranteeEmptyReservoirNoFlow : GuaranteeProperty {
+        attribute :>> id = "GP-007";
+        attribute :>> name = "EmptyReservoirImpliesNoFlow";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Reservoir_Volume < CONST_IN.Empty_Reservoir) => GPCA_SW_OUT.Commanded_Flow_Rate = 0";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 59 'Empty Reservoir')";
+    }
+    part guaranteeVtbiKvo : GuaranteeProperty {
+        attribute :>> id = "GP-008";
+        attribute :>> name = "OverVtbiImpliesFlowAtMostKvo";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Volume_Infused > DB_IN.VTBI_High) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (over-infusion => keep-vein-open, not zero)";
+    }
+    part guaranteeAirInLineKvo : GuaranteeProperty {
+        attribute :>> id = "GP-009";
+        attribute :>> name = "AirInLineImpliesFlowAtMostKvo";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Air_In_Line) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 21 'Air embolism')";
+    }
+    part guaranteeOcclusionKvo : GuaranteeProperty {
+        attribute :>> id = "GP-010";
+        attribute :>> name = "OcclusionImpliesFlowAtMostKvo";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Occlusion) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part guaranteeDoorOpenKvo : GuaranteeProperty {
+        attribute :>> id = "GP-011";
+        attribute :>> name = "DoorOpenImpliesFlowAtMostKvo";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Door_Open) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
+    }
+    part guaranteeAlarmStopsSameStep : GuaranteeProperty {
+        attribute :>> id = "GP-003";
+        attribute :>> name = "SameStepAlarmKvoGuarantee";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee an infusion-inhibiting notification in a step implies Commanded_Flow_Rate <= Flow_Rate_KVO in the same step (ALARM_OUT -> IM.ALARM_IN is an immediate connection)";
+        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl (ALARM_to_IM immediate) with the flow <= KVO guarantees above";
+    }
+    part guaranteeLockoutPreventsBolus : GuaranteeProperty {
+        attribute :>> id = "GP-002";
+        attribute :>> name = "LockoutGuarantee";
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
+        attribute :>> languageKind = PropertyLanguageKind::agreeLike;
+        attribute :>> formalExpression = "guarantee a BolusRequest_prog inside the LockOutPeriod_pbolus_prog window is ignored and no PATIENT BOLUS is initiated";
+        attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.6.1 (REQ 25.3, REQ 26)";
+    }
+
+    // ── Temporal properties over the mode machine ───────────────
+    part temporalNoInvalidTransition : BehaviorProperty {
+        attribute :>> id = "BP-010";
+        attribute :>> name = "NoInvalidTransition";
+        attribute :>> propertyKind = BehaviorPropertyKind::temporalProperty;
+        attribute :>> languageKind = PropertyLanguageKind::ltlLike;
+        attribute :>> formalExpression = "G(mode transitions follow only the edges of the Fig 4.1 hierarchy as constrained by REQ 4-5, 12-13, 19-23, 28-39, 46-47)";
+        attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1 Fig 4.1";
+    }
+    part temporalPauseOnCriticalAlarm : BehaviorProperty {
+        attribute :>> id = "BP-011";
+        attribute :>> name = "PauseAtKvoOnInhibitingNotification";
+        attribute :>> propertyKind = BehaviorPropertyKind::safetyProperty;
+        attribute :>> languageKind = PropertyLanguageKind::ltlLike;
+        attribute :>> formalExpression = "G(infusion_inhibiting_notification -> X (mode = PAUSED and Commanded_Flow_Rate <= Flow_Rate_KVO))";
+        attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.5.2 (REQ 19-23) and §4.1.10.1 (REQ 43)";
+    }
+}