@memoarchitect/ontology 0.4.6 → 0.6.1

package/examples/gpca-pump/model/catalog/gpca_behavior_modes.sysml

@@ -1,7 +1,7 @@
 package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
     private import ScalarValues::*;
 
-    private import memo_architecture_behavior::*;
+    private import memo_architecture_functional_behavior::*;
     private import memo_core_enumerations::*;
 
     // ═════════════════════════════════════════════════════════════
@@ -14,7 +14,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
     // external trigger. Mode-tree containment edges (Composes)
     // live in gpca_trace.sysml.
     // ═════════════════════════════════════════════════════════════
-    part topLevelModeMachine : BehaviorMachine {
+    state topLevelModeMachine : StateMachine {
         attribute :>> id = "BM-001";
         attribute :>> name = "TopLevelModeMachine";
         attribute :>> machineKind = "hierarchical state machine";
@@ -23,7 +23,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
     }
 
     // ── Mode states (Fig 4.1) ───────────────────────────────────
-    part modeOFF : ModeState {
+    state modeOFF : ModeState {
         attribute :>> id = "MODE-000";
         attribute :>> name = "OFF";
         attribute :>> modeKind = "top (default)";
@@ -32,7 +32,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "System_start_prog commanded (REQ 4)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.2";
     }
-    part modeON : ModeState {
+    state modeON : ModeState {
         attribute :>> id = "MODE-001";
         attribute :>> name = "ON";
         attribute :>> modeKind = "operational parent";
@@ -41,7 +41,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "System_stop_prog: stop infusion, cancel all notifications (REQ 5)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.3";
     }
-    part modeIDLE : ModeState {
+    state modeIDLE : ModeState {
         attribute :>> id = "MODE-002";
         attribute :>> name = "ON.IDLE";
         attribute :>> modeKind = "idle";
@@ -50,7 +50,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "confirmed second Infusion_initiate_prog (REQ 12/13)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.4";
     }
-    part modeTHERAPY : ModeState {
+    state modeTHERAPY : ModeState {
         attribute :>> id = "MODE-003";
         attribute :>> name = "ON.THERAPY";
         attribute :>> modeKind = "therapy parent";
@@ -59,7 +59,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "infusion complete to IDLE (REQ 28); manual stop from PAUSED (REQ 47); system stop (REQ 5)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.5";
     }
-    part modePAUSED : ModeState {
+    state modePAUSED : ModeState {
         attribute :>> id = "MODE-004";
         attribute :>> name = "ON.THERAPY.PAUSED";
         attribute :>> modeKind = "paused (KVO delivery)";
@@ -68,7 +68,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "Infusion_initiate_prog with Inhibited_Infusion_macro = FALSE (REQ 46); Infusion_inhibit_prog to IDLE (REQ 47)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.10 (REQ 43-47)";
     }
-    part modeACTIVE : ModeState {
+    state modeACTIVE : ModeState {
         attribute :>> id = "MODE-005";
         attribute :>> name = "ON.THERAPY.ACTIVE";
         attribute :>> modeKind = "active parent";
@@ -77,7 +77,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "infusion complete (REQ 28); PAUSED via REQ 29/30/37-39";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.6";
     }
-    part modeBASAL : ModeState {
+    state modeBASAL : ModeState {
         attribute :>> id = "MODE-006";
         attribute :>> name = "ON.THERAPY.ACTIVE.BASAL";
         attribute :>> modeKind = "active-basal";
@@ -86,7 +86,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "scheduled square bolus (REQ 31); patient bolus granted (REQ 32); Inhibited_Infusion_macro (REQ 37)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.7";
     }
-    part modeSQUARE : ModeState {
+    state modeSQUARE : ModeState {
         attribute :>> id = "MODE-007";
         attribute :>> name = "ON.THERAPY.ACTIVE.SQUARE_BOLUS";
         attribute :>> modeKind = "active-square-bolus (auto-scheduled)";
@@ -95,7 +95,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_modes {
         attribute :>> exitCondition = "scheduled end or Inhibited_Bolus_macro (REQ 34); patient bolus granted (REQ 33); inhibits (REQ 39)";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.8";
     }
-    part modePBOLUS : ModeState {
+    state modePBOLUS : ModeState {
         attribute :>> id = "MODE-008";
         attribute :>> name = "ON.THERAPY.ACTIVE.PATIENT_BOLUS";
         attribute :>> modeKind = "active-patient-bolus";

package/examples/gpca-pump/model/catalog/gpca_behavior_subsystems.sysml

@@ -1,11 +1,11 @@
 package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
     private import ScalarValues::*;
 
-    private import memo_architecture_functions::*;
+    private import memo_architecture_functional_functions::*;
     private import memo_core_enumerations::*;
 
     // ── Logical functions ───────────────────────────────────────
-    part fnAcquireSensors : LogicalFunction {
+    part fnAcquireSensors : SystemFunction {
         attribute :>> id = "FUNC-001";
         attribute :>> name = "AcquireSensorData";
         attribute :>> functionCategory = "sensing";
@@ -14,7 +14,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnValidatePrescription : LogicalFunction {
+    part fnValidatePrescription : SystemFunction {
         attribute :>> id = "FUNC-002";
         attribute :>> name = "ValidatePrescription";
         attribute :>> functionCategory = "configuration";
@@ -23,7 +23,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnMonitorAlarm : LogicalFunction {
+    part fnMonitorAlarm : SystemFunction {
         attribute :>> id = "FUNC-003";
         attribute :>> name = "MonitorExceptionalConditions";
         attribute :>> functionCategory = "alarm";
@@ -32,7 +32,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnAnnunciate : LogicalFunction {
+    part fnAnnunciate : SystemFunction {
         attribute :>> id = "FUNC-004";
         attribute :>> name = "AnnunciateAlarms";
         attribute :>> functionCategory = "alarm";
@@ -41,7 +41,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnManageInfusion : LogicalFunction {
+    part fnManageInfusion : SystemFunction {
         attribute :>> id = "FUNC-005";
         attribute :>> name = "ManageInfusion";
         attribute :>> functionCategory = "infusion";
@@ -50,7 +50,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnEnforceLimits : LogicalFunction {
+    part fnEnforceLimits : SystemFunction {
         attribute :>> id = "FUNC-006";
         attribute :>> name = "EnforceDoseLimits";
         attribute :>> functionCategory = "infusion";
@@ -59,7 +59,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnCommandPump : LogicalFunction {
+    part fnCommandPump : SystemFunction {
         attribute :>> id = "FUNC-007";
         attribute :>> name = "CommandPumpMotor";
         attribute :>> functionCategory = "actuation";
@@ -68,7 +68,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnLogEvents : LogicalFunction {
+    part fnLogEvents : SystemFunction {
         attribute :>> id = "FUNC-008";
         attribute :>> name = "LogTherapyEvents";
         attribute :>> functionCategory = "logging";
@@ -77,7 +77,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::regulatory;
         attribute :>> criticality = CriticalityKind::medium;
     }
-    part fnManagePower : LogicalFunction {
+    part fnManagePower : SystemFunction {
         attribute :>> id = "FUNC-009";
         attribute :>> name = "ManagePower";
         attribute :>> functionCategory = "platform";
@@ -86,7 +86,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::reliability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnPresentStatus : LogicalFunction {
+    part fnPresentStatus : SystemFunction {
         attribute :>> id = "FUNC-010";
         attribute :>> name = "PresentStatus";
         attribute :>> functionCategory = "user-interface";
@@ -95,7 +95,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::usability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnSelfTest : LogicalFunction {
+    part fnSelfTest : SystemFunction {
         attribute :>> id = "FUNC-011";
         attribute :>> name = "ExecuteSelfTest";
         attribute :>> functionCategory = "platform";
@@ -106,7 +106,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
     }
 
     // ── Logical flows ───────────────────────────────────────────
-    part lfSensorAcquisition : LogicalFlow {
+    part lfSensorAcquisition : FunctionalExchange {
         attribute :>> id = "LF-001";
         attribute :>> name = "SensorAcquisitionFlow";
         attribute :>> flowKind = FlowKind::measurement;
@@ -114,8 +114,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 40.0;
         attribute :>> integrityLevel = "class C data path";
+        ref :>> sourceFunction = fnAcquireSensors;
+        ref :>> targetFunction = fnMonitorAlarm;
     }
-    part lfFlowCommand : LogicalFlow {
+    part lfFlowCommand : FunctionalExchange {
         attribute :>> id = "LF-002";
         attribute :>> name = "FlowCommandFlow";
         attribute :>> flowKind = FlowKind::command;
@@ -123,8 +125,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C command path";
+        ref :>> sourceFunction = fnManageInfusion;
+        ref :>> targetFunction = fnCommandPump;
     }
-    part lfAlarmSignal : LogicalFlow {
+    part lfAlarmSignal : FunctionalExchange {
         attribute :>> id = "LF-003";
         attribute :>> name = "AlarmSignalFlow";
         attribute :>> flowKind = FlowKind::alarm;
@@ -132,8 +136,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C alarm path; same-step delivery to infusion manager";
+        ref :>> sourceFunction = fnMonitorAlarm;
+        ref :>> targetFunction = fnAnnunciate;
     }
-    part lfPrescriptionEntry : LogicalFlow {
+    part lfPrescriptionEntry : FunctionalExchange {
         attribute :>> id = "LF-004";
         attribute :>> name = "PrescriptionEntryFlow";
         attribute :>> flowKind = FlowKind::configuration;
@@ -141,10 +147,12 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> latencyBudgetMs = 500.0;
         attribute :>> staleAfterMs = 0.0;
         attribute :>> integrityLevel = "confirmed double-entry path";
+        ref :>> targetFunction = fnValidatePrescription;
     }
 
     // ── Exchange item definitions ───────────────────────────────
-    part ddPrescription : DataDefinition {
+    item ddPrescription : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::data;
         attribute :>> id = "DD-001";
         attribute :>> name = "PrescriptionRecord";
         attribute :>> semantics = "patient id, drug name, concentration, VTBI total, duration total, basal flow rate, square bolus rate/duration/interval, patient bolus rate/duration/lockout period, max boluses per hour (DD-005..DD-017)";
@@ -158,7 +166,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> availabilityClass = "must survive power loss";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §3.1.1 Prescription Data";
     }
-    part ddBolusRequest : DataDefinition {
+    item ddBolusRequest : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::data;
         attribute :>> id = "DD-002";
         attribute :>> name = "BolusRequestSignal";
         attribute :>> semantics = "debounced patient pendant press event";
@@ -168,7 +177,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> confidentialityClass = "none";
         attribute :>> availabilityClass = "sampled every step";
     }
-    part ddSensorVector : DataDefinition {
+    item ddSensorVector : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::data;
         attribute :>> id = "DD-003";
         attribute :>> name = "SensorStatusVector";
         attribute :>> semantics = "air-in-line, occlusion pressure, reservoir volume, door state, flow measurement, battery level, CPU/memory status";
@@ -178,7 +188,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> confidentialityClass = "none";
         attribute :>> availabilityClass = "stale after two missed steps";
     }
-    part ddEventRecord : DataDefinition {
+    item ddEventRecord : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::data;
         attribute :>> id = "DD-004";
         attribute :>> name = "TherapyEventRecord";
         attribute :>> semantics = "timestamped dose, alarm, mode, and configuration events";
@@ -188,14 +199,16 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> confidentialityClass = "patient-identifiable";
         attribute :>> availabilityClass = "retained 90 days";
     }
-    part cdFlowCommand : ControlDefinition {
+    item cdFlowCommand : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::command;
         attribute :>> id = "CD-001";
         attribute :>> name = "FlowCommand";
         attribute :>> controlType = "commanded flow rate with enable interlock";
         attribute :>> timeoutMs = 40.0;
         attribute :>> retryPolicy = "no retry; missing command forces zero flow";
     }
-    part cdAlarmSignal : ControlDefinition {
+    item cdAlarmSignal : InterfaceItem {
+        attribute :>> itemKind = InterfaceItemKind::command;
         attribute :>> id = "CD-002";
         attribute :>> name = "AlarmSignal";
         attribute :>> controlType = "priority-coded alarm assertion (level 1 stops infusion, level 2 warns)";

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -1,7 +1,10 @@
 package memo_examples_gpca_pump_model_catalog_gpca_context {
     private import ScalarValues::*;
 
-    private import memo_architecture_context::*;
+    private import memo_architecture_operational_context_actors::*;
+    private import memo_architecture_operational_context_use_context::*;
+    private import memo_assurance_requirements::*;
+    private import memo_assurance_human_factors::*;
     private import memo_core_enumerations::*;
 
     // ── Intended use (ISO 14971 §5.2, IEC 62366-1) ──────────────
@@ -18,6 +21,17 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> regulatoryClassification = "FDA Class II infusion pump (21 CFR 880.5725); IEC 62304 software safety class C.";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §2.1-2.3 (GPCA overview, system functions, user characteristics)";
     }
+    part bolusByProxyMisuse : ReasonablyForeseeableMisuse {
+        attribute :>> id = "RFM-001";
+        attribute :>> name = "BolusRequestBySomeoneOtherThanPatient";
+        attribute :>> title = "Bolus by proxy";
+        attribute :>> shortDescription = "A caregiver or visitor presses the patient bolus control.";
+        attribute :>> longDescription = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
+        attribute :>> misuseContext = "Patient-controlled analgesia in a supervised hospital setting.";
+        attribute :>> foreseeableBasis = "Known PCA use pattern represented in the GPCA hazard analysis.";
+        attribute :>> affectedUseContext = "UC-001";
+        attribute :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.8; CITE-005: Open PCA ISO 14971 risk analysis, bolus-by-proxy event";
+    }
 
     // ── Use contexts ────────────────────────────────────────────
     part hospitalWardContext : UseContext {
@@ -33,35 +47,40 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
     // system is used in a fixed location and is not ambulatory.
 
     // ── Actors ──────────────────────────────────────────────────
-    part actorPatient : Actor {
+    part actorPatient : User {
+        attribute :>> actorKind = ActorKind::patient;
         attribute :>> id = "ACT-001";
         attribute :>> name = "Patient";
         attribute :>> actorKind = ActorKind::patient;
         attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
         attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
     }
-    part actorNurse : Actor {
+    part actorNurse : User {
+        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-002";
         attribute :>> name = "ClinicianNurse";
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
         attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
     }
-    part actorPrescriber : Actor {
+    part actorPrescriber : User {
+        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-003";
         attribute :>> name = "PrescribingPhysician";
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed prescriber";
         attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
     }
-    part actorPharmacist : Actor {
+    part actorPharmacist : User {
+        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-004";
         attribute :>> name = "Pharmacist";
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed pharmacist";
         attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
     }
-    part actorTechnician : Actor {
+    part actorTechnician : User {
+        attribute :>> actorKind = ActorKind::technician;
         attribute :>> id = "ACT-005";
         attribute :>> name = "BiomedicalTechnician";
         attribute :>> actorKind = ActorKind::technician;

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -1,10 +1,10 @@
 package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
     private import ScalarValues::*;
 
-    private import memo_architecture_cybersecurity::*;
-    private import memo_architecture_requirements::*;
-    private import memo_architecture_risk_risk::*;
-    private import memo_architecture_assurance::*;
+    private import memo_assurance_cybersecurity::*;
+    private import memo_assurance_requirements::*;
+    private import memo_assurance_safety_risk::*;
+    private import memo_assurance_verification_validation::*;
     private import memo_core_enumerations::*;
     private import memo_core_relationships::*;
     private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
@@ -140,7 +140,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
         attribute :>> safetyClass = SafetyClassKind::C;
     }
 
-    part vcAuthenticatedServiceAccess : VerificationCase {
+    verification vcAuthenticatedServiceAccess : VerificationCase {
         attribute :>> id = "CVER-001";
         attribute :>> name = "VerifyAuthenticatedServiceAccess";
         attribute :>> methodKind = VerificationMethodKind::test;
@@ -156,7 +156,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
 
     connection : RealizedByScenario connect realizedThreat ::> unauthorizedConfigChangeThreat to scenario ::> tamperedConfigurationScenario;
 
-    connection : MitigatesVulnerability connect enablingVulnerability ::> weakServiceAuthentication to mitigation ::> strongServiceAuthentication;
+    connection : Mitigates { attribute :>> mitigationKind = MitigationKind::vulnerability; connect control ::> strongServiceAuthentication to mitigatedElement ::> weakServiceAuthentication; }
 
     connection : DerivesCyberRequirement connect sourceThreatOrRisk ::> unauthorizedConfigChangeThreat to targetRequirement ::> reqAuthenticatedServiceAccess;
 

package/examples/gpca-pump/model/catalog/gpca_formal_behavior.sysml

@@ -1,7 +1,7 @@
 package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
     private import ScalarValues::*;
 
-    private import memo_architecture_behavior::*;
+    private import memo_architecture_functional_behavior::*;
     private import memo_core_enumerations::*;
 
     // ═════════════════════════════════════════════════════════════
@@ -38,7 +38,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
     }
 
     // ── Assumptions (GPCA_SW.aadl) ──────────────────────────────
-    part assumeVtbiHighPositive : AssumeProperty {
+    part assumeVtbiHighPositive : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-002";
         attribute :>> name = "VtbiHighPositive";
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
@@ -46,7 +47,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "assume DB_IN.VTBI_High > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
     }
-    part assumeEmptyReservoirPositive : AssumeProperty {
+    part assumeEmptyReservoirPositive : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-003";
         attribute :>> name = "EmptyReservoirConstPositive";
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
@@ -54,7 +56,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "assume CONST_IN.Empty_Reservoir > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
     }
-    part assumeValidPrescriptionSaved : AssumeProperty {
+    part assumeValidPrescriptionSaved : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-001";
         attribute :>> name = "ValidPrescriptionSavedBeforeTherapy";
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
@@ -64,7 +67,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
     }
 
     // ── Guarantees (GPCA_SW.aadl AGREE annex, 1:1) ──────────────
-    part guaranteeExclusiveMode : GuaranteeProperty {
+    part guaranteeExclusiveMode : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-001";
         attribute :>> name = "ModeRange";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -72,7 +76,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee mode_range: GPCA_SW_OUT.Current_System_Mode in {0, 1, 2, 3, 4, 6, 7, 8} (source enumeration omits 5)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 1)";
     }
-    part guaranteeOffMode : GuaranteeProperty {
+    part guaranteeOffMode : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-004";
         attribute :>> name = "NotStartImpliesModeZero";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -80,7 +85,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee not(OP_CMD_IN.System_Start) => GPCA_SW_OUT.Current_System_Mode = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
     }
-    part guaranteeInitialStart : GuaranteeProperty {
+    part guaranteeInitialStart : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-005";
         attribute :>> name = "InitialSystemStartImpliesModeOne";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -88,7 +94,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee sys_initial and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4 allocation: TLM System_Start -> System_On; IM System_On -> mode 1)";
     }
-    part guaranteeOffToOn : GuaranteeProperty {
+    part guaranteeOffToOn : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-006";
         attribute :>> name = "OffToOnImpliesModeOne";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -96,7 +103,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee not(sys_initial) and pre(GPCA_SW_OUT.Current_System_Mode) = 0 and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4)";
     }
-    part guaranteeEmptyReservoirNoFlow : GuaranteeProperty {
+    part guaranteeEmptyReservoirNoFlow : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-007";
         attribute :>> name = "EmptyReservoirImpliesNoFlow";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -104,7 +112,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Reservoir_Volume < CONST_IN.Empty_Reservoir) => GPCA_SW_OUT.Commanded_Flow_Rate = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 59 'Empty Reservoir')";
     }
-    part guaranteeVtbiKvo : GuaranteeProperty {
+    part guaranteeVtbiKvo : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-008";
         attribute :>> name = "OverVtbiImpliesFlowAtMostKvo";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -112,7 +121,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Volume_Infused > DB_IN.VTBI_High) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (over-infusion => keep-vein-open, not zero)";
     }
-    part guaranteeAirInLineKvo : GuaranteeProperty {
+    part guaranteeAirInLineKvo : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-009";
         attribute :>> name = "AirInLineImpliesFlowAtMostKvo";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -120,7 +130,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Air_In_Line) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 21 'Air embolism')";
     }
-    part guaranteeOcclusionKvo : GuaranteeProperty {
+    part guaranteeOcclusionKvo : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-010";
         attribute :>> name = "OcclusionImpliesFlowAtMostKvo";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -128,7 +139,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Occlusion) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
     }
-    part guaranteeDoorOpenKvo : GuaranteeProperty {
+    part guaranteeDoorOpenKvo : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-011";
         attribute :>> name = "DoorOpenImpliesFlowAtMostKvo";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -136,7 +148,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Door_Open) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
     }
-    part guaranteeAlarmStopsSameStep : GuaranteeProperty {
+    part guaranteeAlarmStopsSameStep : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-003";
         attribute :>> name = "SameStepAlarmKvoGuarantee";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
@@ -144,7 +157,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> formalExpression = "guarantee an infusion-inhibiting notification in a step implies Commanded_Flow_Rate <= Flow_Rate_KVO in the same step (ALARM_OUT -> IM.ALARM_IN is an immediate connection)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl (ALARM_to_IM immediate) with the flow <= KVO guarantees above";
     }
-    part guaranteeLockoutPreventsBolus : GuaranteeProperty {
+    part guaranteeLockoutPreventsBolus : BehaviorProperty {
+        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-002";
         attribute :>> name = "LockoutGuarantee";
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;