@memoarchitect/ontology 0.6.4 → 0.7.0

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_context {
+package memo_examples_gpca_pump_gpca_context {
     private import ScalarValues::*;
 
     private import memo_architecture_operational_context_actors::*;
@@ -13,7 +13,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> name = "GPCA_IntendedUse";
         attribute :>> title = "GPCA Pump Intended Use";
         attribute :>> shortDescription = "Patient-controlled analgesia infusion of prescribed opioid analgesics.";
-        attribute :>> longDescription = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
+        attribute :>> description = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
         attribute :>> indication = "Management of acute post-operative or chronic pain requiring titrated intravenous opioid analgesia.";
         attribute :>> contraindication = "Patients unable to comprehend or operate the bolus request mechanism; drugs without safe-value records in the hospital pharmacy database.";
         attribute :>> patientPopulation = "Adult in-patients under clinical supervision.";
@@ -26,7 +26,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> name = "BolusRequestBySomeoneOtherThanPatient";
         attribute :>> title = "Bolus by proxy";
         attribute :>> shortDescription = "A caregiver or visitor presses the patient bolus control.";
-        attribute :>> longDescription = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
+        attribute :>> description = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
         attribute :>> misuseContext = "Patient-controlled analgesia in a supervised hospital setting.";
         attribute :>> foreseeableBasis = "Known PCA use pattern represented in the GPCA hazard analysis.";
         attribute :>> affectedUseContext = "UC-001";
@@ -51,7 +51,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::patient;
         attribute :>> id = "ACT-001";
         attribute :>> name = "Patient";
-        attribute :>> actorKind = ActorKind::patient;
         attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
         attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
     }
@@ -59,7 +58,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-002";
         attribute :>> name = "ClinicianNurse";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
         attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
     }
@@ -67,7 +65,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-003";
         attribute :>> name = "PrescribingPhysician";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed prescriber";
         attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
     }
@@ -75,7 +72,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-004";
         attribute :>> name = "Pharmacist";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed pharmacist";
         attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
     }
@@ -83,7 +79,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::technician;
         attribute :>> id = "ACT-005";
         attribute :>> name = "BiomedicalTechnician";
-        attribute :>> actorKind = ActorKind::technician;
         attribute :>> trainingLevel = "service-trained; authenticated service access";
         attribute :>> description = "Performs maintenance, battery replacement, and calibration through the service interface.";
     }

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
+package memo_examples_gpca_pump_gpca_cybersecurity {
     private import ScalarValues::*;
 
     private import memo_assurance_cybersecurity::*;
@@ -7,10 +7,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
     private import memo_assurance_verification_validation::*;
     private import memo_core_enumerations::*;
     private import memo_core_relationships::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_risk::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_requirements::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_verification::*;
+    private import memo_examples_gpca_pump_gpca_architecture::*;
+    private import memo_examples_gpca_pump_gpca_risk::*;
+    private import memo_examples_gpca_pump_gpca_requirements::*;
+    private import memo_examples_gpca_pump_gpca_verification::*;
 
     part therapyConfigurationAsset : CybersecurityAsset {
         attribute :>> id = "AST-CYB-001";
@@ -78,7 +78,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
         attribute :>> cweReference = "CWE-798";
     }
 
-    part tamperedConfigurationScenario : ThreatScenario {
+    action tamperedConfigurationScenario : ThreatScenario {
         attribute :>> id = "SCN-001";
         attribute :>> name = "TamperedTherapyConfigurationScenario";
         attribute :>> description = "An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards.";

package/examples/gpca-pump/model/catalog/gpca_formal_behavior.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
+package memo_examples_gpca_pump_gpca_formal_behavior {
     private import ScalarValues::*;
 
     private import memo_architecture_functional_behavior::*;
@@ -42,7 +42,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-002";
         attribute :>> name = "VtbiHighPositive";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume DB_IN.VTBI_High > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -51,7 +50,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-003";
         attribute :>> name = "EmptyReservoirConstPositive";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume CONST_IN.Empty_Reservoir > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -60,7 +58,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-001";
         attribute :>> name = "ValidPrescriptionSavedBeforeTherapy";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume a saved prescription is available before infusion initiation";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.3.1 (REQ 7)";
@@ -71,7 +68,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-001";
         attribute :>> name = "ModeRange";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee mode_range: GPCA_SW_OUT.Current_System_Mode in {0, 1, 2, 3, 4, 6, 7, 8} (source enumeration omits 5)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 1)";
@@ -80,7 +76,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-004";
         attribute :>> name = "NotStartImpliesModeZero";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee not(OP_CMD_IN.System_Start) => GPCA_SW_OUT.Current_System_Mode = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -89,7 +84,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-005";
         attribute :>> name = "InitialSystemStartImpliesModeOne";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee sys_initial and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4 allocation: TLM System_Start -> System_On; IM System_On -> mode 1)";
@@ -98,7 +92,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-006";
         attribute :>> name = "OffToOnImpliesModeOne";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee not(sys_initial) and pre(GPCA_SW_OUT.Current_System_Mode) = 0 and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4)";
@@ -107,7 +100,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-007";
         attribute :>> name = "EmptyReservoirImpliesNoFlow";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Reservoir_Volume < CONST_IN.Empty_Reservoir) => GPCA_SW_OUT.Commanded_Flow_Rate = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 59 'Empty Reservoir')";
@@ -116,7 +108,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-008";
         attribute :>> name = "OverVtbiImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Volume_Infused > DB_IN.VTBI_High) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (over-infusion => keep-vein-open, not zero)";
@@ -125,7 +116,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-009";
         attribute :>> name = "AirInLineImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Air_In_Line) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 21 'Air embolism')";
@@ -134,7 +124,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-010";
         attribute :>> name = "OcclusionImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Occlusion) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -143,7 +132,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-011";
         attribute :>> name = "DoorOpenImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Door_Open) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -152,7 +140,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-003";
         attribute :>> name = "SameStepAlarmKvoGuarantee";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee an infusion-inhibiting notification in a step implies Commanded_Flow_Rate <= Flow_Rate_KVO in the same step (ALARM_OUT -> IM.ALARM_IN is an immediate connection)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl (ALARM_to_IM immediate) with the flow <= KVO guarantees above";
@@ -161,7 +148,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-002";
         attribute :>> name = "LockoutGuarantee";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee a BolusRequest_prog inside the LockOutPeriod_pbolus_prog window is ignored and no PATIENT BOLUS is initiated";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.6.1 (REQ 25.3, REQ 26)";

package/examples/gpca-pump/model/catalog/gpca_interfaces.sysml

@@ -1,10 +1,12 @@
-package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
+package memo_examples_gpca_pump_gpca_interfaces {
     private import ScalarValues::*;
 
     private import memo_architecture_logical_interfaces::*;
+    private import memo_architecture_realization_physical::*;
     private import memo_architecture_functional_functions::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems::*;
+    private import memo_core_common::*;
+    private import memo_examples_gpca_pump_gpca_architecture::*;
+    private import memo_examples_gpca_pump_gpca_behavior_subsystems::*;
     private import memo_core_enumerations::*;
     private import memo_core_dimensions::*;
     abstract interface def SensorDataInterface :> DataInterface {
@@ -12,7 +14,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         attribute :>> protocolSemantics = "flow, air, occlusion, door, battery, cpu, memory, pump state";
     }
     port def SensorInputPort :> SensorPort {
-        attribute :>> direction = DirectionKind::input;
+        in item sensorData : MemoExchangeItem;
         attribute :>> interfaceType = "SensorDataInterface";
         attribute :>> sensorDomain = "physiological and device state";
     }
@@ -53,7 +55,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         attribute :>> name = "HW_SW_DataBus";
         attribute :>> interfaceKind = InterfaceKind::digitalSignal;
         attribute :>> protocol = "immediate data port mapping";
-        attribute :>> directionality = DirectionKind::bidirectional;
+        attribute :>> directionality = DirectionKind::inputOutput;
         attribute :>> bandwidth = "implementation-defined";
         attribute :>> timingConstraint = "same execution step where required";
         attribute :>> electricalStandard = "logical/AADL";
@@ -149,7 +151,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         attribute :>> id = "SI-005";
         attribute :>> name = "HospitalPharmacyDatabaseInterface";
         attribute :>> interfaceKind = InterfaceKind::data;
-        attribute :>> direction = DirectionKind::bidirectional;
+        attribute :>> direction = DirectionKind::inputOutput;
         attribute :>> protocol = "CriSys I 9, I 10, I 11";
         attribute :>> protocolSemantics = "Retrieves the safe-value set (concentration, VTBI, flow rate, bolus interval/count, KVO rate) where DrugName_hd = DrugName_prog; resets to defaults when no record matches";
         attribute :>> interactionPattern = "query/response safe-value lookup";
@@ -572,7 +574,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §3.5 Hospital Pharmacy Database Interface";
     }
 
-    // ── Device-boundary exchanges (GPCA_Device.aadl level) ─────
+    // ── MEMO functional-to-physical allocation abstractions ────
+    // These four exchanges summarize requirements-derived physical design
+    // intent. They are not the named port connections in GPCA_Device.aadl;
+    // the exact AADL feature topology is authored below and in gpca_trace.
     part exSensorVector : ComponentExchange {
         attribute :>> id = "CE-001";
         attribute :>> name = "SensorStatusVectorExchange";
@@ -584,7 +589,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         ref :>> allocatedExchanges = lfSensorAcquisition;
         attribute :>> direction = DirectionKind::input;
         attribute :>> timingSemantics = "immediate (same-step delivery, Communication_Properties::Timing => immediate)";
-        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, packages/GPCA_Device.aadl";
+        attribute :>> sourceReference = "MEMO design extension allocated from LF-001; not a GPCA_Device.aadl connection";
     }
     part exFlowCommand : ComponentExchange {
         attribute :>> id = "CE-002";
@@ -597,7 +602,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         ref :>> allocatedExchanges = lfFlowCommand;
         attribute :>> direction = DirectionKind::output;
         attribute :>> timingSemantics = "immediate (same-step delivery, Communication_Properties::Timing => immediate)";
-        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, packages/GPCA_Device.aadl";
+        attribute :>> sourceReference = "MEMO design extension allocated from LF-002; not a GPCA_Device.aadl connection";
     }
     part exAlarmAnnunciation : ComponentExchange {
         attribute :>> id = "CE-003";
@@ -610,7 +615,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         ref :>> allocatedExchanges = lfAlarmSignal;
         attribute :>> direction = DirectionKind::output;
         attribute :>> timingSemantics = "immediate (same-step delivery, Communication_Properties::Timing => immediate)";
-        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, packages/GPCA_Device.aadl";
+        attribute :>> sourceReference = "MEMO design extension allocated from LF-003; not a GPCA_Device.aadl connection";
     }
     part exPrescriptionEntry : ComponentExchange {
         attribute :>> id = "CE-004";
@@ -623,9 +628,34 @@ package memo_examples_gpca_pump_model_catalog_gpca_interfaces {
         ref :>> allocatedExchanges = lfPrescriptionEntry;
         attribute :>> direction = DirectionKind::input;
         attribute :>> timingSemantics = "immediate (same-step delivery, Communication_Properties::Timing => immediate)";
-        attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, packages/GPCA_Device.aadl";
+        attribute :>> sourceReference = "MEMO design extension allocated from LF-004; not a GPCA_Device.aadl connection";
     }
 
+    // ── GPCA_Device and hardware-subsystem ports (AADL, 1:1) ───
+    // The published AADL hardware packages are interface wrappers: they do
+    // not decompose into the individual physical parts modelled elsewhere in
+    // this MEMO example. These features and their connections are therefore
+    // kept exact and separate from that extended physical design content.
+    part devOpCmdIn : PhysicalPort { attribute :>> id = "PORT-DEV-01"; attribute :>> name = "OP_CMD_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_Device.aadl"; }
+    part devDbIn : PhysicalPort { attribute :>> id = "PORT-DEV-02"; attribute :>> name = "DB_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_Device.aadl"; }
+    part devPresIn : PhysicalPort { attribute :>> id = "PORT-DEV-03"; attribute :>> name = "PRES_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_Device.aadl"; }
+    part devPatientIn : PhysicalPort { attribute :>> id = "PORT-DEV-04"; attribute :>> name = "PATIENT_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_Device.aadl"; }
+    part devGpcaOut : PhysicalPort { attribute :>> id = "PORT-DEV-05"; attribute :>> name = "GPCA_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_Device.aadl"; }
+
+    part snsOpCmdIn : PhysicalPort { attribute :>> id = "PORT-SNS-01"; attribute :>> name = "OP_CMD_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsDbIn : PhysicalPort { attribute :>> id = "PORT-SNS-02"; attribute :>> name = "DB_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsPresIn : PhysicalPort { attribute :>> id = "PORT-SNS-03"; attribute :>> name = "PRES_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsPatientIn : PhysicalPort { attribute :>> id = "PORT-SNS-04"; attribute :>> name = "PATIENT_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsOpCmdOut : PhysicalPort { attribute :>> id = "PORT-SNS-05"; attribute :>> name = "OP_CMD_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsPresOut : PhysicalPort { attribute :>> id = "PORT-SNS-06"; attribute :>> name = "PRES_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsPatientOut : PhysicalPort { attribute :>> id = "PORT-SNS-07"; attribute :>> name = "PATIENT_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsSensorOut : PhysicalPort { attribute :>> id = "PORT-SNS-08"; attribute :>> name = "SENSOR_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsConstOut : PhysicalPort { attribute :>> id = "PORT-SNS-09"; attribute :>> name = "CONST_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+    part snsDbOut : PhysicalPort { attribute :>> id = "PORT-SNS-10"; attribute :>> name = "DB_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Sensors.aadl"; }
+
+    part actGpcaSwIn : PhysicalPort { attribute :>> id = "PORT-ACT-01"; attribute :>> name = "GPCA_SW_IN"; attribute :>> direction = DirectionKind::input; attribute :>> sourceReference = "CITE-002: GPCA_HW_Actuators.aadl"; }
+    part actGpcaOut : PhysicalPort { attribute :>> id = "PORT-ACT-02"; attribute :>> name = "GPCA_OUT"; attribute :>> direction = DirectionKind::output; attribute :>> sourceReference = "CITE-002: GPCA_HW_Actuators.aadl"; }
+
     // ── GPCA_SW top-level ports (AADL GPCA_SW.aadl features) ────
     part portOpCmdIn : SoftwarePort {
         attribute :>> id = "PORT-01"; attribute :>> name = "OP_CMD_IN";

package/examples/gpca-pump/model/catalog/gpca_operational.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_operational {
+package memo_examples_gpca_pump_gpca_operational {
     private import ScalarValues::*;
 
     private import memo_architecture_operational_structure::*;
@@ -7,7 +7,8 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
     private import memo_architecture_operational_use_cases::*;
     private import memo_architecture_operational_workflows::*;
     private import memo_core_enumerations::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_context::*;
+    private import memo_examples_gpca_pump_gpca_context::*;
+    private import memo_core_relationships::*;
 
     // ── Operational entities beyond the human actors ────────────
     part entityPharmacy : OperationalEntity {
@@ -234,7 +235,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
     }
 
     // ── Operational scenarios ───────────────────────────────────
-    part osNominalTherapy : OperativeScenario {
+    action osNominalTherapy : OperativeScenario {
         attribute :>> id = "OS-001";
         attribute :>> name = "NominalTherapySession";
         attribute :>> variantKind = ScenarioVariantKind::nominal;
@@ -247,10 +248,11 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         ref :>> parentUseCase = ucDeliverPcaTherapy;
         ref :>> activities = oaCompleteNominalTherapy;
     }
-    part osLockoutBolus : OperativeScenario {
+    action osLockoutBolus : OperativeScenario {
         attribute :>> id = "OS-002";
         attribute :>> name = "BolusRequestDuringLockout";
         attribute :>> variantKind = ScenarioVariantKind::alternate;
+        attribute :>> variationPoint = "patient bolus request during the nominal therapy lockout interval";
         attribute :>> operationalCondition = OperationalConditionKind::foreseeableMisuse;
         attribute :>> preCondition = "basal infusion active; lockout interval running";
         attribute :>> postCondition = "request ignored, logged; basal continues unchanged";
@@ -258,12 +260,14 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.9 PATIENT BOLUS mode (lockout requirements)";
         ref :>> parentWorkflow = wfManageActiveTherapy;
         ref :>> parentUseCase = ucDeliverPcaTherapy;
+        ref :>> baseScenario = osNominalTherapy;
         ref :>> activities = oaRejectBolusDuringLockout;
     }
-    part osOcclusionAlarm : OperativeScenario {
+    action osOcclusionAlarm : OperativeScenario {
         attribute :>> id = "OS-003";
         attribute :>> name = "OcclusionDetectedDuringInfusion";
         attribute :>> variantKind = ScenarioVariantKind::exception;
+        attribute :>> variationPoint = "occlusion detected while nominal infusion is active";
         attribute :>> operationalCondition = OperationalConditionKind::degraded;
         attribute :>> preCondition = "therapy active; downstream line becomes blocked";
         attribute :>> postCondition = "infusion paused, alarm annunciated, clinician clears occlusion and resumes";
@@ -271,12 +275,14 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         attribute :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.2 Alarms and Alerts (occlusion)";
         ref :>> parentWorkflow = wfRespondToTherapyAlarm;
         ref :>> parentUseCase = ucDeliverPcaTherapy;
+        ref :>> baseScenario = osNominalTherapy;
         ref :>> activities = oaRespondToOcclusion;
     }
-    part osAirInLine : OperativeScenario {
+    action osAirInLine : OperativeScenario {
         attribute :>> id = "OS-004";
         attribute :>> name = "AirInLineDetected";
         attribute :>> variantKind = ScenarioVariantKind::exception;
+        attribute :>> variationPoint = "air-in-line detected while nominal infusion is active";
         attribute :>> operationalCondition = OperationalConditionKind::degraded;
         attribute :>> preCondition = "therapy active; air bubble enters tubing";
         attribute :>> postCondition = "infusion stopped before air reaches patient; alarm annunciated";
@@ -284,12 +290,14 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.3 Notification Requirements (REQ 59: Air embolism)";
         ref :>> parentWorkflow = wfRespondToTherapyAlarm;
         ref :>> parentUseCase = ucDeliverPcaTherapy;
+        ref :>> baseScenario = osNominalTherapy;
         ref :>> activities = oaRespondToAirInLine;
     }
-    part osEmptyReservoir : OperativeScenario {
+    action osEmptyReservoir : OperativeScenario {
         attribute :>> id = "OS-005";
         attribute :>> name = "ReservoirEmptyDuringTherapy";
         attribute :>> variantKind = ScenarioVariantKind::exception;
+        attribute :>> variationPoint = "reservoir-empty threshold reached during nominal therapy";
         attribute :>> operationalCondition = OperationalConditionKind::degraded;
         attribute :>> preCondition = "therapy active; reservoir volume reaches empty threshold";
         attribute :>> postCondition = "infusion stopped, alarm raised, reservoir replaced";
@@ -297,12 +305,14 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.3 Notification Requirements (REQ 59: Empty Reservoir)";
         ref :>> parentWorkflow = wfRespondToTherapyAlarm;
         ref :>> parentUseCase = ucDeliverPcaTherapy;
+        ref :>> baseScenario = osNominalTherapy;
         ref :>> activities = oaReplaceEmptyReservoir;
     }
-    part osPowerLoss : OperativeScenario {
+    action osPowerLoss : OperativeScenario {
         attribute :>> id = "OS-006";
         attribute :>> name = "MainsPowerLossAndRecovery";
         attribute :>> variantKind = ScenarioVariantKind::recovery;
+        attribute :>> variationPoint = "mains supply lost during nominal therapy";
         attribute :>> operationalCondition = OperationalConditionKind::degraded;
         attribute :>> preCondition = "therapy active on mains power";
         attribute :>> postCondition = "therapy continues on battery; prescription preserved across full power loss";
@@ -310,6 +320,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_operational {
         attribute :>> sourceReference = "CITE-004: GIP Hazard Analysis v1.0 (2009), §2.4.3 Electrical Hazards (battery failure)";
         ref :>> parentWorkflow = wfRespondToTherapyAlarm;
         ref :>> parentUseCase = ucDeliverPcaTherapy;
+        ref :>> baseScenario = osNominalTherapy;
         ref :>> activities = oaRecoverAfterPowerLoss;
     }
     connection : Realizes connect realizing ::> osNominalTherapy to realized ::> ucDeliverPcaTherapy;

package/examples/gpca-pump/model/catalog/gpca_physical.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_physical {
+package memo_examples_gpca_pump_gpca_physical {
     private import ScalarValues::*;
 
     private import memo_architecture_realization_physical::*;
@@ -41,7 +41,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_physical {
         attribute :>> name = "ServiceMaintenancePort";
         attribute :>> portKind = InterfaceKind::api;
         attribute :>> connectorType = "covered UART/USB service connector";
-        attribute :>> direction = DirectionKind::bidirectional;
+        attribute :>> direction = DirectionKind::inputOutput;
     }
     part portMainsInlet : PhysicalPort {
         attribute :>> id = "PP-005";

package/examples/gpca-pump/model/catalog/gpca_requirements.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_requirements {
+package memo_examples_gpca_pump_gpca_requirements {
     private import ScalarValues::*;
 
     private import memo_assurance_requirements::*;

package/examples/gpca-pump/model/catalog/gpca_risk.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_risk {
+package memo_examples_gpca_pump_gpca_risk {
     private import ScalarValues::*;
 
     private import memo_assurance_safety_risk::*;
@@ -71,6 +71,15 @@ package memo_examples_gpca_pump_model_catalog_gpca_risk {
         attribute :>> year = "2009";
     }
 
+    part citeCriSysSoftwareBehavior : Citation {
+        attribute :>> id = "CITE-009";
+        attribute :>> name = "CriSysGpcaSoftwareBehaviorModel";
+        attribute :>> source = "PCA Pump Software Model (Simulink/Stateflow) — University of Minnesota CriSys";
+        attribute :>> section = "Infusion Pump Software Model Stateflow chart";
+        attribute :>> uri = "https://crisys.cs.umn.edu/downloads/gpca/PCA_Pump_SoftwareModel.mdl";
+        attribute :>> year = "undated";
+    }
+
     // ── Shared risk matrix ───────────────────────────────────────────
     part riskMatrix : RiskMatrix {
         attribute :>> id = "RMX-001";

package/examples/gpca-pump/model/catalog/gpca_system.sysml

@@ -1,10 +1,13 @@
-package memo_examples_gpca_pump_model_catalog_gpca_system {
+package memo_examples_gpca_pump_gpca_system {
     private import ScalarValues::*;
 
     private import memo_architecture_functional_functions::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems::*;
+    private import memo_examples_gpca_pump_gpca_behavior_subsystems::*;
     private import memo_architecture_operational_scenarios::*;
     private import memo_core_enumerations::*;
+    private import memo_architecture_operational_structure::*;
+    private import memo_architecture_operational_use_cases::*;
+    private import memo_core_common::*;
 
     part gpcaMission : Mission {
         attribute :>> id = "MSN-001";
@@ -21,68 +24,69 @@ package memo_examples_gpca_pump_model_catalog_gpca_system {
         attribute :>> id = "FC-001";
         attribute :>> name = "PatientBolusChain";
         attribute :>> flowCategory = FunctionalFlowKind::nominal;
-        ref :>> startFunction = fnAcquireSensors;
-        ref :>> endFunction = fnCommandPump;
         attribute :>> endToEndLatencyBudgetMs = "100";
         attribute :>> safetyRelevant = true;
         attribute :>> securityRelevant = false;
         attribute :>> description = "Bolus button press through lockout/max-dose check to pump actuation and logging.";
     }
-    part fcsBolusSense : FunctionalFlowStep {
+    action fcsBolusSense : FunctionalFlowStep {
         attribute :>> id = "FCS-001"; attribute :>> name = "SenseBolusRequest";
-        attribute :>> stepOrder = "1"; ref :>> function = fnAcquireSensors; ref :>> exchangedItem = ddBolusRequest;
+        ref :>> function = fnAcquireSensors; ref :>> exchangedItem = ddBolusRequest;
     }
-    part fcsBolusValidate : FunctionalFlowStep {
+    action fcsBolusValidate : FunctionalFlowStep {
         attribute :>> id = "FCS-002"; attribute :>> name = "CheckLockoutAndMaxDose";
-        attribute :>> stepOrder = "2"; ref :>> function = fnEnforceLimits; ref :>> exchangedItem = ddPrescription;
+        ref :>> function = fnEnforceLimits; ref :>> exchangedItem = ddPrescription;
     }
-    part fcsBolusCommand : FunctionalFlowStep {
+    action fcsBolusCommand : FunctionalFlowStep {
         attribute :>> id = "FCS-003"; attribute :>> name = "CommandBolusFlow";
-        attribute :>> stepOrder = "3"; ref :>> function = fnManageInfusion; ref :>> exchangedItem = cdFlowCommand;
+        ref :>> function = fnManageInfusion; ref :>> exchangedItem = cdFlowCommand;
     }
-    part fcsBolusActuate : FunctionalFlowStep {
+    action fcsBolusActuate : FunctionalFlowStep {
         attribute :>> id = "FCS-004"; attribute :>> name = "ActuatePumpMotor";
-        attribute :>> stepOrder = "4"; ref :>> function = fnCommandPump; ref :>> exchangedItem = cdFlowCommand;
+        ref :>> function = fnCommandPump; ref :>> exchangedItem = cdFlowCommand;
     }
-    part fcsBolusLog : FunctionalFlowStep {
+    action fcsBolusLog : FunctionalFlowStep {
         attribute :>> id = "FCS-005"; attribute :>> name = "LogBolusOutcome";
-        attribute :>> stepOrder = "5"; ref :>> function = fnLogEvents; ref :>> exchangedItem = ddEventRecord;
+        ref :>> function = fnLogEvents; ref :>> exchangedItem = ddEventRecord;
     }
+    first fcsBolusSense then fcsBolusValidate;
+    first fcsBolusValidate then fcsBolusCommand;
+    first fcsBolusCommand then fcsBolusActuate;
+    first fcsBolusActuate then fcsBolusLog;
 
     part fcAlarmStop : FunctionalFlow {
         attribute :>> id = "FC-002";
         attribute :>> name = "AlarmDetectionToSafeStateChain";
         attribute :>> flowCategory = FunctionalFlowKind::alarm;
-        ref :>> startFunction = fnAcquireSensors;
-        ref :>> endFunction = fnAnnunciate;
         attribute :>> endToEndLatencyBudgetMs = "20";
         attribute :>> safetyRelevant = true;
         attribute :>> securityRelevant = false;
         attribute :>> description = "Sensor condition through alarm evaluation to same-step transition to PAUSED (KVO flow, REQ 43) and annunciation.";
     }
-    part fcsAlarmSense : FunctionalFlowStep {
+    action fcsAlarmSense : FunctionalFlowStep {
         attribute :>> id = "FCS-006"; attribute :>> name = "SenseAlarmCondition";
-        attribute :>> stepOrder = "1"; ref :>> function = fnAcquireSensors; ref :>> exchangedItem = ddSensorVector;
+        ref :>> function = fnAcquireSensors; ref :>> exchangedItem = ddSensorVector;
     }
-    part fcsAlarmEvaluate : FunctionalFlowStep {
+    action fcsAlarmEvaluate : FunctionalFlowStep {
         attribute :>> id = "FCS-007"; attribute :>> name = "EvaluateAlarmCondition";
-        attribute :>> stepOrder = "2"; ref :>> function = fnMonitorAlarm; ref :>> exchangedItem = ddSensorVector;
+        ref :>> function = fnMonitorAlarm; ref :>> exchangedItem = ddSensorVector;
     }
-    part fcsAlarmStopInfusion : FunctionalFlowStep {
+    action fcsAlarmStopInfusion : FunctionalFlowStep {
         attribute :>> id = "FCS-008"; attribute :>> name = "LimitFlowToKvoSameStep";
-        attribute :>> stepOrder = "3"; ref :>> function = fnManageInfusion; ref :>> exchangedItem = cdAlarmSignal;
+        ref :>> function = fnManageInfusion; ref :>> exchangedItem = cdAlarmSignal;
     }
-    part fcsAlarmAnnunciate : FunctionalFlowStep {
+    action fcsAlarmAnnunciate : FunctionalFlowStep {
         attribute :>> id = "FCS-009"; attribute :>> name = "AnnunciateAudibleVisual";
-        attribute :>> stepOrder = "4"; ref :>> function = fnAnnunciate; ref :>> exchangedItem = cdAlarmSignal;
+        ref :>> function = fnAnnunciate; ref :>> exchangedItem = cdAlarmSignal;
     }
+    first fcsAlarmSense then fcsAlarmEvaluate;
+    first fcsAlarmEvaluate then fcsAlarmStopInfusion;
+    first fcsAlarmStopInfusion then fcsAlarmAnnunciate;
 
     part fcStartup : FunctionalFlow {
         attribute :>> id = "FC-003";
         attribute :>> name = "PowerOnSelfTestChain";
         attribute :>> flowCategory = FunctionalFlowKind::startup;
-        ref :>> startFunction = fnManagePower;
-        ref :>> endFunction = fnPresentStatus;
         attribute :>> endToEndLatencyBudgetMs = "5000";
         attribute :>> safetyRelevant = true;
         attribute :>> securityRelevant = false;
@@ -90,22 +94,22 @@ package memo_examples_gpca_pump_model_catalog_gpca_system {
     }
 
     // ── System scenarios ────────────────────────────────────────
-    part ssBolusDuringBasal : FunctionalScenario {
+    action ssBolusDuringBasal : FunctionalScenario {
         attribute :>> id = "SS-001";
         attribute :>> name = "PatientBolusDuringBasal";
         attribute :>> variantKind = ScenarioVariantKind::nominal;
         attribute :>> operationalCondition = OperationalConditionKind::normal;
-        attribute :>> sequenceDiagramRef = "VIEW-BHV-002";
         attribute :>> preCondition = "BASAL mode active; no REQ 25 ignore condition holds";
         attribute :>> postCondition = "PATIENT_BOLUS mode entered, bolus delivered, return to BASAL";
     }
-    part ssAlarmPause : FunctionalScenario {
+    action ssAlarmPause : FunctionalScenario {
         attribute :>> id = "SS-002";
         attribute :>> name = "InhibitingNotificationPausesInfusion";
         attribute :>> variantKind = ScenarioVariantKind::exception;
+        attribute :>> variationPoint = "an infusion-inhibiting notification interrupts active therapy";
         attribute :>> operationalCondition = OperationalConditionKind::degraded;
-        attribute :>> sequenceDiagramRef = "VIEW-BHV-002";
         attribute :>> preCondition = "any ACTIVE therapy mode; infusion-inhibiting notification detected (REQ 59)";
         attribute :>> postCondition = "PAUSED mode entered in same execution step at FlowRate_kvo_hd keep-vein-open flow; notification annunciated per REQ 59";
+        ref :>> baseScenario = ssBolusDuringBasal;
     }
 }