@memoarchitect/ontology 0.6.5 → 0.8.22

package/examples/gpca-pump/model/catalog/gpca_behavior_subsystems.sysml

@@ -1,11 +1,15 @@
-package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
+package memo_examples_gpca_pump_gpca_behavior_subsystems {
     private import ScalarValues::*;
 
     private import memo_architecture_functional_functions::*;
     private import memo_core_enumerations::*;
+    private import memo_architecture_logical_interfaces::*;
+    private import memo_architecture_operational_use_cases::*;
+    private import memo_assurance_requirements::*;
+    private import memo_core_common::*;
 
     // ── Logical functions ───────────────────────────────────────
-    part fnAcquireSensors : SystemFunction {
+    action fnAcquireSensors : SystemFunction {
         attribute :>> id = "FUNC-001";
         attribute :>> name = "AcquireSensorData";
         attribute :>> functionCategory = "sensing";
@@ -13,8 +17,49 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> outputSummary = "Debounced, range-checked sensor status vector";
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
+
+        // ── Component functions decomposing FUNC-001 ─────────────
+        // The functional chain does not stop at the system boundary.
+        // "Acquire sensor data" is a system responsibility; measuring a flow
+        // rate is the flowmeter's, and aggregating the status vector is the
+        // sensor subassembly's. Each names its component through
+        // AllocatedTo (see gpca_behavior_actions), which CR-ONT-074
+        // requires — a component function allocated nowhere is a
+        // responsibility nobody has accepted.
+        action cfnMeasureFlowRate : ComponentFunction {
+            attribute :>> id = "CFUN-001";
+            attribute :>> name = "MeasureFlowRate";
+            attribute :>> functionCategory = "sensing";
+            attribute :>> actionKind = ActionKind::sense;
+            attribute :>> trigger = "continuous, sampled every 20 ms execution step";
+            attribute :>> outputSummary = "Measured delivered flow rate in mL/h, with a validity flag";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
+        action cfnDetectAirInLine : ComponentFunction {
+            attribute :>> id = "CFUN-002";
+            attribute :>> name = "DetectAirInLine";
+            attribute :>> functionCategory = "protection";
+            attribute :>> actionKind = ActionKind::sense;
+            attribute :>> trigger = "continuous, sampled every 20 ms execution step";
+            attribute :>> outputSummary = "Air-in-line present or absent, with accumulated bolus volume";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
+        // The subassembly case: a component function need not sit on a leaf part.
+        action cfnAggregateSensorStatus : ComponentFunction {
+            attribute :>> id = "CFUN-003";
+            attribute :>> name = "AggregateSensorStatus";
+            attribute :>> functionCategory = "sensing";
+            attribute :>> actionKind = ActionKind::transform;
+            attribute :>> trigger = "every 20 ms execution step";
+            attribute :>> outputSummary = "Debounced, range-checked sensor status vector for the controller";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
     }
-    part fnValidatePrescription : SystemFunction {
+
+    action fnValidatePrescription : SystemFunction {
         attribute :>> id = "FUNC-002";
         attribute :>> name = "ValidatePrescription";
         attribute :>> functionCategory = "configuration";
@@ -23,7 +68,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnMonitorAlarm : SystemFunction {
+    action fnMonitorAlarm : SystemFunction {
         attribute :>> id = "FUNC-003";
         attribute :>> name = "MonitorExceptionalConditions";
         attribute :>> functionCategory = "alarm";
@@ -32,7 +77,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnAnnunciate : SystemFunction {
+    action fnAnnunciate : SystemFunction {
         attribute :>> id = "FUNC-004";
         attribute :>> name = "AnnunciateAlarms";
         attribute :>> functionCategory = "alarm";
@@ -41,7 +86,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnManageInfusion : SystemFunction {
+    action fnManageInfusion : SystemFunction {
         attribute :>> id = "FUNC-005";
         attribute :>> name = "ManageInfusion";
         attribute :>> functionCategory = "infusion";
@@ -50,7 +95,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnEnforceLimits : SystemFunction {
+    action fnEnforceLimits : SystemFunction {
         attribute :>> id = "FUNC-006";
         attribute :>> name = "EnforceDoseLimits";
         attribute :>> functionCategory = "infusion";
@@ -59,7 +104,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnCommandPump : SystemFunction {
+    action fnCommandPump : SystemFunction {
         attribute :>> id = "FUNC-007";
         attribute :>> name = "CommandPumpMotor";
         attribute :>> functionCategory = "actuation";
@@ -68,7 +113,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnLogEvents : SystemFunction {
+    action fnLogEvents : SystemFunction {
         attribute :>> id = "FUNC-008";
         attribute :>> name = "LogTherapyEvents";
         attribute :>> functionCategory = "logging";
@@ -77,7 +122,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::regulatory;
         attribute :>> criticality = CriticalityKind::medium;
     }
-    part fnManagePower : SystemFunction {
+    action fnManagePower : SystemFunction {
         attribute :>> id = "FUNC-009";
         attribute :>> name = "ManagePower";
         attribute :>> functionCategory = "platform";
@@ -86,7 +131,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::reliability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnPresentStatus : SystemFunction {
+    action fnPresentStatus : SystemFunction {
         attribute :>> id = "FUNC-010";
         attribute :>> name = "PresentStatus";
         attribute :>> functionCategory = "user-interface";
@@ -95,7 +140,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::usability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnSelfTest : SystemFunction {
+    action fnSelfTest : SystemFunction {
         attribute :>> id = "FUNC-011";
         attribute :>> name = "ExecuteSelfTest";
         attribute :>> functionCategory = "platform";
@@ -110,7 +155,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> id = "LF-001";
         attribute :>> name = "SensorAcquisitionFlow";
         attribute :>> flowKind = FlowKind::measurement;
-        attribute :>> direction = DirectionKind::input;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 40.0;
         attribute :>> integrityLevel = "class C data path";
@@ -121,7 +165,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> id = "LF-002";
         attribute :>> name = "FlowCommandFlow";
         attribute :>> flowKind = FlowKind::command;
-        attribute :>> direction = DirectionKind::output;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C command path";
@@ -132,7 +175,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> id = "LF-003";
         attribute :>> name = "AlarmSignalFlow";
         attribute :>> flowKind = FlowKind::alarm;
-        attribute :>> direction = DirectionKind::output;
         attribute :>> latencyBudgetMs = 20.0;
         attribute :>> staleAfterMs = 20.0;
         attribute :>> integrityLevel = "class C alarm path; same-step delivery to infusion manager";
@@ -143,7 +185,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_behavior_subsystems {
         attribute :>> id = "LF-004";
         attribute :>> name = "PrescriptionEntryFlow";
         attribute :>> flowKind = FlowKind::configuration;
-        attribute :>> direction = DirectionKind::input;
         attribute :>> latencyBudgetMs = 500.0;
         attribute :>> staleAfterMs = 0.0;
         attribute :>> integrityLevel = "confirmed double-entry path";

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_context {
+package memo_examples_gpca_pump_gpca_context {
     private import ScalarValues::*;
 
     private import memo_architecture_operational_context_actors::*;
@@ -6,6 +6,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
     private import memo_assurance_requirements::*;
     private import memo_assurance_human_factors::*;
     private import memo_core_enumerations::*;
+    private import memo_examples_gpca_pump_gpca_operational::*;
 
     // ── Intended use (ISO 14971 §5.2, IEC 62366-1) ──────────────
     part gpcaIntendedUse : IntendedUse {
@@ -13,7 +14,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> name = "GPCA_IntendedUse";
         attribute :>> title = "GPCA Pump Intended Use";
         attribute :>> shortDescription = "Patient-controlled analgesia infusion of prescribed opioid analgesics.";
-        attribute :>> longDescription = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
+        attribute :>> description = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
         attribute :>> indication = "Management of acute post-operative or chronic pain requiring titrated intravenous opioid analgesia.";
         attribute :>> contraindication = "Patients unable to comprehend or operate the bolus request mechanism; drugs without safe-value records in the hospital pharmacy database.";
         attribute :>> patientPopulation = "Adult in-patients under clinical supervision.";
@@ -26,7 +27,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> name = "BolusRequestBySomeoneOtherThanPatient";
         attribute :>> title = "Bolus by proxy";
         attribute :>> shortDescription = "A caregiver or visitor presses the patient bolus control.";
-        attribute :>> longDescription = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
+        attribute :>> description = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
         attribute :>> misuseContext = "Patient-controlled analgesia in a supervised hospital setting.";
         attribute :>> foreseeableBasis = "Known PCA use pattern represented in the GPCA hazard analysis.";
         attribute :>> affectedUseContext = "UC-001";
@@ -51,41 +52,44 @@ package memo_examples_gpca_pump_model_catalog_gpca_context {
         attribute :>> actorKind = ActorKind::patient;
         attribute :>> id = "ACT-001";
         attribute :>> name = "Patient";
-        attribute :>> actorKind = ActorKind::patient;
         attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
         attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
+        perform oaRequestBolus;
     }
     part actorNurse : User {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-002";
         attribute :>> name = "ClinicianNurse";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
         attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
+        perform oaProgram;
+        perform oaStartTherapy;
+        perform oaRespondAlarm;
+        perform oaReviewLog;
     }
     part actorPrescriber : User {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-003";
         attribute :>> name = "PrescribingPhysician";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed prescriber";
         attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
+        perform oaPrescribe;
     }
     part actorPharmacist : User {
         attribute :>> actorKind = ActorKind::clinician;
         attribute :>> id = "ACT-004";
         attribute :>> name = "Pharmacist";
-        attribute :>> actorKind = ActorKind::clinician;
         attribute :>> trainingLevel = "licensed pharmacist";
         attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
+        perform oaLoadReservoir;
     }
     part actorTechnician : User {
         attribute :>> actorKind = ActorKind::technician;
         attribute :>> id = "ACT-005";
         attribute :>> name = "BiomedicalTechnician";
-        attribute :>> actorKind = ActorKind::technician;
         attribute :>> trainingLevel = "service-trained; authenticated service access";
         attribute :>> description = "Performs maintenance, battery replacement, and calibration through the service interface.";
+        perform oaMaintain;
     }
 
     // ── Foreseeable use errors (IEC 62366-1, AAMI TIR PCA) ──────

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -1,16 +1,19 @@
-package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
+package memo_examples_gpca_pump_gpca_cybersecurity {
     private import ScalarValues::*;
+    private import memo_core_dimensions::*;   // ElementStatusKind
 
     private import memo_assurance_cybersecurity::*;
     private import memo_assurance_requirements::*;
     private import memo_assurance_safety_risk::*;
     private import memo_assurance_verification_validation::*;
     private import memo_core_enumerations::*;
+    private import memo_core_common::*;
+    private import memo_architecture_operational_scenarios::*;
     private import memo_core_relationships::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_architecture::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_risk::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_requirements::*;
-    private import memo_examples_gpca_pump_model_catalog_gpca_verification::*;
+    private import memo_examples_gpca_pump_gpca_architecture::*;
+    private import memo_examples_gpca_pump_gpca_risk::*;
+    private import memo_examples_gpca_pump_gpca_requirements::*;
+    private import memo_examples_gpca_pump_gpca_verification::*;
 
     part therapyConfigurationAsset : CybersecurityAsset {
         attribute :>> id = "AST-CYB-001";
@@ -78,9 +81,10 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
         attribute :>> cweReference = "CWE-798";
     }
 
-    part tamperedConfigurationScenario : ThreatScenario {
+    action tamperedConfigurationScenario : MemoScenario {
         attribute :>> id = "SCN-001";
         attribute :>> name = "TamperedTherapyConfigurationScenario";
+        attribute :>> scenarioKind = ScenarioKind::threat;
         attribute :>> description = "An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards.";
         attribute :>> actorDescription = "unauthorized actor with local access to the maintenance port";
         attribute :>> defaultCategory = ThreatCategoryKind::tampering;
@@ -128,7 +132,7 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
         attribute :>> statement = "The system shall require authenticated and authorized service access before any therapy configuration parameter can be modified.";
         attribute :>> sourceKind = RequirementSourceKind::risk;
         attribute :>> concernKind = ConcernKind::cybersecurity;
-        attribute :>> requirementStatus = RequirementStatusKind::approved;
+        attribute :>> status = ElementStatusKind::approved;
         attribute :>> acceptanceCriteria = "Unauthenticated or unauthorized attempts to modify therapy configuration are rejected and logged.";
         attribute :>> subjectDescription = "maintenance and configuration path";
         attribute :>> actorDescription = "service personnel";
@@ -145,7 +149,9 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
         attribute :>> name = "VerifyAuthenticatedServiceAccess";
         attribute :>> methodKind = VerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Only authenticated and authorized service sessions may modify therapy configuration; all attempts are logged.";
-        attribute :>> status = "planned";
+        attribute :>> status = ElementStatusKind::approved;
+
+        objective { verify reqAuthenticatedServiceAccess; }
     }
 
     connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to realizedThreat ::> unauthorizedConfigChangeThreat;
@@ -166,7 +172,5 @@ package memo_examples_gpca_pump_model_catalog_gpca_cybersecurity {
 
     connection : CrossesTrustBoundary connect boundary ::> maintenancePortBoundary to crossingItem ::> therapyConfigurationAsset;
 
-    connection : VerifiedBy connect verificationTarget ::> reqAuthenticatedServiceAccess to verificationCase ::> vcAuthenticatedServiceAccess;
-
     connection : ProducesEvidence connect producer ::> vcAuthenticatedServiceAccess to producedEvidence ::> evidenceLockout;
 }

package/examples/gpca-pump/model/catalog/gpca_formal_behavior.sysml

@@ -1,4 +1,4 @@
-package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
+package memo_examples_gpca_pump_gpca_formal_behavior {
     private import ScalarValues::*;
 
     private import memo_architecture_functional_behavior::*;
@@ -42,7 +42,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-002";
         attribute :>> name = "VtbiHighPositive";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume DB_IN.VTBI_High > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -51,7 +50,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-003";
         attribute :>> name = "EmptyReservoirConstPositive";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume CONST_IN.Empty_Reservoir > 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -60,7 +58,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> id = "AP-001";
         attribute :>> name = "ValidPrescriptionSavedBeforeTherapy";
-        attribute :>> propertyKind = BehaviorPropertyKind::assumption;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "assume a saved prescription is available before infusion initiation";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.3.1 (REQ 7)";
@@ -71,7 +68,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-001";
         attribute :>> name = "ModeRange";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee mode_range: GPCA_SW_OUT.Current_System_Mode in {0, 1, 2, 3, 4, 6, 7, 8} (source enumeration omits 5)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 1)";
@@ -80,7 +76,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-004";
         attribute :>> name = "NotStartImpliesModeZero";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee not(OP_CMD_IN.System_Start) => GPCA_SW_OUT.Current_System_Mode = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -89,7 +84,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-005";
         attribute :>> name = "InitialSystemStartImpliesModeOne";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee sys_initial and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4 allocation: TLM System_Start -> System_On; IM System_On -> mode 1)";
@@ -98,7 +92,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-006";
         attribute :>> name = "OffToOnImpliesModeOne";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee not(sys_initial) and pre(GPCA_SW_OUT.Current_System_Mode) = 0 and OP_CMD_IN.System_Start => GPCA_SW_OUT.Current_System_Mode = 1";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 4)";
@@ -107,7 +100,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-007";
         attribute :>> name = "EmptyReservoirImpliesNoFlow";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Reservoir_Volume < CONST_IN.Empty_Reservoir) => GPCA_SW_OUT.Commanded_Flow_Rate = 0";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 59 'Empty Reservoir')";
@@ -116,7 +108,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-008";
         attribute :>> name = "OverVtbiImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and pre(Current_System_Mode) > 1 and GPCA_SW_OUT.Volume_Infused > DB_IN.VTBI_High) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (over-infusion => keep-vein-open, not zero)";
@@ -125,7 +116,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-009";
         attribute :>> name = "AirInLineImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Air_In_Line) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex (REQ 21 'Air embolism')";
@@ -134,7 +124,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-010";
         attribute :>> name = "OcclusionImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Occlusion) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -143,7 +132,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-011";
         attribute :>> name = "DoorOpenImpliesFlowAtMostKvo";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee (OP_CMD_IN.System_Start and SENSOR_IN.Door_Open) => GPCA_SW_OUT.Commanded_Flow_Rate <= GPCA_SW_OUT.Flow_Rate_KVO";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl AGREE annex";
@@ -152,7 +140,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-003";
         attribute :>> name = "SameStepAlarmKvoGuarantee";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee an infusion-inhibiting notification in a step implies Commanded_Flow_Rate <= Flow_Rate_KVO in the same step (ALARM_OUT -> IM.ALARM_IN is an immediate connection)";
         attribute :>> sourceReference = "CITE-002: CriSys GPCA AADL v2.0, GPCA_SW.aadl (ALARM_to_IM immediate) with the flow <= KVO guarantees above";
@@ -161,7 +148,6 @@ package memo_examples_gpca_pump_model_catalog_gpca_formal_behavior {
         attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> id = "GP-002";
         attribute :>> name = "LockoutGuarantee";
-        attribute :>> propertyKind = BehaviorPropertyKind::guarantee;
         attribute :>> languageKind = PropertyLanguageKind::agreeLike;
         attribute :>> formalExpression = "guarantee a BolusRequest_prog inside the LockOutPeriod_pbolus_prog window is ignored and no PATIENT BOLUS is initiated";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §4.1.6.1 (REQ 25.3, REQ 26)";