@memoarchitect/ontology 0.7.0 → 0.8.24

package/examples/gpca-pump/model/catalog/gpca_behavior_subsystems.sysml

@@ -9,7 +9,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
     private import memo_core_common::*;
 
     // ── Logical functions ───────────────────────────────────────
-    part fnAcquireSensors : SystemFunction {
+    action fnAcquireSensors : SystemFunction {
         attribute :>> id = "FUNC-001";
         attribute :>> name = "AcquireSensorData";
         attribute :>> functionCategory = "sensing";
@@ -17,8 +17,49 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> outputSummary = "Debounced, range-checked sensor status vector";
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
+
+        // ── Component functions decomposing FUNC-001 ─────────────
+        // The functional chain does not stop at the system boundary.
+        // "Acquire sensor data" is a system responsibility; measuring a flow
+        // rate is the flowmeter's, and aggregating the status vector is the
+        // sensor subassembly's. Each names its component through
+        // AllocatedTo (see gpca_behavior_actions), which CR-ONT-074
+        // requires — a component function allocated nowhere is a
+        // responsibility nobody has accepted.
+        action cfnMeasureFlowRate : ComponentFunction {
+            attribute :>> id = "CFUN-001";
+            attribute :>> name = "MeasureFlowRate";
+            attribute :>> functionCategory = "sensing";
+            attribute :>> actionKind = ActionKind::sense;
+            attribute :>> trigger = "continuous, sampled every 20 ms execution step";
+            attribute :>> outputSummary = "Measured delivered flow rate in mL/h, with a validity flag";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
+        action cfnDetectAirInLine : ComponentFunction {
+            attribute :>> id = "CFUN-002";
+            attribute :>> name = "DetectAirInLine";
+            attribute :>> functionCategory = "protection";
+            attribute :>> actionKind = ActionKind::sense;
+            attribute :>> trigger = "continuous, sampled every 20 ms execution step";
+            attribute :>> outputSummary = "Air-in-line present or absent, with accumulated bolus volume";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
+        // The subassembly case: a component function need not sit on a leaf part.
+        action cfnAggregateSensorStatus : ComponentFunction {
+            attribute :>> id = "CFUN-003";
+            attribute :>> name = "AggregateSensorStatus";
+            attribute :>> functionCategory = "sensing";
+            attribute :>> actionKind = ActionKind::transform;
+            attribute :>> trigger = "every 20 ms execution step";
+            attribute :>> outputSummary = "Debounced, range-checked sensor status vector for the controller";
+            attribute :>> concernKind = ConcernKind::safety;
+            attribute :>> criticality = CriticalityKind::catastrophic;
+        }
     }
-    part fnValidatePrescription : SystemFunction {
+
+    action fnValidatePrescription : SystemFunction {
         attribute :>> id = "FUNC-002";
         attribute :>> name = "ValidatePrescription";
         attribute :>> functionCategory = "configuration";
@@ -27,7 +68,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnMonitorAlarm : SystemFunction {
+    action fnMonitorAlarm : SystemFunction {
         attribute :>> id = "FUNC-003";
         attribute :>> name = "MonitorExceptionalConditions";
         attribute :>> functionCategory = "alarm";
@@ -36,7 +77,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnAnnunciate : SystemFunction {
+    action fnAnnunciate : SystemFunction {
         attribute :>> id = "FUNC-004";
         attribute :>> name = "AnnunciateAlarms";
         attribute :>> functionCategory = "alarm";
@@ -45,7 +86,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnManageInfusion : SystemFunction {
+    action fnManageInfusion : SystemFunction {
         attribute :>> id = "FUNC-005";
         attribute :>> name = "ManageInfusion";
         attribute :>> functionCategory = "infusion";
@@ -54,7 +95,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnEnforceLimits : SystemFunction {
+    action fnEnforceLimits : SystemFunction {
         attribute :>> id = "FUNC-006";
         attribute :>> name = "EnforceDoseLimits";
         attribute :>> functionCategory = "infusion";
@@ -63,7 +104,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnCommandPump : SystemFunction {
+    action fnCommandPump : SystemFunction {
         attribute :>> id = "FUNC-007";
         attribute :>> name = "CommandPumpMotor";
         attribute :>> functionCategory = "actuation";
@@ -72,7 +113,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::safety;
         attribute :>> criticality = CriticalityKind::catastrophic;
     }
-    part fnLogEvents : SystemFunction {
+    action fnLogEvents : SystemFunction {
         attribute :>> id = "FUNC-008";
         attribute :>> name = "LogTherapyEvents";
         attribute :>> functionCategory = "logging";
@@ -81,7 +122,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::regulatory;
         attribute :>> criticality = CriticalityKind::medium;
     }
-    part fnManagePower : SystemFunction {
+    action fnManagePower : SystemFunction {
         attribute :>> id = "FUNC-009";
         attribute :>> name = "ManagePower";
         attribute :>> functionCategory = "platform";
@@ -90,7 +131,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::reliability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnPresentStatus : SystemFunction {
+    action fnPresentStatus : SystemFunction {
         attribute :>> id = "FUNC-010";
         attribute :>> name = "PresentStatus";
         attribute :>> functionCategory = "user-interface";
@@ -99,7 +140,7 @@ package memo_examples_gpca_pump_gpca_behavior_subsystems {
         attribute :>> concernKind = ConcernKind::usability;
         attribute :>> criticality = CriticalityKind::high;
     }
-    part fnSelfTest : SystemFunction {
+    action fnSelfTest : SystemFunction {
         attribute :>> id = "FUNC-011";
         attribute :>> name = "ExecuteSelfTest";
         attribute :>> functionCategory = "platform";

package/examples/gpca-pump/model/catalog/gpca_context.sysml

@@ -3,15 +3,17 @@ package memo_examples_gpca_pump_gpca_context {
 
     private import memo_architecture_operational_context_actors::*;
     private import memo_architecture_operational_context_use_context::*;
+    private import memo_architecture_operational_structure::*;
     private import memo_assurance_requirements::*;
+    private import memo_assurance_safety_risk::*;
     private import memo_assurance_human_factors::*;
     private import memo_core_enumerations::*;
+    private import memo_examples_gpca_pump_gpca_operational::*;
 
     // ── Intended use (ISO 14971 §5.2, IEC 62366-1) ──────────────
     part gpcaIntendedUse : IntendedUse {
         attribute :>> id = "IU-001";
         attribute :>> name = "GPCA_IntendedUse";
-        attribute :>> title = "GPCA Pump Intended Use";
         attribute :>> shortDescription = "Patient-controlled analgesia infusion of prescribed opioid analgesics.";
         attribute :>> description = "The GPCA pump delivers a prescribed analgesic drug intravenously at a programmed basal rate, supplemented by square boluses delivered automatically at programmed intervals and by patient-requested bolus doses, subject to lockout intervals and maximum-dose limits.";
         attribute :>> indication = "Management of acute post-operative or chronic pain requiring titrated intravenous opioid analgesia.";
@@ -19,12 +21,14 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> patientPopulation = "Adult in-patients under clinical supervision.";
         attribute :>> clinicalBenefit = "Timely, patient-titrated analgesia with lower total opioid consumption than fixed-schedule dosing.";
         attribute :>> regulatoryClassification = "FDA Class II infusion pump (21 CFR 880.5725); IEC 62304 software safety class C.";
+        attribute :>> missionKind = "therapeutic device mission";
+        attribute :>> successCriteria = "Drug delivered per prescription; no overdose or undetected under-infusion; every hazardous condition annunciated within its alarm latency budget.";
+        attribute :>> operationalContext = "Acute-care hospital ward, fixed (non-ambulatory) location (UC-001).";
         attribute :>> sourceReference = "CITE-001: CriSys GPCA System Requirements (2013), §2.1-2.3 (GPCA overview, system functions, user characteristics)";
     }
     part bolusByProxyMisuse : ReasonablyForeseeableMisuse {
         attribute :>> id = "RFM-001";
         attribute :>> name = "BolusRequestBySomeoneOtherThanPatient";
-        attribute :>> title = "Bolus by proxy";
         attribute :>> shortDescription = "A caregiver or visitor presses the patient bolus control.";
         attribute :>> description = "A person other than the patient activates the bolus request control, bypassing the intended patient self-limiting behavior.";
         attribute :>> misuseContext = "Patient-controlled analgesia in a supervised hospital setting.";
@@ -41,7 +45,6 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> environment = "indoor clinical environment, mains power with battery backup, pole or bed-rail mounted";
         attribute :>> jurisdiction = "generic (FDA/EU reference model)";
         attribute :>> connectedUse = true;
-        attribute :>> intendedUseReference = "IU-001";
     }
     // UC-002 (intra-hospital transport) removed: CriSys §2.4 states the
     // system is used in a fixed location and is not ambulatory.
@@ -53,6 +56,7 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> name = "Patient";
         attribute :>> trainingLevel = "instructed by clinician on bolus request button only";
         attribute :>> description = "Receives the infusion and requests bolus doses via the patient pendant.";
+        perform oaRequestBolus;
     }
     part actorNurse : User {
         attribute :>> actorKind = ActorKind::clinician;
@@ -60,6 +64,10 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> name = "ClinicianNurse";
         attribute :>> trainingLevel = "trained clinical user; programs prescriptions and responds to alarms";
         attribute :>> description = "Loads the drug reservoir, programs and confirms the prescription, starts/stops therapy, and responds to alarms.";
+        perform oaProgram;
+        perform oaStartTherapy;
+        perform oaRespondAlarm;
+        perform oaReviewLog;
     }
     part actorPrescriber : User {
         attribute :>> actorKind = ActorKind::clinician;
@@ -67,6 +75,7 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> name = "PrescribingPhysician";
         attribute :>> trainingLevel = "licensed prescriber";
         attribute :>> description = "Prescribes drug, concentration, basal rate, bolus volume, lockout interval, and maximum dose limits.";
+        perform oaPrescribe;
     }
     part actorPharmacist : User {
         attribute :>> actorKind = ActorKind::clinician;
@@ -74,6 +83,7 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> name = "Pharmacist";
         attribute :>> trainingLevel = "licensed pharmacist";
         attribute :>> description = "Prepares the drug reservoir and verifies drug and concentration against the prescription.";
+        perform oaLoadReservoir;
     }
     part actorTechnician : User {
         attribute :>> actorKind = ActorKind::technician;
@@ -81,6 +91,7 @@ package memo_examples_gpca_pump_gpca_context {
         attribute :>> name = "BiomedicalTechnician";
         attribute :>> trainingLevel = "service-trained; authenticated service access";
         attribute :>> description = "Performs maintenance, battery replacement, and calibration through the service interface.";
+        perform oaMaintain;
     }
 
     // ── Foreseeable use errors (IEC 62366-1, AAMI TIR PCA) ──────

package/examples/gpca-pump/model/catalog/gpca_cybersecurity.sysml

@@ -1,11 +1,14 @@
 package memo_examples_gpca_pump_gpca_cybersecurity {
     private import ScalarValues::*;
+    private import memo_core_dimensions::*;   // ElementStatusKind
 
     private import memo_assurance_cybersecurity::*;
     private import memo_assurance_requirements::*;
     private import memo_assurance_safety_risk::*;
     private import memo_assurance_verification_validation::*;
     private import memo_core_enumerations::*;
+    private import memo_core_common::*;
+    private import memo_architecture_operational_scenarios::*;
     private import memo_core_relationships::*;
     private import memo_examples_gpca_pump_gpca_architecture::*;
     private import memo_examples_gpca_pump_gpca_risk::*;
@@ -78,7 +81,7 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
         attribute :>> cweReference = "CWE-798";
     }
 
-    action tamperedConfigurationScenario : ThreatScenario {
+    action tamperedConfigurationScenario : OperativeScenario {
         attribute :>> id = "SCN-001";
         attribute :>> name = "TamperedTherapyConfigurationScenario";
         attribute :>> description = "An attacker with local access to the maintenance port alters lockout or dose parameters, aiming to bypass safety limits; may enable unsafe therapy delivery or bypass safeguards.";
@@ -128,7 +131,7 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
         attribute :>> statement = "The system shall require authenticated and authorized service access before any therapy configuration parameter can be modified.";
         attribute :>> sourceKind = RequirementSourceKind::risk;
         attribute :>> concernKind = ConcernKind::cybersecurity;
-        attribute :>> requirementStatus = RequirementStatusKind::approved;
+        attribute :>> status = ElementStatusKind::approved;
         attribute :>> acceptanceCriteria = "Unauthenticated or unauthorized attempts to modify therapy configuration are rejected and logged.";
         attribute :>> subjectDescription = "maintenance and configuration path";
         attribute :>> actorDescription = "service personnel";
@@ -145,7 +148,9 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
         attribute :>> name = "VerifyAuthenticatedServiceAccess";
         attribute :>> methodKind = VerificationMethodKind::test;
         attribute :>> acceptanceCriteria = "Only authenticated and authorized service sessions may modify therapy configuration; all attempts are logged.";
-        attribute :>> status = "planned";
+        attribute :>> status = ElementStatusKind::approved;
+
+        objective { verify reqAuthenticatedServiceAccess; }
     }
 
     connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to realizedThreat ::> unauthorizedConfigChangeThreat;
@@ -166,7 +171,5 @@ package memo_examples_gpca_pump_gpca_cybersecurity {
 
     connection : CrossesTrustBoundary connect boundary ::> maintenancePortBoundary to crossingItem ::> therapyConfigurationAsset;
 
-    connection : VerifiedBy connect verificationTarget ::> reqAuthenticatedServiceAccess to verificationCase ::> vcAuthenticatedServiceAccess;
-
     connection : ProducesEvidence connect producer ::> vcAuthenticatedServiceAccess to producedEvidence ::> evidenceLockout;
 }