Model Your Device

Model one engineering argument at a time:

flowchart LR
    Need[Need] --> Req[Requirement]
    Req --> Function[LogicalFunction]
    Function --> Component[LogicalComponent]
    Cause[HazardCause] --> Hazard[Hazard]
    Hazard --> Events[SequenceOfEvents]
    Events --> Situation[HazardousSituation]
    Situation --> Harm[Harm]
    Harm --> Risk[Risk]
    Control[RiskControlMeasure] --> Hazard
    Control --> Residual[ResidualRisk]
    Req --> Test[VerificationCase]
    Control --> Test
    Test --> Evidence[Evidence]

Define the elements

package infusion_pump {
    private import memo_medical_device_library::*;

    requirement safeDelivery : Need {
        attribute :>> id = "NEED-001";
        attribute :>> name = "SafeDelivery";
        attribute :>> needKind = NeedKind::stakeholder;
        attribute :>> statement =
            "The patient needs medication delivered without unintended over-infusion.";
    }

    requirement detectOverDelivery : Requirement {
        attribute :>> id = "REQ-001";
        attribute :>> requirementKind = RequirementKind::system;
        attribute :>> name = "DetectOverDelivery";
        attribute :>> statement =
            "The pump shall detect flow above the configured limit.";
    }

    part monitorFlow : LogicalFunction {
        attribute :>> id = "LF-001";
        attribute :>> name = "MonitorFlow";
    }

    part safetyMonitor : LogicalComponent {
        attribute :>> id = "LC-001";
        attribute :>> name = "SafetyMonitor";
    }

    item overInfusion : Hazard {
        attribute :>> id = "HAZ-001";
        attribute :>> name = "OverInfusion";
    }

    item independentMonitor : RiskControlMeasure {
        attribute :>> id = "RC-001";
        attribute :>> name = "IndependentFlowMonitor";
    }

    part shutoffTest : VerificationCase {
        attribute :>> id = "VER-001";
        attribute :>> name = "OverDeliveryShutoffTest";
    }
}

Connect the argument

connection : DerivesFrom
    connect sourceDriver ::> safeDelivery
    to targetRequirement ::> detectOverDelivery;

connection : AllocatedTo
    connect function ::> monitorFlow
    to allocatedElement ::> safetyMonitor;

connection : MitigatesHazard
    connect riskControl ::> independentMonitor
    to mitigatedHazard ::> overInfusion;

connection : VerifiedBy
    connect verificationTarget ::> detectOverDelivery
    to verificationCase ::> shutoffTest;

connection : VerifiedBy
    connect verificationTarget ::> independentMonitor
    to verificationCase ::> shutoffTest;

Review the slice

Ask:

• Is the need written in stakeholder language?
• Is the requirement measurable?
• Is the function independent of implementation?
• Is component responsibility explicit?
• Does the control genuinely reduce the hazard?
• Does the verification case test both the requirement and the control?

Use Choosing Elements and Connecting Elements when extending the slice.