memo_architecture_implementation_ui

SysML API

Public namespace	memo::architecture::implementation::ui
Declared package	memo_architecture_implementation_ui
Source	src/architecture/implementation/ui/memo_ui.sysml

Namespace hierarchy

memo → memo::architecture → memo::architecture::implementation → memo::architecture::implementation::ui

Packages

Package
memo_architecture_implementation_ui

Imports

Visibility	Target
private	Metaobjects::SemanticMetadata
private	ScalarValues::*
private	memo_core_common::*
private	memo_core_enumerations::*
private	memo_assurance_safety_risk::*
private	memo_core_relationships::*
private	memo_architecture_operational_activities::*
private	memo_architecture_operational_scenarios::*
private	memo_architecture_operational_use_cases::*
private	memo_architecture_functional_functions::*
private	memo_architecture_implementation_software_structure::*
private	memo_architecture_implementation_hardware_common::*
private	memo_assurance_human_factors::*

Declarations

Name	SysML kind	Description	Specializes
UIElementFormKind	enum def	Controlled values for uielement form: screen, dialog, panel, menu, tab, drawer, wizardStep, button, field, selector, slider, table, chart, icon, textMessage, decoration.	—
RegionBounds	attribute def	Region bounds definition.	—
UIDisclosureKind	enum def	How an element appears relative to its parent and siblings. It records design intent a bare rectangle cannot: an element whose box escapes its parent and covers its siblings is a defect if it is inline and correct if it is overlay, and the geometry alone does not say which…	—
BoundsDetectionKind	enum def	How the element's bounds were obtained. Automatic boundary detection PROPOSES; a reviewer DISPOSES. In a regulated review the reader must be able to see which boxes a human confirmed and which the tool guessed, so that provenance is model content and not a workbench-only flag.	—
InteractionIntentKind	enum def	The interaction intents a step or action can carry (§18).	—
UserInterface	part def	User interface definition specializing MemoPart.	MemoPart
UIElement	part def	Uielement definition specializing SoftwareElement.	SoftwareElement
OperatorInterfaceFormKind	enum def	Controlled values for operator interface form: knob, dial, pushButton, toggleSwitch, rockerSwitch, lever, physicalSlider, keypad, footPedal, touchSurface, indicatorLamp, gauge, audibleIndicator, hapticIndicator, printedMarking.	—
OperatorInterfaceElement	part def	Operator interface element definition specializing PhysicalComponent.	PhysicalComponent
ScreenCapture	part def	Screen capture definition specializing MemoEvidence.	MemoEvidence
UIState	part def	UI state is presentation state — distinct from system/device state.	MemoPart
UIEvent	part def	Uievent definition specializing MemoPart.	MemoPart
UIAction	action def	Clicking a button IS an operative action: it has a trigger, a precondition, a criticality, a potential harm and a frequency of use, exactly as turning a knob does.…	OperativeAction
InteractionFlow	action def	A reusable dialogue structure through the UI; a selected path through it is a OperativeScenario with scenarioKind ui.	MemoAction
CapturesScreen	connection def	Which modelled screen an image is a rendering of.	MemoRelationship
ElementTriggersAction	connection def	Typed relationship for element triggers action.	MemoRelationship
FlowServesUseCase	connection def	Typed relationship for flow serves use case.	MemoRelationship
ErrorAtElement	connection def	A UI scenario realizes a functional scenario one layer up: each is a OperativeScenario selected by scenarioKind rather than a separate definition. Target is MemoPart.…	MemoRelationship
ControlImplementedBy	connection def	A risk control implemented by a UI element or by task design (confirmation dialog, lockout, guarded control).	MemoRelationship

UIElementFormKind

enum def UIElementFormKind

Property	Value
Description	Controlled values for uielement form: screen, dialog, panel, menu, tab, drawer, wizardStep, button, field, selector, slider, table, chart, icon, textMessage, decoration.
Kind	enum def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

RegionBounds

attribute def RegionBounds

Property	Value
Description	Region bounds definition.
Kind	attribute def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

UIDisclosureKind

enum def UIDisclosureKind

Property	Value
Description	How an element appears relative to its parent and siblings. It records design intent a bare rectangle cannot: an element whose box escapes its parent and covers its siblings is a defect if it is inline and correct if it is overlay, and the geometry alone does not say which…
Kind	enum def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

BoundsDetectionKind

enum def BoundsDetectionKind

Property	Value
Description	How the element's bounds were obtained. Automatic boundary detection PROPOSES; a reviewer DISPOSES. In a regulated review the reader must be able to see which boxes a human confirmed and which the tool guessed, so that provenance is model content and not a workbench-only flag.
Kind	enum def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

InteractionIntentKind

enum def InteractionIntentKind

Property	Value
Description	The interaction intents a step or action can carry (§18).
Kind	enum def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

UserInterface

part def UserInterface specializes MemoPart

Property	Value
Description	User interface definition specializing MemoPart.
Kind	part def
Abstract	No
Specializes	MemoPart
Owning package	memo_architecture_implementation_ui

UIElement

part def UIElement specializes SoftwareElement

Property	Value
Description	Uielement definition specializing SoftwareElement.
Kind	part def
Abstract	No
Specializes	SoftwareElement
Owning package	memo_architecture_implementation_ui

OperatorInterfaceFormKind

enum def OperatorInterfaceFormKind

Property	Value
Description	Controlled values for operator interface form: knob, dial, pushButton, toggleSwitch, rockerSwitch, lever, physicalSlider, keypad, footPedal, touchSurface, indicatorLamp, gauge, audibleIndicator, hapticIndicator, printedMarking.
Kind	enum def
Abstract	No
Specializes	—
Owning package	memo_architecture_implementation_ui

OperatorInterfaceElement

part def OperatorInterfaceElement specializes PhysicalComponent

Property	Value
Description	Operator interface element definition specializing PhysicalComponent.
Kind	part def
Abstract	No
Specializes	PhysicalComponent
Owning package	memo_architecture_implementation_ui

ScreenCapture

part def ScreenCapture specializes MemoEvidence

Property	Value
Description	Screen capture definition specializing MemoEvidence.
Kind	part def
Abstract	No
Specializes	MemoEvidence
Owning package	memo_architecture_implementation_ui

UIState

part def UIState specializes MemoPart

Property	Value
Description	UI state is presentation state — distinct from system/device state.
Kind	part def
Abstract	No
Specializes	MemoPart
Owning package	memo_architecture_implementation_ui

UIEvent

part def UIEvent specializes MemoPart

Property	Value
Description	Uievent definition specializing MemoPart.
Kind	part def
Abstract	No
Specializes	MemoPart
Owning package	memo_architecture_implementation_ui

UIAction

action def UIAction specializes OperativeAction

Property	Value
Description	Clicking a button IS an operative action: it has a trigger, a precondition, a criticality, a potential harm and a frequency of use, exactly as turning a knob does.…
Kind	action def
Abstract	No
Specializes	OperativeAction
Owning package	memo_architecture_implementation_ui

InteractionFlow

action def InteractionFlow specializes MemoAction

Property	Value
Description	A reusable dialogue structure through the UI; a selected path through it is a OperativeScenario with scenarioKind ui.
Kind	action def
Abstract	No
Specializes	MemoAction
Owning package	memo_architecture_implementation_ui

CapturesScreen

connection def CapturesScreen :> MemoRelationship

Property	Value
Description	Which modelled screen an image is a rendering of.
Kind	connection def
Abstract	No
Specializes	MemoRelationship
Owning package	memo_architecture_implementation_ui

ElementTriggersAction

connection def ElementTriggersAction :> MemoRelationship

Property	Value
Description	Typed relationship for element triggers action.
Kind	connection def
Abstract	No
Specializes	MemoRelationship
Owning package	memo_architecture_implementation_ui

FlowServesUseCase

connection def FlowServesUseCase :> MemoRelationship

Property	Value
Description	Typed relationship for flow serves use case.
Kind	connection def
Abstract	No
Specializes	MemoRelationship
Owning package	memo_architecture_implementation_ui

ErrorAtElement

connection def ErrorAtElement :> MemoRelationship

Property	Value
Description	A UI scenario realizes a functional scenario one layer up: each is a OperativeScenario selected by scenarioKind rather than a separate definition. Target is MemoPart.…
Kind	connection def
Abstract	No
Specializes	MemoRelationship
Owning package	memo_architecture_implementation_ui

ControlImplementedBy

connection def ControlImplementedBy :> MemoRelationship

Property	Value
Description	A risk control implemented by a UI element or by task design (confirmation dialog, lockout, guarded control).
Kind	connection def
Abstract	No
Specializes	MemoRelationship
Owning package	memo_architecture_implementation_ui

Source

architecture/implementation/ui/memo_ui.sysml

// User interface and interaction (§18). A small semantic hierarchy: concrete
// widget forms (button, knob, chart …) are enum classifications, not classes.
// UI state is distinct from system state (memo_architecture_functional_behavior) and
// from device modes (memo_architecture_logical_structure::LogicalMode).
// UI is an implementation concern (rendered UI is software; physical controls
// are hardware), so it lives in the implementation layer, not operational.
package memo_architecture_implementation_ui {
    private import Metaobjects::SemanticMetadata;
    private import ScalarValues::*;

    private import memo_core_common::*;
    private import memo_core_enumerations::*;
    private import memo_assurance_safety_risk::*;   // RiskControlMeasure
    private import memo_core_relationships::*;
    private import memo_architecture_operational_activities::*;
    private import memo_architecture_operational_scenarios::*;
    private import memo_architecture_operational_use_cases::*;
    private import memo_architecture_functional_functions::*;
    private import memo_architecture_implementation_software_structure::*;
    private import memo_architecture_implementation_hardware_common::*;
    private import memo_assurance_human_factors::*;

    // Every concrete UI form, holding and held alike. A screen is not a
    // different KIND of thing from a button — it is a UIElement that happens to
    // contain others, exactly as an assembly is a part that contains parts.
    // The forms below are classifications, not classes, so one tree carries the
    // whole interface.
    enum def UIElementFormKind {
        // ── forms that hold other elements ──
        enum screen;
        enum dialog;
        enum panel;
        enum menu;
        enum tab;
        enum drawer;
        enum wizardStep;
        // ── controls the user acts on ──
        // Rendered controls only. A knob, toggle, lamp, or buzzer the user
        // touches is not software: it is an OperatorInterfaceElement below.
        enum button;
        enum field;
        enum selector;
        enum slider;
        // ── forms that present information ──
        enum table;
        enum chart;
        enum icon;
        enum textMessage;
        // ── chrome ──
        // Non-functional: a rule, a background, a brand mark. Declared, never
        // merely implied — CR-MED-110 exempts `decoration` from needing a
        // design record, so an element left unclassified fails rather than
        // slipping through as scenery.
        enum decoration;
    }

    // ─── Screen geometry ─────────────────────────────────────────
    // Position and size of a UIElement inside its PARENT element, each value
    // normalized to 0..1 of the parent's box — not pixels. Two consequences
    // are wanted: an element survives a re-capture at a different resolution
    // or device scale, and a child's box is stated against its parent, which
    // is exactly what the containment tree already asserts. Absolute pixels
    // stay recoverable from the ScreenCapture's pixelWidth / pixelHeight.
    attribute def RegionBounds {
        attribute x : Real;
        attribute y : Real;
        attribute width : Real;
        attribute height : Real;
    }

    // How an element appears relative to its parent and siblings. It records
    // design intent a bare rectangle cannot: an element whose box escapes its
    // parent and covers its siblings is a defect if it is `inline` and correct
    // if it is `overlay`, and the geometry alone does not say which. A
    // renderer reads it to decide what to clip and what to draw on top; a
    // reviewer reads it to know whether an overlap is intended.
    enum def UIDisclosureKind {
        enum inline;       // laid out inside the parent, sharing space with siblings
        enum overlay;      // dropdown, popover, modal — drawn OVER parent and siblings
        enum transient;    // tooltip, toast — appears over everything, then withdraws
        enum scrolled;     // inside the parent, but beyond its viewport until scrolled
        enum conditional;  // rendered only while a stated condition holds
    }

    // How the element's bounds were obtained. Automatic boundary detection
    // PROPOSES; a reviewer DISPOSES. In a regulated review the reader must be
    // able to see which boxes a human confirmed and which the tool guessed, so
    // that provenance is model content and not a workbench-only flag.
    enum def BoundsDetectionKind {
        enum manual;
        enum automatic;
        enum automaticConfirmed;
        enum imported;
    }

    // The interaction intents a step or action can carry (§18).
    enum def InteractionIntentKind {
        enum userInput;
        enum feedback;
        enum navigation;
        enum confirmation;
        enum inputValidation;
        enum errorMessage;
        enum alarmAnnunciation;
        enum acknowledgement;
        enum cancellation;
        enum timeout;
        enum lockout;
        enum correction;
        enum recovery;
    }

    part def UserInterface specializes MemoPart {
        attribute modality : String;
        attribute uiTechnology : String;
    }

    // `InteractionElement` was an abstract base over UIElement and
    // OperatorInterfaceElement, existing so the §18 relations could type
    // against "something the user interacts with". It was both redundant and
    // too narrow: the nearest real common ancestor is already `MemoPart`, and
    // IEC 62366-1 puts the whole means of interaction in scope — a mis-keyed
    // connector, a moulded marking on a housing, a tube routed backwards are
    // use errors at parts that were never interaction elements and so could
    // not be named. `ErrorAtElement` and `ElementTriggersAction` now take
    // `MemoPart`; the attributes moved to whichever type actually set them.

    // One UIElement — the single UI part type. The widget form — holding
    // (screen/panel/dialog), acting (button/knob/slider), presenting
    // (field/table/chart), physical (knob/switch/indicatorLamp/haptic), or
    // decorative — is the `formKind` enum, not a subclass.
    // Input/output/navigation/alarm/display/physical-control descriptors are
    // optional attributes; a physical control's mechanical realization is a
    // hardware part linked by ControlImplementedBy.
    //
    // Composition is the ordinary `Composes` relation, so a screen's element
    // tree is an ordinary part tree: CR-ONT-001 already forbids cycles in it,
    // impact analysis already walks it, and requirements, functions, use
    // errors, and risk controls already trace to it. Screen layout adds four
    // numbers to that tree — it does not add a tree.
    //
    // A UIElement IS a structural SOFTWARE ITEM (IEC 62304 §3.25) and
    // specializes SoftwareElement, inheriting safetyClass and complexity, so the
    // interface is classified and decomposed like the software it is.
    //
    // It specializes SoftwareElement and NOT SoftwareModule: the module view is
    // CODE, and a screen is not a source module. Runtime processes are
    // SoftwareComponent, code is SoftwareModule, and the UI is a third view of
    // the same software — a sibling of those, not a kind of either.
    part def UIElement specializes SoftwareElement {
        attribute formKind : UIElementFormKind;
        // The visible label. Held here rather than on a shared interaction
        // base: a physical control's label is moulded or printed, and is
        // `legendText` on OperatorInterfaceElement.
        attribute labelText : String;
        // ── alarm annunciation (optional; IEC 60601-1-8) ──
        // On the rendered element, because that is where every modelled
        // annunciation lives. A physical annunciator that needs a priority
        // wants an alarm concept of its own, not three attributes copied onto
        // every front-panel part.
        attribute alarmPriority : NotificationPriorityKind[0..1];
        attribute annunciationModality : String;
        attribute silenceable : Boolean;
        // ── screen layout (optional; set for elements that are laid out) ──
        // Bounds are relative to the parent element in the Composes tree; a
        // root screen's bounds are the full frame.
        attribute bounds : RegionBounds[0..1];
        attribute disclosureKind : UIDisclosureKind[0..1];
        // The condition under which the element renders; meaningful when
        // disclosureKind is `conditional`.
        attribute visibilityCondition : String;
        // Boundary colour as a CSS colour token. Presentation, but modelled: a
        // review print, an exported figure, and the workbench must agree on
        // which box is which, and a colour assigned only in a tool session does
        // not survive the export.
        attribute boundaryColor : String;
        // Capture-relative fill transparency for region review overlays. A
        // modelled value keeps interactive review and exported figures aligned.
        attribute boundaryOpacity : Real[0..1];
        // Stroke width of the same box, in pixels. Colour and opacity are
        // modelled so a review print, an exported figure, and the workbench
        // agree on which box is which; a width chosen per renderer breaks that
        // agreement for exactly the same reason.
        attribute boundaryWidth : Real[0..1];
        attribute detectionMethod : BoundsDetectionKind[0..1];
        attribute detectionConfidence : Real[0..1];
        attribute confirmedBy : String;
        attribute confirmedAt : String;
        // ── role of a holding form (optional) ──
        attribute navigationRole : String;
        // input descriptors (optional)
        attribute inputConstraints : String;
        attribute defaultValue : String;
        // output / display descriptors (optional)
        attribute updateRate : String;
        attribute unitsDisplayed : String;
        attribute informationContent : String;
    }

    // ─── Physical operator interface ─────────────────────────────
    // The hardware the user actually touches and reads. IEC 60601-1 marks
    // "controls and instruments" and defines OPERATOR; this is that surface,
    // covering both directions — what the operator actuates and what the
    // device shows back — because a front panel is one interface, not two.
    //
    // It is a PhysicalComponent, so it inherits part number, material, and the
    // ISO 10993-1 patient-contact characterization that a touched surface
    // needs and that software can never have. That inheritance is the reason
    // these forms had to leave UIElement: as UIElementFormKind members they
    // were software items with no way to state any of it.
    enum def OperatorInterfaceFormKind {
        // ── actuated by the operator ──
        enum knob;
        enum dial;
        enum pushButton;
        enum toggleSwitch;
        enum rockerSwitch;
        enum lever;
        enum physicalSlider;
        enum keypad;
        enum footPedal;
        enum touchSurface;
        // ── presented to the operator ──
        enum indicatorLamp;
        enum gauge;
        enum audibleIndicator;
        enum hapticIndicator;
        enum printedMarking;
    }

    part def OperatorInterfaceElement specializes PhysicalComponent {
        attribute formKind : OperatorInterfaceFormKind;
        // actuation (optional; set for actuated forms)
        attribute actuationForce : String;
        attribute actuationTravel : String;
        attribute guardedAgainstInadvertentActuation : Boolean;
        attribute tactileFeedback : String;
        // presentation (optional; set for presented forms)
        attribute legendText : String;
        attribute luminanceOrVolume : String;
    }

    // ─── Captured evidence ───────────────────────────────────────
    // One image of one screen. MemoEvidence, not a design element: it
    // records what a specific build actually displayed at a specific time,
    // which is the provenance a design review or a usability engineering file
    // needs before it can rely on the picture. The screen it depicts is an
    // ordinary UIElement with formKind = screen.
    part def ScreenCapture specializes MemoEvidence {
        attribute imageUri : String;
        // Content hash of the image bytes. The screenshot is the evidence, so
        // it must be tamper-evident: a DHF reference to a mutable file is not
        // a reference to anything.
        attribute imageHash : String;
        attribute pixelWidth : Integer;
        attribute pixelHeight : Integer;
        attribute captureDate : String;
        // Which build produced this rendering. A screenshot without a build is
        // undated design intent, not evidence of the device.
        attribute capturedBuild : String;
        // Device, viewport, locale, theme, user role — everything that changes
        // what the screen shows without changing the software.
        attribute captureContext : String;
    }

    // UI state is presentation state — distinct from system/device state.
    part def UIState specializes MemoPart {
        attribute displayedInformation : String;
        attribute availableActions : String;
    }
    part def UIEvent specializes MemoPart {
        attribute eventSource : String;
        attribute intent : InteractionIntentKind;
    }

    // Clicking a button IS an operative action: it has a trigger, a
    // precondition, a criticality, a potential harm and a frequency of use,
    // exactly as turning a knob does. Specializing MemoAction directly made
    // UIAction a SIBLING of OperativeAction, which cost two things — a UI
    // action could carry none of those ten attributes, and `CommitsUseError`
    // (source end: OperativeAction) would not accept it, so a use error
    // committed by a click was unmodellable.
    //
    // The three attributes here are what a UI action adds on top: what the
    // user meant by it, what came back, and whether it asks first.
    action def UIAction specializes OperativeAction {
        attribute intent : InteractionIntentKind;
        attribute feedbackProvided : String;
        attribute confirmationRequired : Boolean;
    }

    // A reusable dialogue structure through the UI; a selected path through
    // it is a OperativeScenario with scenarioKind `ui`.
    action def InteractionFlow specializes MemoAction {
        attribute entryPoint : String;
        attribute exitPoint : String;
    }

    // `PresentsState` had zero usages anywhere in the tree (R10-S6). Its
    // audited native form, `exhibit state`, does not actually fit: `UIState`
    // is a `part def` with plain string attributes, not a `state def`, and
    // SysIDE rejects `exhibit` referencing anything that does not conform to
    // `States::StateAction` ("An exhibit state must reference another
    // state"). Free deletion rather than a migration — nothing referenced
    // it, so nothing to preserve. If `UIState` is ever restructured onto a
    // real state machine, `exhibit state` becomes available then.

    // ── Screen layout relations ──────────────────────────────────
    // Which modelled screen an image is a rendering of.
    connection def CapturesScreen :> MemoRelationship {
        end capture : ScreenCapture :>> source;
        end screen : UIElement :>> target;
    }
    abstract connection capturesScreenLinks : CapturesScreen[*];
    metadata def <capturesScreen> CapturesScreenMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = capturesScreenLinks meta SysML::Usage;
    }

    // Activating this element opens another screen. This is NAVIGATION, not
    // containment — the opened screen is not laid out inside the element, so
    // it is not a Composes child and the geometric rules do not relate them.
    // Conflating the two was the mistake that made "clicking takes you to a
    // child view" look like spatial nesting; it is a separate frame reached
    // from here, and only this relation says so.

    // ── §18 traceability ─────────────────────────────────────────
    // Source is `MemoPart`, not a UI-specific base: a foot pedal and a
    // rendered button trigger the same kind of action, and the two are a
    // PhysicalComponent and a SoftwareElement whose only common ancestor is
    // MemoPart. CR-MED-111 still holds rendered controls to it, and it is
    // scoped to UIElement, so the wider end does not weaken the rule.
    connection def ElementTriggersAction :> MemoRelationship {
        end element : MemoPart :>> source;
        end triggeredAction : UIAction :>> target;
    }
    abstract connection elementTriggersActionLinks : ElementTriggersAction[*];
    metadata def <elementTriggersAction> ElementTriggersActionMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = elementTriggersActionLinks meta SysML::Usage;
    }
    // `ActionInvokesFunction` is native `perform` (R10-S6): write
    // `perform <systemFunction>;` inside the `UIAction` usage instead.
    connection def FlowServesUseCase :> MemoRelationship {
        end interactionFlow : InteractionFlow :>> source;
        end useCase : UseCase :>> target;
    }
    abstract connection flowServesUseCaseLinks : FlowServesUseCase[*];
    metadata def <flowServesUseCase> FlowServesUseCaseMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = flowServesUseCaseLinks meta SysML::Usage;
    }
    // A UI scenario realizes a functional scenario one layer up: each is a
    // OperativeScenario selected by scenarioKind rather than a separate definition.
    // Target is `MemoPart`. IEC 62366-1 scopes the user interface to every
    // means of interaction, so a use error lands wherever the user got it
    // wrong — a mis-keyed connector, a moulded marking, a tube routed
    // backwards — not only on a control. Narrowing this to an interaction
    // base made those unmodellable.
    connection def ErrorAtElement :> MemoRelationship {
        end useError : UseError :>> source;
        end element : MemoPart :>> target;
    }
    abstract connection errorAtElementLinks : ErrorAtElement[*];
    metadata def <errorAtElement> ErrorAtElementMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = errorAtElementLinks meta SysML::Usage;
    }
    // A risk control implemented by a UI element or by task design
    // (confirmation dialog, lockout, guarded control).
    connection def ControlImplementedBy :> MemoRelationship {
        end riskControl : RiskControlMeasure :>> source;
        end implementingElement :>> target;
    }
    abstract connection controlImplementedByLinks : ControlImplementedBy[*];
    metadata def <controlImplementedBy> ControlImplementedByMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = controlImplementedByLinks meta SysML::Usage;
    }
}