memo_assurance_safety_risk¶

SysML API


Public namespace	`memo::assurance::safety_risk`
Declared package	`memo_assurance_safety_risk`
Source	`src/assurance/safety_risk/memo_risk.sysml`

Namespace hierarchy¶

memo → memo::assurance → memo::assurance::safety_risk

Packages¶

Package
`memo_assurance_safety_risk`

Imports¶

Visibility	Target
private	`Metaobjects::SemanticMetadata`
private	`ScalarValues::*`
private	`memo_core_relationships::*`
private	`memo_core_common::*`
private	`memo_core_enumerations::*`
private	`memo_assurance_requirements::*`
private	`memo_architecture_operational_scenarios::*`

Declarations¶

Name	SysML kind	Description	Specializes
`ReasonablyForeseeableMisuse`	`part def`	ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards, scenarios, requirements, and DHF records can trace to the foreseeable misuse that motivated them.…	`MemoPart`
`Risk`	`part def`	Risk definition specializing `RiskDriver`.	`RiskDriver`
`ResidualRisk`	`part def`	Residual risk definition specializing `Risk`.	`Risk`
`RiskMatrix`	`part def`	Risk matrix definition specializing `MemoPart`.	`MemoPart`
`SafetyRelatedCharacteristic`	`part def`	Safety related characteristic definition specializing `MemoPart`.	`MemoPart`
`RiskItem`	`item def`	Risk item definition specializing `MemoItem`.	`MemoItem`
`Hazard`	`item def`	Hazard definition specializing `RiskItem`.	`RiskItem`
`SequenceOfEvents`	`item def`	Sequence of events definition specializing `RiskItem`.	`RiskItem`
`HazardCause`	`item def`	Hazard cause definition specializing `RiskItem`.	`RiskItem`
`HazardousSituation`	`item def`	Hazardous situation definition specializing `RiskItem`.	`RiskItem`
`Harm`	`item def`	Harm definition specializing `RiskItem`.	`RiskItem`
`RiskControlMeasure`	`part def`	Risk control measure definition specializing `VerifiableElement`.	`VerifiableElement`
`Benefit`	`part def`	Benefit definition specializing `MemoPart`.	`MemoPart`
`OverallResidualRiskEvaluation`	`part def`	Overall residual risk evaluation definition specializing `MemoPart`.	`MemoPart`
`TracesRisk`	`connection def`	Typed relationship from `RiskItem` to `RiskItem`.	`MemoRelationship`
`LeadsToHarm`	`connection def`	The final ISO 14971 chain edge. P2 is the conditional probability that the hazardous situation results in the harm.	`MemoRelationship`
`HazardRelatedScenario`	`connection def`	Typed relationship from `RiskItem` to `OperativeScenario`.	`MemoRelationship`
`AssessedAgainst`	`connection def`	Typed relationship from `Risk` to `RiskMatrix`.	`MemoRelationship`
`EstimatedFor`	`connection def`	Typed relationship from `Risk` to `RiskItem`.	`MemoRelationship`
`ReducedBy`	`connection def`	Typed relationship from `ResidualRisk` to `RiskControlMeasure`.	`MemoRelationship`
`EvaluatedIn`	`connection def`	Typed relationship from `ResidualRisk` to `OverallResidualRiskEvaluation`.	`MemoRelationship`
`MitigationKind`	`enum def`	Controlled values for mitigation: `hazard`, `vulnerability`, `failureMode`, `cutSet`, `fmeaAction`.	—
`Mitigates`	`connection def`	Typed relationship from `any element` to `RiskItem`.	`MemoRelationship`
`WeighedAgainst`	`connection def`	Typed relationship from `Benefit` to `Risk`.	`MemoRelationship`

ReasonablyForeseeableMisuse¶

part def ReasonablyForeseeableMisuse specializes MemoPart

Property	Value
Description	ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards, scenarios, requirements, and DHF records can trace to the foreseeable misuse that motivated them.…
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_safety_risk`

Risk¶

part def Risk specializes RiskDriver

Property	Value
Description	Risk definition specializing `RiskDriver`.
Kind	`part def`
Abstract	No
Specializes	`RiskDriver`
Owning package	`memo_assurance_safety_risk`

ResidualRisk¶

part def ResidualRisk specializes Risk

Property	Value
Description	Residual risk definition specializing `Risk`.
Kind	`part def`
Abstract	No
Specializes	`Risk`
Owning package	`memo_assurance_safety_risk`

RiskMatrix¶

part def RiskMatrix specializes MemoPart

Property	Value
Description	Risk matrix definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_safety_risk`

SafetyRelatedCharacteristic¶

part def SafetyRelatedCharacteristic specializes MemoPart

Property	Value
Description	Safety related characteristic definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_safety_risk`

RiskItem¶

abstract item def RiskItem specializes MemoItem

Property	Value
Description	Risk item definition specializing `MemoItem`.
Kind	`item def`
Abstract	Yes
Specializes	`MemoItem`
Owning package	`memo_assurance_safety_risk`

Hazard¶

item def Hazard specializes RiskItem

Property	Value
Description	Hazard definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_safety_risk`

SequenceOfEvents¶

item def SequenceOfEvents specializes RiskItem

Property	Value
Description	Sequence of events definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_safety_risk`

HazardCause¶

item def HazardCause specializes RiskItem

Property	Value
Description	Hazard cause definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_safety_risk`

HazardousSituation¶

item def HazardousSituation specializes RiskItem

Property	Value
Description	Hazardous situation definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_safety_risk`

Harm¶

item def Harm specializes RiskItem

Property	Value
Description	Harm definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_safety_risk`

RiskControlMeasure¶

part def RiskControlMeasure specializes VerifiableElement

Property	Value
Description	Risk control measure definition specializing `VerifiableElement`.
Kind	`part def`
Abstract	No
Specializes	`VerifiableElement`
Owning package	`memo_assurance_safety_risk`

Benefit¶

part def Benefit specializes MemoPart

Property	Value
Description	Benefit definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_safety_risk`

OverallResidualRiskEvaluation¶

part def OverallResidualRiskEvaluation specializes MemoPart

Property	Value
Description	Overall residual risk evaluation definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_safety_risk`

TracesRisk¶

connection def TracesRisk :> MemoRelationship

Property	Value
Description	Typed relationship from `RiskItem` to `RiskItem`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

LeadsToHarm¶

connection def LeadsToHarm :> MemoRelationship

Property	Value
Description	The final ISO 14971 chain edge. P2 is the conditional probability that the hazardous situation results in the harm.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

HazardRelatedScenario¶

connection def HazardRelatedScenario :> MemoRelationship

Property	Value
Description	Typed relationship from `RiskItem` to `OperativeScenario`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

AssessedAgainst¶

connection def AssessedAgainst :> MemoRelationship

Property	Value
Description	Typed relationship from `Risk` to `RiskMatrix`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

EstimatedFor¶

connection def EstimatedFor :> MemoRelationship

Property	Value
Description	Typed relationship from `Risk` to `RiskItem`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

ReducedBy¶

connection def ReducedBy :> MemoRelationship

Property	Value
Description	Typed relationship from `ResidualRisk` to `RiskControlMeasure`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

EvaluatedIn¶

connection def EvaluatedIn :> MemoRelationship

Property	Value
Description	Typed relationship from `ResidualRisk` to `OverallResidualRiskEvaluation`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

MitigationKind¶

enum def MitigationKind

Property	Value
Description	Controlled values for mitigation: `hazard`, `vulnerability`, `failureMode`, `cutSet`, `fmeaAction`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_safety_risk`

Mitigates¶

connection def Mitigates :> MemoRelationship

Property	Value
Description	Typed relationship from `any element` to `RiskItem`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

WeighedAgainst¶

connection def WeighedAgainst :> MemoRelationship

Property	Value
Description	Typed relationship from `Benefit` to `Risk`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_safety_risk`

Source¶

assurance/safety_risk/memo_risk.sysml

package memo_assurance_safety_risk {
    private import Metaobjects::SemanticMetadata;
    private import ScalarValues::*;
    private import memo_core_relationships::*;   // MemoRelationship

    private import memo_core_common::*;
    private import memo_core_enumerations::*;
    private import memo_assurance_requirements::*;
    // For HazardRelatedScenario below. Assurance may depend on architecture;
    // the reverse is what the string on the scenario was avoiding.
    private import memo_architecture_operational_scenarios::*;

    // ISO 14971 / IEC 62366-1 risk-analysis input. A model element so hazards,
    // scenarios, requirements, and DHF records can trace to the foreseeable
    // misuse that motivated them. Its counterpart, IntendedUse, is now the
    // operational-world root (memo_architecture_operational_structure::IntendedUse,
    // a MemoMission).
    part def ReasonablyForeseeableMisuse specializes MemoPart {
        attribute misuseContext : String;
        attribute foreseeableBasis : String;
        attribute affectedUseContext : String;
    }

    part def Risk specializes RiskDriver {
        attribute probabilityEstimate : ProbabilityKind;
        attribute severityEstimate : SeverityKind;
        attribute riskLevel : CriticalityKind;
        attribute acceptability : RiskAcceptabilityKind;
        attribute estimationBasis : String;
        attribute analysisContext : String;
        attribute foreseeableMisuseIncluded : Boolean;
        doc /* The risk that remains after the controls (ISO 14971 clause 7) is the same risk
             * re-estimated, so a register that holds one row per risk states it here. A
             * ResidualRisk part is for a model that evaluates it as an element of its own. */
        attribute residualProbabilityEstimate : ProbabilityKind[0..1];
        attribute residualSeverityEstimate : SeverityKind[0..1];
        attribute residualBenefitRiskRequired : Boolean[0..1];
    }
    part def ResidualRisk specializes Risk {
        attribute benefitRiskRequired : Boolean;
    }
    part def RiskMatrix specializes MemoPart {
        attribute probabilityScaleDefinition : String;
        attribute severityScaleDefinition : String;
        attribute riskLevelMapping : String;
        attribute acceptabilityThresholds : String;
    }
    // `DesignControlRiskRow` was a denormalized spreadsheet transcription.
    // Risk rows now decompose into the ISO 14971 chain below: a Hazard,
    // SequenceOfEvents, HazardousSituation and Harm are independent elements, not
    // owned by a risk, because the same hazard is the hazard of many risks. A Risk
    // is linked to each by EstimatedFor, and the chain runs through TracesRisk /
    // LeadsToHarm, with ResidualRisk after mitigation. The risk itself is reached
    // by EstimatedFor / ReducedBy / EvaluatedIn below.
    // A device characteristic whose implementation, failure, or misuse can
    // affect safety. This is the modelable output of ISO 14971 §5.3.
    part def SafetyRelatedCharacteristic specializes MemoPart {
        attribute characteristic : String;
        attribute safetyImpact : String;
        attribute normalUseRelevant : Boolean;
        attribute faultConditionRelevant : Boolean;
    }
    // ─── Risk-element base ──────────────────────────────────────────
    // The common supertype of the item-based elements an ISO 14971 / FMEA /
    // FTA chain relates: hazards, sequences of events, hazardous situations,
    // harms, causes, failure modes, fault-tree events, cut sets, HAZOP
    // deviations, vulnerabilities.
    //
    // It exists so the risk relations can TYPE their ends. Before it, every
    // one of them (Causes, TracesRisk, DetectedBy, InputToGate, ProducesEvent,
    // ContainsEvent, IdentifiesHazard, Mitigates, ImpactsSafety) fell back to
    // MemoPart — which every element in MEMO is — so the authoring picker
    // offered fault-tree edges when linking a screen to a requirement.
    //
    // It is deliberately an `item def` and deliberately does NOT cover Risk /
    // ResidualRisk / RiskMatrix, which are parts: a risk is an assessed
    // judgement about a chain, not a link in it, and it is reached by
    // AssessedAgainst instead. One base per metaclass is the right shape here
    // — forcing the two families under one supertype would put a hazard and a
    // risk matrix back in the same picker.
    abstract item def RiskItem specializes MemoItem;

    item def Hazard specializes RiskItem {
        attribute hazardType : HazardTypeKind;
        attribute severity : SeverityKind;
        attribute foreseeable : Boolean;
    }
    item def SequenceOfEvents specializes RiskItem {
        attribute initiatingEvent : String;
        attribute contributingFactors : String;
    }
    // A categorized root cause in a hazard causal tree (FDA GIIP
    // taxonomy pattern: cause -> hazard -> hazardous situation -> harm;
    // several HazardCause elements may converge on one Hazard).
    item def HazardCause specializes RiskItem {
        attribute causeSource : CauseSourceKind;
        attribute contributingFactors : String;
    }
    item def HazardousSituation specializes RiskItem {
        attribute exposedPersons : String;
        attribute operatingCondition : String;
        // ISO 14971 P1: probability that the hazardous situation occurs.
        attribute probabilityOfOccurrence : ProbabilityKind;
    }
    item def Harm specializes RiskItem {
        attribute clinicalImpact : String;
        attribute reversibility : String;
        attribute severity : SeverityKind;
    }
    part def RiskControlMeasure specializes VerifiableElement {
        attribute controlKind : RiskControlKind;
        attribute implementationKind : RiskControlImplementationKind;
        attribute verificationStatus : String;
    }
    part def Benefit specializes MemoPart {
        attribute beneficialOutcome : String;
        attribute beneficiary : String;
        attribute clinicalSignificance : String;
        attribute supportingEvidence : String;
    }
    part def OverallResidualRiskEvaluation specializes MemoPart {
        attribute conclusion : String;
        attribute reviewer : String;
    }

    // ── Relations owned by this package ─────────────────────────────
    // Moved out of memo_core_relationships: their ends are typed against
    // types declared here, and core must not depend on a domain package.
    // ISO 14971 risk chain — distinct sequence-of-events relations over risk elements.
    connection def TracesRisk :> MemoRelationship {
        end sourceRiskElement : RiskItem :>> source;
        end targetRiskElement : RiskItem :>> target;
    }
    abstract connection tracesRiskLinks : TracesRisk[*];
    metadata def <tracesRisk> TracesRiskMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = tracesRiskLinks meta SysML::Usage;
    }
    // The final ISO 14971 chain edge. P2 is the conditional probability that
    // the hazardous situation results in the harm.
    connection def LeadsToHarm :> MemoRelationship {
        attribute conditionalProbability : ProbabilityKind;
        end hazardousSituation : HazardousSituation :>> source;
        end resultingHarm : Harm :>> target;
    }
    abstract connection leadsToHarmLinks : LeadsToHarm[*];
    metadata def <leadsToHarm> LeadsToHarmMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = leadsToHarmLinks meta SysML::Usage;
    }
    // IEC 62366-1 3.9's hazard-related use scenario: the scenario a hazard can
    // arise in. It is declared HERE rather than as a `hazardReference` string
    // on the scenario, which is what stood in for it: a string names nothing a
    // consumer can follow, and the layering is why it was written that way —
    // assurance may depend on architecture, and the scenario package cannot
    // see `Hazard`. On this side both ends are visible and the dependency runs
    // the direction it already runs.
    connection def HazardRelatedScenario :> MemoRelationship {
        end hazard : RiskItem :>> source;
        end scenario : OperativeScenario :>> target;
    }
    abstract connection hazardRelatedScenarioLinks : HazardRelatedScenario[*];
    metadata def <hazardRelatedScenario> HazardRelatedScenarioMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = hazardRelatedScenarioLinks meta SysML::Usage;
    }
    connection def AssessedAgainst :> MemoRelationship {
        end risk : Risk :>> source;
        end riskMatrix : RiskMatrix :>> target;
    }
    abstract connection assessedAgainstLinks : AssessedAgainst[*];
    metadata def <assessedAgainst> AssessedAgainstMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = assessedAgainstLinks meta SysML::Usage;
    }
    // A risk is not a link in the chain (see RiskItem), so TracesRisk cannot
    // reach it — and until these three nothing else could either. A model had
    // no way to say which hazardous situation or harm a risk was estimated for
    // (ISO 14971 §5.5), which control reduced it to a residual risk (§7), or
    // which overall evaluation covered that residual (§8), so gpca-pump wrote
    // all three as TracesRisk into a Risk and the builder rejected every one.
    // Named from the risk's side, like AssessedAgainst.
    connection def EstimatedFor :> MemoRelationship {
        end risk : Risk :>> source;
        end riskElement : RiskItem :>> target;
    }
    abstract connection estimatedForLinks : EstimatedFor[*];
    metadata def <estimatedFor> EstimatedForMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = estimatedForLinks meta SysML::Usage;
    }
    connection def ReducedBy :> MemoRelationship {
        end residualRisk : ResidualRisk :>> source;
        end control : RiskControlMeasure :>> target;
    }
    abstract connection reducedByLinks : ReducedBy[*];
    metadata def <reducedBy> ReducedByMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = reducedByLinks meta SysML::Usage;
    }
    connection def EvaluatedIn :> MemoRelationship {
        end residualRisk : ResidualRisk :>> source;
        end evaluation : OverallResidualRiskEvaluation :>> target;
    }
    abstract connection evaluatedInLinks : EvaluatedIn[*];
    metadata def <evaluatedIn> EvaluatedInMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = evaluatedInLinks meta SysML::Usage;
    }
    // Mitigates unifies the control/action → risk-element edges of the
    // ISO 14971 / FMEA / FTA / cyber chains — MitigatesHazard,
    // MitigatesVulnerability, MitigatedByControl, BrokenByControl,
    // AddressedByAction — keyed by mitigationKind. control is the mitigating
    // control/action; mitigatedElement is the hazard/vulnerability/failure/cut set.
    enum def MitigationKind {
        enum hazard;
        enum vulnerability;
        enum failureMode;
        enum cutSet;
        enum fmeaAction;
    }
    connection def Mitigates :> MemoRelationship {
        attribute mitigationKind : MitigationKind;
        // Untyped: controls/hazards may be item defs (RiskControlMeasure, Hazard, …).
        end control :>> source;
        end mitigatedElement : RiskItem :>> target;
    }
    abstract connection mitigatesLinks : Mitigates[*];
    metadata def <mitigates> MitigatesMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = mitigatesLinks meta SysML::Usage;
    }

    // ISO 14971 clause 7.4: where the residual risk is judged unacceptable, the benefit of the intended use is
    // weighed against it. Nothing in the chain reached a Benefit, which is a part and not a RiskItem, and the
    // generic relations that accept the pair say something else (`causes` between a benefit and a risk would say
    // the benefit gives rise to it). Named from the benefit's side, the way AssessedAgainst is from the risk's.
    connection def WeighedAgainst :> MemoRelationship {
        end benefit : Benefit :>> source;
        end risk : Risk :>> target;
    }
    abstract connection weighedAgainstLinks : WeighedAgainst[*];
    metadata def <weighedAgainst> WeighedAgainstMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = weighedAgainstLinks meta SysML::Usage;
    }
}