diff --git a/.bazelignore b/.bazelignore
index fbcb4bd3..9698c9a1 100644
--- a/.bazelignore
+++ b/.bazelignore
@@ -23,3 +23,11 @@ bazel/rules/rules_score/examples/seooc
 bazel/rules/rules_score/examples/some_other_library
 # Separate local Bazel module (system integrator demo, depends on @seooc//)
 bazel/rules/rules_score/examples/integrator
+# minimal is a separate local Bazel module too, but its :doc_sources filegroup
+# is still loaded directly from the parent workspace (rules_score_doc). Only
+# ignore its own convenience symlinks, whose targets loop back into this
+# directory and would otherwise trip a symlink-cycle error during globbing.
+bazel/rules/rules_score/examples/minimal/bazel-bin
+bazel/rules/rules_score/examples/minimal/bazel-minimal
+bazel/rules/rules_score/examples/minimal/bazel-out
+bazel/rules/rules_score/examples/minimal/bazel-testlogs
diff --git a/.github/skills/rules-score/SKILL.md b/.github/skills/rules-score/SKILL.md
index 5d9a5bd6..4a11627d 100644
--- a/.github/skills/rules-score/SKILL.md
+++ b/.github/skills/rules-score/SKILL.md
@@ -40,7 +40,7 @@ Use this skill to coordinate; open the specialized skill for the actual work:
 | `.trlc` requirement records, `ScoreReq` model, traceability, `assumed_system_requirements` / `feature_requirements` / `component_requirements` / `assumptions_of_use` | **score-requirements** |
 | PlantUML diagrams, `architectural_design` / `unit` / `unit_design` / `component` / `dependable_element` structure, architecture/API/sequence validations | **score-architecture** |
 | GoogleTest `lobster-tracing` + Given-When-Then, `test_case_coverage.lock.yaml`, attaching tests | **score-testing** |
-| FMEA, `FailureMode` / `ControlMeasure` / FTA, `fmea` / `dependability_analysis` | **score-safety-analysis** |
+| FMEA, `FailureMode` / `SafetyMeasure` / FTA, `safety_analysis` / `dependability_analysis` | **score-safety-analysis** |
 
 ---
 
@@ -59,7 +59,7 @@ with a traceability report.
 | Architectural Design | `architectural_design` | score-architecture |
 | Units & Components | `unit`, `unit_design`, `component` | score-architecture |
 | Tests & Coverage | `tests` attr, `test_case_coverage_lock` | score-testing |
-| Dependability Analysis | `fmea`, `dependability_analysis` | score-safety-analysis |
+| Dependability Analysis | `safety_analysis`, `dependability_analysis` | score-safety-analysis |
 | SEooC assembly | `dependable_element` | this skill |
 
 ### Hierarchy
@@ -182,7 +182,7 @@ FMEA, cross-module `deps`, and test-case coverage — see
 3. **Implementation & tests** → back each `unit` with a `cc_library` + `cc_test`; annotate tests
    with `lobster-tracing` + Given-When-Then; add `test_case_coverage_lock` on components.
    *(score-testing)*
-4. **Safety analysis** → add `fmea` (FailureMode + ControlMeasure + FTA) and wrap it in a
+4. **Safety analysis** → add `safety_analysis` (FailureMode + SafetyMeasure + FTA) and wrap it in a
    `dependability_analysis`. *(score-safety-analysis)*
 5. **Assemble** → allocate `CompReq` to `component(requirements=…)` and `FeatReq` to
    `dependable_element(requirements=…)`; wire `architectural_design`, `components`,
diff --git a/.github/skills/score-requirements/SKILL.md b/.github/skills/score-requirements/SKILL.md
index d2b21fcf..304f0591 100644
--- a/.github/skills/score-requirements/SKILL.md
+++ b/.github/skills/score-requirements/SKILL.md
@@ -42,7 +42,7 @@ Bazel build/test rules.
 ## Not for
 
 - Architecture diagrams, `unit` / `component` / `dependable_element` structure → **score-architecture**
-- FMEA / FailureMode / ControlMeasure / FTA safety analysis → **score-safety-analysis**
+- FMEA / FailureMode / SafetyMeasure / FTA safety analysis → **score-safety-analysis**
 - Test annotation and coverage → **score-testing**
 - End-to-end SEooC assembly / choosing which skill to use → **rules-score**
 
@@ -243,7 +243,8 @@ component-internal requirements with no feature-level parent.
 
 ### Assumptions of Use (AoU)
 
-`AoU` extends `ControlMeasure` and captures conditions the integrating project must satisfy.
+`AoU` extends `RequirementSafety` (not `SafetyMeasure`) and captures conditions the integrating
+project must satisfy, via its own independent, optional `root_causes` field.
 The `assumptions_of_use` rule accepts raw `.trlc` **or** `.rst` files carrying `aou_req`
 directives (converted to TRLC automatically).
 
diff --git a/.github/skills/score-safety-analysis/SKILL.md b/.github/skills/score-safety-analysis/SKILL.md
index df766ad2..9bb18f59 100644
--- a/.github/skills/score-safety-analysis/SKILL.md
+++ b/.github/skills/score-safety-analysis/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: score-safety-analysis
-description: "Step-by-step workflow for creating or extending a FMEA-based safety analysis in TRLC format for S-CORE software components. Use when asked to: add failure modes, create FTA diagrams, add control measures, or validate the safety analysis traceability chain. Covers clustering, FailureMode records, FTA PlantUML files, ControlMeasure records, BUILD wiring, and trlc validation."
+description: "Step-by-step workflow for creating or extending a FMEA-based safety analysis in TRLC format for S-CORE software components. Use when asked to: add failure modes, create FTA diagrams, add mitigations, or validate the safety analysis traceability chain. Covers clustering, FailureMode records, FTA PlantUML files, Mitigation records, BUILD wiring, and trlc validation."
 argument-hint: "interface or component name to analyse"
 ---
 
@@ -23,7 +23,7 @@ argument-hint: "interface or component name to analyse"
 
 - Adding new failure modes to an existing safety analysis
 - Creating FTA diagrams for root-cause decomposition
-- Defining ControlMeasure / AoU records for identified root causes
+- Defining Mitigation / CompReq / AoU records for identified root causes
 - Validating the full traceability chain before a review of a safety analysis
 
 ## Key Files and Locations
@@ -32,9 +32,9 @@ argument-hint: "interface or component name to analyse"
 score/<component>/dependability/
 ├── safety_analysis/
 │   ├── failure_modes.trlc      # FailureMode records (one per unique root-cause cluster)
-│   ├── control_measures.trlc   # ControlMeasure / PreventiveMeasure / AoU records
+│   ├── safetymeasures.trlc     # Mitigation / AoU / CompReq records
 │   ├── fta_<failure_mode>.puml # One FTA diagram per FailureMode
-│   └── BUILD                   # fmea() rule — must list all .puml in fta_files filegroup
+│   └── BUILD                   # safety_analysis() rule — must list all .puml in fta_files filegroup
 ├── assumed_system/
 │   └── aous.trlc               # AoU records (caller obligations)
 └── requirements/
@@ -64,7 +64,7 @@ than inventing it.
 
 Only once the failure modes, causes, and measures are decided, transcribe them into the files
 below (Steps 1–5). This is mechanical: one `FailureMode` per decided effect, one FTA per failure
-mode, one measure record per `$BasicEvent`, matching aliases, BUILD wired, `trlc` clean.
+mode, one measure record per `$RootCause`, matching aliases, BUILD wired, `trlc` clean.
 
 ## Authoring guidance: performing the FMEA
 
@@ -85,16 +85,15 @@ safety goal?"* Dismiss low-relevance models with a short rationale.
 worst-case terms relative to the safety goal. Then build the FTA top-down to **actionable root
 causes**: `$OrGate` (default) when any single cause suffices; `$AndGate` only when all must
 co-occur (a fault *and* a failed safety mechanism — this justifies lower residual risk). Decompose
-until each `$BasicEvent` is something you can place a measure on.
+until each `$RootCause` is something you can place a measure on.
 
-**Step 3 — one measure per root cause**, chosen by *when* it acts:
+**Step 3 — one measure per root cause**, chosen by *who* closes it:
 
-| Type | Use when it… | Acts |
-|------|--------------|------|
-| `PreventiveMeasure` | removes the cause so the fault cannot occur | before |
-| `ControlMeasure` | detects/handles the fault at runtime (plausibility check, monitor) | during |
-| `Mitigation` | reduces severity/probability after occurrence | after |
-| `AoU` | can only be guaranteed by the **integrator/caller** | at integration |
+| Type | Use when it… | Closed via |
+|------|--------------|------------|
+| `Mitigation` | the SEooC itself provides a dedicated safety measure (with a mandatory `justification`) | `root_causes` |
+| `CompReq` | a normal, implemented-and-tested component requirement already closes it | `derived_from` |
+| `AoU` | can only be guaranteed by the **integrator/caller** | `root_causes` (optional) |
 
 Use an `AoU` to **push an obligation outward** when the SEooC cannot close a cause itself; it must
 be forwarded to the integrating project. Record *why* a measure is sufficient (AND-gate argument,
@@ -128,19 +127,22 @@ ScoreReq.FailureMode <RecordName> {
 
 ## Step 2 — Create FTA Diagrams (`fta_<snake_name>.puml`)
 
-One `.puml` file per `FailureMode` record. The `$TopEvent` alias **must** equal the fully-qualified TRLC record name (`<Package>.<RecordName>`).
+Use `$FailureMode(name, fm1, fm2="", ..., fm8="")` to link the diagram's top-level node
+directly to the `FailureMode` record(s) it covers — `fm1` is mandatory, up to
+`fm8` may be given, each a fully-qualified `<Pkg>.<FailureModeRecord>` name.
+`fm1` also doubles as the node's connection point for gates.
 
 ```plantuml
 @startuml
 
 !include fta_metamodel.puml
 
-$TopEvent("<Human-readable top event label>", "<Pkg>.<FailureModeRecord>")
+$FailureMode("<Human-readable failure-mode node label>", "<Pkg>.<FailureModeRecord>", "<Pkg>.<FailureModeRecord2>")
 
 $OrGate("OG1", "<Pkg>.<FailureModeRecord>")
 
-$BasicEvent("<Root cause label>", "<Pkg>.<ControlMeasureRecord>", "OG1")
-$BasicEvent("<Root cause label 2>", "<Pkg>.<ControlMeasureRecord2>", "OG1")
+$RootCause("<Root cause label>", "<RootCauseAlias>", "OG1")
+$RootCause("<Root cause label 2>", "<RootCauseAlias2>", "OG1")
 
 @enduml
 ```
@@ -149,37 +151,40 @@ $BasicEvent("<Root cause label 2>", "<Pkg>.<ControlMeasureRecord2>", "OG1")
 
 | Procedure | Purpose | `connection` points to |
 |-----------|---------|------------------------|
-| `$TopEvent(name, alias)` | Top failure mode | — (root, no connection) |
+| `$FailureMode(name, fm1, fm2, ..., fm8)` | Top failure mode; `fm1`..`fm8` are `FailureMode` FQNs it covers | — (root, no connection); `fm1` is the alias used by child gates |
 | `$OrGate(alias, connection)` | Any child sufficient | parent alias |
 | `$AndGate(alias, connection)` | All children required | parent alias |
-| `$BasicEvent(name, alias, connection)` | Root cause / leaf | enclosing gate alias |
+| `$RootCause(name, alias, connection)` | Root cause / leaf — `alias` must be a **plain TRLC identifier** (no dotted `Package.Name`) | enclosing gate alias |
 | `$IntermediateEvent(name, alias, connection)` | Intermediate cause | parent gate alias |
 | `$TransferInGate(name, alias, connection)` | Link to sub-tree | parent alias |
 
 **Rules:**
-- `$BasicEvent` alias = `<Package>.<ControlMeasureRecordName>` — this IS the traceability link.
-- Build bottom-up in the file: `$TopEvent` first, then gates, then `$BasicEvent` leaves.
-- The same `ControlMeasure` alias may appear in multiple FTAs (shared root cause).
+- `$RootCause` alias is a plain identifier; the `puml_cli` FTA parser auto-generates a `fta_events.trlc` stub (imported as `<name>_fta`) containing a `RootCause` record named after that alias — `Mitigation`/`CompReq`/`AoU` records reference it explicitly (e.g. `root_causes = [sample_safety_analysis_fta.JustBadLuck]`); there is no implicit name-matching.
+- Build top-down in the file: `$FailureMode` first, then gates, then `$RootCause` leaves.
+- The same `$RootCause` alias may appear in multiple FTAs (shared root cause).
 - `$OrGate` is the default for independent root causes; use `$AndGate` only when all causes must co-occur.
 
-## Step 3 — Write ControlMeasure Records (`control_measures.trlc`)
+## Step 3 — Write Mitigation Records (`safetymeasures.trlc`)
 
-For every `$BasicEvent` alias in every FTA, define a matching record:
+For every `$RootCause` alias in every FTA that isn't already closed by a `CompReq` or `AoU`,
+define a matching `Mitigation` record. `root_causes` and `justification` are both
+**mandatory**, and `root_causes` must reference the generated `RootCause` stub(s):
 
 ```trlc
-ScoreReq.ControlMeasure <RecordName> {
-    safety      = ScoreReq.Asil.B
-    description = "Normative measure text"
-    version     = 1
+ScoreReq.Mitigation <RecordName> {
+    safety        = ScoreReq.Asil.B
+    description   = "Normative measure text"
+    justification = "Why this measure is sufficient to close the root cause"
+    version       = 1
+    root_causes   = [<fta_package>.<RootCauseAlias>]
 }
 ```
 
-Other available types (same pattern, different semantics):
-- `ScoreReq.PreventiveMeasure` — prevents the failure from occurring
-- `ScoreReq.Mitigation` — reduces severity/probability after occurrence
-- `ScoreReq.AoU` — assumption the caller must satisfy; add `mitigates = "<RecordName>"` field
+Other ways to close a root cause:
+- `ScoreReq.CompReq` — closes it via `derived_from`, referencing the `RootCause` stub alongside any `FeatReq`/`AssumedSystemReq`/`AoU` it also derives from
+- `ScoreReq.AoU` — assumption the caller must satisfy; does **not** extend `SafetyMeasure` and has its own independent, optional `root_causes` field (no `justification` required)
 
-**Rule:** `<Package>.<RecordName>` in TRLC must match the `$BasicEvent` alias verbatim.
+**Rule:** every `$RootCause` alias must be referenced by at least one `Mitigation.root_causes`, `CompReq.derived_from`, or `AoU.root_causes` — this is validated by `bazel test` on the owning `dependability_analysis` target.
 
 ## Step 4 — Update BUILD
 
@@ -199,22 +204,24 @@ filegroup(
 
 ## Step 5 — Validate
 
-**Pass criteria:** zero errors in `failure_modes.trlc`, `control_measures.trlc`, `aous.trlc`.
+**Pass criteria:** zero errors in `failure_modes.trlc`, `safetymeasures.trlc`, `aous.trlc`.
 Pre-existing RSL union-type errors (`expected identifier, encountered '['`) are a known trlc v2 / RSL version mismatch — ignore if they appear only in the tooling RSL, not in component files.
 
 **Traceability chain that must be complete:**
 
 ```
 FailureMode.interface  →  public_api interface name
-FailureMode record     →  $TopEvent alias
-$BasicEvent alias      →  ControlMeasure / AoU record name
+FailureMode record     →  $FailureMode fm1..fm8 arguments
+$RootCause alias      →  Mitigation.root_causes / CompReq.derived_from / AoU.root_causes
 ```
 
 ## Common Mistakes
 
 | Mistake | Fix |
 |---------|-----|
-| `$BasicEvent` alias does not match any TRLC record | Ensure `<Pkg>.<RecordName>` is spelled identically in both places |
+| `$RootCause` alias is dotted (`Pkg.Name`) | Use a plain identifier — dotted aliases are rejected for root causes |
+| `$FailureMode` fm1..fm8 argument does not match any TRLC record | Ensure `<Pkg>.<RecordName>` is spelled identically in both places |
+| A root cause (`$RootCause`) is not referenced by any `Mitigation`/`CompReq`/`AoU` | Add an explicit reference to the generated `<fta_package>.<Alias>` `RootCause` stub |
 | New `.puml` not in BUILD `fta_files` | Add the file path to the `srcs` list |
-| AoU added to `control_measures.trlc` | AoUs belong in `aous.trlc`; both extend `Measure` so the FTA alias still resolves |
+| AoU added to `safetymeasures.trlc` | AoUs belong in `aous.trlc`; `AoU` does not extend `SafetyMeasure`, it has its own independent `root_causes` field |
 | Wrong RSL used for trlc validation   | Always pass the tooling RSL as the first directory argument |
diff --git a/bazel/rules/rules_score/BUILD b/bazel/rules/rules_score/BUILD
index 47792d8e..9b08f4ec 100644
--- a/bazel/rules/rules_score/BUILD
+++ b/bazel/rules/rules_score/BUILD
@@ -38,7 +38,7 @@ exports_files([
     "templates/section_page.template.rst",
     "templates/unit.template.rst",
     "templates/component.template.rst",
-    "templates/fmea.template.rst",
+    "templates/safety_analysis.template.rst",
     "templates/puml_diagram.template.rst",
 ])
 
@@ -88,13 +88,13 @@ py_binary(
     visibility = ["//visibility:public"],
 )
 
-# FMEA page assembler: builds the failure-mode-centric fmea.rst body in-process
-# via the extended TRLCRST library and the FTA chains JSON from puml_cli.
+# Safety-analysis page assembler: builds the failure-mode-centric safety_analysis.rst body
+# in-process via the extended TRLCRST library and the FTA chains JSON from puml_cli.
 py_binary(
-    name = "fmea_assembler",
-    srcs = ["src/fmea_assembler.py"],
+    name = "safety_analysis_assembler",
+    srcs = ["src/safety_analysis_assembler.py"],
     imports = ["src"],
-    main = "src/fmea_assembler.py",
+    main = "src/safety_analysis_assembler.py",
     visibility = ["//visibility:public"],
     deps = [
         "@trlc//tools/trlc_rst:trlc_rst_lib",
diff --git a/bazel/rules/rules_score/README.md b/bazel/rules/rules_score/README.md
index 36b58507..86d11612 100644
--- a/bazel/rules/rules_score/README.md
+++ b/bazel/rules/rules_score/README.md
@@ -28,7 +28,7 @@ for safety related automotive software.
 | `architectural_design` | `ArchitecturalDesignInfo` |
 | `unit` | `UnitInfo`, `CertifiedScope` |
 | `component` | `ComponentInfo` |
-| `fmea` | `AnalysisInfo` |
+| `safety_analysis` | `AnalysisInfo` |
 | `glossary` | `SphinxSourcesInfo` |
 | `dependability_analysis` | `DependabilityAnalysisInfo` |
 | `dependable_element` | HTML documentation zip (Sphinx) |
@@ -137,21 +137,21 @@ and collects requirement + architecture + test lobster sources.
 
 ---
 
-## `fmea`
+## `safety_analysis`
 
 ```starlark
-fmea(
-    name = "my_fmea",
+safety_analysis(
+    name = "my_safety_analysis",
     failuremodes = [":failure_modes"],
-    controlmeasures = [":control_measures"],
     root_causes = ["fta.puml"],
+    safetymeasures = [":safetymeasures"],
     arch_design = ":my_design",
 )
 ```
 
-**`bazel build`** — generates `fmea.rst` (merged FM / CM / FTA sections),
+**`bazel build`** — generates `safety_analysis.rst` (merged FM / Safety Measures / FTA sections),
 runs `lobster-trlc` on TRLC inputs, and extracts FTA events from `.puml`
-diagrams into `fta.lobster`. Build-only; traceability validation is done
+diagrams into `fta_events.trlc`. Build-only; traceability validation is done
 by the wrapping `dependability_analysis` test.
 
 ---
@@ -212,7 +212,7 @@ dependable_element(
 ```starlark
 dependability_analysis(
     name = "my_da",
-    fmea = [":my_fmea"],
+    safety_analysis = [":my_safety_analysis"],
     arch_design = ":my_design",
 )
 ```
diff --git a/bazel/rules/rules_score/docs/_assets/SeoocExample_FTA.puml b/bazel/rules/rules_score/docs/_assets/SeoocExample_FTA.puml
index a3b3853e..49638e68 100644
--- a/bazel/rules/rules_score/docs/_assets/SeoocExample_FTA.puml
+++ b/bazel/rules/rules_score/docs/_assets/SeoocExample_FTA.puml
@@ -15,15 +15,15 @@
 
 !include fta_metamodel.puml
 
-$TopEvent("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
+$FailureMode("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
 
 $OrGate("OG1", "SampleLibrary.SampleFailureMode")
 
 $IntermediateEvent("SampleFailureMode is Angry", "IEF", "OG1")
-$BasicEvent("Just bad luck", "SampleLibrary.JustBadLuck", "OG1")
+$RootCause("Just bad luck", "JustBadLuck", "OG1")
 
 $AndGate("AG2", "IEF")
-$BasicEvent("No More Cookies", "SampleLibrary.NoMoreCookies", "AG2")
-$BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
+$RootCause("No More Cookies", "NoMoreCookies", "AG2")
+$RootCause("No More Coffee", "NoMoreCoffee", "AG2")
 
 @enduml
diff --git a/bazel/rules/rules_score/docs/_assets/fta_metamodel.puml b/bazel/rules/rules_score/docs/_assets/fta_metamodel.puml
index 770f7a54..fe509e78 100644
--- a/bazel/rules/rules_score/docs/_assets/fta_metamodel.puml
+++ b/bazel/rules/rules_score/docs/_assets/fta_metamodel.puml
@@ -29,8 +29,37 @@ sprite $transferin <svg width="60" height="70" viewBox="0 0 60 70" xmlns="http:/
 'skinparam linetype polyline
 'skinparam linetype ortho
 
-!procedure $TopEvent($name, $alias)
-  rectangle "$name" as $alias
+' $FailureMode(name, fm1, fm2, ..., fm8): a fault-tree top-level node covering
+' one or more failure modes, each given as a TRLC 'Package.Name' fully-qualified
+' name. The *first* failure mode ($fm1) doubles as this node's alias -- the
+' connection point every gate/root-cause ancestor attaches to. Any further
+' failure modes ($fm2..$fm8) are rendered as extra notes so a reader can see
+' at a glance that this node covers more than one failure mode. PlantUML
+' procedures have no true variadic arguments, only trailing defaults, so the
+' argument count is capped at 8 failure modes per node.
+!procedure $FailureMode($name, $fm1, $fm2="", $fm3="", $fm4="", $fm5="", $fm6="", $fm7="", $fm8="")
+  rectangle "$name" as $fm1
+  !if ($fm2 != "")
+  note right of $fm1: $fm2
+  !endif
+  !if ($fm3 != "")
+  note right of $fm1: $fm3
+  !endif
+  !if ($fm4 != "")
+  note right of $fm1: $fm4
+  !endif
+  !if ($fm5 != "")
+  note right of $fm1: $fm5
+  !endif
+  !if ($fm6 != "")
+  note right of $fm1: $fm6
+  !endif
+  !if ($fm7 != "")
+  note right of $fm1: $fm7
+  !endif
+  !if ($fm8 != "")
+  note right of $fm1: $fm8
+  !endif
 !endprocedure
 
 !procedure $IntermediateEvent($name, $alias, $connection)
@@ -38,7 +67,7 @@ sprite $transferin <svg width="60" height="70" viewBox="0 0 60 70" xmlns="http:/
   $alias -u-> $connection
 !endprocedure
 
-!procedure $BasicEvent($name, $alias, $connection)
+!procedure $RootCause($name, $alias, $connection)
   usecase "$name" as $alias
   $alias -u-> $connection
 !endprocedure
diff --git a/bazel/rules/rules_score/docs/_assets/lobster_report_assembly.puml b/bazel/rules/rules_score/docs/_assets/lobster_report_assembly.puml
index 55f1137e..5753cf99 100644
--- a/bazel/rules/rules_score/docs/_assets/lobster_report_assembly.puml
+++ b/bazel/rules/rules_score/docs/_assets/lobster_report_assembly.puml
@@ -33,7 +33,7 @@ skinparam rectangle {
     BorderColor<<out>> #6A1B9A
 }
 
-rectangle "A: Per-level .lobster files\n(Feature/Component Req, Unit Test,\nCoverage, Architecture, Public API,\nFailure Modes, Control Measures,\nRoot Causes)" <<src>> as A
+rectangle "A: Per-level .lobster files\n(Feature/Component Req, Unit Test,\nCoverage, Architecture, Public API,\nFailure Modes, Safety Measures,\nRoot Causes)" <<src>> as A
 
 rectangle "B: expand_template\nformat_lobster_block() per level\n(emit_empty=strict in release)" <<own>> as B
 rectangle "de_traceability_config" <<rep>> as conf
diff --git a/bazel/rules/rules_score/docs/_assets/rules_score_overview.puml b/bazel/rules/rules_score/docs/_assets/rules_score_overview.puml
index bddea3e9..ae3d48b9 100644
--- a/bazel/rules/rules_score/docs/_assets/rules_score_overview.puml
+++ b/bazel/rules/rules_score/docs/_assets/rules_score_overview.puml
@@ -45,7 +45,7 @@ component "unit" <<implementation>> as unit
 component "component" <<implementation>> as comp
 
 ' ── Safety Analysis rules ─────────────────────────────────────────────────────
-component "fmea" <<analysis>> as fmea
+component "safety_analysis" <<analysis>> as safety_analysis
 component "dependability_analysis" <<analysis>> as da
 
 ' ── Documentation rules ───────────────────────────────────────────────────────
@@ -56,7 +56,7 @@ component "dependable_element" as de
 
 unit_design  -->  unit  : <<UnitDesignInfo>>
 
-arch  -->  fmea   : <<ArchitecturalDesignInfo>>
+arch  -->  safety_analysis   : <<ArchitecturalDesignInfo>>
 arch  -->  de     : <<ArchitecturalDesignInfo>>
 
 feat_req  -->  aou  : <<FeatureRequirementsInfo>>
@@ -65,7 +65,7 @@ feat_req  -->  de   : <<FeatureRequirementsInfo>>
 comp_req  -->  comp  : <<ComponentRequirementsInfo>>
 comp_req  -->  aou   : <<ComponentRequirementsInfo>>
 
-fmea  -->  da  : <<AnalysisInfo>>
+safety_analysis  -->  da  : <<AnalysisInfo>>
 da    -->  de  : <<DependabilityAnalysisInfo>>
 
 aou   -->  de  : <<AssumptionsOfUseInfo>>
diff --git a/bazel/rules/rules_score/docs/_assets/safety_analysis_doc_pipeline.puml b/bazel/rules/rules_score/docs/_assets/safety_analysis_doc_pipeline.puml
index 21884adf..dfa4e9b4 100644
--- a/bazel/rules/rules_score/docs/_assets/safety_analysis_doc_pipeline.puml
+++ b/bazel/rules/rules_score/docs/_assets/safety_analysis_doc_pipeline.puml
@@ -14,7 +14,7 @@
 @startuml safety_analysis_doc_pipeline
 
 ' Component view of the FMEA build: input artifacts (authored + tooling
-' defaults) flow through three in-process tool actions of the ``fmea`` rule into
+' defaults) flow through three in-process tool actions of the ``safety_analysis`` rule into
 ' the generated files, the providers, and finally the Sphinx staging tree.
 
 skinparam linetype ortho
@@ -42,73 +42,76 @@ skinparam component {
 
 ' ── Input artifacts ──────────────────────────────────────────────────────────
 package "Authored by the component team" {
-    rectangle "failuremodes.trlc\n(FailureMode records)"     <<src>> as fm_trlc
-    rectangle "controlmeasures.trlc\n(ControlMeasure records)" <<src>> as cm_trlc
-    rectangle "fta_*.puml\n(root_causes attr)"               <<src>> as fta_puml
+    rectangle "failuremodes.trlc\n(FailureMode records)"    <<src>> as fm_trlc
+    rectangle "safetymeasures.trlc\n(Mitigation/AoU/CompReq)"  <<src>> as sm_trlc
+    rectangle "fta_*.puml\n(root_causes attr)"              <<src>> as fta_puml
 }
 package "Tooling defaults (rules_score / ScoreReq)" {
     rectangle "ScoreReq *.rsl\n(spec attr)"        <<def>> as rsl
     rectangle "fta_metamodel.puml\n(on PlantUML include path)" <<def>> as meta
-    rectangle "fmea.template.rst\n({body})"        <<def>> as tmpl
-    rectangle "fm/cm lobster\nconfigs"             <<def>> as lcfg
+    rectangle "safety_analysis.template.rst\n({body})"        <<def>> as tmpl
+    rectangle "fm/safetymeasures lobster\nconfigs"    <<def>> as lcfg
 }
 
-' ── fmea rule: three tool actions ────────────────────────────────────────────
-package "fmea rule actions" {
+' ── safety_analysis rule: three tool actions ────────────────────────────────────────────
+package "safety_analysis rule actions" {
     component "puml_cli  (FTA mode)\n--fta-output-dir\n[crate: puml_fta]" <<tool>> as puml
-    component "fmea_assembler\n[lib: TRLCRST]"                            <<tool>> as asm
-    component "lobster-trlc  x2"                                          <<tool>> as ltrlc
+    component "safety_analysis_assembler\n[lib: TRLCRST]"                            <<tool>> as asm
+    component "lobster-trlc  x4"                                          <<tool>> as ltrlc
 }
 
 ' ── Generated files ──────────────────────────────────────────────────────────
 package "Generated files" {
     rectangle "fta_*.puml\n(authored, symlinked)"   <<gen>> as puml_inl
-    rectangle "fta_chains.json"        <<gen>> as chains
-    rectangle "root_causes.lobster"    <<gen>> as rc_lob
-    rectangle "fmea.rst"               <<gen>> as fmea_rst
-    rectangle "failuremodes.lobster\ncontrolmeasures.lobster" <<gen>> as fmcm_lob
+    rectangle "fta_events.trlc\n(FtaFailureMode/RootCause stubs)" <<gen>> as fta_events
+    rectangle "safety_analysis.rst"               <<gen>> as safety_analysis_rst
+    rectangle "failuremodes.lobster\nsafetymeasures.lobster\nfta_failure_modes.lobster\nfta_root_causes.lobster" <<gen>> as fmcm_lob
 }
 
 ' ── Providers ────────────────────────────────────────────────────────────────
-rectangle "SphinxSourcesInfo\n────────────────\nsrcs:     fmea.rst\ndeps:     fmea.rst\naux_srcs: fta_*.puml" <<prov>> as ssi
-rectangle "AnalysisInfo.lobster_files\n────────────────\nfailuremodes.lobster\ncontrolmeasures.lobster\nroot_causes.lobster" <<prov>> as ai
+rectangle "SphinxSourcesInfo\n────────────────\nsrcs:     safety_analysis.rst\ndeps:     safety_analysis.rst\naux_srcs: fta_*.puml" <<prov>> as ssi
+rectangle "AnalysisInfo.lobster_files\n────────────────\nfailuremodes.lobster\nsafetymeasures.lobster\nfta_failure_modes.lobster\nfta_root_causes.lobster" <<prov>> as ai
+rectangle "SafetyAnalysisProviderInfo\n────────────────\nfailuremodes, safetymeasures,\nfta_events, spec" <<prov>> as tpi
 
 ' ── Downstream rules + staging ───────────────────────────────────────────────
-component "dependability_analysis" <<tool>> as da
+component "dependability_analysis\n(+ root-cause coverage check)" <<tool>> as da
 component "dependable_element"     <<tool>> as de
-rectangle "dependability_analysis/\n  dfa.rst    <- toctree\n  fmea.rst   <- toctree\n  fta_*.puml (.. uml::)" <<stage>> as stage
+rectangle "dependability_analysis/\n  dfa.rst    <- toctree\n  safety_analysis.rst   <- toctree\n  fta_*.puml (.. uml::)" <<stage>> as stage
 
 ' ── Edges: inputs -> tools ───────────────────────────────────────────────────
 fta_puml --> puml : parse macro calls
 
-chains   --> asm
+fta_events --> asm
 fm_trlc  --> asm
-cm_trlc  --> asm
+sm_trlc  --> asm
 rsl      --> asm : import resolution
 tmpl     --> asm
 
 fm_trlc  --> ltrlc
-cm_trlc  --> ltrlc
+sm_trlc  --> ltrlc
+fta_events --> ltrlc
 rsl      --> ltrlc
 lcfg     --> ltrlc
 
 ' ── Edges: tools -> generated ────────────────────────────────────────────────
-fta_puml --> puml_inl : symlinked beside fmea.rst
+fta_puml --> puml_inl : symlinked beside safety_analysis.rst
 meta     --> stage : on PlantUML include path
-puml  --> chains
-puml  --> rc_lob
-asm   --> fmea_rst
+puml  --> fta_events
+asm   --> safety_analysis_rst
 ltrlc --> fmcm_lob
 
 ' ── Edges: generated -> providers ────────────────────────────────────────────
-fmea_rst --> ssi
+safety_analysis_rst --> ssi
 puml_inl --> ssi
-rc_lob   --> ai
 fmcm_lob --> ai
+fm_trlc    --> tpi
+sm_trlc    --> tpi
+fta_events --> tpi
 
 ' ── Edges: providers -> downstream -> staging ────────────────────────────────
 ssi --> da : merge SphinxSourcesInfo
 ai  --> da : merge lobster_files
+tpi --> da : merge for root-cause\ncoverage check
 da  --> de
 de  --> stage : symlink srcs + aux_srcs\n(aux not indexed in toctree)
 
diff --git a/bazel/rules/rules_score/docs/_assets/seooc_flow.puml b/bazel/rules/rules_score/docs/_assets/seooc_flow.puml
index ba783425..cbeecc2b 100644
--- a/bazel/rules/rules_score/docs/_assets/seooc_flow.puml
+++ b/bazel/rules/rules_score/docs/_assets/seooc_flow.puml
@@ -37,7 +37,7 @@ rectangle "Unit Design Diagrams\n(.puml / .rst)" <<input>> as ud_in
 rectangle "Implementation\n(cc_library / py_library…)" <<input>> as impl_in
 rectangle "Tests\n(cc_test / py_test…)" <<input>> as tests_in
 rectangle "Failure Modes\n(.trlc)" <<input>> as fm_in
-rectangle "Control Measures\n(.trlc)" <<input>> as cm_in
+rectangle "Safety Measures\n(.trlc)" <<input>> as cm_in
 rectangle "FTA Diagrams\n(.puml)" <<input>> as fta_in
 
 ' ── Bazel Rules ─────────────────────────────────────────────────────────────
@@ -49,7 +49,7 @@ rectangle "architectural_design" <<rule>> as arch_r
 rectangle "unit_design" <<rule>> as ud_r
 rectangle "unit" <<rule>> as unit_r
 rectangle "component" <<rule>> as comp_r2
-rectangle "fmea" <<rule>> as fmea_r
+rectangle "safety_analysis" <<rule>> as safety_analysis_r
 rectangle "dependability_analysis" <<rule>> as da_r
 rectangle "dependable_element" <<rule>> as de_r
 
@@ -65,9 +65,9 @@ arch_in --> arch_r
 ud_in --> ud_r
 impl_in --> unit_r
 tests_in --> unit_r
-fm_in --> fmea_r
-cm_in --> fmea_r
-fta_in --> fmea_r
+fm_in --> safety_analysis_r
+cm_in --> safety_analysis_r
+fta_in --> safety_analysis_r
 
 asr_r --> feat_r : deps
 asr_r --> aou_r
@@ -77,7 +77,7 @@ comp_r --> comp_r2 : requirements
 
 ud_r --> unit_r : unit_design
 unit_r --> comp_r2 : components
-fmea_r --> da_r : fmea
+safety_analysis_r --> da_r : safety_analysis
 
 arch_r --> de_r : architectural_design
 aou_r --> de_r : assumptions_of_use
diff --git a/bazel/rules/rules_score/docs/_assets/tooling_chain.puml b/bazel/rules/rules_score/docs/_assets/tooling_chain.puml
index 64cbf4a8..9d6d0f11 100644
--- a/bazel/rules/rules_score/docs/_assets/tooling_chain.puml
+++ b/bazel/rules/rules_score/docs/_assets/tooling_chain.puml
@@ -33,7 +33,7 @@ skinparam rectangle {
 ' ── Rules (Starlark macros) ───────────────────────────────────────────────────
 rectangle "feature_requirements\ncomponent_requirements\nassumed_system_requirements" <<rule>> as req
 rectangle "architectural_design\nunit_design" <<rule>> as arch
-rectangle "fmea" <<rule>> as fmea
+rectangle "safety_analysis" <<rule>> as safety_analysis
 rectangle "unit" <<rule>> as unit
 rectangle "dependability_analysis" <<rule>> as da
 rectangle "dependable_element" <<rule>> as de
@@ -43,8 +43,8 @@ rectangle "sphinx_module" <<rule>> as sphinx
 rectangle "**TRLC**\ntrlc parser + trlc_rst\n(.trlc/.rsl -> .rst; TRLCRST lib)" <<tool>> as trlc
 rectangle "**rst_to_trlc**\n(.rst -> .trlc)" <<own>> as r2t
 rectangle "**PlantUML Parser**\npuml_cli (Rust)\n(.puml -> .fbs.bin + .lobster + .idmap.json)" <<tool>> as puml
-rectangle "**puml_cli** (FTA mode)\ninline metamodel + extract\n(.puml -> inlined .puml +\nfta_chains.json + root_causes.lobster)" <<own>> as fta
-rectangle "**fmea_assembler**\nTRLCRST page build\n(.trlc + chains -> fmea.rst)" <<own>> as asm
+rectangle "**puml_cli** (FTA mode)\ninline metamodel + extract\n(.puml -> inlined .puml +\nfta_events.trlc)" <<own>> as fta
+rectangle "**safety_analysis_assembler**\nTRLCRST page build\n(.trlc + fta_events.trlc -> safety_analysis.rst)" <<own>> as asm
 rectangle "**Lobster**\nlobster-trlc / -report /\n-ci-report / gtest_report" <<tool>> as lob
 rectangle "**Architecture Verifier**\nvalidation_cli\n(arch.json + .fbs.bin)" <<tool>> as verifier
 rectangle "**Sphinx**\ntoolchain-resolved build binary + private\nhtml_merge tool\n(.rst -> needs.json + HTML)" <<tool>> as docs
@@ -58,10 +58,10 @@ req --> trlc  : render + typecheck
 req --> lob   : lobster-trlc
 
 arch --> puml : parse diagrams
-fmea --> fta  : FTA root causes
-fmea --> asm  : assemble fmea.rst
+safety_analysis --> fta  : FTA root causes
+safety_analysis --> asm  : assemble safety_analysis.rst
 asm  ..> trlc : TRLCRST lib
-fmea --> lob  : lobster-trlc
+safety_analysis --> lob  : lobster-trlc
 unit --> lob  : gtest_report
 
 da  --> lob   : lobster-report (FM+CM+FTA)
diff --git a/bazel/rules/rules_score/docs/_assets/traceability_dataflow.puml b/bazel/rules/rules_score/docs/_assets/traceability_dataflow.puml
index a31d7820..eec66bae 100644
--- a/bazel/rules/rules_score/docs/_assets/traceability_dataflow.puml
+++ b/bazel/rules/rules_score/docs/_assets/traceability_dataflow.puml
@@ -33,15 +33,15 @@ skinparam rectangle {
 ' ── Sources ───────────────────────────────────────────────────────────────────
 rectangle "Assumed System Req\nFeature Req\nComponent Req\n(.trlc)" <<src>> as reqs_in
 rectangle "public_api.puml\n(architectural_design)" <<src>> as api_in
-rectangle "failuremodes.trlc\ncontrolmeasures.trlc" <<src>> as fmcm_in
+rectangle "failuremodes.trlc\nsafetymeasures.trlc" <<src>> as fmcm_in
 rectangle "fta.puml" <<src>> as fta_in
 rectangle "Unit tests\n(cc_test / gtest)" <<src>> as test_in
 
 ' ── Lobster artefacts (one per source kind) ───────────────────────────────────
 rectangle "requirements.lobster" <<lob>> as reqs_lob
 rectangle "public_api.lobster" <<lob>> as api_lob
-rectangle "failuremodes.lobster\ncontrolmeasures.lobster" <<lob>> as fmcm_lob
-rectangle "root_causes.lobster" <<lob>> as rc_lob
+rectangle "failuremodes.lobster\nsafetymeasures.lobster" <<lob>> as fmcm_lob
+rectangle "fta_failure_modes.lobster\nfta_root_causes.lobster" <<lob>> as rc_lob
 rectangle "<unit>.lobster\n(test results)" <<lob>> as test_lob
 
 ' ── Aggregation + gate ────────────────────────────────────────────────────────
diff --git a/bazel/rules/rules_score/docs/integration_guide.rst b/bazel/rules/rules_score/docs/integration_guide.rst
index b7d2604e..7fb5b766 100644
--- a/bazel/rules/rules_score/docs/integration_guide.rst
+++ b/bazel/rules/rules_score/docs/integration_guide.rst
@@ -190,7 +190,7 @@ Complete Example
         "architectural_design", "assumed_system_requirements",
         "assumptions_of_use", "component", "component_requirements",
         "dependability_analysis", "dependable_element",
-        "feature_requirements", "fmea", "unit")
+        "feature_requirements", "safety_analysis", "unit")
 
    # Requirements
    assumed_system_requirements(name = "sys_req", srcs = ["docs/sys_req.trlc"])
@@ -208,11 +208,11 @@ Complete Example
                         public_api = ["docs/public_api.puml"])
 
    # Safety analysis
-   fmea(name = "my_fmea", arch_design = ":arch",
-        controlmeasures = ["docs/controls.trlc"],
+   safety_analysis(name = "my_safety_analysis", arch_design = ":arch",
+        safetymeasures  = ["docs/safetymeasures.trlc"],
         failuremodes    = ["docs/failures.trlc"],
         root_causes     = ["docs/fta.puml"])
-   dependability_analysis(name = "analysis", fmea = [":my_fmea"])
+   dependability_analysis(name = "analysis", safety_analysis = [":my_safety_analysis"])
 
    # Implementation
    cc_library(name = "kvs_lib", srcs = ["kvs.cpp"], hdrs = ["kvs.h"])
diff --git a/bazel/rules/rules_score/docs/overview.rst b/bazel/rules/rules_score/docs/overview.rst
index 27cc14b5..064de091 100644
--- a/bazel/rules/rules_score/docs/overview.rst
+++ b/bazel/rules/rules_score/docs/overview.rst
@@ -101,8 +101,8 @@ target two layers of checks apply:
 - **S-CORE requirements model**  enforces the
   derivation chain ``AssumedSystemReq → FeatReq → CompReq``, requires an ``Asil`` safety
   classification and defines the safety-analysis
-  vocabulary (``FailureMode`` with HAZOP ``Guideword``\ s, ``ControlMeasure``,
-  ``AoU``) used by ``fmea``/``assumptions_of_use``.
+  vocabulary (``FailureMode`` with HAZOP ``Guideword``\ s, ``SafetyMeasure``,
+  ``AoU``) used by ``safety_analysis``/``assumptions_of_use``.
 
 Architecture consistency (build)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -192,7 +192,7 @@ lacks full up/down traceability.
       "Architecture" [fillcolor="#4CAF50", fontcolor="white"];
       "Public API" [fillcolor="#4CAF50", fontcolor="white"];
       "Failure Modes" [fillcolor="#2196F3", fontcolor="white"];
-      "Control Measures" [fillcolor="#2196F3", fontcolor="white"];
+      "Safety Measures" [fillcolor="#2196F3", fontcolor="white"];
       "Root Causes" [fillcolor="#FF9800", fontcolor="white"];
       "Forwarded AoUs" -> "Received AoUs";
       "Component Requirements" -> "Feature Requirements";
@@ -202,7 +202,7 @@ lacks full up/down traceability.
       "Architecture" -> "Component Requirements";
       "Failure Modes" -> "Public API";
       "Root Causes" -> "Failure Modes";
-      "Root Causes" -> "Control Measures";
+      "Root Causes" -> "Safety Measures";
    }
 
 Execution Overview (Current Behavior)
@@ -315,7 +315,7 @@ Quick Reference
    * - :ref:`unit_design <rule-unit-design>`
      - Artifact
      - :doc:`user_guide/unit_design`
-   * - :ref:`fmea <rule-fmea>`
+   * - :ref:`safety_analysis <rule-safety-analysis>`
      - Artifact
      - :doc:`user_guide/dependability_analysis`
    * - :ref:`dependability_analysis <rule-dependability-analysis>`
diff --git a/bazel/rules/rules_score/docs/requirements/tool_requirements.trlc b/bazel/rules/rules_score/docs/requirements/tool_requirements.trlc
index 0150d03a..122f3c00 100644
--- a/bazel/rules/rules_score/docs/requirements/tool_requirements.trlc
+++ b/bazel/rules/rules_score/docs/requirements/tool_requirements.trlc
@@ -82,7 +82,7 @@ section "Tool Requirements" {
 
         ToolQualification.ToolRequirement Render_All_Failure_Modes {
             description = '''
-                The FMEA rule shall render every FailureMode record from the
+                The safety_analysis rule shall render every FailureMode record from the
                 input TRLC sources into the documentation output.
             '''
             mitigates = [Missing_Failure_Mode_In_Render]
diff --git a/bazel/rules/rules_score/docs/rule_reference.rst b/bazel/rules/rules_score/docs/rule_reference.rst
index d305ba0b..4c22b2e4 100644
--- a/bazel/rules/rules_score/docs/rule_reference.rst
+++ b/bazel/rules/rules_score/docs/rule_reference.rst
@@ -392,7 +392,7 @@ architectural_design
 
 Bundles static, dynamic, public-API, and internal-API architecture views into a
 single target. Provides ``ArchitecturalDesignInfo`` consumed by ``dependable_element``
-and ``fmea``.
+and ``safety_analysis``.
 
 .. code-block:: python
 
@@ -528,21 +528,21 @@ implementation.
 
 **Generated targets:** ``<name>`` (no standalone test; diagrams are consumed by the parent ``unit``)
 
-.. _rule-fmea:
+.. _rule-safety-analysis:
 
-fmea
-~~~~
+safety_analysis
+~~~~~~~~~~~~~~~
 
-Bundles failure modes, control measures, and FTA diagrams into a single FMEA
+Bundles failure modes, safety measures, and FTA diagrams into a single FMEA
 documentation target.
 
 .. code-block:: python
 
-   fmea(
-       name            = "my_fmea",
+   safety_analysis(
+       name            = "my_safety_analysis",
        failuremodes    = ["docs/failuremodes.trlc"],
-       controlmeasures = ["docs/controlmeasures.trlc"],
        root_causes     = ["docs/fta.puml"],
+       safetymeasures  = ["docs/safetymeasures.trlc"],
        arch_design     = ":arch",
    )
 
@@ -562,14 +562,20 @@ documentation target.
      - label list
      - no
      - ``.trlc`` files containing ``FailureMode`` records (default ``[]``)
-   * - ``controlmeasures``
+   * - ``safetymeasures``
      - label list
      - no
-     - ``.trlc`` files containing ``ControlMeasure`` records (default ``[]``)
+     - ``.trlc`` files containing ``Mitigation``/``AoU``/``CompReq`` records (default ``[]``)
    * - ``root_causes``
      - label list
      - no
      - FTA PlantUML diagram files (``.puml`` / ``.plantuml``) (default ``[]``)
+   * - ``fta_package``
+     - string
+     - no
+     - TRLC package name for the generated ``fta_events.trlc`` stub (the
+       ``FtaFailureMode``/``RootCause`` records derived from ``root_causes``).
+       Defaults to a sanitized form of ``name`` with a ``_fta`` suffix.
    * - ``arch_design``
      - label
      - no
@@ -586,7 +592,7 @@ documentation target.
 dependability_analysis
 ~~~~~~~~~~~~~~~~~~~~~~
 
-Wraps one or more ``fmea`` targets into a complete safety-analysis package.
+Wraps one or more ``safety_analysis`` targets into a complete safety-analysis package.
 Running ``bazel test`` validates the full FMEA traceability chain.
 
 .. code-block:: python
@@ -594,7 +600,7 @@ Running ``bazel test`` validates the full FMEA traceability chain.
    dependability_analysis(
        name        = "analysis",
        arch_design = ":my_arch",
-       fmea        = [":my_fmea"],
+       safety_analysis = [":my_safety_analysis"],
    )
 
 .. list-table::
@@ -609,10 +615,14 @@ Running ``bazel test`` validates the full FMEA traceability chain.
      - string
      - yes
      - Target name
-   * - ``fmea``
+   * - ``safety_analysis``
+     - label list
+     - no
+     - ``safety_analysis`` targets to include in this analysis (default ``[]``)
+   * - ``measures``
      - label list
      - no
-     - ``fmea`` targets to include in this analysis (default ``[]``)
+     - Additional ``Mitigation``/``AoU``/``CompReq`` ``.trlc`` files not scoped to a single ``safety_analysis`` target, considered for the root-cause-coverage completeness check (default ``[]``)
    * - ``arch_design``
      - label
      - no
diff --git a/bazel/rules/rules_score/docs/tooling_architecture.rst b/bazel/rules/rules_score/docs/tooling_architecture.rst
index 65debd15..48ffe6d6 100644
--- a/bazel/rules/rules_score/docs/tooling_architecture.rst
+++ b/bazel/rules/rules_score/docs/tooling_architecture.rst
@@ -28,7 +28,7 @@ Three layers
 build wires layers 2 and 3 automatically.
 
 #. **Macros / rules** (Starlark, ``private/*.bzl``) — the public work-product
-   declarations (``feature_requirements``, ``architectural_design``, ``fmea``,
+   declarations (``feature_requirements``, ``architectural_design``, ``safety_analysis``,
    ``unit``, ``component``, ``dependability_analysis``, ``dependable_element``,
    …). Each one declares actions and emits **providers**.
 #. **Providers** (``providers.bzl``) — the typed contracts that carry data
@@ -37,7 +37,7 @@ build wires layers 2 and 3 automatically.
    :doc:`overview` for the provider-flow diagram.
 #. **Tools** — the executables each action runs. Some are vendored third-party
    tools (TRLC, Lobster, the PlantUML parser, Sphinx); some are local helpers
-   under ``src/`` (``rst_to_trlc.py``, ``fmea_assembler.py``,
+   under ``src/`` (``rst_to_trlc.py``, ``safety_analysis_assembler.py``,
    ``sphinx_html_merge.py``). The FMEA fault-tree processing lives in the Rust
    ``puml_cli`` (FTA mode, backed by the ``puml_fta`` crate).
 
@@ -79,10 +79,10 @@ are rendered under :doc:`tool_reference/index`.
      - ``@trlc//tools/trlc_rst:trlc_rst`` + TRLC parser;
        ``trlc_requirements_test``
      - ``feature_requirements``, ``component_requirements``,
-       ``assumed_system_requirements``, ``fmea``
+       ``assumed_system_requirements``, ``safety_analysis``
      - Parses and type-checks requirement / FMEA records against the ``.rsl``
        metamodel and renders them to ``.rst``.  ``trlc_rst`` also ships a
-       reusable ``TRLCRST`` library that ``fmea_assembler`` links directly to
+       reusable ``TRLCRST`` library that ``safety_analysis_assembler`` links directly to
        build the FMEA page from a single in-process parse (no per-record
        ``.inc`` files).
    * - **rst_to_trlc**
@@ -102,40 +102,33 @@ are rendered under :doc:`tool_reference/index`.
    * - **puml_cli (FTA mode)**
      - ``//plantuml/parser/puml_cli`` ``--fta-output-dir`` (Rust; FTA model in
        the ``puml_fta`` crate)
-     - ``fmea``
-     - Analysis only: parses the ``$TopEvent`` / ``$BasicEvent`` / gate macro
-       calls of each root-cause FTA diagram into
-       two outputs: ``root_causes.lobster`` (``lobster-act-trace``) and
-       ``fta_chains.json`` (the ordered per-failure-mode chains).  The authored
+     - ``safety_analysis``
+     - Analysis only: parses the ``$FailureMode`` / ``$RootCause`` / gate macro
+       calls of each root-cause FTA diagram and emits ``fta_events.trlc``, a
+       generated stub file (imported as the ``<name>_fta`` package) containing
+       one ``FtaFailureMode`` record per ``$FailureMode`` call and one ``RootCause``
+       record per reachable ``$RootCause`` alias.  The authored
        diagram keeps its ``!include fta_metamodel.puml``; the metamodel ships in
        the docs toolchain runfiles and is put on PlantUML's global include path
        (``-Dplantuml.include.path``) so the include resolves at render even under
-       sphinxcontrib-plantuml's ``-pipe`` mode.  Unrooted basic events and
+       sphinxcontrib-plantuml's ``-pipe`` mode.  Unrooted root causes and
        malformed TRLC aliases are reported as build warnings rather than silently
        dropped.
-   * - **fmea_assembler**
-     - ``//bazel/rules/rules_score:fmea_assembler``
-       (``src/fmea_assembler.py``, local; links the ``TRLCRST`` library)
-     - ``fmea``
-     - Assembles the failure-mode-centric ``fmea.rst`` from ``fta_chains.json``
-       plus the FailureMode / ControlMeasure records in one in-process TRLC
+   * - **safety_analysis_assembler**
+     - ``//bazel/rules/rules_score:safety_analysis_assembler``
+       (``src/safety_analysis_assembler.py``, local; links the ``TRLCRST`` library)
+     - ``safety_analysis``
+     - Assembles the failure-mode-centric ``safety_analysis.rst`` from ``fta_events.trlc``
+       plus the FailureMode / Mitigation / AoU / CompReq records in one
+       in-process TRLC
        parse: an overview table, one section per failure mode (detail + inline
-       fault tree + that chain's control measures), and trailing "Unlinked"
-       sections so nothing is dropped.
-   * - **safety_analysis_tools**
-     - ``//bazel/rules/rules_score:safety_analysis_tools``
-       (``src/safety_analysis_tools.py``, local)
-     - ``fmea``
-     - Assembles the failure-mode-centric ``fmea.rst`` from ``fta_chains.json``
-       plus the FailureMode / ControlMeasure records in one in-process TRLC
-       parse: an overview table, one section per failure mode (detail + inline
-       fault tree + that chain's control measures), and trailing "Unlinked"
+       fault tree + that chain's measures), and trailing "Unlinked"
        sections so nothing is dropped.
    * - **Lobster**
      - ``@lobster//`` : ``lobster-trlc``, ``lobster-report``,
        ``lobster-ci-report``, ``lobster-html-report``, ``gtest_report``,
        ``lobster-rst-report``
-     - ``*_requirements``, ``fmea``, ``unit``, ``dependability_analysis``,
+     - ``*_requirements``, ``safety_analysis``, ``unit``, ``dependability_analysis``,
        ``dependable_element``
      - The traceability backbone. ``lobster-trlc`` extracts ``.lobster`` items
        from TRLC; ``gtest_report`` turns test results into ``.lobster``;
@@ -205,8 +198,9 @@ feed that pipeline:
 * **Requirements** (``.trlc``) → ``lobster-trlc`` → ``requirements.lobster``.
 * **Public API diagrams** (``public_api.puml``) → PlantUML parser →
   ``public_api.lobster`` (enables failure-mode-to-interface tracing).
-* **FMEA** (``failuremodes.trlc`` / ``controlmeasures.trlc``) → ``lobster-trlc``;
-  **FTA** (``fta.puml``) → ``puml_cli`` (FTA mode) → ``root_causes.lobster``.
+* **FMEA** (``failuremodes.trlc`` / ``safetymeasures.trlc``) → ``lobster-trlc``;
+  **FTA** (``fta.puml``) → ``puml_cli`` (FTA mode) → ``fta_events.trlc`` →
+  ``lobster-trlc`` → ``fta_failure_modes.lobster`` / ``fta_root_causes.lobster``.
 * **Unit tests** (gtest) → ``gtest_report`` → ``<unit>.lobster``.
 
 Lobster report assembly (``dependable_element``)
@@ -328,9 +322,9 @@ Safety analysis document pipeline
 
 The component diagram below shows how the FMEA **input artifacts** — authored
 ``.trlc`` records and ``fta_*.puml`` diagrams plus the tooling defaults
-(``ScoreReq`` ``.rsl`` spec, ``fta_metamodel.puml``, ``fmea.template.rst`` and
+(``ScoreReq`` ``.rsl`` spec, ``fta_metamodel.puml``, ``safety_analysis.template.rst`` and
 the lobster configs) — flow through the three in-process tool actions of the
-``fmea`` rule into the generated files, the providers, and finally the Sphinx
+``safety_analysis`` rule into the generated files, the providers, and finally the Sphinx
 staging tree.  Blue boxes are authored sources, light-blue are tooling defaults,
 green components are the tool actions, orange boxes are generated files, yellow
 boxes are the provider payloads, and the purple box is the staging directory
@@ -341,38 +335,41 @@ consumed by Sphinx.
    :alt: Safety analysis document pipeline
    :width: 100%
 
-The ``fmea`` rule drives three actions, all reading the input artifacts above:
+The ``safety_analysis`` rule drives three actions, all reading the input artifacts above:
 
 #. **puml_cli (FTA mode)** parses each ``fta_*.puml`` directly (no rewriting)
-   and writes ``root_causes.lobster`` and ``fta_chains.json`` (the ordered
-   per-failure-mode chains).  The diagrams keep their ``!include
+   and writes ``fta_events.trlc`` (the generated ``FtaFailureMode``/``RootCause``
+   stubs).  The diagrams keep their ``!include
    fta_metamodel.puml``; the metamodel is on PlantUML's global include path
    (shipped in the docs toolchain runfiles), so it resolves at render time.
-#. **fmea_assembler** consumes ``fta_chains.json`` and parses the FailureMode /
-   ControlMeasure ``.trlc`` records (with the ``.rsl`` spec for import
+#. **safety_analysis_assembler** consumes ``fta_events.trlc`` and parses the FailureMode /
+   Mitigation / AoU / CompReq ``.trlc`` records (with the ``.rsl`` spec for import
    resolution) in a single in-process ``TRLCRST`` pass, expanding
-   ``fmea.template.rst`` into ``fmea.rst``.
-#. **lobster-trlc** (run twice) turns the FailureMode and ControlMeasure records
-   into ``failuremodes.lobster`` / ``controlmeasures.lobster`` for the
+   ``safety_analysis.template.rst`` into ``safety_analysis.rst``.
+#. **lobster-trlc** (run four times) turns the FailureMode, Mitigation/AoU/CompReq,
+   and generated ``FtaFailureMode``/``RootCause`` records
+   into ``failuremodes.lobster`` / ``safetymeasures.lobster`` /
+   ``fta_failure_modes.lobster`` / ``fta_root_causes.lobster`` for the
    traceability report.
 
 ``SphinxSourcesInfo`` carries three depsets:
 
 - **srcs** — files that become top-level toctree entries in the enclosing
-  document section.  ``fmea`` emits exactly one: ``fmea.rst``.
+  document section.  ``safety_analysis`` emits exactly one: ``safety_analysis.rst``.
 - **deps** — all files that must be present in the staging directory; for
-  ``fmea`` this is just ``fmea.rst``, because the page is self-contained
+  ``safety_analysis`` this is just ``safety_analysis.rst``, because the page is self-contained
   (failure modes and control measures are rendered inline, not pulled in via
   ``.. include::``).
 - **aux_srcs** — files to symlink alongside ``srcs``/``deps`` but **not** added
-  to any toctree.  ``fmea`` uses this for the authored ``fta_*.puml`` diagrams,
-  which ``fmea.rst`` references inline via ``.. uml::`` and which must therefore
+  to any toctree.  ``safety_analysis`` uses this for the authored ``fta_*.puml`` diagrams,
+  which ``safety_analysis.rst`` references inline via ``.. uml::`` and which must therefore
   sit beside it in the staging tree without being indexed as documents.  (The
   metamodel is not staged here — it resolves via PlantUML's global include
   path.)
 
 The lobster outputs travel separately on ``AnalysisInfo.lobster_files``
-(``failuremodes.lobster``, ``controlmeasures.lobster``, ``root_causes.lobster``)
+(``failuremodes.lobster``, ``safetymeasures.lobster``, ``fta_failure_modes.lobster``,
+``fta_root_causes.lobster``)
 into the ``dependability_analysis`` traceability report.
 
 .. _hermetic-tool-path-resolution:
diff --git a/bazel/rules/rules_score/docs/user_guide/architectural_design.rst b/bazel/rules/rules_score/docs/user_guide/architectural_design.rst
index 0e0756c8..97a3ec5a 100644
--- a/bazel/rules/rules_score/docs/user_guide/architectural_design.rst
+++ b/bazel/rules/rules_score/docs/user_guide/architectural_design.rst
@@ -507,7 +507,7 @@ Bazel
         public_api = ["public_api.puml"],
     )
 
-The ``public_api`` attribute also generates traceability items that can be referenced by ``fmea`` targets (see :doc:`dependability_analysis`) via the ``arch_design`` attribute.
+The ``public_api`` attribute also generates traceability items that can be referenced by ``safety_analysis`` targets (see :doc:`dependability_analysis`) via the ``arch_design`` attribute.
 
 Internal API
 --------------
diff --git a/bazel/rules/rules_score/docs/user_guide/assumptions_of_use.rst b/bazel/rules/rules_score/docs/user_guide/assumptions_of_use.rst
index 93d84e5c..a796c391 100644
--- a/bazel/rules/rules_score/docs/user_guide/assumptions_of_use.rst
+++ b/bazel/rules/rules_score/docs/user_guide/assumptions_of_use.rst
@@ -16,8 +16,9 @@ Assumptions of Use
 ===================
 
 Conditions that the *integrating project* must satisfy when using your SEooC.
-The optional ``mitigates`` field describes (as a free-form string) the hazard
-or risk that is mitigated when this assumption is fulfilled.
+The optional ``root_causes`` field lets an ``AoU`` close one or more FTA
+``RootCause`` root causes directly, pushing the obligation to prevent them
+out to the integrator.
 
 Traceability to requirements is established at the Bazel level via the ``deps``
 attribute on the ``assumptions_of_use`` rule — there is no TRLC ``derived_from``
@@ -33,9 +34,8 @@ however, declare that it implements a received AoU by referencing it from its ow
     import ScoreReq
 
     ScoreReq.AoU SampleAoU {
-        description = "It shall be made sure that this SampleAoU never ends up anywhere"
+        description = "It shall be made sure that shared memory segments are never created with the wrong name (ShmemCreatedWrongName)"
         safety      = ScoreReq.Asil.B
-        mitigates   = "ShmemCreatedWrongName"
         version     = 1
     }
 
diff --git a/bazel/rules/rules_score/docs/user_guide/dependability_analysis.rst b/bazel/rules/rules_score/docs/user_guide/dependability_analysis.rst
index 00b1b020..7931bab9 100644
--- a/bazel/rules/rules_score/docs/user_guide/dependability_analysis.rst
+++ b/bazel/rules/rules_score/docs/user_guide/dependability_analysis.rst
@@ -12,11 +12,11 @@
    # SPDX-License-Identifier: Apache-2.0
    # *******************************************************************************
 
-Dependability Analysis
-=======================
+Safety Analysis
+================
 
 .. note::
-   A complete working example covering ``fmea`` and ``dependability_analysis`` is
+   A complete working example covering ``safety_analysis`` and ``dependability_analysis`` is
    available in
    `bazel/rules/rules_score/examples/seooc/safety_analysis/ <https://github.com/eclipse-score/tooling/tree/main/bazel/rules/rules_score/examples/seooc/safety_analysis>`_.
 
@@ -30,25 +30,43 @@ Overview
 Why safety analysis?
 ~~~~~~~~~~~~~~~~~~~~~
 
-Safety analysis is required to systematically identify failures that could
-violate safety goals and to demonstrate that appropriate countermeasures are
-in place. In ISO 26262 terms it provides the evidence that residual risk is
-acceptable.
+A safety analysis shall support the process to systematically identify failures which could
+violate safety goals or safety requirements. It shall also help to identify their root causes and design
+appropriate countermeasures.
 
-How FMEA works
-~~~~~~~~~~~~~~~
+Safety analyses are typically performed with two complementary methods:
 
-A Failure Mode and Effects Analysis (FMEA) follows three steps for each public
-interface of the software module:
+- **FMEA (Failure Mode and Effects Analysis)** is an inductive, bottom-up method:
+  it examines individual components mainly at their interfaces, how they can fail, and what effect those failures have on the overall system.
+- **FTA (Fault Tree Analysis)** is a deductive, top-down method:
+  depending on the context it starts from a safety goal / safety requirement / failure (mode) and traces back to the potential causes that could lead to it.
 
-1. **Identify failure modes** — apply structured fault models (see below) to
-   each public interface to derive what can cause a violation of a
-   overarching safety goal.
-2. **Analyse effects and causes** — document the effect on the system and
-   decompose to root causes using a Fault Tree Analysis (FTA).
-3. **Define countermeasures** — for every root cause specify a
-   ``ControlMeasure`` (or ``PreventiveMeasure`` / ``Mitigation``) and trace it
-   back through the FTA to the failure mode.
+How safety analyses are used in this context
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+SEooCs are designed to be included in a system (e.g. platform). This means that from a system point
+of view the SEooCs are the leaves of its FMEA. Thus failure modes of the SEooC can be
+identified by applying the FMEA methodology (structured fault models) to its interface (aka public API).
+
+In a second step the root causes of the identified failure modes need to be analyzed within the SEooC. This
+can be achieved by performing a Fault Tree Analysis (FTA). Each identified root cause then needs to be
+treated with appropriate safety measures to guarantee that a safety-related failure mode cannot occur in
+the first place.
+
+So the single steps are:
+
+1. **Identify failure modes** — apply structured fault models (see
+   `Fault models`_) to each public interface to derive what can cause a
+   violation of an overarching safety goal.
+2. **Analyze effects and causes** — decompose the identified failure modes
+   into their root causes using a Fault Tree Analysis (FTA).
+3. **Define countermeasures** — for every root cause, close it with a
+   ``Mitigation``, a ``CompReq``, or push the obligation outward with an
+   ``AoU``, and trace it back through the FTA to the root cause.
+4. **Wire and validate** — bundle the resulting artifacts in Bazel and let the
+   traceability check verify that they are consistently linked.
+
+Each step is described in detail in `Performing the Analysis`_.
 
 Fault models
 ~~~~~~~~~~~~~
@@ -63,29 +81,72 @@ loss, delay, corruption, non-determinism). The ``Guideword`` enum in the
 ``ScoreReq`` model maps each category to a structured label used in the
 ``FailureMode`` records.
 
-The description below covers the FMEA-based **safety** analysis for a
-software module.
+Artifacts and traceability
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+As mentioned above, the safety analysis method used by ``dependability_analysis`` is a combination of
+both an FMEA and a FTA. Each ``safety_analysis`` target bundles four types of artifacts that must be
+linked together:
+
+.. list-table::
+   :header-rows: 1
+
+   * - Artifact
+     - Format
+     - What it represents
+     - Created in
+   * - **Public API Interfaces**
+     - PlantUML (from ``architectural_design.public_api``)
+     - Interfaces where failures can manifest; referenced by ``FailureMode.interface``
+     - :doc:`architectural_design`
+   * - **Failure Modes**
+     - TRLC (``.trlc``)
+     - Effects identified in the FMEA: what can go wrong and its impact
+     - Step 1
+   * - **FTA Diagrams**
+     - PlantUML (``.puml``)
+     - Fault Tree Analysis: structural decomposition of each failure mode into root causes
+     - Step 2
+   * - **Safety Measures**
+     - TRLC (``.trlc``)
+     - Countermeasures that address the root causes identified in the FTA
+     - Step 3
+
+The artifacts are linked as follows:
+
+- ``FailureMode.interface`` references an element of the ``public_api`` of the
+  ``architectural_design`` target. This connects the architectural view to the
+  safety analysis.
+- Every ``$FailureMode`` node in an FTA diagram names the **TRLC
+  fully-qualified record name(s)** (``Package.RecordName``) of the
+  ``FailureMode``(s) it covers.
+- Every ``$RootCause`` leaf in an FTA diagram gets a plain-identifier alias. A
+  dedicated tool generates a ``RootCause`` stub for each such alias, which a
+  ``Mitigation``/``CompReq``/``AoU`` then references explicitly from its
+  ``root_causes``/``derived_from`` field.
+
+The traceability check verifies these links automatically (see
+`Traceability Validation`_).
 
 Performing the Analysis
 -----------------------
 
 The Bazel rule and traceability check only verify that the artifacts are
-*linked* — they cannot tell you whether the analysis is *complete or correct*.
+*linked* and *traced* — they cannot tell you whether the analysis is *complete or correct*.
 Identifying failure modes, reasoning about causes, and choosing countermeasures
-is a safety-engineering activity governed by the S-CORE
-`Safety Analysis process area <https://eclipse-score.github.io/process_description/main/process_areas/safety_analysis/index.html>`_
-and its
-`FMEA fault models guideline <https://eclipse-score.github.io/process_description/main/process_areas/safety_analysis/guidance/fault_models_guideline.html>`_.
-Work through it in this order.
+is a safety-engineering activity.
+
+The following steps walk through this activity. Each step first explains the
+safety reasoning and then shows how its result is recorded as an artifact. All
+snippets are taken from the SEooC example in
+``bazel/rules/rules_score/examples/seooc``.
 
 Step 1 — Identify failure modes per interface
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Go through the ``public_api`` **method by method**. For each method, walk the
 applicable fault models and ask *"can this occur, and would it violate a safety
-goal?"* Record only the plausible, safety-relevant ones — the guideline marks
-many models as *low relevance* (e.g. "message received too early") that you can
-dismiss with a short rationale.
+goal or safety requirement?"*
 
 The ``Guideword`` enum labels the fault-model category on each ``FailureMode``:
 
@@ -97,132 +158,25 @@ The ``Guideword`` enum labels the fault-model category on each ``FailureMode``:
      - Example fault models
      - ``Guideword`` labels
    * - **Message** (send/receive)
-     - not sent / not received, corrupted, lost, unintended (``MF_01_*``)
+     - not sent / not received, corrupted, lost, unintended
      - ``LossOfFunction``, ``PartialFunction``, ``Corrupted``,
        ``UnintendedFunction``, ``Wrong``
    * - **Timing / duration constraint**
-     - too late / too early, boundary violated (``CO_01_*``)
+     - too late / too early, boundary violated
      - ``TooEarly``, ``TooLate``, ``DelayedFunction``
    * - **Execution**
-     - wrong result, loss of execution, arbitrary/incomplete (``EX_01_*``)
+     - wrong result, loss of execution, arbitrary/incomplete
      - ``Wrong``, ``LossOfFunction``, ``ExceedingFunction``, ``ArbitraryExecution``
 
-**Clustering:** create **one** ``FailureMode`` record per *(interface, guideword)*
-effect, not one per method blindly. If the same root cause produces the same
-effect across several methods, list them together in the ``interface`` field. A
-single root cause that manifests under two guide words needs two records (TRLC
-allows one ``guidewords`` classification per record).
-
-Step 2 — Analyse the effect, then decompose to causes
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-- **Effect** (``failureeffect``) — describe the consequence **from the caller /
-  system perspective**, in worst-case terms, relative to the safety goal. "Returns
-  a stale value that the controller uses to actuate" is a usable effect; "function
-  returns wrong data" is not.
-- **Causes** — build the Fault Tree (FTA) top-down from the failure mode to its
-  **root causes**:
-
-  - Use an **OR gate** when *any single* child cause is sufficient to produce the
-    parent — this is the default for independent causes.
-  - Use an **AND gate** only when *all* children must occur together (e.g. a fault
-    plus the failure of a safety mechanism) — this is what justifies a lower
-    residual risk.
-  - Decompose until each leaf (``$BasicEvent``) is an **actionable root cause** you
-    can place a measure on — not a vague restatement of the failure.
-
-Step 3 — Choose a countermeasure for every root cause
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-Every ``$BasicEvent`` needs exactly one measure record. Pick the type by *when* it
-acts:
-
-.. list-table::
-   :header-rows: 1
-   :widths: 24 46 30
-
-   * - Type
-     - Use when the measure…
-     - Acts
-   * - ``PreventiveMeasure``
-     - removes the cause so the fault cannot occur.
-     - before
-   * - ``ControlMeasure``
-     - detects and handles the fault at runtime (plausibility check, monitor).
-     - during
-   * - ``Mitigation``
-     - reduces severity/probability after the fault has occurred.
-     - after
-   * - ``AoU`` (Assumption of Use)
-     - can only be guaranteed by the **integrator/caller**, not inside the SEooC.
-     - at integration
-
-An ``AoU`` is how you *push an obligation outward* when the SEooC cannot close a
-root cause itself — it must be forwarded to the integrating project (see
-:doc:`assumptions_of_use`).
-
-**ASIL rationale:** the ``safety`` level on a ``FailureMode`` follows the safety
-goal it can violate; a ``ControlMeasure`` that an ASIL argument relies on inherits
-that level. Record *why* a measure is sufficient — an AND-gate decomposition or a
-diagnostic coverage claim — rather than only *that* it exists.
-
-Bazel Rule ``dependability_analysis``
-----------------------------------------
-
-.. code-block:: starlark
-
-    load("@score_tooling//bazel/rules/rules_score:rules_score.bzl",
-         "dependability_analysis")
-
-    dependability_analysis(
-        name        = "my_da",
-        arch_design = ":my_arch",
-        fmea        = [":my_fmea"],
-    )
-
-**Generated targets:** ``<name>`` — build produces the documentation and
-traceability report; ``bazel test`` validates the full chain.
-
-FMEA
-----
-
-The Failure Mode and Effects Analysis (FMEA) is the core safety analysis
-method used by ``dependability_analysis``. Each ``fmea`` target bundles four
-types of artifacts that must be linked together:
-
-.. list-table::
-   :header-rows: 1
-
-   * - Artifact
-     - Format
-     - What it represents
-   * - **Public API Interfaces**
-     - PlantUML (from ``architectural_design.public_api``)
-     - Interfaces where failures can manifest; referenced by ``FailureMode.interface``
-   * - **Failure Modes**
-     - TRLC (``.trlc``)
-     - Effects identified in the FMEA: what can go wrong and its impact
-   * - **FTA Diagrams**
-     - PlantUML (``.puml``)
-     - Fault Tree Analysis: structural decomposition of each failure mode into root causes
-   * - **Control Measures**
-     - TRLC (``.trlc``)
-     - Countermeasures that address the root causes identified in the FTA
-
-The public API connects the architectural view to the safety analysis:
-``FailureMode.interface`` references an interface name defined in the
-``public_api`` of the ``architectural_design`` target.
-
-The FTA artifacts are linked by a shared naming convention: the **TRLC
-fully-qualified record name** (package + record name) must match the
-**alias** used in the FTA PlantUML diagram. This is how traceability is
-established automatically in the report.
+Recording failure modes (TRLC)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Failure Modes (TRLC)
-~~~~~~~~~~~~~~~~~~~~~
-
-A failure mode is a ``FailureMode`` record in the ``ScoreReq`` model. The
-example below is taken from ``examples/seooc/safety_analysis``:
+Each identified failure mode is recorded as a ``ScoreReq.FailureMode`` record
+in a ``.trlc`` file (here ``sample_safety_analysis_failure_modes.trlc``). The
+TRLC ``package`` name (``SampleLibrary`` below) is chosen freely by the author —
+it is not derived from the Bazel target name and is not enforced by the rule
+(only the *generated* ``<name>_fta`` package, see `Modeling the fault tree
+(PlantUML)`_, is fixed):
 
 .. code-block:: text
 
@@ -236,72 +190,142 @@ example below is taken from ``examples/seooc/safety_analysis``:
         failureeffect = "The world as we know it will end"
         version = 1
         safety = ScoreReq.Asil.B
-        interface = "SampleLibraryAPI.GetNumber"
+        interface = "safety_software_seooc_example.SampleLibraryAPI.GetNumber"
     }
 
-The TRLC fully-qualified name of this record is
-**``SampleLibrary.SampleFailureMode``**. This name is used as the
-``$TopEvent`` alias in the FTA diagram.
+.. list-table::
+   :header-rows: 1
+   :widths: 25 75
+
+   * - Attribute
+     - Meaning
+   * - ``guidewords``
+     - One or more ``Guideword`` values classifying the failure (see table above).
+   * - ``description``
+     - What goes wrong.
+   * - ``failureeffect``
+     - Consequence for the caller / system (see Step 2).
+   * - ``interface``
+     - Fully-qualified name of the affected ``public_api`` element
+       (``<namespace>.<Interface>.<Method>``). Links the failure mode to the
+       architecture.
+   * - ``safety``
+     - ASIL of the safety goal the failure mode can violate (see *ASIL
+       rationale* in Step 3).
+   * - ``version``
+     - Monotonically increasing counter; increment on every content change.
+   * - ``rationale`` (optional)
+     - Why this failure mode is considered relevant.
+
+The record's fully-qualified name, ``SampleLibrary.SampleFailureMode``
+(package + record name), is passed as a ``$FailureMode`` argument in Step 2,
+linking it to its fault tree.
 
-FTA Diagrams (PlantUML)
-~~~~~~~~~~~~~~~~~~~~~~~~
+Step 2 — Analyse the effect, then decompose to causes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+- **Effect** (``failureeffect``) — describe the consequence **from the caller /
+  system perspective**, in worst-case terms, relative to the safety goal. "Returns
+  a stale value that the controller uses to actuate" is a usable effect; "function
+  returns wrong data" is not.
+- **Causes** — build the Fault Tree (FTA) top-down from the failure mode to its
+  **root causes**:
 
-Each failure mode gets a Fault Tree Analysis diagram. A dedicated PlantUML
-metamodel
-(`fta_metamodel.puml <https://github.com/eclipse-score/tooling/blob/main/plantuml/fta_metamodel.puml>`_)
-provides the graphical elements — it is located at
-``plantuml/fta_metamodel.puml`` in the score-tooling repository. Your diagram
-uses procedure calls from that metamodel; no standard PlantUML shapes are
-needed.
+  - Use an **OR gate** when *any single* child cause is sufficient to produce the
+    parent — this is the default for independent causes.
+  - Use an **AND gate** only when *all* children must occur together (e.g. a fault
+    plus the failure of a safety mechanism) — this is what justifies a lower
+    residual risk.
+  - Decompose until each leaf (``$RootCause``) is an **actionable root cause** you
+    can place a measure on — not a vague restatement of the failure.
 
-Every ``.puml`` FTA file must begin with ``!include fta_metamodel.puml`` so
-that the procedure definitions are available.
+Modeling the fault tree (PlantUML)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-Available procedures
-^^^^^^^^^^^^^^^^^^^^^
+Each failure mode gets its own FTA diagram. A dedicated PlantUML metamodel
+(`fta_metamodel.puml <https://github.com/eclipse-score/tooling/blob/main/plantuml/fta_metamodel.puml>`_,
+located at ``plantuml/fta_metamodel.puml`` in the score-tooling repository)
+provides the graphical elements as procedures; no standard PlantUML shapes are
+needed. Every FTA ``.puml`` file must begin with ``!include fta_metamodel.puml``
+so that the procedure definitions are available.
 
 .. list-table::
    :header-rows: 1
+   :widths: 35 65
 
    * - Procedure
      - Description
-   * - ``$TopEvent(name, alias)``
-     - The top-level failure mode. ``alias`` must equal the fully-qualified TRLC name of the corresponding ``FailureMode`` record (e.g. ``SampleLibrary.SampleFailureMode``)
+   * - ``$FailureMode(name, fm1, fm2, ..., fm8)``
+     - The failure mode(s) at the root of the tree. Each ``fm*`` is the
+       fully-qualified TRLC name (``Package.RecordName``) of a
+       ``FailureMode`` record this node covers — at least one (``fm1``) is
+       required, up to 8 total. ``fm1`` doubles as this node's alias, the
+       connection point every gate/root-cause ancestor attaches to.
    * - ``$IntermediateEvent(name, alias, connection)``
-     - An intermediate cause. ``connection`` is the **alias of the parent** node this event feeds into
-   * - ``$BasicEvent(name, alias, connection)``
-     - A root cause (leaf node). ``alias`` must equal the fully-qualified TRLC name of the corresponding ``ControlMeasure`` record. ``connection`` is the alias of the parent gate
+     - An intermediate cause that is decomposed further. ``connection`` is the
+       alias of the parent node this event feeds into.
+   * - ``$RootCause(name, alias, connection)``
+     - A root cause (leaf node). ``alias`` is a plain TRLC identifier — it
+       becomes the record name of a generated ``RootCause`` stub, referenced
+       explicitly from a measure's ``root_causes``/``derived_from`` field in
+       Step 3. ``connection`` is the alias of the parent gate.
    * - ``$AndGate(alias, connection)``
-     - AND gate. All children must occur for the parent to trigger. ``connection`` is the alias of the parent node
+     - AND gate: all children must occur for the parent to occur.
+       ``connection`` is the alias of the parent node.
    * - ``$OrGate(alias, connection)``
-     - OR gate. Any single child is sufficient to trigger the parent. ``connection`` is the alias of the parent node
+     - OR gate: any single child is sufficient for the parent to occur.
+       ``connection`` is the alias of the parent node.
    * - ``$TransferInGate(name, alias, connection)``
-     - Transfer-in gate linking to another FTA sub-tree
-
-Linking procedures together
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+     - Transfer-in gate linking to another FTA sub-tree. ``connection`` is the
+       alias of the parent node.
 
 Each element points to its **parent** via the ``connection`` parameter — the
-arrow goes *from* the element *up* to the parent. Build the tree bottom-up:
+arrow goes *from* the element *up* to the parent. Declare the tree from the top
+down:
 
-1. Declare the ``$TopEvent`` first (no ``connection`` parameter — it is the root).
-2. Declare gate(s) with ``connection`` set to the ``$TopEvent`` alias.
-3. Declare ``$BasicEvent`` / ``$IntermediateEvent`` nodes with ``connection``
-   set to the enclosing gate's alias.
+1. Declare the ``$FailureMode`` first (no ``connection`` parameter — it is the root).
+2. Declare the gate(s) with ``connection`` set to the ``$FailureMode`` alias (``fm1``).
+3. Declare ``$IntermediateEvent`` / ``$RootCause`` nodes with ``connection``
+   set to the enclosing gate's alias. An ``$IntermediateEvent`` is decomposed
+   further by gates whose ``connection`` is its alias.
 
 ::
 
-    $TopEvent  ← root, no connection
-        └── $OrGate(alias="OG_1", connection="TopEvent.alias")
-                ├── $BasicEvent(alias="CM_A", connection="OG_1")
-                └── $BasicEvent(alias="CM_B", connection="OG_1")
+    $FailureMode  ← root, no connection
+        └── $OrGate(alias="OG_1", connection="FailureMode.fm1")
+                ├── $RootCause(alias="RootCauseA", connection="OG_1")
+                └── $RootCause(alias="RootCauseB", connection="OG_1")
+
+Gate and intermediate-event aliases (e.g. ``OG_1``) are only local identifiers
+within the diagram; they do not refer to TRLC records.
+
+A dedicated Rust tool (``puml_cli``'s FTA parser) reads every ``$FailureMode``/
+``$RootCause`` in the ``safety_analysis``'s ``root_causes`` diagrams and generates a
+TRLC stub package (``fta_events.trlc``, imported as the ``<name>_fta``
+package) with one ``FtaFailureMode`` record per ``$FailureMode`` call and one
+``RootCause`` record per reachable ``$RootCause`` alias. No manual linking
+step is needed on the TRLC side beyond importing that generated package and
+referencing its records from your measure definitions (Step 3).
 
-The ``$BasicEvent`` **alias IS the fully-qualified TRLC name**
-(``Package.RecordName``) of the corresponding ``ControlMeasure`` record. No
-separate linking step is needed — the naming convention is the link.
+.. _fta-failure-mode-links:
 
-Example FTA diagram
-^^^^^^^^^^^^^^^^^^^^
+Linking a ``$FailureMode`` to its failure mode(s)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Pass every ``FailureMode`` fully-qualified name a failure-mode node covers directly
+as ``$FailureMode`` arguments. This lets several related failure modes be
+consolidated under one failure-mode node and its fault tree, instead of
+duplicating the same tree once per failure mode:
+
+.. code-block:: text
+
+    $FailureMode("Message lost, incomplete, or corrupted during transmission",
+              "MessagePassing.MessageLost",
+              "MessagePassing.MessagePartiallyDelivered",
+              "MessagePassing.MessageCorrupted")
+
+For example, the fault tree for ``SampleLibrary.SampleFailureMode`` (the
+``FailureMode`` from Step 1) decomposes as follows:
 
 .. uml:: ../_assets/SeoocExample_FTA.puml
    :align: center
@@ -312,112 +336,117 @@ Example FTA diagram
     @startuml SeoocExample_FTA
     !include fta_metamodel.puml
 
-    $TopEvent("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
+    $FailureMode("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
 
     $OrGate("OG1", "SampleLibrary.SampleFailureMode")
 
     $IntermediateEvent("SampleFailureMode is Angry", "IEF", "OG1")
-    $BasicEvent("Just bad luck", "SampleLibrary.JustBadLuck", "OG1")
+    $RootCause("Just bad luck", "JustBadLuck", "OG1")
 
     $AndGate("AG2", "IEF")
-    $BasicEvent("No More Cookies", "SampleLibrary.NoMoreCookies", "AG2")
-    $BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
+    $RootCause("No More Cookies", "NoMoreCookies", "AG2")
+    $RootCause("No More Coffee", "NoMoreCoffee", "AG2")
 
     @enduml
 
-Control Measures (TRLC)
-~~~~~~~~~~~~~~~~~~~~~~~~
+``JustBadLuck`` alone is sufficient to cause the failure mode (OR gate),
+whereas ``NoMoreCookies`` and ``NoMoreCoffee`` must occur together (AND gate)
+to cause the intermediate event. Each of these root causes needs a measure in
+Step 3.
+
+Step 3 — Choose a countermeasure for every root cause
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Every ``$RootCause`` needs to be addressed by at least one of the following.
+Pick the path by *who* closes the root cause:
 
-For each ``$BasicEvent`` in your FTA diagram, define a ``ControlMeasure``
-record whose fully-qualified name matches the event alias:
+.. list-table::
+   :header-rows: 1
+   :widths: 24 46 30
+
+   * - Type
+     - Use when the root cause is closed by…
+     - Closed via
+   * - ``Mitigation``
+     - a reasoning why the root cause cannot occur at all (due to system design, ...)
+     - ``root_causes`` + mandatory ``justification``
+   * - ``CompReq``
+     - a runtime/design measure, implemented and tested like any other component requirement.
+     - ``derived_from`` referencing the ``RootCause``
+   * - ``AoU`` (Assumption of Use)
+     - an obligation only the **integrator/caller** can guarantee, not the SEooC.
+     - optional ``root_causes``
+
+Recording measures (TRLC)
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Each measure imports the generated ``<name>_fta`` package and references the
+``RootCause`` stub(s) it addresses explicitly from its
+``root_causes``/``derived_from`` field. For example, the following
+``Mitigation`` records (from ``sample_safety_analysis_safetymeasures.trlc``)
+address the ``JustBadLuck``, ``NoMoreCookies``, and ``NoMoreCoffee`` root
+causes from the FTA diagram in Step 2:
 
 .. code-block:: text
 
     package SampleLibrary
 
     import ScoreReq
+    import sample_safety_analysis_fta
 
-    ScoreReq.ControlMeasure JustBadLuck{
+    ScoreReq.Mitigation JustBadLuck{
         safety = ScoreReq.Asil.B
         description = "Sometimes, the dark side wins. We shall be prepared for that."
+        justification = "This root cause is outside our control; no active measure can prevent it."
         version = 1
+        root_causes = [sample_safety_analysis_fta.JustBadLuck]
     }
 
-    ScoreReq.ControlMeasure NoMoreCookies{
+    ScoreReq.Mitigation NoMoreCookies{
         safety = ScoreReq.Asil.B
         description = "We shall only order family size cookie jars"
+        justification = "Ordering only family size jars keeps the reserve stable, so this root cause does not apply."
         version = 1
+        root_causes = [sample_safety_analysis_fta.NoMoreCookies]
     }
 
-    ScoreReq.ControlMeasure NoMoreCoffee{
+    ScoreReq.Mitigation NoMoreCoffee{
         safety = ScoreReq.Asil.B
         description = "We shall keep a coffee reserve for emergencies"
+        justification = "An emergency reserve is kept on hand, so this root cause does not apply."
         version = 1
+        root_causes = [sample_safety_analysis_fta.NoMoreCoffee]
     }
 
-The alias ``SampleLibrary.JustBadLuck`` in the FTA diagram matches the TRLC
-record ``JustBadLuck`` in package ``SampleLibrary`` — and likewise for
-``NoMoreCookies``/``NoMoreCoffee``. This is how the traceability link is
-established.
-
-Other measure types
-^^^^^^^^^^^^^^^^^^^^
+The alias ``JustBadLuck`` in the FTA diagram matches the ``RootCause`` stub
+``sample_safety_analysis_fta.JustBadLuck`` referenced from the ``Mitigation``'s
+``root_causes`` — and likewise for ``NoMoreCookies``/``NoMoreCoffee``. This
+explicit reference is how the traceability link is established (there is no
+implicit name-matching between the diagram alias and the ``Mitigation``
+record's own name).
+
+A ``CompReq``
+can reference the generated ``RootCause`` stub directly in its
+``derived_from`` list (closing it via a normal, implemented-and-tested
+component requirement instead of a dedicated safety measure), or an ``AoU``
+can reference it via its own optional ``root_causes`` field (pushing the
+obligation out to the integrator). ``bazel test`` on the owning
+``dependability_analysis`` target fails if a root cause is covered by none
+of ``Mitigation``, ``CompReq``, or ``AoU``.
 
-The SCORE requirements model also defines ``PreventiveMeasure`` and
-``Mitigation``, both extending the same abstract ``Measure`` base type as
-``ControlMeasure``. Their Bazel and TRLC usage follows the same pattern; the
-record type name changes but the FTA alias convention (package + record name
-matching the ``$BasicEvent`` alias) is identical.
-
-``fmea`` — Bazel Rule
-~~~~~~~~~~~~~~~~~~~~~~
-
-For the complete ``fmea`` attribute reference, see :ref:`fmea <rule-fmea>` in
-the rule index.
-
-Traceability Validation
-------------------------
-
-Running ``bazel test //my/package:my_da`` executes a traceability check that
-validates the complete chain:
-
-::
-
-          public_api interface ← FailureMode.interface
-                                            |
-                                        $TopEvent
-                                            |
-                                     AND / OR gate(s)
-                                            |
-                                       $BasicEvent
-                                            |
-                                      ControlMeasure
-
-The check fails if:
-
-- A ``$TopEvent`` alias does not match any ``FailureMode`` record name
-- A ``$BasicEvent`` alias does not match any ``ControlMeasure`` record name
-- A ``FailureMode`` or ``ControlMeasure`` is defined but not referenced in any FTA diagram
-
-Fixing a traceability error means ensuring the naming convention is followed
-precisely: the fully-qualified TRLC name (package + record name, e.g.
-``SampleLibrary.JustBadLuck``) must be used verbatim as the alias in the FTA diagram.
-
-Example
--------
+An ``AoU`` is how you *push an obligation outward* when the SEooC cannot close a
+root cause itself — it must be forwarded to the integrating project (see
+:doc:`assumptions_of_use`).
 
-The ``fmea`` rule's ``failuremodes``/``controlmeasures``/``root_causes``
-files must live in the **same package** as the ``fmea`` target itself (Bazel
-does not allow referencing another package's raw source files without
-``exports_files``). The parent ``dependability_analysis`` target then
-references the ``fmea`` target by label:
+Step 4 — Wire the analysis into Bazel
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 .. code-block:: starlark
    :caption: bazel/rules/rules_score/examples/seooc/safety_analysis/BUILD
 
    load(
        "@score_tooling//bazel/rules/rules_score:rules_score.bzl",
-       "fmea",
+       "safety_analysis",
    )
 
    filegroup(
@@ -429,15 +458,18 @@ references the ``fmea`` target by label:
        visibility = ["//visibility:public"],
    )
 
-   fmea(
-       name = "sample_fmea",
+   safety_analysis(
+       name = "sample_safety_analysis",
        arch_design = "//design:sample_seooc_design",
-       controlmeasures = ["sample_fmea_control_measures.trlc"],
-       failuremodes = ["sample_fmea_failure_modes.trlc"],
+       failuremodes = ["sample_safety_analysis_failure_modes.trlc"],
        root_causes = [":sample_fta"],
+       safetymeasures = ["sample_safety_analysis_safetymeasures.trlc"],
        visibility = ["//visibility:public"],
    )
 
+The ``dependability_analysis`` target of the dependable element then
+references one or more ``safety_analysis`` targets by label:
+
 .. code-block:: starlark
    :caption: bazel/rules/rules_score/examples/seooc/BUILD
 
@@ -447,7 +479,46 @@ references the ``fmea`` target by label:
    )
 
    dependability_analysis(
-       name        = "sample_dependability_analysis",
+       name = "sample_dependability_analysis",
        arch_design = "//design:sample_seooc_design",
-       fmea        = ["//safety_analysis:sample_fmea"],
+       safety_analysis = ["//safety_analysis:sample_safety_analysis"],
    )
+
+**Generated targets:** ``<name>`` — ``bazel build`` produces the documentation
+and traceability report; ``bazel test`` validates the full chain (see
+`Traceability Validation`_).
+
+For the complete attribute reference, see
+:ref:`safety_analysis <rule-safety-analysis>` and
+:ref:`dependability_analysis <rule-dependability-analysis>` in the rule index.
+
+Traceability Validation
+------------------------
+
+Running ``bazel test`` on the ``dependability_analysis`` target (e.g.
+``bazel test //:sample_dependability_analysis`` in the SEooC example) executes
+a traceability check that validates the complete chain:
+
+::
+
+          public_api interface ← FailureMode.interface
+                                            |
+                                        $FailureMode
+                                            |
+                                     AND / OR gate(s)
+                                            |
+                                       $RootCause
+                                            |
+                             Mitigation / CompReq / AoU
+
+The check fails if:
+
+- A ``$FailureMode`` references a failure-mode fully-qualified name that does not match any ``FailureMode`` record
+- A ``$RootCause`` alias is not a plain TRLC identifier (dotted ``Package.Name`` aliases are rejected for root causes)
+- A ``FailureMode`` is defined but not referenced by any ``$FailureMode`` in any FTA diagram
+- A root cause (``$RootCause``) is not referenced by any ``Mitigation.root_causes``, ``CompReq.derived_from``, or ``AoU.root_causes``
+
+Fixing a traceability error means ensuring the reference is explicit: the
+``Mitigation``/``CompReq``/``AoU`` must import the generated ``<name>_fta``
+package and reference the ``RootCause`` stub by name (e.g.
+``sample_safety_analysis_fta.JustBadLuck``).
diff --git a/bazel/rules/rules_score/examples/seooc/BUILD b/bazel/rules/rules_score/examples/seooc/BUILD
index de798362..06ea6d14 100644
--- a/bazel/rules/rules_score/examples/seooc/BUILD
+++ b/bazel/rules/rules_score/examples/seooc/BUILD
@@ -67,7 +67,7 @@ component(
 dependability_analysis(
     name = "sample_dependability_analysis",
     arch_design = "//design:sample_seooc_design",
-    fmea = ["//safety_analysis:sample_fmea"],
+    safety_analysis = ["//safety_analysis:sample_safety_analysis"],
 )
 
 dependable_element(
diff --git a/bazel/rules/rules_score/examples/seooc/docs/aous.trlc b/bazel/rules/rules_score/examples/seooc/docs/aous.trlc
index 28ab9a13..ddd90865 100644
--- a/bazel/rules/rules_score/examples/seooc/docs/aous.trlc
+++ b/bazel/rules/rules_score/examples/seooc/docs/aous.trlc
@@ -15,8 +15,7 @@ package SampleType
 import ScoreReq
 
 ScoreReq.AoU SampleAoU {
-    description = "It shall be made sure that this SampleAoU never ends up anywhere"
+    description = "It shall be made sure that shared memory segments are never created with the wrong name (ShmemCreatedWrongName)"
     safety = ScoreReq.Asil.B
-    mitigates = "ShmemCreatedWrongName"
     version = 1
 }
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/BUILD b/bazel/rules/rules_score/examples/seooc/safety_analysis/BUILD
index cfba949a..597f34dd 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/BUILD
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/BUILD
@@ -13,7 +13,7 @@
 
 load(
     "@score_tooling//bazel/rules/rules_score:rules_score.bzl",
-    "fmea",
+    "safety_analysis",
 )
 
 #  FTA
@@ -27,11 +27,11 @@ filegroup(
     visibility = ["//visibility:public"],
 )
 
-fmea(
-    name = "sample_fmea",
+safety_analysis(
+    name = "sample_safety_analysis",
     arch_design = "//design:sample_seooc_design",
-    controlmeasures = ["sample_fmea_control_measures.trlc"],
-    failuremodes = ["sample_fmea_failure_modes.trlc"],
+    failuremodes = ["sample_safety_analysis_failure_modes.trlc"],
     root_causes = [":sample_fta"],
+    safetymeasures = ["sample_safety_analysis_safetymeasures.trlc"],
     visibility = ["//visibility:public"],
 )
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/fta_example.puml b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/fta_example.puml
index 67a186f7..75e7da69 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/fta_example.puml
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/fta_example.puml
@@ -16,16 +16,16 @@
 !include ../../../../../../../plantuml/fta_metamodel.puml
 
 ' Top level (skeleton)
-$TopEvent("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
+$FailureMode("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
 
 ' 2nd level gates and events
 $OrGate("OG1", "SampleLibrary.SampleFailureMode")
 
 $IntermediateEvent("SampleFailureMode is Angry", "IEF", "OG1")
-$BasicEvent("Just bad luck", "SampleLibrary.JustBadLuck", "OG1")
+$RootCause("Just bad luck", "JustBadLuck", "OG1")
 
 ' 3rd level cascades from AGF
 $AndGate("AG2", "IEF")
-$BasicEvent("No More Cookies", "SampleLibrary.NoMoreCookies", "AG2")
-$BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
+$RootCause("No More Cookies", "NoMoreCookies", "AG2")
+$RootCause("No More Coffee", "NoMoreCoffee", "AG2")
 @enduml
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.puml b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.puml
index 592cd28e..da093f3a 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.puml
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.puml
@@ -21,7 +21,7 @@ object "Failure Mode" as FailureMode
 object "Root Cause" as RootCause
 object "Safety Goal" as SafetyGoal
 object "Measure" as Measure
-object "Control Measure" as ControlMeasure
+object "Mitigation" as Mitigation
 object "Assumption of Use\n(AoU)" as AoU
 
 SafetyAnalysis <|-l- FMEA
@@ -37,10 +37,10 @@ SEooC "1" o-- "n" AoU
 FMEA ..> FailureMode : determine
 FTA ..> RootCause : determine
 
-Measure <|-- ControlMeasure
+Measure <|-- Mitigation
 Measure <|-- AoU
-RootCause <-l- ControlMeasure : same ID
-RootCause <-l- AoU : mitigates
+RootCause <-l- Mitigation : root_causes
+RootCause <-l- AoU : root_causes
 
 
 
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.svg b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.svg
index 9742084c..45bb5beb 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.svg
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/safety_analysis.svg
@@ -1,55 +1 @@
-<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="434px" preserveAspectRatio="none" style="width:540px;height:434px;" version="1.1" viewBox="0 0 540 434" width="540px" zoomAndPan="magnify"><defs><filter height="300%" id="fc53txeoxl2je" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="50" x="375.5" y="131.5"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="36" x="382.5" y="146.3281">SEooC</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="376.5" x2="424.5" y1="151.8441" y2="151.8441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="98" x="242.5" y="131.5"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="84" x="249.5" y="146.3281">Safety Analysis</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="243.5" x2="339.5" y1="151.8441" y2="151.8441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="52.6882" style="stroke: #A80036; stroke-width: 1.5;" width="201" x="6" y="123"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="187" x="13" y="137.8281">Failure Mode and Effects Analysis</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="40" x="86.5" y="154.1722">(FMEA)</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="7" x2="206" y1="159.6882" y2="159.6882"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="52.6882" style="stroke: #A80036; stroke-width: 1.5;" width="119" x="56" y="255"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="105" x="63" y="269.8281">Fault Tree Analysis</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="29" x="101" y="286.1722">(FTA)</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="57" x2="174" y1="291.6882" y2="291.6882"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="87" x="288" y="263.5"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="73" x="295" y="278.3281">Failure Mode</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="289" x2="374" y1="283.8441" y2="283.8441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="77" x="268" y="387"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="63" x="275" y="401.8281">Root Cause</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="269" x2="344" y1="407.3441" y2="407.3441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="78" x="361.5" y="8"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="64" x="368.5" y="22.8281">Safety Goal</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="362.5" x2="438.5" y1="28.3441" y2="28.3441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="36.3441" style="stroke: #A80036; stroke-width: 1.5;" width="64" x="437.5" y="387"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="50" x="444.5" y="401.8281">Measure</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="438.5" x2="500.5" y1="407.3441" y2="407.3441"/><rect fill="#FEFECE" filter="url(#fc53txeoxl2je)" height="52.6882" style="stroke: #A80036; stroke-width: 1.5;" width="119" x="410" y="255"/><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="105" x="417" y="269.8281">Assumption of Use</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="32" x="453.5" y="286.1722">(AoU)</text><line style="stroke: #A80036; stroke-width: 1.5;" x1="411" x2="528" y1="291.6882" y2="291.6882"/><!--MD5=[cb1a7b8816f1a55ddf081cda6914b275]
-link FMEA to SafetyAnalysis--><path d="M207.31,149.5 C212.35,149.5 217.39,149.5 222.43,149.5 " fill="none" id="FMEA-&gt;SafetyAnalysis" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="none" points="222.5,142.5,242.5,149.5,222.5,156.5,222.5,142.5" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[c9947d9c826e78edc430f9f7c1857126]
-reverse link SafetyAnalysis to FTA--><path d="M267.57,183.92 C256.49,197.81 242.46,213.38 227.5,225 C211.73,237.25 192.84,247.86 175.09,256.43 " fill="none" id="SafetyAnalysis&lt;-FTA" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="none" points="262.25,179.35,279.9,167.63,273.41,187.8,262.25,179.35" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[66743eda8f46975ad39e5066e3574364]
-reverse link SafetyGoal to SEooC--><path d="M400.5,49.29 C400.5,72.99 400.5,109.95 400.5,131.44 " fill="none" id="SafetyGoal&lt;-SEooC" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="400.5,44.15,396.5,53.15,400.5,49.15,404.5,53.15,400.5,44.15" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="8" x="391.275" y="66.264">n</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="7" x="392.3406" y="119.599">1</text><!--MD5=[dfa409b5495fefdb2a989657ffdec77c]
-link FMEA to SEooC--><path d="M145.66,122.86 C190.95,95.57 267.36,60.34 330.5,85 C352.17,93.46 371.17,112.12 383.89,127.2 " fill="none" id="FMEA-&gt;SEooC" style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 7.0,7.0;"/><polygon fill="#A80036" points="387.31,131.35,384.6838,121.8577,384.1345,127.4879,378.5043,126.9386,387.31,131.35" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="76" x="253.5" y="88.897">is conducted</text><!--MD5=[428ec81167f1cf6b3b8392e9ffc46ee8]
-link FTA to FailureMode--><path d="M175.09,281.5 C208.99,281.5 250.92,281.5 282.82,281.5 " fill="none" id="FTA-&gt;FailureMode" style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 7.0,7.0;"/><polygon fill="#A80036" points="287.86,281.5,278.86,277.5,282.86,281.5,278.86,285.5,287.86,281.5" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="76" x="193.5" y="274.397">is conducted</text><!--MD5=[852e5840c8e6a4f220a13f088ea09b68]
-reverse link FailureMode to RootCause--><path d="M325.29,312.66 C320.48,336.08 313.97,367.71 310.01,386.94 " fill="none" id="FailureMode&lt;-RootCause" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#FFFFFF" points="327.97,299.65,322.8458,304.7237,325.5583,311.4052,330.6826,306.3315,327.97,299.65" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="7" x="318.8171" y="321.764">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="8" x="301.8477" y="375.099">n</text><!--MD5=[014e089a8f859e0d55366ce51976c5ba]
-reverse link SEooC to FailureMode--><path d="M385.18,179.37 C371.55,205.05 352.06,241.76 340.7,263.17 " fill="none" id="SEooC&lt;-FailureMode" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#FFFFFF" points="391.34,167.76,384.993,171.1828,385.7114,178.3581,392.0584,174.9352,391.34,167.76" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="7" x="380.4629" y="189.9077">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="8" x="334.3575" y="251.5726">n</text><!--MD5=[2fdeddaf2470211c09314549982a9f40]
-reverse link SEooC to AoU--><path d="M415.78,179.29 C427.74,201.83 444.23,232.89 455.77,254.64 " fill="none" id="SEooC&lt;-AoU" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#FFFFFF" points="409.66,167.76,408.9416,174.9352,415.2886,178.3581,416.007,171.1828,409.66,167.76" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="7" x="404.3934" y="189.9077">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="8" x="443.4483" y="243.0421">n</text><!--MD5=[edff57ea562f2c8cafe89cce3d0e059c]
-link FMEA to FailureMode--><path d="M150.68,176.03 C193.6,200.83 257.88,237.96 297.11,260.63 " fill="none" id="FMEA-&gt;FailureMode" style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 7.0,7.0;"/><polygon fill="#A80036" points="301.77,263.32,295.977,255.355,297.4403,260.8193,291.9759,262.2826,301.77,263.32" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="62" x="233.5" y="220.897">determine</text><!--MD5=[d0e13d95d127d119522d2668bf131df5]
-link FTA to RootCause--><path d="M156.01,308.27 C191.64,330.93 242.76,363.46 275.3,384.15 " fill="none" id="FTA-&gt;RootCause" style="stroke: #A80036; stroke-width: 1.0; stroke-dasharray: 7.0,7.0;"/><polygon fill="#A80036" points="279.56,386.87,274.1199,378.6599,275.3435,384.1828,269.8205,385.4064,279.56,386.87" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="62" x="229.5" y="352.897">determine</text><!--MD5=[aeeb252b465381bb1997717d10a0380e]
-link AoU to Measure--><path d="M469.5,308.27 C469.5,325.29 469.5,347.87 469.5,366.83 " fill="none" id="AoU-&gt;Measure" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="none" points="476.5,366.87,469.5,386.87,462.5,366.87,476.5,366.87" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[1ad2c2fa4f5705021d191bb712f21252]
-reverse link RootCause to Measure--><path d="M350.17,405 C377.66,405 412.52,405 437.45,405 " fill="none" id="RootCause&lt;-Measure" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="345.13,405,354.13,409,350.13,405,354.13,401,345.13,405" style="stroke: #A80036; stroke-width: 1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacingAndGlyphs" textLength="56" x="363.25" y="397.897">mitigates</text><!--MD5=[717a5e0430e2d4830e1e3fc3c2f01fc8]
-@startuml
-
-object "SEooC" as SEooC
-object "Safety Analysis" as SafetyAnalysis
-object "Failure Mode and Effects Analysis\n(FMEA)" as FMEA
-object "Fault Tree Analysis\n(FTA)" as FTA
-object "Failure Mode" as FailureMode
-object "Root Cause" as RootCause
-object "Safety Goal" as SafetyGoal
-object "Measure" as Measure
-object "Assumption of Use\n(AoU)" as AoU
-
-SafetyAnalysis <|-l- FMEA
-SafetyAnalysis <|- - FTA
-
-SEooC "1" -u-> "n" SafetyGoal
-SEooC <.r. FMEA : is conducted
-FailureMode <.r. FTA : is conducted
-FailureMode "1" o- - "n" RootCause
-
-SEooC "1" o- - "n" FailureMode
-SEooC "1" o- - "n" AoU
-FMEA ..> FailureMode : determine
-FTA ..> RootCause : determine
-
-Measure <|-u- AoU
-RootCause <-l- Measure : mitigates
-
-
-
-@enduml
-
-PlantUML version 1.2020.02(Sun Mar 01 11:22:07 CET 2020)
-(GPL source distribution)
-Java Runtime: OpenJDK Runtime Environment
-JVM: OpenJDK 64-Bit Server VM
-Java Version: 21.0.8+9-Ubuntu-0ubuntu124.04.1
-Operating System: Linux
-Default Encoding: UTF-8
-Language: en
-Country: US
---></g></svg>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" data-diagram-type="CLASS" height="445px" preserveAspectRatio="none" style="width:615px;height:445px;background:#FFFFFF;" version="1.1" viewBox="0 0 615 445" width="615px" zoomAndPan="magnify"><defs/><g><g class="entity" data-entity="SEooC" data-source-line="15" data-uid="ent0002" id="entity_SEooC"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="55.2578" x="48.5" y="116.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="41.2578" x="55.5" y="133.4659">SEooC</text><line style="stroke:#181818;stroke-width:0.5;" x1="49.5" x2="102.7578" y1="139.5679" y2="139.5679"/></g><g class="entity" data-entity="SafetyAnalysis" data-source-line="16" data-uid="ent0003" id="entity_SafetyAnalysis"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="111.3136" x="485.5" y="116.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="97.3136" x="492.5" y="133.4659">Safety Analysis</text><line style="stroke:#181818;stroke-width:0.5;" x1="486.5" x2="595.8136" y1="139.5679" y2="139.5679"/></g><g class="entity" data-entity="FMEA" data-source-line="17" data-uid="ent0004" id="entity_FMEA"><rect fill="#F1F1F1" height="58.1358" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="233.0432" x="217.5" y="107"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="219.0432" x="224.5" y="123.9659">Failure Mode and Effects Analysis</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="45.0938" x="311.4747" y="143.0339">(FMEA)</text><line style="stroke:#181818;stroke-width:0.5;" x1="218.5" x2="449.5432" y1="149.1358" y2="149.1358"/></g><g class="entity" data-entity="FTA" data-source-line="18" data-uid="ent0005" id="entity_FTA"><rect fill="#F1F1F1" height="58.1358" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="136.3035" x="473" y="244"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="122.3035" x="480" y="260.9659">Fault Tree Analysis</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="32.3959" x="524.9538" y="280.0339">(FTA)</text><line style="stroke:#181818;stroke-width:0.5;" x1="474" x2="608.3035" y1="286.1358" y2="286.1358"/></g><g class="entity" data-entity="FailureMode" data-source-line="19" data-uid="ent0006" id="entity_FailureMode"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="99.9877" x="259" y="253.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="85.9877" x="266" y="270.4659">Failure Mode</text><line style="stroke:#181818;stroke-width:0.5;" x1="260" x2="357.9877" y1="276.5679" y2="276.5679"/></g><g class="entity" data-entity="RootCause" data-source-line="20" data-uid="ent0007" id="entity_RootCause"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="88.2977" x="370" y="390.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="74.2977" x="377" y="407.4659">Root Cause</text><line style="stroke:#181818;stroke-width:0.5;" x1="371" x2="457.2977" y1="413.5679" y2="413.5679"/></g><g class="entity" data-entity="SafetyGoal" data-source-line="21" data-uid="ent0008" id="entity_SafetyGoal"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="88.2137" x="32" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="74.2137" x="39" y="23.9659">Safety Goal</text><line style="stroke:#181818;stroke-width:0.5;" x1="33" x2="119.2137" y1="30.0679" y2="30.0679"/></g><g class="entity" data-entity="Measure" data-source-line="22" data-uid="ent0009" id="entity_Measure"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="71.4838" x="141.5" y="253.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="57.4838" x="148.5" y="270.4659">Measure</text><line style="stroke:#181818;stroke-width:0.5;" x1="142.5" x2="211.9838" y1="276.5679" y2="276.5679"/></g><g class="entity" data-entity="Mitigation" data-source-line="23" data-uid="ent0010" id="entity_Mitigation"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="81.2278" x="180.5" y="390.5"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="67.2278" x="187.5" y="407.4659">Mitigation</text><line style="stroke:#181818;stroke-width:0.5;" x1="181.5" x2="260.7278" y1="413.5679" y2="413.5679"/></g><g class="entity" data-entity="AoU" data-source-line="24" data-uid="ent0011" id="entity_AoU"><rect fill="#F1F1F1" height="58.1358" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="137.8995" x="7" y="381"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="123.8995" x="14" y="397.9659">Assumption of Use</text><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="36.0499" x="57.9248" y="417.0339">(AoU)</text><line style="stroke:#181818;stroke-width:0.5;" x1="8" x2="143.8995" y1="423.1358" y2="423.1358"/></g><!--link FMEA to SafetyAnalysis--><g class="link" data-entity-1="FMEA" data-entity-2="SafetyAnalysis" data-source-line="26" data-uid="lnk13" id="link_FMEA_SafetyAnalysis"><path codeLine="26" d="M450.84,136 C462.35,136 455.85,136 467.36,136" fill="none" id="FMEA-to-SafetyAnalysis" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="485.36,136,467.36,130,467.36,142,485.36,136" style="stroke:#181818;stroke-width:1;"/></g><!--reverse link SafetyAnalysis to FTA--><g class="link" data-entity-1="SafetyAnalysis" data-entity-2="FTA" data-source-line="27" data-uid="lnk14" id="link_SafetyAnalysis_FTA"><path codeLine="27" d="M541,173.77 C541,196.59 541,217.33 541,243.76" fill="none" id="SafetyAnalysis-backto-FTA" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="541,155.77,535,173.77,547,173.77,541,155.77" style="stroke:#181818;stroke-width:1;"/></g><!--reverse link SafetyGoal to SEooC--><g class="link" data-entity-1="SafetyGoal" data-entity-2="SEooC" data-source-line="29" data-uid="lnk16" id="link_SafetyGoal_SEooC"><path codeLine="29" d="M76,52.23 C76,71.96 76,96.84 76,116.49" fill="none" id="SafetyGoal-backto-SEooC" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="76,46.23,72,55.23,76,51.23,80,55.23,76,46.23" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="8.034" x="66.9009" y="67.7996">n</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="7.436" x="67.9128" y="104.5605">1</text></g><!--reverse link SEooC to FMEA--><g class="link" data-entity-1="SEooC" data-entity-2="FMEA" data-source-line="30" data-uid="lnk17" id="link_SEooC_FMEA"><path codeLine="30" d="M109.61,136 C137.1,136 175.2,136 217.48,136" fill="none" id="SEooC-backto-FMEA" style="stroke:#181818;stroke-width:1;stroke-dasharray:7,7;"/><polygon fill="#181818" points="103.61,136,112.61,140,108.61,136,112.61,132,103.61,136" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="77.3891" x="122" y="128.897">is conducted</text></g><!--reverse link FailureMode to FTA--><g class="link" data-entity-1="FailureMode" data-entity-2="FTA" data-source-line="31" data-uid="lnk18" id="link_FailureMode_FTA"><path codeLine="31" d="M365.05,273 C398.36,273 436.52,273 472.99,273" fill="none" id="FailureMode-backto-FTA" style="stroke:#181818;stroke-width:1;stroke-dasharray:7,7;"/><polygon fill="#181818" points="359.05,273,368.05,277,364.05,273,368.05,269,359.05,273" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="77.3891" x="377.5" y="265.897">is conducted</text></g><!--reverse link FailureMode to RootCause--><g class="link" data-entity-1="FailureMode" data-entity-2="RootCause" data-source-line="32" data-uid="lnk19" id="link_FailureMode_RootCause"><path codeLine="32" d="M330.9675,302.242 C351.0275,328.032 379.53,364.68 399.52,390.39" fill="none" id="FailureMode-backto-RootCause" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="323.6,292.77,324.1264,299.9619,330.9675,302.242,330.4411,295.0502,323.6,292.77" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="7.436" x="319.6434" y="314.3503">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="8.034" x="385.8201" y="378.776">n</text></g><!--reverse link SEooC to FailureMode--><g class="link" data-entity-1="SEooC" data-entity-2="FailureMode" data-source-line="34" data-uid="lnk20" id="link_SEooC_FailureMode"><path codeLine="34" d="M114.0237,159.0349 C157.4237,184.1749 230.94,226.77 276.92,253.41" fill="none" id="SEooC-backto-FailureMode" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="103.64,153.02,106.8269,159.4887,114.0237,159.0349,110.8368,152.5662,103.64,153.02" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="7.436" x="111.6425" y="152.182">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="8.034" x="257.8776" y="241.8022">n</text></g><!--reverse link SEooC to AoU--><g class="link" data-entity-1="SEooC" data-entity-2="AoU" data-source-line="35" data-uid="lnk21" id="link_SEooC_AoU"><path codeLine="35" d="M76,167.7 C76,214.51 76,324.97 76,380.68" fill="none" id="SEooC-backto-AoU" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="76,155.7,72,161.7,76,167.7,80,161.7,76,155.7" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="7.436" x="68.0407" y="177.618">1</text><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="8.034" x="67.1397" y="369.3663">n</text></g><!--link FMEA to FailureMode--><g class="link" data-entity-1="FMEA" data-entity-2="FailureMode" data-source-line="36" data-uid="lnk22" id="link_FMEA_FailureMode"><path codeLine="36" d="M328.76,165.3 C323.86,191.74 317.782,224.5702 313.562,247.3702" fill="none" id="FMEA-to-FailureMode" style="stroke:#181818;stroke-width:1;stroke-dasharray:7,7;"/><polygon fill="#181818" points="312.47,253.27,318.0412,245.1483,313.38,248.3535,310.1748,243.6923,312.47,253.27" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="63.5961" x="323" y="209.897">determine</text></g><!--link FTA to RootCause--><g class="link" data-entity-1="FTA" data-entity-2="RootCause" data-source-line="37" data-uid="lnk23" id="link_FTA_RootCause"><path codeLine="37" d="M514.38,302.3 C489.5,328.74 457.1813,363.1 435.7313,385.9" fill="none" id="FTA-to-RootCause" style="stroke:#181818;stroke-width:1;stroke-dasharray:7,7;"/><polygon fill="#181818" points="431.62,390.27,440.7003,386.4558,435.0461,386.6283,434.8736,380.9741,431.62,390.27" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="63.5961" x="486" y="346.897">determine</text></g><!--reverse link Measure to Mitigation--><g class="link" data-entity-1="Measure" data-entity-2="Mitigation" data-source-line="39" data-uid="lnk24" id="link_Measure_Mitigation"><path codeLine="39" d="M207.3813,306.1667 C216.6313,316.7567 215.03,317.27 220,332 C226.46,351.13 225.64,374.48 223.89,390.42" fill="none" id="Measure-backto-Mitigation" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="195.54,292.61,202.8624,310.1138,211.9002,302.2196,195.54,292.61" style="stroke:#181818;stroke-width:1;"/></g><!--reverse link Measure to AoU--><g class="link" data-entity-1="Measure" data-entity-2="AoU" data-source-line="40" data-uid="lnk25" id="link_Measure_AoU"><path codeLine="40" d="M152.1742,307.1806 C135.0942,330.0006 116.9,354.33 97.13,380.76" fill="none" id="Measure-backto-AoU" style="stroke:#181818;stroke-width:1;"/><polygon fill="none" points="162.96,292.77,147.3706,303.5853,156.9777,310.7759,162.96,292.77" style="stroke:#181818;stroke-width:1;"/></g><!--link Mitigation to RootCause--><g class="link" data-entity-1="Mitigation" data-entity-2="RootCause" data-source-line="41" data-uid="lnk27" id="link_Mitigation_RootCause"><path codeLine="41" d="M261.93,410 C293.58,410 331.32,410 363.77,410" fill="none" id="Mitigation-to-RootCause" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="369.77,410,360.77,406,364.77,410,360.77,414,369.77,410" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="72.9171" x="279.75" y="402.897">root_causes</text></g><!--link AoU to RootCause--><g class="link" data-entity-1="AoU" data-entity-2="RootCause" data-source-line="42" data-uid="lnk29" id="link_AoU_RootCause"><path codeLine="42" d="M97.11,380.79 C109.3,366.49 125.97,350.72 145,343 C175.48,330.64 186.56,337.58 219,343 C272.84,351.99 326.2112,371.7194 365.0212,388.0794" fill="none" id="AoU-to-RootCause" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="370.55,390.41,363.8105,383.2282,365.9426,388.4678,360.703,390.5999,370.55,390.41" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="72.9171" x="146" y="346.897">root_causes</text></g><!--SRC=[VL6nQiGm3Dtz5I9JEoJGjOI3SEGwPMbpMw6uYLDyvAmIsyD1FxwMdJXEhdIJz9xqf2Vyl8ZEGFPM8nupu1fyn72fyq6O6rIAZpSjTM3usbAAr1ENevq4DDWBuAg7UXWSe6FpkteuDNNrw8TGbBJQqK0x2R4XjmkthVvK2M0eK1v9huW6ZjpgGA7KP_kpNf2FoKcKHaeZk7PpFJp7AoQD_E96eWfmJ2EZqjfUlwa4EC1P2tTFXUTmZmiOsxe8vKy-vi6LUoJt5Z3_6iYUCiXjVe3CgIUB1xGifiAFWMTmpHsgtdP6z2pnQIQr_t981fqogQm69ZiiOFg0UvHkzUiKnI6bEkbU635TfHACLY4ywcnGDjiVd4ZCtjH9QEqloSsLwkPD3lle2DHxdclT4HZx1G00]--></g></svg>
\ No newline at end of file
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.puml b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.puml
index 7b21c41c..d163b4b5 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.puml
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.puml
@@ -15,23 +15,26 @@
 left to right direction
 rectangle "public_api.puml" as arch
 rectangle "failuremodes.trlc" as fm
-rectangle "controlmeasures.trlc" as cm
+rectangle "safetymeasures.trlc" as sm
 rectangle "fta.puml" as fta
 rectangle "architecture.lobster" as arch_lob
 rectangle "failuremodes.lobster" as fm_lob
-rectangle "controlmeasures.lobster" as cm_lob
-rectangle "root_causes.lobster" as rc_lob
+rectangle "safetymeasures.lobster" as sm_lob
+rectangle "fta_failure_modes.lobster" as te_lob
+rectangle "fta_root_causes.lobster" as rc_lob
 rectangle "lobster_sa.conf" as conf
 rectangle "report.json" as json
 rectangle "report.html" as html
 
 arch --> arch_lob : puml_parser
 fm --> fm_lob : lobster-trlc
-cm --> cm_lob : lobster-trlc
-fta --> rc_lob : safety_analysis_tools
+sm --> sm_lob : lobster-trlc
+fta --> te_lob : puml_cli (FTA mode)
+fta --> rc_lob : puml_cli (FTA mode)
 arch_lob --> conf
 fm_lob --> conf
-cm_lob --> conf
+sm_lob --> conf
+te_lob --> conf
 rc_lob --> conf
 conf --> json : lobster-ci-report
 json --> html : lobster-html-report
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.svg b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.svg
index de76b320..e3896087 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.svg
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/assets/tool_data_flow.svg
@@ -1 +1 @@
-<?xml version="1.0" encoding="us-ascii" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" height="274px" preserveAspectRatio="none" style="width:1253px;height:274px;background:#FFFFFF;" version="1.1" viewBox="0 0 1253 274" width="1253px" zoomAndPan="magnify"><defs/><g><!--entity arch--><g id="elem_arch"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="128" x="22.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="108" x="32.5" y="31.9659">public_api.puml</text></g><!--entity fm--><g id="elem_fm"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="135" x="19" y="81"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="115" x="29" y="105.9659">failuremodes.trlc</text></g><!--entity cm--><g id="elem_cm"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="159" x="7" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="139" x="17" y="179.9659">controlmeasures.trlc</text></g><!--entity fta--><g id="elem_fta"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="77" x="48" y="229"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="57" x="58" y="253.9659">fta.puml</text></g><!--entity arch_lob--><g id="elem_arch_lob"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="153" x="368.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="133" x="378.5" y="31.9659">architecture.lobster</text></g><!--entity fm_lob--><g id="elem_fm_lob"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="160" x="365" y="81"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="140" x="375" y="105.9659">failuremodes.lobster</text></g><!--entity cm_lob--><g id="elem_cm_lob"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="184" x="353" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="164" x="363" y="179.9659">controlmeasures.lobster</text></g><!--entity rc_lob--><g id="elem_rc_lob"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="150" x="370" y="229"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="130" x="380" y="253.9659">root_causes.lobster</text></g><!--entity conf--><g id="elem_conf"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="121" x="598" y="119"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="101" x="608" y="143.9659">lobster_sa.conf</text></g><!--entity json--><g id="elem_json"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="94" x="878" y="119"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="74" x="888" y="143.9659">report.json</text></g><!--entity html--><g id="elem_html"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="97" x="1150" y="119"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="77" x="1160" y="143.9659">report.html</text></g><!--link arch to arch_lob--><g id="link_arch_arch_lob"><path d="M150.82,26.5 C211.65,26.5 297.6,26.5 362.27,26.5 " fill="none" id="arch-to-arch_lob" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="368.27,26.5,359.27,22.5,363.27,26.5,359.27,30.5,368.27,26.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="75" x="222" y="22.397">puml_parser</text></g><!--link fm to fm_lob--><g id="link_fm_fm_lob"><path d="M154.14,100.5 C213.89,100.5 295.65,100.5 358.93,100.5 " fill="none" id="fm-to-fm_lob" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="364.93,100.5,355.93,96.5,359.93,100.5,355.93,104.5,364.93,100.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="65" x="227" y="96.397">lobster-trlc</text></g><!--link cm to cm_lob--><g id="link_cm_cm_lob"><path d="M166.18,174.5 C221.34,174.5 289.22,174.5 346.93,174.5 " fill="none" id="cm-to-cm_lob" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="352.93,174.5,343.93,170.5,347.93,174.5,343.93,178.5,352.93,174.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="65" x="227" y="170.397">lobster-trlc</text></g><!--link fta to rc_lob--><g id="link_fta_rc_lob"><path d="M125.31,248.5 C183.28,248.5 289.22,248.5 363.79,248.5 " fill="none" id="fta-to-rc_lob" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="369.79,248.5,360.79,244.5,364.79,248.5,360.79,252.5,369.79,248.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="125" x="197" y="244.397">safety_analysis_tools</text></g><!--link arch_lob to conf--><g id="link_arch_lob_conf"><path d="M498.66,46.13 C511.4,51.37 524.84,57.3 537,63.5 C569.71,80.18 600.176,99.5093 624.106,115.5493 " fill="none" id="arch_lob-to-conf" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="629.09,118.89,623.8412,110.5563,624.9367,116.1061,619.3869,117.2016,629.09,118.89" style="stroke:#181818;stroke-width:1.0;"/></g><!--link fm_lob to conf--><g id="link_fm_lob_conf"><path d="M525.06,114.7 C549.11,119.03 569.2244,122.6398 591.7844,126.6898 " fill="none" id="fm_lob-to-conf" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="597.69,127.75,589.5384,122.2227,592.7687,126.8665,588.1248,130.0968,597.69,127.75" style="stroke:#181818;stroke-width:1.0;"/></g><!--link cm_lob to conf--><g id="link_cm_lob_conf"><path d="M537.23,158.97 C557.8,155.47 573.205,152.8462 592.075,149.6362 " fill="none" id="cm_lob-to-conf" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="597.99,148.63,588.4467,146.196,593.0608,149.4685,589.7883,154.0827,597.99,148.63" style="stroke:#181818;stroke-width:1.0;"/></g><!--link rc_lob to conf--><g id="link_rc_lob_conf"><path d="M498.13,228.96 C511.01,223.68 524.66,217.7 537,211.5 C569.13,195.36 599.0557,176.9544 623.0057,161.4244 " fill="none" id="rc_lob-to-conf" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="628.04,158.16,618.3124,159.7004,623.8448,160.8803,622.6649,166.4128,628.04,158.16" style="stroke:#181818;stroke-width:1.0;"/></g><!--link conf to json--><g id="link_conf_json"><path d="M719.19,138.5 C767.18,138.5 827.65,138.5 871.69,138.5 " fill="none" id="conf-to-json" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="877.69,138.5,868.69,134.5,872.69,138.5,868.69,142.5,877.69,138.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="97" x="750" y="134.397">lobster-ci-report</text></g><!--link json to html--><g id="link_json_html"><path d="M972.06,138.5 C1021.53,138.5 1093.77,138.5 1143.85,138.5 " fill="none" id="json-to-html" style="stroke:#181818;stroke-width:1.0;"/><polygon fill="#181818" points="1149.85,138.5,1140.85,134.5,1144.85,138.5,1140.85,142.5,1149.85,138.5" style="stroke:#181818;stroke-width:1.0;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="116" x="1003" y="134.397">lobster-html-report</text></g><!--SRC=[TP11SiCW34Ntd8B9tZv05xqAeoYGq07B8-H5Rb-46OUuwSRMvx-Hz9Ly42jaETuVOc-HFKganUWVbdlozh9krnJHmHhdTSlfOg5OO7oCJ82ODlQPRhxCmWaR5VB882t2bBA7Kj41mpSi2BpcL35wEZPArRN1dEXQnFEnZwiF_-uqmY6VqVDg8ur_Q2OIXx2L4ybu9hlh2inrHDZxrUAjcr-9PVufj3HVYm_-G_f9j3160zjf-ZwIso-hLtChSF5iGcxk7hLwVPD9ZsvmD_6ZMK_Ut3rDTGi4Bqy72wHdYSK9KIhccDiwQQO-wz1uqhtXow-VfZJni0N6QSzicg64PXu8bPtv1G00]--></g></svg>
+<?plantuml 1.2026.1?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentStyleType="text/css" data-diagram-type="DESCRIPTION" height="348px" preserveAspectRatio="none" style="width:1242px;height:348px;background:#FFFFFF;" version="1.1" viewBox="0 0 1242 348" width="1242px" zoomAndPan="magnify"><defs/><g><!--entity arch--><g class="entity" data-qualified-name="arch" data-source-line="15" id="ent0002"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="123.8236" x="19.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="103.8236" x="29.5" y="31.9659">public_api.puml</text></g><!--entity fm--><g class="entity" data-qualified-name="fm" data-source-line="16" id="ent0003"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="131.9156" x="15.5" y="81"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="111.9156" x="25.5" y="105.9659">failuremodes.trlc</text></g><!--entity sm--><g class="entity" data-qualified-name="sm" data-source-line="17" id="ent0004"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="148.9675" x="7" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="128.9675" x="17" y="179.9659">safetymeasures.trlc</text></g><!--entity fta--><g class="entity" data-qualified-name="fta" data-source-line="18" id="ent0005"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="75.4398" x="44" y="258"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="55.4398" x="54" y="282.9659">fta.puml</text></g><!--entity arch_lob--><g class="entity" data-qualified-name="arch_lob" data-source-line="19" id="ent0006"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="149.5555" x="358.5" y="7"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="129.5555" x="368.5" y="31.9659">architecture.lobster</text></g><!--entity fm_lob--><g class="entity" data-qualified-name="fm_lob" data-source-line="20" id="ent0007"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="156.8775" x="355" y="81"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="136.8775" x="365" y="105.9659">failuremodes.lobster</text></g><!--entity sm_lob--><g class="entity" data-qualified-name="sm_lob" data-source-line="21" id="ent0008"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="173.9294" x="346.5" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="153.9294" x="356.5" y="179.9659">safetymeasures.lobster</text></g><!--entity te_lob--><g class="entity" data-qualified-name="te_lob" data-source-line="22" id="ent0009"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="187.0334" x="340" y="229"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="167.0334" x="350" y="253.9659">fta_failure_modes.lobster</text></g><!--entity rc_lob--><g class="entity" data-qualified-name="rc_lob" data-source-line="23" id="ent0010"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="172.3474" x="347.5" y="303"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="152.3474" x="357.5" y="327.9659">fta_root_causes.lobster</text></g><!--entity conf--><g class="entity" data-qualified-name="conf" data-source-line="24" id="ent0011"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="119.3156" x="588" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="99.3156" x="598" y="179.9659">lobster_sa.conf</text></g><!--entity json--><g class="entity" data-qualified-name="json" data-source-line="25" id="ent0012"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="92.7857" x="868" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="72.7857" x="878" y="179.9659">report.json</text></g><!--entity html--><g class="entity" data-qualified-name="html" data-source-line="26" id="ent0013"><rect fill="#F1F1F1" height="39.0679" rx="2.5" ry="2.5" style="stroke:#181818;stroke-width:0.5;" width="95.7537" x="1141" y="155"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacing" textLength="75.7537" x="1151" y="179.9659">report.html</text></g><!--link arch to arch_lob--><g class="link" data-entity-1="ent0002" data-entity-2="ent0006" data-link-type="dependency" data-source-line="28" id="lnk14"><path d="M143.87,26.5 C203.66,26.5 288.64,26.5 352.43,26.5" fill="none" id="arch-to-arch_lob" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="358.43,26.5,349.43,22.5,353.43,26.5,349.43,30.5,358.43,26.5" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="76.8951" x="210" y="22.397">puml_parser</text></g><!--link fm to fm_lob--><g class="link" data-entity-1="ent0003" data-entity-2="ent0007" data-link-type="dependency" data-source-line="29" id="lnk15"><path d="M147.51,100.5 C206.13,100.5 286.43,100.5 348.69,100.5" fill="none" id="fm-to-fm_lob" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="354.69,100.5,345.69,96.5,349.69,100.5,345.69,104.5,354.69,100.5" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="66.6771" x="215" y="96.397">lobster-trlc</text></g><!--link sm to sm_lob--><g class="link" data-entity-1="ent0004" data-entity-2="ent0008" data-link-type="dependency" data-source-line="30" id="lnk16"><path d="M156.3,174.5 C211.85,174.5 282.14,174.5 340.46,174.5" fill="none" id="sm-to-sm_lob" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="346.46,174.5,337.46,170.5,341.46,174.5,337.46,178.5,346.46,174.5" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="66.6771" x="215" y="170.397">lobster-trlc</text></g><!--link fta to te_lob--><g class="link" data-entity-1="ent0005" data-entity-2="ent0009" data-link-type="dependency" data-source-line="31" id="lnk17"><path d="M119.29,274.45 C171.16,270.15 261.5005,262.6653 333.6905,256.6853" fill="none" id="fta-to-te_lob" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="339.67,256.19,330.3705,252.9466,334.6871,256.6028,331.0309,260.9193,339.67,256.19" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="122.4471" x="187" y="255.397">puml_cli (FTA mode)</text></g><!--link fta to rc_lob--><g class="link" data-entity-1="ent0005" data-entity-2="ent0010" data-link-type="dependency" data-source-line="32" id="lnk18"><path d="M119.29,284.48 C139.03,288.08 163.79,292.36 186,295.5 C239.5,303.07 293.8103,309.1075 341.3703,313.9075" fill="none" id="fta-to-rc_lob" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="347.34,314.51,338.7871,309.6265,342.3653,314.0079,337.9838,317.586,347.34,314.51" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="122.4471" x="187" y="291.397">puml_cli (FTA mode)</text></g><!--link arch_lob to conf--><g class="link" data-entity-1="ent0006" data-entity-2="ent0011" data-link-type="dependency" data-source-line="33" id="lnk19"><path d="M492.86,46.04 C504.56,51 516.48,56.84 527,63.5 C568.15,89.56 603.9454,126.242 625.6354,150.442" fill="none" id="arch_lob-to-conf" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="629.64,154.91,626.6118,145.5382,626.3028,151.1867,620.6544,150.8777,629.64,154.91" style="stroke:#181818;stroke-width:1;"/></g><!--link fm_lob to conf--><g class="link" data-entity-1="ent0007" data-entity-2="ent0011" data-link-type="dependency" data-source-line="34" id="lnk20"><path d="M490.48,120.04 C521.39,130.83 554.0052,142.2126 584.9152,153.0026" fill="none" id="fm_lob-to-conf" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="590.58,154.98,583.4011,148.2373,585.8594,153.3321,580.7645,155.7903,590.58,154.98" style="stroke:#181818;stroke-width:1;"/></g><!--link sm_lob to conf--><g class="link" data-entity-1="ent0008" data-entity-2="ent0011" data-link-type="dependency" data-source-line="35" id="lnk21"><path d="M520.73,174.5 C543.31,174.5 561.14,174.5 581.9,174.5" fill="none" id="sm_lob-to-conf" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="587.9,174.5,578.9,170.5,582.9,174.5,578.9,178.5,587.9,174.5" style="stroke:#181818;stroke-width:1;"/></g><!--link te_lob to conf--><g class="link" data-entity-1="ent0009" data-entity-2="ent0011" data-link-type="dependency" data-source-line="36" id="lnk22"><path d="M490.48,228.96 C521.39,218.17 554.0052,206.7874 584.9152,195.9974" fill="none" id="te_lob-to-conf" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="590.58,194.02,580.7645,193.2097,585.8594,195.6679,583.4011,200.7627,590.58,194.02" style="stroke:#181818;stroke-width:1;"/></g><!--link rc_lob to conf--><g class="link" data-entity-1="ent0010" data-entity-2="ent0011" data-link-type="dependency" data-source-line="37" id="lnk23"><path d="M492.86,302.96 C504.56,298 516.48,292.16 527,285.5 C568.15,259.44 603.9454,222.758 625.6354,198.558" fill="none" id="rc_lob-to-conf" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="629.64,194.09,620.6544,198.1223,626.3028,197.8133,626.6118,203.4618,629.64,194.09" style="stroke:#181818;stroke-width:1;"/></g><!--link conf to json--><g class="link" data-entity-1="ent0011" data-entity-2="ent0012" data-link-type="dependency" data-source-line="38" id="lnk24"><path d="M707.31,174.5 C755.65,174.5 817.17,174.5 861.59,174.5" fill="none" id="conf-to-json" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="867.59,174.5,858.59,170.5,862.59,174.5,858.59,178.5,867.59,174.5" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="99.4241" x="738" y="170.397">lobster-ci-report</text></g><!--link json to html--><g class="link" data-entity-1="ent0012" data-entity-2="ent0013" data-link-type="dependency" data-source-line="39" id="lnk25"><path d="M961.11,174.5 C1010.96,174.5 1084.43,174.5 1134.87,174.5" fill="none" id="json-to-html" style="stroke:#181818;stroke-width:1;"/><polygon fill="#181818" points="1140.87,174.5,1131.87,170.5,1135.87,174.5,1131.87,178.5,1140.87,174.5" style="stroke:#181818;stroke-width:1;"/><text fill="#000000" font-family="sans-serif" font-size="13" lengthAdjust="spacing" textLength="118.0661" x="992" y="170.397">lobster-html-report</text></g><?plantuml-src TP4nSiCW44LxJi6uIWhf02aoaoOdICzW31OP49hTLU7RXqKO4rbk9Bx-c-NlLx2E92K9_ZgHl7YmXdoQ1R_rV0rMdfRr7BnHUl7ZiiPmaXgb1ZFrZDC-h61ZkbWS2O8fb8izWzfPkaMhCPCTXVyeH_fnJHQznxTwoZeF64Cw8rbeSLJ-y39I3xkuHtV9UXYVu9n9rTdgUJZP8nvI8cNqYZiQp9wkha8zcZIxGl6XPy0k2MZynJGNdmy7_aIrHJu8mHt9OVXiPSaFoKMhHGDQ42uMTsidUpN9mFz9u6RYePatBEws-tsi2Lw-VVzyIIxflK7RoY-W5et9idQDqpJkTBspwJg-QNuKnILrmOqVjff4CPZWcZg2PMN-0000?></g></svg>
\ No newline at end of file
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta.puml b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta.puml
index cfc194ce..648152c1 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta.puml
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta.puml
@@ -16,17 +16,17 @@
 !include fta_metamodel.puml
 
 ' Top level (skeleton)
-$TopEvent("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
+$FailureMode("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
 
 ' 2nd level gates and events
 $OrGate("OG1", "SampleLibrary.SampleFailureMode")
 
 $IntermediateEvent("SampleFailureMode is Angry", "IEF", "OG1")
-$BasicEvent("Just bad luck", "SampleLibrary.JustBadLuck", "OG1")
+$RootCause("Just bad luck", "JustBadLuck", "OG1")
 
 ' 3rd level cascades from AGF
 $AndGate("AG2", "IEF")
-$BasicEvent("No More Cookies", "SampleLibrary.NoMoreCookies", "AG2")
-$BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
+$RootCause("No More Cookies", "NoMoreCookies", "AG2")
+$RootCause("No More Coffee", "NoMoreCoffee", "AG2")
 
 @enduml
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta2.puml b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta2.puml
index ee4fed7d..9f2327a9 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta2.puml
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fta2.puml
@@ -16,12 +16,12 @@
 !include fta_metamodel.puml
 
 ' Top level (skeleton)
-$TopEvent("SampleFailureMode2 responds too late", "SampleLibrary.SampleFailureMode2")
+$FailureMode("SampleFailureMode2 responds too late", "SampleLibrary.SampleFailureMode2")
 
-' 2nd level gate and basic events
+' 2nd level gate and root causes
 $OrGate("OG1", "SampleLibrary.SampleFailureMode2")
 
-$BasicEvent("Watchdog timer", "SampleLibrary.WatchdogTimer", "OG1")
-$BasicEvent("Deadline monitor", "SampleLibrary.DeadlineMonitor", "OG1")
+$RootCause("Watchdog timer", "WatchdogTimer", "OG1")
+$RootCause("Deadline monitor", "DeadlineMonitor", "OG1")
 
 @enduml
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fmea_failure_modes.trlc b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_safety_analysis_failure_modes.trlc
similarity index 100%
rename from bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fmea_failure_modes.trlc
rename to bazel/rules/rules_score/examples/seooc/safety_analysis/sample_safety_analysis_failure_modes.trlc
diff --git a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fmea_control_measures.trlc b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_safety_analysis_safetymeasures.trlc
similarity index 54%
rename from bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fmea_control_measures.trlc
rename to bazel/rules/rules_score/examples/seooc/safety_analysis/sample_safety_analysis_safetymeasures.trlc
index da5ddd87..a358ad42 100644
--- a/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_fmea_control_measures.trlc
+++ b/bazel/rules/rules_score/examples/seooc/safety_analysis/sample_safety_analysis_safetymeasures.trlc
@@ -13,33 +13,44 @@
 package SampleLibrary
 
 import ScoreReq
+import sample_safety_analysis_fta
 
-ScoreReq.ControlMeasure JustBadLuck{
+ScoreReq.Mitigation JustBadLuck{
     safety = ScoreReq.Asil.B
     description = "Sometimes, the dark side wins. We shall be prepared for that."
+    justification = "This root cause is outside our control; no active measure can prevent it."
     version = 1
+    root_causes = [sample_safety_analysis_fta.JustBadLuck]
 }
 
-ScoreReq.ControlMeasure NoMoreCookies{
+ScoreReq.Mitigation NoMoreCookies{
     safety = ScoreReq.Asil.B
     description = "We shall only order family size cookie jars"
+    justification = "Ordering only family size jars keeps the reserve stable, so this root cause does not apply."
     version = 1
+    root_causes = [sample_safety_analysis_fta.NoMoreCookies]
 }
 
-ScoreReq.ControlMeasure NoMoreCoffee{
+ScoreReq.Mitigation NoMoreCoffee{
     safety = ScoreReq.Asil.B
     description = "We shall keep a coffee reserve for emergencies"
+    justification = "An emergency reserve is kept on hand, so this root cause does not apply."
     version = 1
+    root_causes = [sample_safety_analysis_fta.NoMoreCoffee]
 }
 
-ScoreReq.ControlMeasure WatchdogTimer{
+ScoreReq.Mitigation WatchdogTimer{
     safety = ScoreReq.Asil.D
     description = "A watchdog shall detect overruns and force a safe state"
+    justification = "The watchdog design ensures this overrun cannot go undetected in this context."
     version = 1
+    root_causes = [sample_safety_analysis_fta.WatchdogTimer]
 }
 
-ScoreReq.ControlMeasure DeadlineMonitor{
+ScoreReq.Mitigation DeadlineMonitor{
     safety = ScoreReq.Asil.D
     description = "Per-request deadline monitoring shall flag late responses"
+    justification = "Deadline monitoring ensures late responses cannot go unflagged in this context."
     version = 1
+    root_causes = [sample_safety_analysis_fta.DeadlineMonitor]
 }
diff --git a/bazel/rules/rules_score/lobster/config/BUILD b/bazel/rules/rules_score/lobster/config/BUILD
index 466b5ef0..de714d95 100644
--- a/bazel/rules/rules_score/lobster/config/BUILD
+++ b/bazel/rules/rules_score/lobster/config/BUILD
@@ -12,7 +12,7 @@
 # *******************************************************************************
 
 # Lobster-trlc YAML configs and report config templates for S-CORE traceability.
-# Used as defaults by rules_score rules (component, dependable_element, fmea, etc.).
+# Used as defaults by rules_score rules (component, dependable_element, safety_analysis, etc.).
 
 filegroup(
     name = "component_requirement",
@@ -39,8 +39,20 @@ filegroup(
 )
 
 filegroup(
-    name = "controlmeasures_config",
-    srcs = ["lobster_controlmeasures.yaml"],
+    name = "safetymeasures_config",
+    srcs = ["lobster_safetymeasures.yaml"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "fta_failure_modes_config",
+    srcs = ["lobster_fta_failure_modes.yaml"],
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "fta_root_causes_config",
+    srcs = ["lobster_fta_root_causes.yaml"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/bazel/rules/rules_score/lobster/config/lobster_de.conf.tpl b/bazel/rules/rules_score/lobster/config/lobster_de.conf.tpl
index 57e56b26..9f25e307 100644
--- a/bazel/rules/rules_score/lobster/config/lobster_de.conf.tpl
+++ b/bazel/rules/rules_score/lobster/config/lobster_de.conf.tpl
@@ -16,6 +16,8 @@
 
 {FM_BLOCK}
 
-{CM_BLOCK}
+{FTA_FM_BLOCK}
 
 {RC_BLOCK}
+
+{SAFETYMEASURES_BLOCK}
diff --git a/bazel/rules/rules_score/lobster/config/lobster_fta_failure_modes.yaml b/bazel/rules/rules_score/lobster/config/lobster_fta_failure_modes.yaml
new file mode 100644
index 00000000..0c195fa6
--- /dev/null
+++ b/bazel/rules/rules_score/lobster/config/lobster_fta_failure_modes.yaml
@@ -0,0 +1,22 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# lobster-trlc configuration for FTA-generated FtaFailureMode stub records.
+inputs:
+  - .
+conversion-rules:
+  - package: ScoreReq
+    record-type: FtaFailureMode
+    namespace: req
+    description-fields: title
+    tags:
+      - failure_modes
diff --git a/bazel/rules/rules_score/lobster/config/lobster_fta_root_causes.yaml b/bazel/rules/rules_score/lobster/config/lobster_fta_root_causes.yaml
new file mode 100644
index 00000000..4891c8f7
--- /dev/null
+++ b/bazel/rules/rules_score/lobster/config/lobster_fta_root_causes.yaml
@@ -0,0 +1,23 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+# lobster-trlc configuration for FTA-generated RootCause (root cause) stub
+# records.
+inputs:
+  - .
+conversion-rules:
+  - package: ScoreReq
+    record-type: RootCause
+    namespace: req
+    description-fields: title
+    tags:
+      - failure_modes
diff --git a/bazel/rules/rules_score/lobster/config/lobster_sa.conf.tpl b/bazel/rules/rules_score/lobster/config/lobster_sa.conf.tpl
index 17f1417e..232db723 100644
--- a/bazel/rules/rules_score/lobster/config/lobster_sa.conf.tpl
+++ b/bazel/rules/rules_score/lobster/config/lobster_sa.conf.tpl
@@ -7,12 +7,15 @@ requirements "Failure Modes" {
   trace to: "Architecture";
 }
 
-requirements "Control Measures" {
-{CM_SOURCES}
+activity "FTA Failure Modes" {
+{FTA_FM_SOURCES}
+  trace to: "Failure Modes";
 }
 
 activity "Root Causes" {
 {RC_SOURCES}
-  trace to: "Failure Modes";
-  trace to: "Control Measures";
+}
+
+requirements "Safety Measures" {
+{SAFETYMEASURES_SOURCES}
 }
diff --git a/bazel/rules/rules_score/lobster/config/lobster_controlmeasures.yaml b/bazel/rules/rules_score/lobster/config/lobster_safetymeasures.yaml
similarity index 83%
rename from bazel/rules/rules_score/lobster/config/lobster_controlmeasures.yaml
rename to bazel/rules/rules_score/lobster/config/lobster_safetymeasures.yaml
index 347aa3b2..1d3febab 100644
--- a/bazel/rules/rules_score/lobster/config/lobster_controlmeasures.yaml
+++ b/bazel/rules/rules_score/lobster/config/lobster_safetymeasures.yaml
@@ -10,11 +10,13 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
-# lobster-trlc configuration for FMEA Control Measure records.
+# lobster-trlc configuration for FMEA safety measure (Mitigation) records.
 inputs:
   - .
 conversion-rules:
   - package: ScoreReq
-    record-type: ControlMeasure
+    record-type: Mitigation
     namespace: req
     description-fields: description
+    tags:
+      - root_causes
diff --git a/bazel/rules/rules_score/private/dependability_analysis.bzl b/bazel/rules/rules_score/private/dependability_analysis.bzl
index 2dd5ce9c..b262253a 100644
--- a/bazel/rules/rules_score/private/dependability_analysis.bzl
+++ b/bazel/rules/rules_score/private/dependability_analysis.bzl
@@ -16,15 +16,22 @@ Dependability Analysis build rules for S-CORE projects.
 
 A dependability analysis aggregates sub-analysis rules
 
-  * **fmea**              – ``fmea`` rule targets (failure modes, control
-                            measures, and optional root cause FTA diagrams).
+  * **safety_analysis**   – ``safety_analysis`` rule targets (failure modes, safety measures,
+                            and optional root cause FTA diagrams).
   * **security_analysis** – security analysis rule targets (placeholder,
                             optional).
+
+It also validates root-cause-coverage completeness: every ``RootCause``
+generated by any ``safety_analysis`` sub-target's ``root_causes`` FTA diagrams must be
+addressed by at least one Mitigation, AoU, or CompReq -- combining each
+``safety_analysis`` sub-target's own safety measures with this rule's own ``measures``
+attribute, via a coverage-check-only invocation of ``safety_analysis_assembler``.
 """
 
 load("@lobster//:lobster.bzl", "subrule_lobster_html_report", "subrule_lobster_report")
-load("//bazel/rules/rules_score:providers.bzl", "AnalysisInfo", "ArchitecturalDesignInfo", "DependabilityAnalysisInfo", "SphinxSourcesInfo")
+load("//bazel/rules/rules_score:providers.bzl", "AnalysisInfo", "ArchitecturalDesignInfo", "DependabilityAnalysisInfo", "SafetyAnalysisProviderInfo", "SphinxSourcesInfo")
 load("//bazel/rules/rules_score/private:lobster_config.bzl", "format_lobster_sources")
+load("//bazel/rules/rules_score/private:verbosity.bzl", "VERBOSITY_ATTR", "get_log_level")
 
 # ============================================================================
 # Private Helpers
@@ -36,7 +43,7 @@ def _collect_analysis_providers(sa, rst_srcs_list, rst_deps_list, rst_aux_list,
     Updates the provided lists/dicts in-place.
 
     Args:
-        sa:            A sub-analysis target (fmea or security).
+        sa:            A sub-analysis target (safety_analysis or security).
         rst_srcs_list: List of depsets to extend with SphinxSourcesInfo.srcs.
         rst_deps_list: List of depsets to extend with SphinxSourcesInfo.deps.
         rst_aux_list:  List of depsets to extend with SphinxSourcesInfo.aux_srcs.
@@ -81,12 +88,21 @@ def _dependability_analysis_impl(ctx):
     lobster_files = {}  # canonical name → File, merged from all sub-analyses
 
     # -------------------------------------------------------------------------
-    # Collect from fmea targets
+    # Collect from safety_analysis targets
     # -------------------------------------------------------------------------
-    fmea_output_files = []
-    for sa in ctx.attr.fmea:
-        fmea_output_files.append(sa[DefaultInfo].files)
+    safety_analysis_output_files = []
+    fta_events_transitive = []
+    safetymeasures_transitive = [depset(ctx.files.measures)]
+    dep_files_transitive = []
+    for sa in ctx.attr.safety_analysis:
+        safety_analysis_output_files.append(sa[DefaultInfo].files)
         _collect_analysis_providers(sa, rst_srcs_transitive, rst_deps_transitive, rst_aux_transitive, lobster_files)
+        if SafetyAnalysisProviderInfo in sa:
+            trlc = sa[SafetyAnalysisProviderInfo]
+            fta_events_transitive.append(trlc.fta_events)
+            safetymeasures_transitive.append(trlc.safetymeasures)
+            dep_files_transitive.append(trlc.failuremodes)
+            dep_files_transitive.append(trlc.spec)
 
     # -------------------------------------------------------------------------
     # Collect from security_analysis targets
@@ -125,8 +141,9 @@ def _dependability_analysis_impl(ctx):
             substitutions = {
                 "{ARCH_SOURCES}": format_lobster_sources(arch_lobster_files),
                 "{FM_SOURCES}": format_lobster_sources([lobster_files["failuremodes.lobster"]] if "failuremodes.lobster" in lobster_files else []),
-                "{CM_SOURCES}": format_lobster_sources([lobster_files["controlmeasures.lobster"]] if "controlmeasures.lobster" in lobster_files else []),
-                "{RC_SOURCES}": format_lobster_sources([lobster_files["root_causes.lobster"]] if "root_causes.lobster" in lobster_files else []),
+                "{SAFETYMEASURES_SOURCES}": format_lobster_sources([lobster_files["safetymeasures.lobster"]] if "safetymeasures.lobster" in lobster_files else []),
+                "{FTA_FM_SOURCES}": format_lobster_sources([lobster_files["fta_failure_modes.lobster"]] if "fta_failure_modes.lobster" in lobster_files else []),
+                "{RC_SOURCES}": format_lobster_sources([lobster_files["fta_root_causes.lobster"]] if "fta_root_causes.lobster" in lobster_files else []),
             },
         )
 
@@ -139,30 +156,89 @@ def _dependability_analysis_impl(ctx):
             report_files.append(lobster_html_file)
 
     # =========================================================================
-    # Test executable (lobster-ci-report)
+    # Root-cause coverage completeness check (combined across safety_analysis targets)
+    # =========================================================================
+    # Every RootCause generated by any safety_analysis sub-target's root_causes FTA
+    # diagrams must be addressed by at least one Mitigation, AoU, or CompReq --
+    # possibly one declared via this dependability_analysis's own `measures`
+    # attribute rather than scoped to a single safety_analysis target.
+    fta_events_files = depset(transitive = fta_events_transitive).to_list()
+    uncovered_root_causes = None
+    if fta_events_files:
+        uncovered_root_causes = ctx.actions.declare_file(
+            "{}/uncovered_root_causes.json".format(ctx.label.name),
+        )
+        safetymeasures_files = depset(transitive = safetymeasures_transitive).to_list()
+        dep_files = depset(transitive = dep_files_transitive).to_list()
+
+        args = ctx.actions.args()
+        args.add("--uncovered-root-causes-output", uncovered_root_causes.path)
+        args.add("--fta-events")
+        args.add_all(fta_events_files)
+        if safetymeasures_files:
+            args.add("--measures")
+            args.add_all(safetymeasures_files)
+        if dep_files:
+            args.add("--dep-files")
+            args.add_all(dep_files)
+        args.add("--log-level", get_log_level(ctx))
+        ctx.actions.run(
+            inputs = fta_events_files + safetymeasures_files + dep_files,
+            outputs = [uncovered_root_causes],
+            executable = ctx.executable._safety_analysis_assembler,
+            arguments = [args],
+            progress_message = "Checking root-cause coverage for %s" % ctx.label.name,
+        )
+        report_files.append(uncovered_root_causes)
+
+    # =========================================================================
+    # Test executable (lobster-ci-report + root-cause coverage)
     # =========================================================================
     test_executable = ctx.actions.declare_file(
         "{}_lobster_ci_test_executable".format(ctx.attr.name),
     )
 
+    commands = []
     runfiles_files = []
     if lobster_report_file:
         if ctx.attr.maturity == "development":
             # Development mode: report traceability issues without failing the
             # build, matching the maturity pattern used by dependable_element.
-            command = "{ci} {report} || echo 'WARNING: lobster traceability check failed (maturity=development)'".format(
+            commands.append("{ci} {report} || echo 'WARNING: lobster traceability check failed (maturity=development)'".format(
                 ci = ctx.executable._lobster_ci_report.short_path,
                 report = lobster_report_file.short_path,
-            )
+            ))
         else:
-            command = "set -o pipefail; {ci} {report}".format(
+            commands.append("{ci} {report}".format(
                 ci = ctx.executable._lobster_ci_report.short_path,
                 report = lobster_report_file.short_path,
-            )
-        ctx.actions.write(output = test_executable, content = command)
-        runfiles_files = [ctx.executable._lobster_ci_report, lobster_report_file]
+            ))
+        runfiles_files.extend([ctx.executable._lobster_ci_report, lobster_report_file])
+
+    if uncovered_root_causes:
+        # `python3` is available on the exec host but not declared as a Bazel
+        # dependency here (matches the pattern of other inline shell/python
+        # glue in this rule); the check is intentionally tiny.
+        check = """python3 - "{path}" "{maturity}" <<'PYEOF'
+import json, sys
+path, maturity = sys.argv[1], sys.argv[2]
+data = json.load(open(path))
+if data:
+    msg = "root causes not addressed by any Mitigation/AoU/CompReq: " + ", ".join(data)
+    if maturity == "development":
+        print("WARNING: " + msg, file=sys.stderr)
     else:
-        ctx.actions.write(output = test_executable, content = "exit 0")
+        print("ERROR: " + msg, file=sys.stderr)
+        sys.exit(1)
+PYEOF""".format(path = uncovered_root_causes.short_path, maturity = ctx.attr.maturity)
+        commands.append(check)
+        runfiles_files.append(uncovered_root_causes)
+
+    if commands:
+        script = "#!/bin/bash\nset -o pipefail\n" + "\n".join(commands) + "\n"
+        ctx.actions.write(output = test_executable, content = script, is_executable = True)
+    else:
+        ctx.actions.write(output = test_executable, content = "#!/bin/sh\nexit 0\n", is_executable = True)
 
     runfiles = ctx.runfiles(files = runfiles_files)
     if lobster_report_file:
@@ -173,7 +249,7 @@ def _dependability_analysis_impl(ctx):
     # =========================================================================
     all_output_files = depset(
         report_files,
-        transitive = [dfa_rst_files] + fmea_output_files + security_output_files,
+        transitive = [dfa_rst_files] + safety_analysis_output_files + security_output_files,
     )
 
     return [
@@ -183,7 +259,7 @@ def _dependability_analysis_impl(ctx):
             executable = test_executable,
         ),
         DependabilityAnalysisInfo(
-            fmea = depset(transitive = fmea_output_files),
+            safety_analysis = depset(transitive = safety_analysis_output_files),
             security_analysis = depset(transitive = security_output_files),
             dfa = dfa_rst_files,
             arch_design = arch_design_info,
@@ -203,46 +279,65 @@ def _dependability_analysis_impl(ctx):
 
 _dependability_analysis_test = rule(
     implementation = _dependability_analysis_impl,
-    doc = "Aggregates dependability analysis sub-analyses (fmea, security_analysis) " +
-          "and validates the combined traceability chain via lobster-ci-report.",
-    attrs = {
-        "fmea": attr.label_list(
-            providers = [AnalysisInfo],
-            mandatory = False,
-            doc = "fmea rule targets (failure modes + control measures).",
-        ),
-        "security_analysis": attr.label_list(
-            providers = [AnalysisInfo],
-            mandatory = False,
-            doc = "Security analysis rule targets (placeholder -- not yet implemented).",
-        ),
-        "dfa": attr.label_list(
-            allow_files = [".rst", ".md"],
-            mandatory = False,
-            doc = "Dependent Failure Analysis (DFA) documentation (placeholder).",
-        ),
-        "arch_design": attr.label(
-            providers = [ArchitecturalDesignInfo],
-            mandatory = False,
-            doc = "Reference to architectural_design target for interface tracing.",
-        ),
-        "maturity": attr.string(
-            default = "release",
-            values = ["release", "development"],
-            doc = "Maturity level of the dependability analysis. 'release' (default) fails `bazel test` when traceability links are missing; 'development' emits a warning and continues.",
-        ),
-        "_lobster_ci_report": attr.label(
-            default = "@lobster//:lobster-ci-report",
-            executable = True,
-            cfg = "exec",
-            doc = "lobster-ci-report executable for test execution.",
-        ),
-        "_lobster_sa_template": attr.label(
-            default = Label("//bazel/rules/rules_score/lobster/config:lobster_sa_template"),
-            allow_single_file = True,
-            doc = "Lobster config template for safety analysis traceability.",
-        ),
-    },
+    doc = "Aggregates dependability analysis sub-analyses (safety_analysis, security_analysis) " +
+          "and validates the combined traceability chain via lobster-ci-report, plus " +
+          "root-cause-coverage completeness (every RootCause addressed by a Mitigation, " +
+          "AoU, or CompReq) across every safety_analysis sub-target.",
+    attrs = dict(
+        {
+            "safety_analysis": attr.label_list(
+                providers = [AnalysisInfo],
+                mandatory = False,
+                doc = "safety_analysis rule targets (failure modes + safety measures).",
+            ),
+            "security_analysis": attr.label_list(
+                providers = [AnalysisInfo],
+                mandatory = False,
+                doc = "Security analysis rule targets (placeholder -- not yet implemented).",
+            ),
+            "dfa": attr.label_list(
+                allow_files = [".rst", ".md"],
+                mandatory = False,
+                doc = "Dependent Failure Analysis (DFA) documentation (placeholder).",
+            ),
+            "arch_design": attr.label(
+                providers = [ArchitecturalDesignInfo],
+                mandatory = False,
+                doc = "Reference to architectural_design target for interface tracing.",
+            ),
+            "measures": attr.label_list(
+                allow_files = [".trlc"],
+                mandatory = False,
+                doc = "Additional Mitigation/AoU/CompReq .trlc files not scoped to a single " +
+                      "safety_analysis target, considered for the root-cause-coverage completeness check.",
+            ),
+            "maturity": attr.string(
+                default = "release",
+                values = ["release", "development"],
+                doc = "Maturity level of the dependability analysis. 'release' (default) fails `bazel test` when traceability links are missing; 'development' emits a warning and continues.",
+            ),
+            "_lobster_ci_report": attr.label(
+                default = "@lobster//:lobster-ci-report",
+                executable = True,
+                cfg = "exec",
+                doc = "lobster-ci-report executable for test execution.",
+            ),
+            "_lobster_sa_template": attr.label(
+                default = Label("//bazel/rules/rules_score/lobster/config:lobster_sa_template"),
+                allow_single_file = True,
+                doc = "Lobster config template for safety analysis traceability.",
+            ),
+            "_safety_analysis_assembler": attr.label(
+                default = Label("//bazel/rules/rules_score:safety_analysis_assembler"),
+                executable = True,
+                allow_files = True,
+                cfg = "exec",
+                doc = "Safety-analysis page assembler, invoked in coverage-check-only mode " +
+                      "(no --output/--template) to compute uncovered_root_causes.json.",
+            ),
+        },
+        **VERBOSITY_ATTR
+    ),
     subrules = [subrule_lobster_report, subrule_lobster_html_report],
     test = True,
 )
@@ -253,30 +348,39 @@ _dependability_analysis_test = rule(
 
 def dependability_analysis(
         name,
-        fmea = [],
+        safety_analysis = [],
         security_analysis = [],
         dfa = [],
         arch_design = None,
+        measures = [],
         maturity = "release",
         **kwargs):
     """Define dependability analysis following S-CORE process guidelines.
 
     Aggregates up to three sub-analysis rules and validates the combined
-    traceability chain (FM + CM + FTA) via ``lobster-ci-report``.
+    traceability chain (FM + Safety Measures + FTA) via ``lobster-ci-report``, and
+    checks root-cause-coverage completeness: every ``RootCause`` generated by
+    any ``safety_analysis`` sub-target's ``root_causes`` FTA diagrams must be addressed by
+    at least one Mitigation, AoU, or CompReq -- including ones declared via
+    ``measures`` rather than scoped to a single ``safety_analysis`` target.
 
     The target is a Bazel **test rule**.  During ``bazel build`` it produces
     aggregated documentation artefacts and the lobster traceability report.
-    During ``bazel test`` it runs ``lobster-ci-report`` to validate the chain.
+    During ``bazel test`` it runs ``lobster-ci-report`` and the root-cause
+    coverage check to validate the chain.
 
     Args:
         name: The name of the dependability analysis target.
-        fmea: Optional list of ``fmea`` rule target labels.
+        safety_analysis: Optional list of ``safety_analysis`` rule target labels.
         security_analysis: Optional list of security analysis rule target
             labels (placeholder -- not yet implemented).
         dfa: Optional list of ``.rst``/``.md`` DFA documentation files
             (placeholder).
         arch_design: Optional label to an ``architectural_design`` target
             (placeholder).
+        measures: Optional list of additional Mitigation/AoU/CompReq ``.trlc``
+            files not scoped to a single ``safety_analysis`` target, considered for the
+            root-cause-coverage completeness check.
         maturity: 'release' (default) fails ``bazel test`` when traceability
             links are missing; 'development' emits a warning and continues.
         visibility: Bazel visibility.
@@ -287,15 +391,16 @@ def dependability_analysis(
 
             dependability_analysis(
                 name = "my_da",
-                fmea = [":my_fmea"],
+                safety_analysis = [":my_safety_analysis"],
             )
     """
     _dependability_analysis_test(
         name = name,
-        fmea = fmea,
+        safety_analysis = safety_analysis,
         security_analysis = security_analysis,
         dfa = dfa,
         arch_design = arch_design,
+        measures = measures,
         maturity = maturity,
         **kwargs
     )
diff --git a/bazel/rules/rules_score/private/dependable_element.bzl b/bazel/rules/rules_score/private/dependable_element.bzl
index a366ab36..9f1e75a5 100644
--- a/bazel/rules/rules_score/private/dependable_element.bzl
+++ b/bazel/rules/rules_score/private/dependable_element.bzl
@@ -1384,12 +1384,13 @@ def _dependable_element_index_impl(ctx):
     # Lobster Traceability: Dependable Element Level
     # Builds the multi-level traceability report (Feature/Assumed-System
     # Requirements, Component Requirements, Unit Test, Test Case Coverage,
-    # Architecture, Public API, Failure Modes, Control Measures, Root Causes).
+    # Architecture, Public API, Failure Modes, FTA Failure Modes, Root Causes,
+    # Safety Measures).
     # The report is produced whenever any level has data; each level and its
     # `trace to:` coverage edges are emitted only when relevant. In release
     # mode every checking level (Unit Test, Test Case Coverage, Architecture,
-    # Failure Modes, Root Causes) is emitted even when empty, so a missing
-    # unit test / coverage / architecture allocation / public API
+    # Failure Modes, FTA Failure Modes, Root Causes) is emitted even when empty, so a
+    # missing unit test / coverage / architecture allocation / public API
     # characterization / root cause fails the traceability check (see the
     # strict handling below).
     # =========================================================================
@@ -1510,8 +1511,9 @@ def _dependable_element_index_impl(ctx):
     comp_arch_list = comp_arch_lobster_depset.to_list()
     interface_req_list = public_api_lobster_list
     fm_list = [sa_lobster_files["failuremodes.lobster"]] if "failuremodes.lobster" in sa_lobster_files else []
-    cm_list = [sa_lobster_files["controlmeasures.lobster"]] if "controlmeasures.lobster" in sa_lobster_files else []
-    rc_list = [sa_lobster_files["root_causes.lobster"]] if "root_causes.lobster" in sa_lobster_files else []
+    fta_fm_list = [sa_lobster_files["fta_failure_modes.lobster"]] if "fta_failure_modes.lobster" in sa_lobster_files else []
+    rc_list = [sa_lobster_files["fta_root_causes.lobster"]] if "fta_root_causes.lobster" in sa_lobster_files else []
+    safetymeasures_list = [sa_lobster_files["safetymeasures.lobster"]] if "safetymeasures.lobster" in sa_lobster_files else []
 
     # =========================================================================
     # AoU Forwarding: collect own AoUs and received AoUs from deps
@@ -1585,8 +1587,9 @@ def _dependable_element_index_impl(ctx):
         comp_arch_list,
         interface_req_list,
         fm_list,
-        cm_list,
+        fta_fm_list,
         rc_list,
+        safetymeasures_list,
     ])
 
     if has_any_lobster_input:
@@ -1604,8 +1607,12 @@ def _dependable_element_index_impl(ctx):
         #     -> check Component Requirements coverage
         #   * Failure Modes
         #     -> check Public API coverage
+        #   * FTA Failure Modes
+        #     -> check Failure Modes coverage
         #   * Root Causes
-        #     -> check Failure Modes and Control Measures coverage
+        #     -> check FTA Failure Modes coverage
+        #   * Safety Measures
+        #     -> check Root Causes coverage
         # In development mode these checking levels are omitted when empty
         # instead, keeping the in-progress report free of noise.
         #
@@ -1622,7 +1629,8 @@ def _dependable_element_index_impl(ctx):
         has_received_aou = bool(received_aou_list)
         has_public_api = bool(interface_req_list) or strict
         has_fm = bool(fm_list) or strict
-        has_cm = bool(cm_list) or strict
+        has_fta_fm = bool(fta_fm_list) or strict
+        has_rc = bool(rc_list) or strict
 
         lobster_config = ctx.actions.declare_file(ctx.label.name + "/de_traceability_config")
 
@@ -1705,23 +1713,31 @@ def _dependable_element_index_impl(ctx):
                     trace_to = _cond_names((has_public_api, "Public API")),
                     emit_empty = strict,
                 ),
-                "{CM_BLOCK}": format_lobster_block(
-                    "requirements",
-                    "Control Measures",
-                    cm_list,
+                "{FTA_FM_BLOCK}": format_lobster_block(
+                    "activity",
+                    "FTA Failure Modes",
+                    fta_fm_list,
+                    trace_to = _cond_names((has_fm, "Failure Modes")),
                     emit_empty = strict,
                 ),
                 "{RC_BLOCK}": format_lobster_block(
                     "activity",
                     "Root Causes",
                     rc_list,
-                    trace_to = _cond_names((has_fm, "Failure Modes"), (has_cm, "Control Measures")),
+                    trace_to = _cond_names((has_fta_fm, "FTA Failure Modes")),
+                    emit_empty = strict,
+                ),
+                "{SAFETYMEASURES_BLOCK}": format_lobster_block(
+                    "requirements",
+                    "Safety Measures",
+                    safetymeasures_list,
+                    trace_to = _cond_names((has_rc, "Root Causes")),
                     emit_empty = strict,
                 ),
             },
         )
 
-        all_lobster_inputs = feat_req_list + comp_req_list + comp_arch_list + comp_test_list + interface_req_list + fm_list + cm_list + rc_list + received_aou_list + forwarded_aou_markers_list + coverage_lobster_files
+        all_lobster_inputs = feat_req_list + comp_req_list + comp_arch_list + comp_test_list + interface_req_list + fm_list + fta_fm_list + rc_list + safetymeasures_list + received_aou_list + forwarded_aou_markers_list + coverage_lobster_files
         lobster_report_file = subrule_lobster_report(all_lobster_inputs, lobster_config)
         lobster_files = [lobster_config, lobster_report_file]
 
diff --git a/bazel/rules/rules_score/private/fmea.bzl b/bazel/rules/rules_score/private/fmea.bzl
deleted file mode 100644
index 11044f4a..00000000
--- a/bazel/rules/rules_score/private/fmea.bzl
+++ /dev/null
@@ -1,341 +0,0 @@
-# *******************************************************************************
-# Copyright (c) 2025 Contributors to the Eclipse Foundation
-#
-# See the NOTICE file(s) distributed with this work for additional
-# information regarding copyright ownership.
-#
-# This program and the accompanying materials are made available under the
-# terms of the Apache License Version 2.0 which is available at
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# SPDX-License-Identifier: Apache-2.0
-# *******************************************************************************
-
-"""
-FMEA (Failure Mode and Effects Analysis) build rules for S-CORE projects.
-
-The rule generates a single, failure-mode-centric ``fmea.rst`` page: an
-overview summary table followed by one section per failure mode.  Each section
-carries the full failure-mode safety attributes, the fault-tree diagram inline
-(``.. uml::``), and a "Control Measures" subsection holding only that chain's
-basic events.  Failure modes and control measures not referenced by any fault
-tree are appended under trailing "Unlinked …" sections.
-
-Pipeline:
-
-  1. **FTA** (``puml_cli`` in ``--fta-output-dir`` mode) – inlines
-     ``fta_metamodel.puml`` into each ``root_causes`` diagram and emits the
-     metamodel-inlined ``.puml`` (for ``.. uml::``), ``root_causes.lobster``
-     (``lobster-act-trace``) and ``fta_chains.json`` (the ordered per-failure
-     mode chains).
-  2. **Assembly** (``fmea_assembler``) – a single in-process TRLC parse via the
-     extended ``TRLCRST`` library renders the overview table and every chain
-     section into ``fmea.rst``.
-  3. **Lobster** (``lobster-trlc``) – FailureMode and ControlMeasure
-     traceability files, unchanged.
-
-The metamodel-inlined ``.puml`` diagrams travel as ``aux_srcs`` so Sphinx can
-resolve ``.. uml::`` without adding them to the toctree.
-
-``AnalysisInfo`` carries all lobster traceability files (failuremodes,
-controlmeasures, and root_causes if present) as a ``lobster_files`` dict keyed
-by canonical filename.  All Sphinx source files travel via
-``SphinxSourcesInfo``.
-
-This is a **build-only** rule.  The combined traceability *test* is owned by the
-``dependability_analysis`` rule which wraps this one.
-"""
-
-load("//bazel/rules/rules_score:providers.bzl", "AnalysisInfo", "ArchitecturalDesignInfo", "SphinxSourcesInfo")
-load("//bazel/rules/rules_score/private:verbosity.bzl", "VERBOSITY_ATTR", "get_log_level")
-
-# ============================================================================
-# Root-cause (FTA) processing helper
-# ============================================================================
-
-def _process_root_causes(ctx):
-    """Extract FTA traceability + chains and stage the diagrams for rendering.
-
-    ``puml_cli`` (FTA mode) parses the ``$TopEvent``/``$BasicEvent``/gate macro
-    calls straight from each diagram and emits, into ``{label}/``:
-
-      * ``root_causes.lobster`` (``lobster-act-trace`` traceability), and
-      * ``fta_chains.json`` (the ordered per-failure-mode chains).
-
-    The diagrams are *not* rewritten: each source ``.puml`` is symlinked next to
-    ``fmea.rst`` so ``.. uml:: <basename>`` resolves to the authored diagram.
-    Its ``!include fta_metamodel.puml`` is resolved at render time via the docs
-    toolchain's global PlantUML include path (the metamodel is shipped with
-    the registered ``sphinx_toolchain``), so the metamodel is not staged here.
-
-    Returns:
-        Tuple ``(diagram_aux_files, root_causes_lobster_or_None, chains_json)``.
-        ``diagram_aux_files`` (the staged ``.puml`` diagrams) is empty when there
-        are no PlantUML inputs; ``chains_json`` is always a File (an empty ``[]``
-        array when there are no diagrams).
-    """
-    puml_inputs = [
-        f
-        for f in ctx.files.root_causes
-        if f.extension in ("puml", "plantuml")
-    ]
-
-    chains_json = ctx.actions.declare_file("{}/fta_chains.json".format(ctx.label.name))
-
-    if not puml_inputs:
-        # No fault trees: emit an empty chains file so the assembler still runs
-        # (rendering every failure mode without an FTA).
-        ctx.actions.write(chains_json, "[]\n")
-        return [], None, chains_json
-
-    # Symlink each authored diagram next to fmea.rst so ``.. uml:: <basename>``
-    # resolves in the Sphinx tree.
-    diagram_aux_files = []
-    for src in puml_inputs:
-        staged = ctx.actions.declare_file("{}/{}".format(ctx.label.name, src.basename))
-        ctx.actions.symlink(output = staged, target_file = src)
-        diagram_aux_files.append(staged)
-
-    root_causes_lobster = ctx.actions.declare_file("{}/root_causes.lobster".format(ctx.label.name))
-
-    args = ctx.actions.args()
-    for src in puml_inputs:
-        args.add("--file", src.path)
-    args.add("--fta-output-dir", root_causes_lobster.dirname)
-    args.add("--log-level", get_log_level(ctx))
-    ctx.actions.run(
-        inputs = puml_inputs,
-        outputs = [root_causes_lobster, chains_json],
-        executable = ctx.executable._puml_cli,
-        arguments = [args],
-        progress_message = "Processing root cause FTA diagrams for %s" % ctx.label.name,
-    )
-
-    return diagram_aux_files, root_causes_lobster, chains_json
-
-# ============================================================================
-# Lobster (TRLC traceability) helper
-# ============================================================================
-
-def _lobster_trlc(ctx, trlc_files, config, out_name):
-    """Run ``lobster-trlc`` over *trlc_files* producing ``{label}/<out_name>``."""
-    if not trlc_files:
-        return None
-    out = ctx.actions.declare_file("{}/{}".format(ctx.label.name, out_name))
-    args = ctx.actions.args()
-    args.add("--config", config.path)
-    args.add("--out", out.path)
-    ctx.actions.run(
-        inputs = trlc_files + ctx.files.spec + [config],
-        outputs = [out],
-        executable = ctx.executable._lobster_trlc,
-        arguments = [args],
-        progress_message = "lobster-trlc {}".format(out.path),
-    )
-    return out
-
-# ============================================================================
-# Private Rule Implementation
-# ============================================================================
-
-def _fmea_impl(ctx):
-    output_files = []
-
-    # 0. FTA: extract chains/lobster + stage diagrams (and metamodel) for rendering.
-    diagram_aux_files, root_causes_lobster, chains_json = _process_root_causes(ctx)
-    output_files.extend(diagram_aux_files)
-
-    # 1. Assemble fmea.rst from the chains + TRLC records (single in-process parse).
-    fmea_rst = ctx.actions.declare_file("{}/fmea.rst".format(ctx.label.name))
-    title = ctx.label.name
-
-    args = ctx.actions.args()
-    args.add("--output", fmea_rst.path)
-    args.add("--template", ctx.file._template.path)
-    args.add("--title", title)
-    args.add("--chains", chains_json.path)
-    args.add("--log-level", get_log_level(ctx))
-    if ctx.files.failuremodes:
-        args.add("--failuremodes")
-        args.add_all(ctx.files.failuremodes)
-    if ctx.files.controlmeasures:
-        args.add("--controlmeasures")
-        args.add_all(ctx.files.controlmeasures)
-    if ctx.files.spec:
-        args.add("--spec")
-        args.add_all(ctx.files.spec)
-    ctx.actions.run(
-        inputs = (
-            ctx.files.failuremodes +
-            ctx.files.controlmeasures +
-            ctx.files.spec +
-            [chains_json, ctx.file._template]
-        ),
-        outputs = [fmea_rst],
-        executable = ctx.executable._fmea_assembler,
-        arguments = [args],
-        progress_message = "Assembling FMEA page for %s" % ctx.label.name,
-    )
-    output_files.append(fmea_rst)
-
-    # 2. lobster-trlc traceability for FailureMode / ControlMeasure records.
-    fm_lobster = _lobster_trlc(ctx, ctx.files.failuremodes, ctx.file._fm_lobster_config, "failuremodes.lobster")
-    cm_lobster = _lobster_trlc(ctx, ctx.files.controlmeasures, ctx.file._cm_lobster_config, "controlmeasures.lobster")
-
-    # 3. Providers.
-    lobster_files = {}
-    if fm_lobster:
-        lobster_files["failuremodes.lobster"] = fm_lobster
-    if cm_lobster:
-        lobster_files["controlmeasures.lobster"] = cm_lobster
-    if root_causes_lobster:
-        lobster_files["root_causes.lobster"] = root_causes_lobster
-
-    # The preprocessed .puml diagrams are referenced inline via ``.. uml::`` but
-    # must not be toctree documents, so they travel as aux_srcs (symlinked
-    # alongside fmea.rst by dependable_element without being indexed).
-    sphinx_srcs = depset([fmea_rst])
-
-    return [
-        DefaultInfo(
-            files = depset(output_files + [v for v in lobster_files.values()]),
-        ),
-        AnalysisInfo(
-            name = ctx.label.name,
-            lobster_files = lobster_files,
-        ),
-        SphinxSourcesInfo(
-            srcs = sphinx_srcs,
-            deps = depset(transitive = [sphinx_srcs]),
-            aux_srcs = depset(diagram_aux_files),
-        ),
-    ]
-
-# ============================================================================
-# Rule Definition
-# ============================================================================
-
-_fmea = rule(
-    implementation = _fmea_impl,
-    doc = "Renders a failure-mode-centric FMEA page (overview table + one chain " +
-          "section per failure mode) and lobster traceability files. " +
-          "Build-only rule; traceability testing is owned by dependability_analysis.",
-    attrs = dict(
-        {
-            "failuremodes": attr.label_list(
-                allow_files = [".trlc"],
-                mandatory = False,
-                doc = "Failure mode ``.trlc`` source files.",
-            ),
-            "controlmeasures": attr.label_list(
-                allow_files = [".trlc"],
-                mandatory = False,
-                doc = "Control measure ``.trlc`` source files.",
-            ),
-            "spec": attr.label_list(
-                allow_files = [".rsl", ".trlc"],
-                default = [Label("//bazel/rules/rules_score/trlc/config:score_requirements_model")],
-                doc = "TRLC model specification files (``.rsl``) required for import resolution. " +
-                      "Defaults to the S-CORE requirements model.",
-            ),
-            "root_causes": attr.label_list(
-                allow_files = [".puml", ".plantuml"],
-                mandatory = False,
-                doc = "Root cause FTA PlantUML diagram files.  " +
-                      "``fta_metamodel.puml`` is inlined automatically; " +
-                      "lobster items are extracted to ``root_causes.lobster``.",
-            ),
-            "arch_design": attr.label(
-                providers = [ArchitecturalDesignInfo],
-                mandatory = False,
-                doc = "Reference to architectural_design target for traceability.",
-            ),
-            "_puml_cli": attr.label(
-                default = Label("//plantuml/parser/puml_cli:puml_cli"),
-                executable = True,
-                allow_files = True,
-                cfg = "exec",
-                doc = "puml_cli binary used in FTA mode to inline the metamodel and " +
-                      "extract root_causes.lobster + fta_chains.json.",
-            ),
-            "_fmea_assembler": attr.label(
-                default = Label("//bazel/rules/rules_score:fmea_assembler"),
-                executable = True,
-                allow_files = True,
-                cfg = "exec",
-                doc = "FMEA page assembler (imports the extended TRLCRST library).",
-            ),
-            "_lobster_trlc": attr.label(
-                default = Label("@lobster//:lobster-trlc"),
-                executable = True,
-                allow_files = True,
-                cfg = "exec",
-                doc = "lobster-trlc executable used to generate FM and CM lobster files.",
-            ),
-            "_fm_lobster_config": attr.label(
-                default = Label("//bazel/rules/rules_score/lobster/config:failuremodes_config"),
-                allow_single_file = True,
-                doc = "lobster-trlc YAML config for FailureMode records.",
-            ),
-            "_cm_lobster_config": attr.label(
-                default = Label("//bazel/rules/rules_score/lobster/config:controlmeasures_config"),
-                allow_single_file = True,
-                doc = "lobster-trlc YAML config for ControlMeasure records.",
-            ),
-            "_template": attr.label(
-                default = Label("//bazel/rules/rules_score:templates/fmea.template.rst"),
-                allow_single_file = True,
-                doc = "RST template for the FMEA page (single ``{body}`` placeholder).",
-            ),
-        },
-        **VERBOSITY_ATTR
-    ),
-)
-
-# ============================================================================
-# Public Macro
-# ============================================================================
-
-def fmea(
-        name,
-        spec = None,
-        failuremodes = [],
-        controlmeasures = [],
-        root_causes = [],
-        arch_design = None,
-        **kwargs):
-    """Define FMEA (Failure Mode and Effects Analysis) following S-CORE process guidelines.
-
-    Generates a single, failure-mode-centric ``fmea.rst`` page: an overview
-    summary table followed by one section per failure mode (failure-mode detail,
-    the fault tree inline, and that chain's control measures).
-
-    FTA diagrams passed via ``root_causes`` are preprocessed to inline
-    ``fta_metamodel.puml`` (hermetic, no ``!include`` at render time) and
-    lobster traceability items are extracted to ``root_causes.lobster``.
-
-    This is a **build-only** rule.  The combined traceability test
-    (FM + CM + FTA) is owned by the ``dependability_analysis`` that wraps
-    this target.
-
-    Args:
-        name: Target name.
-        spec: TRLC model specification files (``.rsl``) for resolving imports.
-            Defaults to the S-CORE requirements model. Override only when using
-            a custom TRLC schema.
-        failuremodes: Failure mode ``.trlc`` source files.
-        controlmeasures: Control measure ``.trlc`` source files.
-        root_causes: Optional FTA PlantUML diagram files (``.puml`` /
-            ``.plantuml``) representing the root causes of failure modes.
-        arch_design: Optional ``architectural_design`` target for traceability.
-        **kwargs: Additional arguments (e.g. ``visibility``, ``tags``).
-    """
-    _fmea(
-        name = name,
-        spec = spec,
-        failuremodes = failuremodes,
-        controlmeasures = controlmeasures,
-        root_causes = root_causes,
-        arch_design = arch_design,
-        **kwargs
-    )
diff --git a/bazel/rules/rules_score/private/safety_analysis.bzl b/bazel/rules/rules_score/private/safety_analysis.bzl
new file mode 100644
index 00000000..68924dff
--- /dev/null
+++ b/bazel/rules/rules_score/private/safety_analysis.bzl
@@ -0,0 +1,441 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+"""
+Safety analysis (FMEA – Failure Mode and Effects Analysis) build rules for S-CORE projects.
+
+The rule generates a single, failure-mode-centric ``safety_analysis.rst`` page: an
+overview summary table followed by one section per failure mode.  Each section
+carries the full failure-mode safety attributes and one "Root Cause Analysis"
+block per fault tree (``FtaFailureMode``) that covers it: the diagram inline
+(``.. uml::``) and a "Safety Measures" subsection holding only the measures
+(``Mitigation``, ``AoU``, ``CompReq``) that address that tree's root causes.
+Failure modes not covered by any fault tree, and measures not referenced by
+any generated stub, are still rendered (with an empty root-cause /
+traceability section) so nothing is dropped.
+
+Pipeline:
+
+  1. **FTA** (``puml_cli`` in ``--fta-output-dir`` mode) – parses the
+     ``$FailureMode``/``$RootCause``/gate macro calls straight from each
+     ``root_causes`` diagram and emits ``fta_events.trlc`` — the generated
+     ``ScoreReq.FtaFailureMode`` / ``ScoreReq.RootCause`` stub records (see
+     ``puml_fta::render_trlc_stub``) that carry the fault-tree topology as
+     regular, strongly-typed TRLC references instead of alias-matching. Each
+     source diagram is staged (symlinked) alongside ``safety_analysis.rst``, unmodified,
+     so ``.. uml:: <basename>`` resolves in the Sphinx tree.
+  2. **Assembly** (``safety_analysis_assembler``) – a single in-process TRLC parse (via
+     the extended ``TRLCRST`` library) over ``fta_events.trlc`` plus the
+     FailureMode / Mitigation records renders the overview table and every
+     chain section into ``safety_analysis.rst``.
+  3. **Lobster** (``lobster-trlc``) – FailureMode, Mitigation, FtaFailureMode and
+     RootCause traceability files, driven by real TRLC references
+     (``failure_modes``, ``root_causes``) rather than
+     alias-name matching.
+
+The metamodel-inlined ``.puml`` diagrams travel as ``aux_srcs`` so Sphinx can
+resolve ``.. uml::`` without adding them to the toctree.
+
+``AnalysisInfo`` carries all lobster traceability files (failuremodes,
+safetymeasures, fta_failure_modes, fta_root_causes) as a ``lobster_files`` dict
+keyed by canonical filename.  ``SafetyAnalysisProviderInfo`` carries the raw TRLC
+source files (failuremodes, safetymeasures, fta_events, spec) so
+``dependability_analysis`` can combine them across every safety_analysis sub-target for
+its root-cause-coverage completeness check.  All Sphinx source files travel
+via ``SphinxSourcesInfo``.
+
+This is a **build-only** rule.  The combined traceability *test* is owned by the
+``dependability_analysis`` rule which wraps this one.
+"""
+
+load("//bazel/rules/rules_score:providers.bzl", "AnalysisInfo", "ArchitecturalDesignInfo", "SafetyAnalysisProviderInfo", "SphinxSourcesInfo")
+load("//bazel/rules/rules_score/private:verbosity.bzl", "VERBOSITY_ATTR", "get_log_level")
+
+def _default_fta_package(name):
+    """Best-effort conversion of a Bazel target *name* into a valid TRLC
+    package identifier (``[A-Za-z_][A-Za-z0-9_]*``): non-identifier
+    characters (e.g. ``-``) become ``_``; a name starting with a digit gets a
+    leading ``_``.
+
+    A ``_fta`` suffix is appended: TRLC rejects packages whose name is "too
+    similar" (same modulo case/underscores) to another declared package, and
+    FailureMode/SafetyMeasure packages conventionally use a PascalCase form
+    of the very same target name (e.g. target ``my_safety_analysis`` + package
+    ``MySafetyAnalysis``) -- using the bare sanitized name here would then always
+    collide with that package.
+    """
+    out = ""
+    for i in range(len(name)):
+        c = name[i]
+        out += c if (c.isalnum() or c == "_") else "_"
+    if out[:1].isdigit():
+        out = "_" + out
+    return out + "_fta"
+
+# ============================================================================
+# Root-cause (FTA) processing helper
+# ============================================================================
+
+def _process_root_causes(ctx, fta_package):
+    """Extract the generated TRLC stub, and stage the diagrams for rendering.
+
+    ``puml_cli`` (FTA mode) parses the ``$FailureMode``/``$RootCause``/gate macro
+    calls straight from each diagram and emits, into ``{label}/``:
+
+      * ``fta_events.trlc`` (the generated ``FtaFailureMode``/``RootCause`` stub
+        records, package *fta_package*; see ``puml_fta::render_trlc_stub``).
+
+    The diagrams are *not* rewritten: each source ``.puml`` is symlinked next to
+    ``safety_analysis.rst`` so ``.. uml:: <basename>`` resolves to the authored diagram.
+    Its ``!include fta_metamodel.puml`` is resolved at render time via the docs
+    toolchain's global PlantUML include path (the metamodel is shipped with
+    the registered ``sphinx_toolchain``), so the metamodel is not staged here.
+
+    Args:
+        ctx: Rule context.
+        fta_package: TRLC package name for the generated ``fta_events.trlc``.
+
+    Returns:
+        Tuple ``(diagram_aux_files, fta_events_trlc)``.  ``diagram_aux_files``
+        (the staged ``.puml`` diagrams) is empty when there are no PlantUML
+        inputs; ``fta_events_trlc`` is always a File (a stub package with zero
+        records when there are no diagrams).
+    """
+    puml_inputs = [
+        f
+        for f in ctx.files.root_causes
+        if f.extension in ("puml", "plantuml")
+    ]
+
+    fta_events_trlc = ctx.actions.declare_file("{}/fta_events.trlc".format(ctx.label.name))
+
+    if not puml_inputs:
+        # No fault trees: emit an empty stub artifact so the assembler still runs
+        # (rendering every failure mode without a root-cause analysis). No
+        # "import ScoreReq" here: with zero records it would be flagged as an
+        # unused import by TRLC.
+        ctx.actions.write(
+            fta_events_trlc,
+            "// no root cause diagrams\npackage {}\n".format(fta_package),
+        )
+        return [], fta_events_trlc
+
+    # Symlink each authored diagram next to safety_analysis.rst so ``.. uml:: <basename>``
+    # resolves in the Sphinx tree.
+    diagram_aux_files = []
+    for src in puml_inputs:
+        staged = ctx.actions.declare_file("{}/{}".format(ctx.label.name, src.basename))
+        ctx.actions.symlink(output = staged, target_file = src)
+        diagram_aux_files.append(staged)
+
+    args = ctx.actions.args()
+    for src in puml_inputs:
+        args.add("--file", src.path)
+    args.add("--fta-output-dir", fta_events_trlc.dirname)
+    args.add("--fta-package", fta_package)
+    args.add("--log-level", get_log_level(ctx))
+    ctx.actions.run(
+        inputs = puml_inputs,
+        outputs = [fta_events_trlc],
+        executable = ctx.executable._puml_cli,
+        arguments = [args],
+        progress_message = "Processing root cause FTA diagrams for %s" % ctx.label.name,
+    )
+
+    return diagram_aux_files, fta_events_trlc
+
+# ============================================================================
+# Lobster (TRLC traceability) helper
+# ============================================================================
+
+def _lobster_trlc(ctx, trlc_files, config, out_name):
+    """Run ``lobster-trlc`` over *trlc_files* producing ``{label}/<out_name>``."""
+    if not trlc_files:
+        return None
+    out = ctx.actions.declare_file("{}/{}".format(ctx.label.name, out_name))
+    args = ctx.actions.args()
+    args.add("--config", config.path)
+    args.add("--out", out.path)
+    ctx.actions.run(
+        inputs = trlc_files + ctx.files.spec + [config],
+        outputs = [out],
+        executable = ctx.executable._lobster_trlc,
+        arguments = [args],
+        progress_message = "lobster-trlc {}".format(out.path),
+    )
+    return out
+
+# ============================================================================
+# Private Rule Implementation
+# ============================================================================
+
+def _safety_analysis_impl(ctx):
+    output_files = []
+
+    fta_package = ctx.attr.fta_package if ctx.attr.fta_package else _default_fta_package(ctx.label.name)
+
+    # 0. FTA: extract the generated TRLC stub, and stage diagrams for rendering.
+    diagram_aux_files, fta_events_trlc = _process_root_causes(ctx, fta_package)
+    output_files.extend(diagram_aux_files)
+    has_root_causes = bool(diagram_aux_files)
+
+    # 1. Assemble safety_analysis.rst from the generated FTA stub + TRLC records (single in-process parse).
+    safety_analysis_rst = ctx.actions.declare_file("{}/safety_analysis.rst".format(ctx.label.name))
+    title = ctx.label.name
+
+    args = ctx.actions.args()
+    args.add("--output", safety_analysis_rst.path)
+    args.add("--template", ctx.file._template.path)
+    args.add("--title", title)
+    args.add("--fta-events", fta_events_trlc.path)
+    args.add("--log-level", get_log_level(ctx))
+    if ctx.files.failuremodes:
+        args.add("--failuremodes")
+        args.add_all(ctx.files.failuremodes)
+    if ctx.files.safetymeasures:
+        args.add("--safetymeasures")
+        args.add_all(ctx.files.safetymeasures)
+    if ctx.files.spec:
+        args.add("--spec")
+        args.add_all(ctx.files.spec)
+    ctx.actions.run(
+        inputs = (
+            ctx.files.failuremodes +
+            ctx.files.safetymeasures +
+            ctx.files.spec +
+            [fta_events_trlc, ctx.file._template]
+        ),
+        outputs = [safety_analysis_rst],
+        executable = ctx.executable._safety_analysis_assembler,
+        arguments = [args],
+        progress_message = "Assembling safety-analysis page for %s" % ctx.label.name,
+    )
+    output_files.append(safety_analysis_rst)
+
+    # 2. lobster-trlc traceability for FailureMode / Mitigation / FtaFailureMode / RootCause records.
+    #
+    # fta_events.trlc always ``import``s every FailureMode package referenced by
+    # its FtaFailureMode records (regardless of which record a given invocation is
+    # actually converting), so ctx.files.failuremodes must travel alongside it
+    # in every lobster-trlc input set, or TRLC parsing fails on the unresolved
+    # import.
+    fta_and_fm_files = [fta_events_trlc] + ctx.files.failuremodes
+
+    fm_lobster = _lobster_trlc(ctx, ctx.files.failuremodes, ctx.file._fm_lobster_config, "failuremodes.lobster")
+    safetymeasures_trlc_files = ctx.files.safetymeasures + (fta_and_fm_files if ctx.files.safetymeasures else [])
+    safetymeasures_lobster = _lobster_trlc(ctx, safetymeasures_trlc_files, ctx.file._safetymeasures_lobster_config, "safetymeasures.lobster")
+
+    fta_fm_lobster = None
+    rc_lobster = None
+    if has_root_causes:
+        fta_fm_lobster = _lobster_trlc(
+            ctx,
+            fta_and_fm_files,
+            ctx.file._fta_fm_lobster_config,
+            "fta_failure_modes.lobster",
+        )
+        rc_lobster = _lobster_trlc(
+            ctx,
+            fta_and_fm_files,
+            ctx.file._rc_lobster_config,
+            "fta_root_causes.lobster",
+        )
+
+    # 3. Providers.
+    lobster_files = {}
+    if fm_lobster:
+        lobster_files["failuremodes.lobster"] = fm_lobster
+    if safetymeasures_lobster:
+        lobster_files["safetymeasures.lobster"] = safetymeasures_lobster
+    if fta_fm_lobster:
+        lobster_files["fta_failure_modes.lobster"] = fta_fm_lobster
+    if rc_lobster:
+        lobster_files["fta_root_causes.lobster"] = rc_lobster
+
+    # The preprocessed .puml diagrams are referenced inline via ``.. uml::`` but
+    # must not be toctree documents, so they travel as aux_srcs (symlinked
+    # alongside safety_analysis.rst by dependable_element without being indexed).
+    sphinx_srcs = depset([safety_analysis_rst])
+
+    return [
+        DefaultInfo(
+            files = depset(output_files + [v for v in lobster_files.values()]),
+        ),
+        AnalysisInfo(
+            name = ctx.label.name,
+            lobster_files = lobster_files,
+        ),
+        SafetyAnalysisProviderInfo(
+            failuremodes = depset(ctx.files.failuremodes),
+            safetymeasures = depset(ctx.files.safetymeasures),
+            fta_events = depset([fta_events_trlc]),
+            spec = depset(ctx.files.spec),
+        ),
+        SphinxSourcesInfo(
+            srcs = sphinx_srcs,
+            deps = depset(transitive = [sphinx_srcs]),
+            aux_srcs = depset(diagram_aux_files),
+        ),
+    ]
+
+# ============================================================================
+# Rule Definition
+# ============================================================================
+
+_safety_analysis = rule(
+    implementation = _safety_analysis_impl,
+    doc = "Renders a failure-mode-centric safety-analysis page (overview table + one chain " +
+          "section per failure mode) and lobster traceability files. " +
+          "Build-only rule; traceability testing is owned by dependability_analysis.",
+    attrs = dict(
+        {
+            "failuremodes": attr.label_list(
+                allow_files = [".trlc"],
+                mandatory = False,
+                doc = "Failure mode ``.trlc`` source files.",
+            ),
+            "safetymeasures": attr.label_list(
+                allow_files = [".trlc"],
+                mandatory = False,
+                doc = "Safety measure (``Mitigation``/``AoU``/``CompReq``) ``.trlc`` source files.",
+            ),
+            "spec": attr.label_list(
+                allow_files = [".rsl", ".trlc"],
+                default = [Label("//bazel/rules/rules_score/trlc/config:score_requirements_model")],
+                doc = "TRLC model specification files (``.rsl``) required for import resolution. " +
+                      "Defaults to the S-CORE requirements model.",
+            ),
+            "root_causes": attr.label_list(
+                allow_files = [".puml", ".plantuml"],
+                mandatory = False,
+                doc = "Root cause FTA PlantUML diagram files.  " +
+                      "``fta_metamodel.puml`` is inlined automatically; " +
+                      "lobster items and the ``fta_events.trlc`` TRLC stub are generated from them.",
+            ),
+            "fta_package": attr.string(
+                mandatory = False,
+                default = "",
+                doc = "TRLC package name for the generated ``fta_events.trlc`` stub file " +
+                      "(the ``FtaFailureMode``/``RootCause`` records generated from ``root_causes``). " +
+                      "Defaults to a sanitized form of the target name.",
+            ),
+            "arch_design": attr.label(
+                providers = [ArchitecturalDesignInfo],
+                mandatory = True,
+                doc = "architectural_design target for traceability.",
+            ),
+            "_puml_cli": attr.label(
+                default = Label("//plantuml/parser/puml_cli:puml_cli"),
+                executable = True,
+                allow_files = True,
+                cfg = "exec",
+                doc = "puml_cli binary used in FTA mode to extract fta_events.trlc.",
+            ),
+            "_safety_analysis_assembler": attr.label(
+                default = Label("//bazel/rules/rules_score:safety_analysis_assembler"),
+                executable = True,
+                allow_files = True,
+                cfg = "exec",
+                doc = "Safety-analysis page assembler (imports the extended TRLCRST library).",
+            ),
+            "_lobster_trlc": attr.label(
+                default = Label("@lobster//:lobster-trlc"),
+                executable = True,
+                allow_files = True,
+                cfg = "exec",
+                doc = "lobster-trlc executable used to generate FM and CM lobster files.",
+            ),
+            "_fm_lobster_config": attr.label(
+                default = Label("//bazel/rules/rules_score/lobster/config:failuremodes_config"),
+                allow_single_file = True,
+                doc = "lobster-trlc YAML config for FailureMode records.",
+            ),
+            "_safetymeasures_lobster_config": attr.label(
+                default = Label("//bazel/rules/rules_score/lobster/config:safetymeasures_config"),
+                allow_single_file = True,
+                doc = "lobster-trlc YAML config for Mitigation records.",
+            ),
+            "_fta_fm_lobster_config": attr.label(
+                default = Label("//bazel/rules/rules_score/lobster/config:fta_failure_modes_config"),
+                allow_single_file = True,
+                doc = "lobster-trlc YAML config for generated FtaFailureMode records.",
+            ),
+            "_rc_lobster_config": attr.label(
+                default = Label("//bazel/rules/rules_score/lobster/config:fta_root_causes_config"),
+                allow_single_file = True,
+                doc = "lobster-trlc YAML config for generated RootCause records.",
+            ),
+            "_template": attr.label(
+                default = Label("//bazel/rules/rules_score:templates/safety_analysis.template.rst"),
+                allow_single_file = True,
+                doc = "RST template for the safety-analysis page (single ``{body}`` placeholder).",
+            ),
+        },
+        **VERBOSITY_ATTR
+    ),
+)
+
+# ============================================================================
+# Public Macro
+# ============================================================================
+
+def safety_analysis(
+        name,
+        arch_design,
+        spec = None,
+        failuremodes = [],
+        safetymeasures = [],
+        root_causes = [],
+        fta_package = None,
+        **kwargs):
+    """Define a safety analysis (FMEA - Failure Mode and Effects Analysis) following S-CORE process guidelines.
+
+    Generates a single, failure-mode-centric ``safety_analysis.rst`` page: an overview
+    summary table followed by one section per failure mode (failure-mode detail,
+    one inline fault tree per covering ``FtaFailureMode``, and that tree's measures).
+
+    FTA diagrams passed via ``root_causes`` are preprocessed to extract
+    fault-tree topology, emitted as strongly-typed TRLC ``FtaFailureMode``/
+    ``RootCause`` records (``fta_events.trlc``, package ``fta_package``) that
+    ``Mitigation``, ``AoU``, and ``CompReq`` records can reference (via
+    ``root_causes``/``derived_from``) as a measure addressing that root cause.
+
+    This is a **build-only** rule.  The combined traceability test
+    (FM + measures + FTA, including root-cause-coverage completeness) is
+    owned by the ``dependability_analysis`` that wraps this target.
+
+    Args:
+        name: Target name.
+        arch_design: ``architectural_design`` target for traceability; its
+            ``public_api`` is what ``FailureMode.interface`` references.
+        spec: TRLC model specification files (``.rsl``) for resolving imports.
+            Defaults to the S-CORE requirements model. Override only when using
+            a custom TRLC schema.
+        failuremodes: Failure mode ``.trlc`` source files.
+        safetymeasures: Safety measure (``Mitigation``/``AoU``/``CompReq``) ``.trlc`` source files.
+        root_causes: Optional FTA PlantUML diagram files (``.puml`` /
+            ``.plantuml``) representing the root causes of failure modes.
+        fta_package: TRLC package name for the generated ``fta_events.trlc``
+            stub file. Defaults to a sanitized form of ``name``.
+        **kwargs: Additional arguments (e.g. ``visibility``, ``tags``).
+    """
+    _safety_analysis(
+        name = name,
+        spec = spec,
+        failuremodes = failuremodes,
+        safetymeasures = safetymeasures,
+        root_causes = root_causes,
+        fta_package = fta_package or "",
+        arch_design = arch_design,
+        **kwargs
+    )
diff --git a/bazel/rules/rules_score/providers.bzl b/bazel/rules/rules_score/providers.bzl
index 7a612d1b..abfd8730 100644
--- a/bazel/rules/rules_score/providers.bzl
+++ b/bazel/rules/rules_score/providers.bzl
@@ -117,7 +117,24 @@ AnalysisInfo = provider(
     fields = {
         "name": "Name of the analysis target.",
         "lobster_files": "Dict mapping canonical lobster file names to File objects " +
-                         "(e.g. {'failuremodes.lobster': File, 'root_causes.lobster': File}).",
+                         "(e.g. {'failuremodes.lobster': File, 'safetymeasures.lobster': File}).",
+    },
+)
+
+SafetyAnalysisProviderInfo = provider(
+    doc = """Provider carrying a safety_analysis target's raw TRLC source files.
+
+    Consumed by ``dependability_analysis`` to combine every safety_analysis sub-target's
+    fault-tree topology (RootCause root causes) with its own ``measures``
+    attribute into a single root-cause-coverage completeness check (every
+    RootCause addressed by at least one Mitigation, AoU, or CompReq),
+    without re-rendering each safety_analysis target's own ``safety_analysis.rst`` page.
+    """,
+    fields = {
+        "failuremodes": "Depset of FailureMode .trlc source files.",
+        "safetymeasures": "Depset of Mitigation/AoU/CompReq .trlc source files.",
+        "fta_events": "Depset containing the single generated fta_events.trlc stub file.",
+        "spec": "Depset of .rsl/.trlc model spec files needed for import resolution.",
     },
 )
 
@@ -224,11 +241,11 @@ DependabilityAnalysisInfo = provider(
     doc = """Provider for dependability analysis artifacts.
 
     Aggregates sub-analyses:
-      * **fmea**              – fmea rule targets (FM + CM + optional root causes).
+      * **safety_analysis**   – safety_analysis rule targets (FM + CM + optional root causes).
       * **security_analysis** – security analysis targets (placeholder).
     """,
     fields = {
-        "fmea": "Depset of output files from fmea targets.",
+        "safety_analysis": "Depset of output files from safety_analysis targets.",
         "security_analysis": "Depset of output files from security analysis targets.",
         "dfa": "Depset of DFA documentation files (placeholder).",
         "arch_design": "ArchitecturalDesignInfo from the linked architectural design (placeholder).",
diff --git a/bazel/rules/rules_score/rules_score.bzl b/bazel/rules/rules_score/rules_score.bzl
index 9a6cb8e8..85b0ae42 100644
--- a/bazel/rules/rules_score/rules_score.bzl
+++ b/bazel/rules/rules_score/rules_score.bzl
@@ -53,14 +53,14 @@ load(
     "//bazel/rules/rules_score/private:filter_execpath.bzl",
     _filter_execpath = "filter_execpath",
 )
-load(
-    "//bazel/rules/rules_score/private:fmea.bzl",
-    _fmea = "fmea",
-)
 load(
     "//bazel/rules/rules_score/private:glossary.bzl",
     _glossary = "glossary",
 )
+load(
+    "//bazel/rules/rules_score/private:safety_analysis.bzl",
+    _safety_analysis = "safety_analysis",
+)
 load(
     "//bazel/rules/rules_score/private:sphinx_module.bzl",
     _sphinx_module = "sphinx_module",
@@ -82,7 +82,7 @@ dependability_analysis = _dependability_analysis
 feature_requirements = _feature_requirements
 glossary = _glossary
 filter_execpath = _filter_execpath
-fmea = _fmea
+safety_analysis = _safety_analysis
 sphinx_module = _sphinx_module
 unit = _unit
 unit_design = _unit_design
diff --git a/bazel/rules/rules_score/src/fmea_assembler.py b/bazel/rules/rules_score/src/fmea_assembler.py
deleted file mode 100644
index 655b2a58..00000000
--- a/bazel/rules/rules_score/src/fmea_assembler.py
+++ /dev/null
@@ -1,349 +0,0 @@
-# *******************************************************************************
-# Copyright (c) 2026 Contributors to the Eclipse Foundation
-#
-# See the NOTICE file(s) distributed with this work for additional
-# information regarding copyright ownership.
-#
-# This program and the accompanying materials are made available under the
-# terms of the Apache License Version 2.0 which is available at
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# SPDX-License-Identifier: Apache-2.0
-# *******************************************************************************
-"""Assemble a failure-mode-centric ``fmea.rst`` page.
-
-The page is pivoted around the safety chain: an overview summary table followed
-by one section per failure mode, each containing the failure-mode detail, the
-fault-tree diagram inline, and a "Control Measures" subsection holding only that
-chain's basic events.  Failure modes and control measures not referenced by any
-fault tree are appended under trailing "Unlinked …" sections so nothing is
-dropped.
-
-A single in-process TRLC parse (via the extended ``TRLCRST`` library) backs the
-whole page — no per-record Bazel actions and no ``.inc`` splitting.
-"""
-
-import argparse
-import dataclasses
-import json
-import logging
-import re
-import sys
-
-from trlc_rst import TRLCRST, TRLCParseError
-
-logger = logging.getLogger(__name__)
-
-_LEVEL_MAP = {
-    "error": logging.ERROR,
-    "warn": logging.WARNING,
-    "info": logging.INFO,
-    "debug": logging.DEBUG,
-}
-
-# Global Control Measures summary table columns.
-_CM_TABLE_COLUMNS = {"safety": "ASIL", "description": "Description"}
-# Overview summary table columns (one row per failure mode).
-_FM_TABLE_COLUMNS = {
-    "guideword": "Guideword",
-    "safety": "ASIL",
-    "interface": "Interface",
-}
-
-_OVERVIEW_TITLE = "Overview"
-_FAILURE_MODES_TITLE = "Failure Modes"
-_CONTROL_MEASURES_TITLE = "Control Measures"
-_ROOT_CAUSE_TITLE = "Root Cause Analysis"
-
-# ASIL value -> sphinx-design badge role (severity-coloured).
-_ASIL_BADGE = {
-    "QM": "bdg-secondary",
-    "B": "bdg-warning",
-    "D": "bdg-danger",
-}
-_DEFAULT_BADGE = "bdg-secondary"
-_GUIDEWORD_BADGE = "bdg-info"
-
-
-def _heading(text: str, char: str) -> str:
-    return f"{text}\n{char * len(text)}\n"
-
-
-def _indent(text: str, n: int = 3) -> str:
-    """Indent every non-empty line of *text* by *n* spaces (for nesting under a
-    directive); blank lines are kept empty."""
-    pad = " " * n
-    return "\n".join(pad + line if line.strip() else "" for line in text.splitlines())
-
-
-def _anchor(fqn: str) -> str:
-    """Sphinx cross-reference label derived from a fully-qualified name."""
-    return "fmea-" + re.sub(r"[^0-9a-zA-Z]+", "-", fqn).strip("-").lower()
-
-
-def _ref(fqn: str, name: str) -> str:
-    return f":ref:`{name} <{_anchor(fqn)}>`"
-
-
-@dataclasses.dataclass
-class _Directive:
-    """A renderable RST / sphinx-design directive node.
-
-    Indentation and blank-line separation are handled centrally in
-    :meth:`render`, so element builders stay declarative trees instead of
-    hand-concatenated strings.  ``body`` items may be nested ``_Directive``\\ s
-    or raw RST string blocks (e.g. a trlc_rst-rendered table or description).
-    """
-
-    name: str
-    arg: str = ""
-    options: dict = dataclasses.field(default_factory=dict)
-    body: list = dataclasses.field(default_factory=list)
-
-    def render(self) -> str:
-        lines = [f".. {self.name}::" + (f" {self.arg}" if self.arg else "")]
-        for key, value in self.options.items():
-            lines.append(f"   :{key}: {value}")
-        blocks = [b for b in (_render_block(x) for x in self.body if x) if b]
-        if blocks:
-            lines.append("")
-            lines.append(_indent("\n\n".join(blocks)))
-        return "\n".join(lines)
-
-
-def _render_block(block) -> str:
-    """Render a nested directive node or a raw RST string block."""
-    if isinstance(block, _Directive):
-        return block.render()
-    return str(block).rstrip("\n")
-
-
-# --- sphinx-design element builders (declarative; no manual indentation) ----
-
-
-def _grid(items: list, columns: int = 2, gutter: int | None = None) -> _Directive:
-    options = {} if gutter is None else {"gutter": gutter}
-    return _Directive("grid", str(columns), options, list(items))
-
-
-def _grid_item(body, options: dict | None = None) -> _Directive:
-    """A bare grid cell (no card chrome)."""
-    return _Directive("grid-item", options=options or {}, body=[body])
-
-
-def _card(title: str, body) -> _Directive:
-    """A ``grid-item-card``; *title* may be empty for a header-less card."""
-    return _Directive("grid-item-card", title, body=body if isinstance(body, list) else [body])
-
-
-def _badge(role: str, text: str) -> str:
-    return f":{role}:`{text}`"
-
-
-# ---------------------------------------------------------------------------
-# Element renderers — each returns a directive node (or None)
-# ---------------------------------------------------------------------------
-
-
-def _attr_grid(obj: object) -> _Directive | None:
-    """FM attributes: guideword/ASIL as centred chips (no card chrome),
-    interface/failure-effect as titled cards; a gutter separates the rows."""
-    fields = obj.to_python_dict()
-    items = []
-    guideword = fields.get("guideword")
-    if guideword:
-        items.append(_grid_item(_badge(_GUIDEWORD_BADGE, guideword), {"class": "sd-text-center"}))
-    safety = fields.get("safety")
-    if safety:
-        role = _ASIL_BADGE.get(safety, _DEFAULT_BADGE)
-        items.append(_grid_item(_badge(role, f"ASIL {safety}"), {"class": "sd-text-center"}))
-    for field_name, label in (
-        ("interface", "Interface"),
-        ("failureeffect", "Failure Effect"),
-    ):
-        value = fields.get(field_name)
-        if value:
-            items.append(_card(label, value))
-    return _grid(items, columns=2, gutter=3) if items else None
-
-
-def _description_card(renderer: TRLCRST, fqn: str) -> _Directive | None:
-    """Description as a prominent card in a ``grid:: 1`` so its borders align
-    with the attribute grid above."""
-    description = renderer.field_value_for(fqn, "description")
-    if not description:
-        return None
-    return _grid([_card("Description", description)], columns=1)
-
-
-def _cm_card(renderer: TRLCRST, fqn: str, obj: object) -> _Directive:
-    """One control-measure card: bold ID with inline ASIL badge, then description.
-
-    Both the ID line and the description are direct text content of the card
-    (not nested grids), so they align at the same indentation as the Description
-    card body above.
-    """
-    safety = obj.to_python_dict().get("safety", "")
-    badge_str = " " + _badge(_ASIL_BADGE.get(safety, _DEFAULT_BADGE), f"ASIL {safety}") if safety else ""
-    header_text = f"**{obj.name}**{badge_str}"
-    description = renderer.field_value_for(fqn, "description")
-    body: list = [header_text]
-    if description:
-        body.append(description)
-    return _card("", body)
-
-
-def _cm_grid(renderer: TRLCRST, obj_map: dict, cms: list[str]) -> _Directive | None:
-    cards = [_cm_card(renderer, fqn, obj_map[fqn]) for fqn in cms if fqn in obj_map]
-    return _grid(cards, columns=1) if cards else None
-
-
-def _fm_dropdown(renderer: TRLCRST, fqn: str, obj: object, chain: dict | None) -> _Directive:
-    """One collapsible failure-mode dropdown.
-
-    *chain* is ``None`` for an orphan failure mode (no fault tree); the Root
-    Cause Analysis and Control Measures parts are then omitted.
-    """
-    body = [_attr_grid(obj), _description_card(renderer, fqn)]
-    if chain is not None:
-        body.append(_Directive("rubric", _ROOT_CAUSE_TITLE))
-        body.append(_Directive("uml", chain["puml"]))
-        cms = _cm_grid(renderer, renderer.objects_by_fqn(), chain.get("control_measures", []))
-        if cms is not None:
-            body.append(_Directive("rubric", _CONTROL_MEASURES_TITLE))
-            body.append(cms)
-    return _Directive("dropdown", fqn, {"name": _anchor(fqn)}, body)
-
-
-# ---------------------------------------------------------------------------
-# Section renderers — top-level page sections (return RST strings)
-# ---------------------------------------------------------------------------
-
-
-def _validate_chain(chain) -> str:
-    """Return a chain's ``fm_fqn`` or raise ``ValueError`` if it is malformed."""
-    try:
-        fqn = chain["fm_fqn"]
-        chain["puml"]
-    except (KeyError, TypeError) as exc:
-        raise ValueError(f"Malformed chain entry {chain!r} in fta_chains.json: missing required key {exc}") from exc
-    return fqn
-
-
-def _render_overview(renderer: TRLCRST, fm_fqns: list[str]) -> str:
-    if not fm_fqns:
-        return ""
-    table = renderer.render_table_to_string(_FM_TABLE_COLUMNS, fqns=fm_fqns, name_header="Failure Mode", link_fn=_ref)
-    return _heading(_OVERVIEW_TITLE, "-") + "\n" + table
-
-
-def _render_failure_modes(renderer: TRLCRST, chains: list, obj_map: dict, fm_fqns: list[str]) -> str:
-    dropdowns = []
-    linked = set()
-    for chain in chains:
-        fqn = _validate_chain(chain)
-        if fqn in obj_map:
-            linked.add(fqn)
-            dropdowns.append(_fm_dropdown(renderer, fqn, obj_map[fqn], chain))
-        else:
-            logger.warning(
-                "fta_chains.json references unknown FailureMode %r; no matching TRLC record — chain skipped",
-                fqn,
-            )
-    # Orphan failure modes (no fault tree) still render, without FTA / CMs.
-    for fqn in fm_fqns:
-        if fqn not in linked:
-            dropdowns.append(_fm_dropdown(renderer, fqn, obj_map[fqn], None))
-    body = "\n\n".join(d.render() for d in dropdowns)
-    return _heading(_FAILURE_MODES_TITLE, "-") + "\n" + body + "\n"
-
-
-def _render_control_measures(renderer: TRLCRST, cm_fqns: list[str]) -> str:
-    if not cm_fqns:
-        return ""
-    table = renderer.render_table_to_string(_CM_TABLE_COLUMNS, fqns=cm_fqns, name_header="Control Measure")
-    return _heading(_CONTROL_MEASURES_TITLE, "-") + "\n" + table
-
-
-def _build_body(renderer: TRLCRST, chains: list, title: str) -> str:
-    obj_map = renderer.objects_by_fqn()
-    fm_fqns = [fqn for fqn, obj in obj_map.items() if obj.n_typ.name == "FailureMode"]
-    cm_fqns = [fqn for fqn, obj in obj_map.items() if obj.n_typ.name == "ControlMeasure"]
-
-    sections = [
-        _heading(title, "="),
-        _render_overview(renderer, fm_fqns),
-        _render_failure_modes(renderer, chains, obj_map, fm_fqns),
-        _render_control_measures(renderer, cm_fqns),
-    ]
-    return "\n".join(s for s in sections if s)
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--output", required=True, help="Output fmea.rst path.")
-    parser.add_argument("--template", required=True, help="RST template path.")
-    parser.add_argument("--title", required=True, help="Page title.")
-    parser.add_argument(
-        "--chains",
-        required=True,
-        help="fta_chains.json produced by puml_cli FTA mode.",
-    )
-    parser.add_argument("--failuremodes", nargs="*", default=[], help="FailureMode .trlc files.")
-    parser.add_argument(
-        "--controlmeasures",
-        nargs="*",
-        default=[],
-        help="ControlMeasure .trlc files.",
-    )
-    parser.add_argument(
-        "--spec",
-        nargs="*",
-        default=[],
-        help="TRLC .rsl/.trlc spec files for import resolution.",
-    )
-    parser.add_argument(
-        "--log-level",
-        choices=["error", "warn", "info", "debug"],
-        default="warn",
-        dest="log_level",
-        help="Log level for tool output (default: warn).",
-    )
-    args = parser.parse_args()
-
-    logging.basicConfig(level=_LEVEL_MAP[args.log_level], format="%(levelname)s: %(message)s")
-
-    try:
-        with open(args.chains, encoding="utf-8") as fh:
-            chains = json.load(fh)
-    except (OSError, json.JSONDecodeError) as exc:
-        logger.error("Error reading chains file %s: %s", args.chains, exc)
-        sys.exit(1)
-
-    source_files = list(args.failuremodes) + list(args.controlmeasures)
-    renderer = TRLCRST(
-        input_directory=None,
-        source_files=source_files,
-        dep_files=list(args.spec),
-    )
-    try:
-        renderer.parse_trlc_files()
-    except TRLCParseError as exc:
-        logger.error("TRLC parse error: %s", exc)
-        sys.exit(1)
-
-    body = _build_body(renderer, chains, args.title)
-
-    with open(args.template, encoding="utf-8", newline="") as fh:
-        template = fh.read()
-    if "{body}" not in template:
-        logger.error("Template %r does not contain a '{body}' placeholder", args.template)
-        sys.exit(1)
-    rendered = template.replace("{body}", body)
-
-    with open(args.output, "w", newline="", encoding="utf-8") as fh:
-        fh.write(rendered)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/bazel/rules/rules_score/src/safety_analysis_assembler.py b/bazel/rules/rules_score/src/safety_analysis_assembler.py
new file mode 100644
index 00000000..677afc4c
--- /dev/null
+++ b/bazel/rules/rules_score/src/safety_analysis_assembler.py
@@ -0,0 +1,452 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+"""Assemble a failure-mode-centric ``safety_analysis.rst`` page.
+
+The page is pivoted around the safety chain: an overview summary table followed
+by one section per failure mode, each containing the failure-mode detail and one
+"Root Cause Analysis" block per fault tree (``FtaFailureMode``) that covers it — the
+diagram inline plus a "Safety Measures" subsection holding only the measures
+(``Mitigation``, ``AoU``, ``CompReq``) that address that tree's root causes.
+Failure modes not covered by any fault tree, and measures not referenced by
+any generated stub, still render (with an empty root-cause / measures part)
+so nothing is dropped.
+
+A fault-tree root cause (``RootCause``) is addressed by any of three measure
+kinds: a ``Mitigation`` or ``AoU`` referencing it directly via their
+``root_causes`` field, or a ``CompReq`` referencing it as one item in its
+``derived_from`` (a control measure).  ``--uncovered-root-causes-output``
+emits the set of ``RootCause`` fqns addressed by none of the three, so
+``dependability_analysis`` can fail (or warn) on incomplete coverage.
+
+The fault-tree topology (``FtaFailureMode``/``RootCause`` -> ``FailureMode``/
+measures) is carried entirely by regular, strongly-typed TRLC references (see
+``puml_fta::render_trlc_stub``) rather than an external alias-matched
+``fta_chains.json``, so a single in-process TRLC parse (via the extended
+``TRLCRST`` library) backs the whole page — no per-record Bazel actions and
+no ``.inc`` splitting.
+"""
+
+import argparse
+import dataclasses
+import json
+import logging
+import re
+import sys
+
+from trlc_rst import TRLCRST, TRLCParseError
+
+logger = logging.getLogger(__name__)
+
+_LEVEL_MAP = {
+    "error": logging.ERROR,
+    "warn": logging.WARNING,
+    "info": logging.INFO,
+    "debug": logging.DEBUG,
+}
+
+# Overview summary table columns (one row per failure mode).
+_FM_TABLE_COLUMNS = {
+    "guideword": "Guideword",
+    "safety": "ASIL",
+    "interface": "Interface",
+}
+
+_OVERVIEW_TITLE = "Overview"
+_FAILURE_MODES_TITLE = "Failure Modes"
+_SAFETY_MEASURES_TITLE = "Safety Measures"
+_ROOT_CAUSE_TITLE = "Root Cause Analysis"
+
+# TRLC record types that count as a measure addressing a fault-tree root
+# cause (RootCause): Mitigation/AoU via their own root_causes field, CompReq
+# indirectly via a RootCause item inside its derived_from.
+_MEASURE_KINDS = ("Mitigation", "AoU", "CompReq")
+
+# Measure kind -> sphinx-design badge role and human-readable label.
+_MEASURE_KIND_BADGE = {
+    "Mitigation": "bdg-warning",
+    "AoU": "bdg-info",
+    "CompReq": "bdg-success",
+}
+_MEASURE_KIND_LABEL = {
+    "Mitigation": "Mitigation",
+    "AoU": "Assumption of Use",
+    "CompReq": "Control Measure",
+}
+
+# ASIL value -> sphinx-design badge role (severity-coloured).
+_ASIL_BADGE = {
+    "QM": "bdg-secondary",
+    "B": "bdg-warning",
+    "D": "bdg-danger",
+}
+_DEFAULT_BADGE = "bdg-secondary"
+_GUIDEWORD_BADGE = "bdg-info"
+
+
+def _heading(text: str, char: str) -> str:
+    return f"{text}\n{char * len(text)}\n"
+
+
+def _indent(text: str, n: int = 3) -> str:
+    """Indent every non-empty line of *text* by *n* spaces (for nesting under a
+    directive); blank lines are kept empty."""
+    pad = " " * n
+    return "\n".join(pad + line if line.strip() else "" for line in text.splitlines())
+
+
+def _anchor(fqn: str) -> str:
+    """Sphinx cross-reference label derived from a fully-qualified name."""
+    return "safety-analysis-" + re.sub(r"[^0-9a-zA-Z]+", "-", fqn).strip("-").lower()
+
+
+def _ref(fqn: str, name: str) -> str:
+    return f":ref:`{name} <{_anchor(fqn)}>`"
+
+
+@dataclasses.dataclass
+class _Directive:
+    """A renderable RST / sphinx-design directive node.
+
+    Indentation and blank-line separation are handled centrally in
+    :meth:`render`, so element builders stay declarative trees instead of
+    hand-concatenated strings.  ``body`` items may be nested ``_Directive``\\ s
+    or raw RST string blocks (e.g. a trlc_rst-rendered table or description).
+    """
+
+    name: str
+    arg: str = ""
+    options: dict = dataclasses.field(default_factory=dict)
+    body: list = dataclasses.field(default_factory=list)
+
+    def render(self) -> str:
+        lines = [f".. {self.name}::" + (f" {self.arg}" if self.arg else "")]
+        for key, value in self.options.items():
+            lines.append(f"   :{key}: {value}")
+        blocks = [b for b in (_render_block(x) for x in self.body if x) if b]
+        if blocks:
+            lines.append("")
+            lines.append(_indent("\n\n".join(blocks)))
+        return "\n".join(lines)
+
+
+def _render_block(block) -> str:
+    """Render a nested directive node or a raw RST string block."""
+    if isinstance(block, _Directive):
+        return block.render()
+    return str(block).rstrip("\n")
+
+
+# --- sphinx-design element builders (declarative; no manual indentation) ----
+
+
+def _grid(items: list, columns: int = 2, gutter: int | None = None) -> _Directive:
+    options = {} if gutter is None else {"gutter": gutter}
+    return _Directive("grid", str(columns), options, list(items))
+
+
+def _grid_item(body, options: dict | None = None) -> _Directive:
+    """A bare grid cell (no card chrome)."""
+    return _Directive("grid-item", options=options or {}, body=[body])
+
+
+def _card(title: str, body) -> _Directive:
+    """A ``grid-item-card``; *title* may be empty for a header-less card."""
+    return _Directive("grid-item-card", title, body=body if isinstance(body, list) else [body])
+
+
+def _badge(role: str, text: str) -> str:
+    return f":{role}:`{text}`"
+
+
+# ---------------------------------------------------------------------------
+# Element renderers — each returns a directive node (or None)
+# ---------------------------------------------------------------------------
+
+
+def _attr_grid(obj: object) -> _Directive | None:
+    """FM attributes: guideword/ASIL as centred chips (no card chrome),
+    interface/failure-effect as titled cards; a gutter separates the rows."""
+    fields = obj.to_python_dict()
+    items = []
+    guideword = fields.get("guideword")
+    if guideword:
+        items.append(_grid_item(_badge(_GUIDEWORD_BADGE, guideword), {"class": "sd-text-center"}))
+    safety = fields.get("safety")
+    if safety:
+        role = _ASIL_BADGE.get(safety, _DEFAULT_BADGE)
+        items.append(_grid_item(_badge(role, f"ASIL {safety}"), {"class": "sd-text-center"}))
+    for field_name, label in (
+        ("interface", "Interface"),
+        ("failureeffect", "Failure Effect"),
+    ):
+        value = fields.get(field_name)
+        if value:
+            items.append(_card(label, value))
+    return _grid(items, columns=2, gutter=3) if items else None
+
+
+def _description_card(renderer: TRLCRST, fqn: str) -> _Directive | None:
+    """Description as a prominent card in a ``grid:: 1`` so its borders align
+    with the attribute grid above."""
+    description = renderer.field_value_for(fqn, "description")
+    if not description:
+        return None
+    return _grid([_card("Description", description)], columns=1)
+
+
+def _measure_card(renderer: TRLCRST, fqn: str, obj: object) -> _Directive:
+    """One measure card: bold ID with an inline kind badge and (if present) an
+    ASIL badge, then description.
+
+    Both the ID line and the description are direct text content of the card
+    (not nested grids), so they align at the same indentation as the Description
+    card body above.
+    """
+    kind = obj.n_typ.name
+    fields = obj.to_python_dict()
+    kind_badge = _badge(_MEASURE_KIND_BADGE.get(kind, _DEFAULT_BADGE), _MEASURE_KIND_LABEL.get(kind, kind))
+    safety = fields.get("safety", "")
+    safety_badge = " " + _badge(_ASIL_BADGE.get(safety, _DEFAULT_BADGE), f"ASIL {safety}") if safety else ""
+    header_text = f"**{obj.name}** {kind_badge}{safety_badge}"
+    description = renderer.field_value_for(fqn, "description")
+    body: list = [header_text]
+    if description:
+        body.append(description)
+    return _card("", body)
+
+
+def _measures_grid(renderer: TRLCRST, obj_map: dict, measures: list[str]) -> _Directive | None:
+    cards = [_measure_card(renderer, fqn, obj_map[fqn]) for fqn in measures if fqn in obj_map]
+    return _grid(cards, columns=1) if cards else None
+
+
+def _fm_dropdown(renderer: TRLCRST, fqn: str, obj: object, chains: list[dict]) -> _Directive:
+    """One collapsible failure-mode dropdown.
+
+    *chains* holds one entry per fault tree (``FtaFailureMode``) covering this
+    failure mode; it is empty for an orphan failure mode (no fault tree), in
+    which case the Root Cause Analysis / Safety Measures parts are omitted.
+    """
+    body = [_attr_grid(obj), _description_card(renderer, fqn)]
+    for chain in chains:
+        body.append(_Directive("rubric", _ROOT_CAUSE_TITLE))
+        body.append(_Directive("uml", chain["puml"]))
+        measures = _measures_grid(renderer, renderer.objects_by_fqn(), chain["measures"])
+        if measures is not None:
+            body.append(_Directive("rubric", _SAFETY_MEASURES_TITLE))
+            body.append(measures)
+    return _Directive("dropdown", fqn, {"name": _anchor(fqn)}, body)
+
+
+# ---------------------------------------------------------------------------
+# Section renderers — top-level page sections (return RST strings)
+# ---------------------------------------------------------------------------
+
+
+def _root_causes_for_fta_failure_mode(obj_map: dict, ffm_fqn: str) -> list[str]:
+    """RootCause fqns whose ``failure_modes`` field references *ffm_fqn*."""
+    return [
+        fqn
+        for fqn, obj in obj_map.items()
+        if obj.n_typ.name == "RootCause" and ffm_fqn in (obj.to_python_dict().get("failure_modes") or [])
+    ]
+
+
+def _measures_for_root_cause(obj_map: dict, rc_fqn: str) -> list[str]:
+    """Mitigation/AoU/CompReq fqns that address *rc_fqn* (a RootCause root cause).
+
+    ``Mitigation`` and ``AoU`` reference root causes directly via their
+    ``root_causes`` field.  ``CompReq`` references them indirectly, as one
+    item among the FeatReq/AssumedSystemReq/AoU/RootCause union inside its
+    ``derived_from`` ``CompReqSourceId`` tuples -- only tuple items that
+    resolve to *rc_fqn* count as a control measure for this root cause.
+    """
+    result = []
+    for fqn, obj in obj_map.items():
+        kind = obj.n_typ.name
+        fields = obj.to_python_dict()
+        if kind in ("Mitigation", "AoU"):
+            if rc_fqn in (fields.get("root_causes") or []):
+                result.append(fqn)
+        elif kind == "CompReq":
+            sources = fields.get("derived_from") or []
+            if any(src.get("item") == rc_fqn for src in sources):
+                result.append(fqn)
+    return result
+
+
+def _uncovered_root_causes(obj_map: dict) -> list[str]:
+    """``RootCause`` fqns addressed by no Mitigation, AoU, or CompReq."""
+    rc_fqns = [fqn for fqn, obj in obj_map.items() if obj.n_typ.name == "RootCause"]
+    return sorted(fqn for fqn in rc_fqns if not _measures_for_root_cause(obj_map, fqn))
+
+
+def _chains_for_failure_mode(obj_map: dict, fm_fqn: str) -> list[dict]:
+    """One chain entry per ``FtaFailureMode`` covering *fm_fqn*: its diagram plus the
+    measures attached (via ``root_causes``/``derived_from``) to its root
+    causes."""
+    chains = []
+    for ffm_fqn, ffm_obj in obj_map.items():
+        if ffm_obj.n_typ.name != "FtaFailureMode":
+            continue
+        if fm_fqn not in (ffm_obj.to_python_dict().get("failure_modes") or []):
+            continue
+        measures = []
+        for rc_fqn in _root_causes_for_fta_failure_mode(obj_map, ffm_fqn):
+            for measure_fqn in _measures_for_root_cause(obj_map, rc_fqn):
+                if measure_fqn not in measures:
+                    measures.append(measure_fqn)
+        chains.append(
+            {
+                "ffm_fqn": ffm_fqn,
+                "puml": ffm_obj.to_python_dict()["diagram"],
+                "measures": measures,
+            }
+        )
+    return chains
+
+
+def _render_overview(renderer: TRLCRST, fm_fqns: list[str]) -> str:
+    if not fm_fqns:
+        return ""
+    table = renderer.render_table_to_string(_FM_TABLE_COLUMNS, fqns=fm_fqns, name_header="Failure Mode", link_fn=_ref)
+    return _heading(_OVERVIEW_TITLE, "-") + "\n" + table
+
+
+def _render_failure_modes(renderer: TRLCRST, obj_map: dict, fm_fqns: list[str]) -> str:
+    dropdowns = [_fm_dropdown(renderer, fqn, obj_map[fqn], _chains_for_failure_mode(obj_map, fqn)) for fqn in fm_fqns]
+    body = "\n\n".join(d.render() for d in dropdowns)
+    return _heading(_FAILURE_MODES_TITLE, "-") + "\n" + body + "\n"
+
+
+def _render_measures(renderer: TRLCRST, obj_map: dict, measure_fqns: list[str]) -> str:
+    if not measure_fqns:
+        return ""
+    grid = _measures_grid(renderer, obj_map, measure_fqns)
+    body = grid.render() if grid is not None else ""
+    return _heading(_SAFETY_MEASURES_TITLE, "-") + "\n" + body + "\n"
+
+
+def _build_body(renderer: TRLCRST, title: str) -> str:
+    obj_map = renderer.objects_by_fqn()
+    fm_fqns = [fqn for fqn, obj in obj_map.items() if obj.n_typ.name == "FailureMode"]
+    measure_fqns = [fqn for fqn, obj in obj_map.items() if obj.n_typ.name in _MEASURE_KINDS]
+
+    sections = [
+        _heading(title, "="),
+        _render_overview(renderer, fm_fqns),
+        _render_failure_modes(renderer, obj_map, fm_fqns),
+        _render_measures(renderer, obj_map, measure_fqns),
+    ]
+    return "\n".join(s for s in sections if s)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--output", default=None, help="Output safety_analysis.rst path (omit for a coverage-check-only run)."
+    )
+    parser.add_argument("--template", default=None, help="RST template path (required together with --output).")
+    parser.add_argument("--title", default="", help="Page title (required together with --output).")
+    parser.add_argument(
+        "--fta-events",
+        nargs="+",
+        required=True,
+        dest="fta_events",
+        help="One or more fta_events.trlc files produced by puml_cli FTA mode (generated "
+        "FtaFailureMode/RootCause stubs) -- one per safety_analysis target when combining several for a "
+        "dependability_analysis-wide coverage check.",
+    )
+    parser.add_argument("--failuremodes", nargs="*", default=[], help="FailureMode .trlc files.")
+    parser.add_argument(
+        "--safetymeasures",
+        nargs="*",
+        default=[],
+        help="Mitigation/AoU/CompReq .trlc files scoped to this safety_analysis target.",
+    )
+    parser.add_argument(
+        "--measures",
+        nargs="*",
+        default=[],
+        help="Additional Mitigation/AoU/CompReq .trlc files not scoped to a single safety_analysis target "
+        "(e.g. from a dependability_analysis's own 'measures' attribute).",
+    )
+    parser.add_argument(
+        "--dep-files",
+        nargs="*",
+        default=[],
+        dest="dep_files",
+        help="Extra .trlc files needed only for reference resolution (e.g. FeatReq/AssumedSystemReq "
+        "records referenced by a CompReq's derived_from) -- not rendered on the page themselves.",
+    )
+    parser.add_argument(
+        "--spec",
+        nargs="*",
+        default=[],
+        help="TRLC .rsl/.trlc spec files for import resolution.",
+    )
+    parser.add_argument(
+        "--uncovered-root-causes-output",
+        dest="uncovered_root_causes_output",
+        default=None,
+        help="Optional path to write a JSON array of RootCause fqns addressed by no "
+        "Mitigation, AoU, or CompReq (root-cause coverage completeness check).",
+    )
+    parser.add_argument(
+        "--log-level",
+        choices=["error", "warn", "info", "debug"],
+        default="warn",
+        dest="log_level",
+        help="Log level for tool output (default: warn).",
+    )
+    args = parser.parse_args()
+
+    logging.basicConfig(level=_LEVEL_MAP[args.log_level], format="%(levelname)s: %(message)s")
+
+    if bool(args.output) != bool(args.template):
+        parser.error("--output and --template must be given together")
+
+    source_files = list(args.failuremodes) + list(args.safetymeasures) + list(args.measures) + list(args.fta_events)
+    renderer = TRLCRST(
+        input_directory=None,
+        source_files=source_files,
+        dep_files=list(args.spec) + list(args.dep_files),
+    )
+    try:
+        renderer.parse_trlc_files()
+    except TRLCParseError as exc:
+        logger.error("TRLC parse error: %s", exc)
+        sys.exit(1)
+
+    if args.output:
+        body = _build_body(renderer, args.title)
+
+        with open(args.template, encoding="utf-8", newline="") as fh:
+            template = fh.read()
+        if "{body}" not in template:
+            logger.error("Template %r does not contain a '{body}' placeholder", args.template)
+            sys.exit(1)
+        rendered = template.replace("{body}", body)
+
+        with open(args.output, "w", newline="", encoding="utf-8") as fh:
+            fh.write(rendered)
+
+    if args.uncovered_root_causes_output:
+        uncovered = _uncovered_root_causes(renderer.objects_by_fqn())
+        with open(args.uncovered_root_causes_output, "w", encoding="utf-8") as fh:
+            json.dump(uncovered, fh, indent=2)
+            fh.write("\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/bazel/rules/rules_score/templates/fmea.template.rst b/bazel/rules/rules_score/templates/safety_analysis.template.rst
similarity index 100%
rename from bazel/rules/rules_score/templates/fmea.template.rst
rename to bazel/rules/rules_score/templates/safety_analysis.template.rst
diff --git a/bazel/rules/rules_score/test/BUILD b/bazel/rules/rules_score/test/BUILD
index 5df54825..4e0524c9 100644
--- a/bazel/rules/rules_score/test/BUILD
+++ b/bazel/rules/rules_score/test/BUILD
@@ -26,7 +26,7 @@ load(
     "dependability_analysis",
     "dependable_element",
     "feature_requirements",
-    "fmea",
+    "safety_analysis",
     "sphinx_module",
     "unit",
     "unit_design",
@@ -429,19 +429,19 @@ dependable_element(
 )
 
 # - Safety Analysis (DFA):    wp__sw_component_dfa
-# - Safety Analysis (FMEA):   wp__sw_component_fmea
+# - Safety Analysis (FMEA):   wp__sw_component_safety_analysis
 dependability_analysis(
     name = "dependability_analysis_target",
     arch_design = ":arch_design",
     dfa = ["fixtures/seooc_test/dfa.rst"],
-    fmea = [":samplelibrary_safety_analysis"],
+    safety_analysis = [":samplelibrary_safety_analysis"],
 )
 
-fmea(
+safety_analysis(
     name = "samplelibrary_safety_analysis",
-    # TODO: add failure modes, control measures, and root causes here
+    # TODO: add failure modes, safety measures, and root causes here
     # failuremodes = [],
-    # controlmeasures = [], # can be AoUs or requirements
+    # safetymeasures = [], # can be AoUs or requirements
     # root_causes = [],
     arch_design = ":arch_design",
 )
@@ -569,9 +569,9 @@ architectural_design(
 # safety analysis (unlike static/dynamic/internal_api) - the shared
 # dependability_analysis_target/samplelibrary_safety_analysis fixture used by
 # other targets in this file is deliberately empty, so this scenario gets its
-# own minimal FMEA that traces to "package_pub.PublicInterface".
-fmea(
-    name = "public_api_example_fmea",
+# own minimal safety analysis that traces to "package_pub.PublicInterface".
+safety_analysis(
+    name = "public_api_example_safety_analysis",
     arch_design = ":arch_design_public_api_example",
     failuremodes = ["fixtures/clickable_example/public_api_failure_modes.trlc"],
     root_causes = ["fixtures/clickable_example/public_api_fta.puml"],
@@ -580,7 +580,26 @@ fmea(
 dependability_analysis(
     name = "public_api_example_dependability_analysis",
     arch_design = ":arch_design_public_api_example",
-    fmea = [":public_api_example_fmea"],
+    safety_analysis = [":public_api_example_safety_analysis"],
+)
+
+# Regression fixture for the `$FailureMode(name, fm1, fm2, fm3)` multi-argument
+# link syntax: one $FailureMode covers three failure modes via three fm
+# arguments (N:1), proving puml_fta resolves and de-duplicates the links and
+# lobster-trlc accepts the resulting FtaFailureMode.failure_modes fan-out. Reuses
+# :arch_design_public_api_example so the failure modes' `interface` field has
+# a real public_api item to trace up to (see :public_api_example_safety_analysis above).
+safety_analysis(
+    name = "multi_failure_mode_example_safety_analysis",
+    arch_design = ":arch_design_public_api_example",
+    failuremodes = ["fixtures/clickable_example/multi_failure_mode_failure_modes.trlc"],
+    root_causes = ["fixtures/clickable_example/multi_failure_mode_fta.puml"],
+)
+
+dependability_analysis(
+    name = "multi_failure_mode_example_dependability_analysis",
+    arch_design = ":arch_design_public_api_example",
+    safety_analysis = [":multi_failure_mode_example_safety_analysis"],
 )
 
 dependable_element(
@@ -746,11 +765,11 @@ architectural_design(
 )
 
 # public_api items must be referenced by a FailureMode in the SEooC's own
-# safety analysis (see :public_api_example_fmea above for the same reasoning)
+# safety analysis (see :public_api_example_safety_analysis above for the same reasoning)
 # - the shared dependability_analysis_target fixture is deliberately empty, so
-# this scenario gets its own minimal FMEA that traces to "TaskInterface".
-fmea(
-    name = "dynamic_example_fmea",
+# this scenario gets its own minimal safety analysis that traces to "TaskInterface".
+safety_analysis(
+    name = "dynamic_example_safety_analysis",
     arch_design = ":arch_design_dynamic_example",
     failuremodes = ["fixtures/clickable_example/dynamic_public_api_failure_modes.trlc"],
     root_causes = ["fixtures/clickable_example/dynamic_public_api_fta.puml"],
@@ -759,7 +778,7 @@ fmea(
 dependability_analysis(
     name = "dynamic_example_dependability_analysis",
     arch_design = ":arch_design_dynamic_example",
-    fmea = [":dynamic_example_fmea"],
+    safety_analysis = [":dynamic_example_safety_analysis"],
 )
 
 dependable_element(
@@ -1743,10 +1762,10 @@ puml_layout_test_suite(name = "puml_layout")
 # Safety Analysis Tools Unit Tests
 # ============================================================================
 
-# Validates the updated Measure type hierarchy (ControlMeasure, PreventiveMeasure,
-# Mitigation, AoU) introduced in the tracing-policy update (commit bff44df3):
-# ControlMeasure no longer carries a "mitigates" field; tracing is implicit via
-# name-matching with the FTA $BasicEvent alias.
+# Validates the Measure type hierarchy (SafetyMeasure, Mitigation, AoU):
+# SafetyMeasure is abstract (only Mitigation extends it) and its "root_causes"
+# field is mandatory, tracing explicitly to a RootCause record instead of
+# name-matching the FTA $RootCause alias.
 trlc_requirements(
     name = "safety_measures_fixtures",
     srcs = ["fixtures/seooc_test/safety_measures_fixtures.trlc"],
@@ -1759,10 +1778,10 @@ trlc_requirements_test(
 )
 
 py_test(
-    name = "test_fmea_assembler",
+    name = "test_safety_analysis_assembler",
     size = "small",
-    srcs = ["test_fmea_assembler.py"],
-    deps = ["@score_tooling//bazel/rules/rules_score:fmea_assembler"],
+    srcs = ["test_safety_analysis_assembler.py"],
+    deps = ["@score_tooling//bazel/rules/rules_score:safety_analysis_assembler"],
 )
 
 py_test(
@@ -1827,8 +1846,8 @@ test_suite(
         ":sphinx_module_tests",
         ":test_aou_forwarding_to_lobster",
         ":test_bazel_sphinx_needs",
-        ":test_fmea_assembler",
         ":test_rst_to_trlc",
+        ":test_safety_analysis_assembler",
         ":test_sphinx_html_merge",
         ":test_sphinx_module_ext",
         ":test_trlc_rst_image_rendering",
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_failure_modes.trlc b/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_failure_modes.trlc
index a2a29a77..d6e0b5fe 100644
--- a/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_failure_modes.trlc
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_failure_modes.trlc
@@ -10,7 +10,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
-package DynamicExampleFmea
+package DynamicExampleSafetyAnalysis
 
 import ScoreReq
 
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_fta.puml b/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_fta.puml
index 1bce93b9..4cca50f9 100644
--- a/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_fta.puml
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/dynamic_public_api_fta.puml
@@ -15,6 +15,6 @@
 
 !include fta_metamodel.puml
 
-$TopEvent("TaskInterface stops responding", "DynamicExampleFmea.TaskInterfaceFailure")
+$FailureMode("TaskInterface stops responding", "DynamicExampleSafetyAnalysis.TaskInterfaceFailure")
 
 @enduml
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_failure_modes.trlc b/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_failure_modes.trlc
new file mode 100644
index 00000000..f91ce406
--- /dev/null
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_failure_modes.trlc
@@ -0,0 +1,42 @@
+/********************************************************************************
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
+ *
+ * See the NOTICE file(s) distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Apache License Version 2.0 which is available at
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ ********************************************************************************/
+package MultiFailureModeExampleSafetyAnalysis
+
+import ScoreReq
+
+ScoreReq.FailureMode MessageLost {
+    guidewords = [ScoreReq.Guideword.LossOfFunction]
+    description = "Message is lost in transit"
+    failureeffect = "Receiver never gets the message"
+    version = 1
+    safety = ScoreReq.Asil.B
+    interface = "package_pub.PublicInterface"
+}
+
+ScoreReq.FailureMode MessagePartiallyDelivered {
+    guidewords = [ScoreReq.Guideword.PartialFunction]
+    description = "Message is only partially delivered"
+    failureeffect = "Receiver processes incomplete data"
+    version = 1
+    safety = ScoreReq.Asil.B
+    interface = "package_pub.PublicInterface"
+}
+
+ScoreReq.FailureMode MessageCorrupted {
+    guidewords = [ScoreReq.Guideword.Corrupted]
+    description = "Message content is corrupted in transit"
+    failureeffect = "Receiver processes wrong data"
+    version = 1
+    safety = ScoreReq.Asil.B
+    interface = "package_pub.PublicInterface"
+}
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_fta.puml b/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_fta.puml
new file mode 100644
index 00000000..4bd21ffe
--- /dev/null
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/multi_failure_mode_fta.puml
@@ -0,0 +1,20 @@
+' *******************************************************************************
+' Copyright (c) 2026 Contributors to the Eclipse Foundation
+'
+' See the NOTICE file(s) distributed with this work for additional
+' information regarding copyright ownership.
+'
+' This program and the accompanying materials are made available under the
+' terms of the Apache License Version 2.0 which is available at
+' https://www.apache.org/licenses/LICENSE-2.0
+'
+' SPDX-License-Identifier: Apache-2.0
+' *******************************************************************************
+
+@startuml
+
+!include fta_metamodel.puml
+
+$FailureMode("Message lost, incomplete, or corrupted during IPC transmission", "MultiFailureModeExampleSafetyAnalysis.MessageLost", "MultiFailureModeExampleSafetyAnalysis.MessagePartiallyDelivered", "MultiFailureModeExampleSafetyAnalysis.MessageCorrupted")
+
+@enduml
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_failure_modes.trlc b/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_failure_modes.trlc
index 85d78325..16197598 100644
--- a/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_failure_modes.trlc
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_failure_modes.trlc
@@ -10,7 +10,7 @@
  *
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
-package PublicApiExampleFmea
+package PublicApiExampleSafetyAnalysis
 
 import ScoreReq
 
diff --git a/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_fta.puml b/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_fta.puml
index 61dd2b3d..db9c09b1 100644
--- a/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_fta.puml
+++ b/bazel/rules/rules_score/test/fixtures/clickable_example/public_api_fta.puml
@@ -15,6 +15,6 @@
 
 !include fta_metamodel.puml
 
-$TopEvent("PublicInterface stops responding", "PublicApiExampleFmea.PublicInterfaceFailure")
+$FailureMode("PublicInterface stops responding", "PublicApiExampleSafetyAnalysis.PublicInterfaceFailure")
 
 @enduml
diff --git a/bazel/rules/rules_score/test/fixtures/seooc_test/safety_measures_fixtures.trlc b/bazel/rules/rules_score/test/fixtures/seooc_test/safety_measures_fixtures.trlc
index c81da33e..5ee38096 100644
--- a/bazel/rules/rules_score/test/fixtures/seooc_test/safety_measures_fixtures.trlc
+++ b/bazel/rules/rules_score/test/fixtures/seooc_test/safety_measures_fixtures.trlc
@@ -11,36 +11,56 @@
  * SPDX-License-Identifier: Apache-2.0
  ********************************************************************************/
 
-// Fixture exercising the updated Measure type hierarchy (commit bff44df3).
-// - ControlMeasure: no "mitigates" field; tracing is implicit via name-matching
-//   (record FQN must equal the $BasicEvent alias in the FTA diagram).
-// - PreventiveMeasure: new type, no mitigates field
-// - Mitigation: new type, no mitigates field
-// - AoU: still allows optional "mitigates" field (unchanged)
+// Fixture exercising the Measure type hierarchy (SafetyMeasure/Mitigation/AoU/
+// CompReq): every fault-tree root cause (RootCause) must be addressed by at
+// least one concrete measure.
+// - SafetyMeasure: abstract, never instantiated directly; only exists so
+//   Mitigation can inherit the mandatory ``root_causes`` field.
+// - Mitigation: extends SafetyMeasure, adds a mandatory ``justification``
+//   explaining why the root cause does not apply in this context.
+// - AoU: independent type (does not extend SafetyMeasure); its
+//   ``root_causes`` field is optional -- an AoU acts as a preventive measure
+//   only when it addresses a fault-tree root cause.
+// - CompReq (elsewhere): acts as a control measure when its ``derived_from``
+//   references a fault-tree RootCause.
 
 package TestSafetyMeasures
 
 import ScoreReq
 
-ScoreReq.ControlMeasure SomeBasicEvent {
-    safety      = ScoreReq.Asil.B
-    description = "Control measure linked to FTA BasicEvent by name-matching (no mitigates field)"
-    version     = 1
+ScoreReq.FailureMode SomeFailureMode {
+    guidewords    = [ScoreReq.Guideword.LossOfFunction]
+    failureeffect = "Some effect"
+    safety        = ScoreReq.Asil.B
+    description   = "A failure mode backing this fixture's fault tree"
+    version       = 1
+}
+
+ScoreReq.FtaFailureMode SomeFtaFailureMode {
+    title         = "Some failure mode"
+    diagram       = "n/a"
+    line          = 1
+    failure_modes = [TestSafetyMeasures.SomeFailureMode]
 }
 
-ScoreReq.PreventiveMeasure SomePreventiveMeasure {
+ScoreReq.RootCause SomeRootCause {
+    title      = "Some root cause"
+    diagram    = "n/a"
+    line       = 2
+    failure_modes = [TestSafetyMeasures.SomeFtaFailureMode]
 }
 
 ScoreReq.Mitigation SomeMitigation {
-    safety      = ScoreReq.Asil.B
-    description = "A mitigation that reduces the severity of a hazard"
-    rationale   = "Reduces severity by providing an alternative processing path"
-    version     = 1
+    safety        = ScoreReq.Asil.B
+    description   = "Mitigation linked to the FTA RootCause via an explicit root_causes reference"
+    justification = "This root cause cannot occur in this context because of an independent design property"
+    version       = 1
+    root_causes   = [TestSafetyMeasures.SomeRootCause]
 }
 
 ScoreReq.AoU SomeAoU {
     safety      = ScoreReq.Asil.B
-    description = "An assumption of use with an explicit mitigates link"
+    description = "An assumption of use that also addresses a fault-tree root cause"
     version     = 1
-    mitigates   = "TestSafetyMeasures.SomeBasicEvent"
+    root_causes = [TestSafetyMeasures.SomeRootCause]
 }
diff --git a/bazel/rules/rules_score/test/lobster_config_test.bzl b/bazel/rules/rules_score/test/lobster_config_test.bzl
index 8a2ae1d3..633c2425 100644
--- a/bazel/rules/rules_score/test/lobster_config_test.bzl
+++ b/bazel/rules/rules_score/test/lobster_config_test.bzl
@@ -142,12 +142,12 @@ def lobster_config_test_suite(name):
     loadingtest.equals(
         env,
         "block_with_multiple_trace_to",
-        'activity "Root Causes" {\n  source: "rc.lobster";\n  trace to: "Failure Modes";\n  trace to: "Control Measures";\n}',
+        'activity "Root Causes" {\n  source: "rc.lobster";\n  trace to: "Failure Modes";\n  trace to: "Safety Measures";\n}',
         format_lobster_block(
             "activity",
             "Root Causes",
             [_fake_file("rc.lobster")],
-            trace_to = ["Failure Modes", "Control Measures"],
+            trace_to = ["Failure Modes", "Safety Measures"],
         ),
     )
 
diff --git a/bazel/rules/rules_score/test/rst_to_trlc_test.py b/bazel/rules/rules_score/test/rst_to_trlc_test.py
index 2b6da09d..a2734741 100644
--- a/bazel/rules/rules_score/test/rst_to_trlc_test.py
+++ b/bazel/rules/rules_score/test/rst_to_trlc_test.py
@@ -539,7 +539,7 @@ def test_fulfils_is_not_a_ref_field(self):
         self.assertEqual(_collect_refs({"fulfils": "some_req"}), [])
 
     def test_mitigates_is_not_a_ref_field(self):
-        """mitigates is a String field on AoU/CompReq, not a cross-reference."""
+        """mitigates is not part of the S-CORE process and must not produce refs."""
         self.assertEqual(_collect_refs({"mitigates": "some_req"}), [])
 
     def test_returns_empty_when_no_ref_fields(self):
diff --git a/bazel/rules/rules_score/test/test_fmea_assembler.py b/bazel/rules/rules_score/test/test_fmea_assembler.py
deleted file mode 100644
index db98ace4..00000000
--- a/bazel/rules/rules_score/test/test_fmea_assembler.py
+++ /dev/null
@@ -1,359 +0,0 @@
-# *******************************************************************************
-# Copyright (c) 2026 Contributors to the Eclipse Foundation
-#
-# See the NOTICE file(s) distributed with this work for additional
-# information regarding copyright ownership.
-#
-# This program and the accompanying materials are made available under the
-# terms of the Apache License Version 2.0 which is available at
-# https://www.apache.org/licenses/LICENSE-2.0
-#
-# SPDX-License-Identifier: Apache-2.0
-# *******************************************************************************
-"""Unit tests for the FMEA page assembler layout logic."""
-
-import json
-import os
-import sys
-import tempfile
-import unittest
-
-import fmea_assembler as fa
-
-
-class _Type:
-    def __init__(self, name):
-        self.name = name
-
-
-class _Obj:
-    def __init__(self, name, type_name, fields=None):
-        self.name = name
-        self.n_typ = _Type(type_name)
-        self._fields = fields or {}
-
-    def to_python_dict(self):
-        return self._fields
-
-
-class _FakeRenderer:
-    """Minimal stand-in for ``TRLCRST`` exercising the assembler layout."""
-
-    def __init__(self, objs):
-        self._objs = objs
-
-    def objects_by_fqn(self):
-        return self._objs
-
-    def render_table_to_string(self, columns, fqns=None, name_header="Name", link_fn=None):
-        if fqns is None:
-            fqns = list(self._objs)
-        if link_fn is not None:
-            rows = "\n".join(link_fn(f, self._objs[f].name) for f in fqns)
-        else:
-            rows = "\n".join(self._objs[f].name for f in fqns)
-        return f"TABLE[{name_header}]\n{rows}\n"
-
-    def render_records_to_string(self, fqns, fields):
-        return "RECORDS(" + ",".join(fqns) + ")\n"
-
-    def field_value_for(self, fqn, field_name, records=None):
-        return self._objs[fqn].to_python_dict().get(field_name, "")
-
-
-def _objs():
-    return {
-        "Lib.FM_A": _Obj(
-            "FM_A",
-            "FailureMode",
-            {
-                "guideword": "LossOfFunction",
-                "safety": "B",
-                "interface": "Lib.Api",
-                "failureeffect": "world ends",
-                "description": "fm a description",
-            },
-        ),
-        "Lib.FM_Orphan": _Obj("FM_Orphan", "FailureMode", {"safety": "QM", "guideword": "TooLate"}),
-        "Lib.CM_1": _Obj("CM_1", "ControlMeasure", {"safety": "B", "description": "cm one"}),
-        "Lib.CM_Orphan": _Obj("CM_Orphan", "ControlMeasure", {"safety": "D"}),
-    }
-
-
-class AnchorTest(unittest.TestCase):
-    def test_anchor_is_sanitised_lowercase(self):
-        self.assertEqual(fa._anchor("Lib.FM_A"), "fmea-lib-fm-a")
-
-    def test_ref_targets_anchor(self):
-        self.assertEqual(
-            fa._ref("Lib.FM_A", "FM_A"),
-            ":ref:`FM_A <fmea-lib-fm-a>`",
-        )
-
-
-class BuildBodyTest(unittest.TestCase):
-    def setUp(self):
-        self.renderer = _FakeRenderer(_objs())
-        self.chains = [
-            {
-                "fm_fqn": "Lib.FM_A",
-                "fm_name": "Failure Mode A",
-                "puml": "fta_a.puml",
-                "control_measures": ["Lib.CM_1"],
-            }
-        ]
-
-    def test_overview_and_chain_section_rendered(self):
-        body = fa._build_body(self.renderer, self.chains, "Title")
-        self.assertIn("Title\n=====", body)
-        self.assertIn("Overview", body)
-        # Top-level grouping sections.
-        self.assertIn("Failure Modes\n-------------", body)
-        # FM dropdown titled by its full fqn only (no ASIL in the heading).
-        self.assertIn(".. dropdown:: Lib.FM_A\n", body)
-        self.assertNotIn(".. dropdown:: Lib.FM_A :bdg", body)
-        self.assertIn(":name: fmea-lib-fm-a", body)
-        # Attributes as a grid of cards; no inner requirement id.
-        self.assertNotIn(".. requirement:definition::", body)
-        self.assertIn(".. grid:: 2", body)
-        # Guideword / ASIL are bare centred grid items (no card chrome).
-        self.assertIn(".. grid-item::", body)
-        self.assertIn(":class: sd-text-center", body)
-        self.assertIn(":bdg-info:`LossOfFunction`", body)
-        self.assertIn(":bdg-warning:`ASIL B`", body)
-        self.assertNotIn(".. grid-item-card:: Guideword", body)
-        self.assertIn(".. grid-item-card:: Interface", body)
-        # Description as a prominent card.
-        self.assertIn(".. grid-item-card:: Description", body)
-        self.assertIn("fm a description", body)
-        # Root Cause Analysis rubric over the inline FTA + per-FM CM cards.
-        self.assertIn(".. rubric:: Root Cause Analysis", body)
-        self.assertIn(".. uml:: fta_a.puml", body)
-        self.assertIn(".. rubric:: Control Measures", body)
-        # CM card: bold ID with inline ASIL badge in the card body (no card title).
-        self.assertIn(".. grid-item-card::\n", body)
-        self.assertIn("**CM_1**", body)
-        self.assertIn(":bdg-warning:`ASIL B`", body)
-        # Attribute grid uses a gutter to separate the badge row from the cards.
-        self.assertIn(":gutter: 3", body)
-
-    def test_global_control_measures_table_lists_all(self):
-        body = fa._build_body(self.renderer, self.chains, "Title")
-        self.assertIn("Control Measures\n----------------", body)
-        self.assertIn("TABLE[Control Measure]", body)
-        self.assertIn("CM_1", body)
-        self.assertIn("CM_Orphan", body)
-
-    def test_orphan_failure_mode_rendered_without_fta(self):
-        body = fa._build_body(self.renderer, self.chains, "Title")
-        # Orphan FM still appears as a dropdown, but with no FTA / RCA rubric.
-        self.assertIn(".. dropdown:: Lib.FM_Orphan\n", body)
-        self.assertEqual(body.count(".. rubric:: Root Cause Analysis"), 1)
-
-    def test_no_chains_renders_all_failure_modes(self):
-        body = fa._build_body(self.renderer, [], "Title")
-        self.assertIn(".. dropdown:: Lib.FM_A\n", body)
-        self.assertIn(".. dropdown:: Lib.FM_Orphan\n", body)
-        self.assertNotIn(".. uml::", body)
-
-    def test_chain_with_unknown_fm_fqn_logs_warning(self):
-        chains = [
-            {
-                "fm_fqn": "Lib.NoSuchFM",
-                "fm_name": "Unknown",
-                "puml": "x.puml",
-                "control_measures": [],
-            }
-        ]
-        import logging as _logging
-
-        with self.assertLogs("fmea_assembler", level=_logging.WARNING) as log:
-            body = fa._build_body(self.renderer, chains, "Title")
-        self.assertTrue(any("Lib.NoSuchFM" in m for m in log.output))
-        # The unknown FM is skipped; the known FMs still render.
-        self.assertIn(".. dropdown:: Lib.FM_A\n", body)
-        self.assertNotIn(".. dropdown:: Lib.NoSuchFM\n", body)
-
-
-class ChainValidationTest(unittest.TestCase):
-    """A malformed chain entry must fail loudly, not crash with a bare KeyError."""
-
-    def setUp(self):
-        self.renderer = _FakeRenderer(_objs())
-
-    def test_chain_missing_fm_fqn_raises_valueerror(self):
-        chains = [{"puml": "a.puml", "control_measures": []}]
-        with self.assertRaises(ValueError) as ctx:
-            fa._build_body(self.renderer, chains, "Title")
-        self.assertIn("missing required key", str(ctx.exception))
-
-    def test_chain_missing_puml_raises_valueerror(self):
-        chains = [{"fm_fqn": "Lib.FM_A", "control_measures": []}]
-        with self.assertRaises(ValueError):
-            fa._build_body(self.renderer, chains, "Title")
-
-
-# Minimal self-contained TRLC model: defines the FailureMode / ControlMeasure
-# types the assembler keys on, so main() runs a real TRLCRST parse (catching
-# contract drift the _FakeRenderer cannot).
-_RSL = """\
-package TestFmea
-
-type FailureMode {
-    guideword optional String
-    safety optional String
-    interface optional String
-    failureeffect optional String
-    description optional String
-}
-
-type ControlMeasure {
-    safety optional String
-    description optional String
-}
-"""
-
-_FM_TRLC = """\
-package TestFmea
-
-FailureMode FmA {
-    guideword = "TooLate"
-    safety = "ASIL_D"
-    interface = "Lib.Api"
-    failureeffect = "downstream timeout"
-    description = "fm a description"
-}
-"""
-
-_CM_TRLC = """\
-package TestFmea
-
-ControlMeasure CmA {
-    safety = "ASIL_D"
-    description = "cm a description"
-}
-"""
-
-
-class MainIntegrationTest(unittest.TestCase):
-    """End-to-end main(): real TRLCRST parse + chains JSON -> fmea.rst."""
-
-    def _write(self, directory, name, content):
-        path = os.path.join(directory, name)
-        with open(path, "w", encoding="utf-8") as fh:
-            fh.write(content)
-        return path
-
-    def _run_main(self, argv):
-        saved = sys.argv
-        try:
-            sys.argv = argv
-            fa.main()
-        finally:
-            sys.argv = saved
-
-    def test_full_page_assembled_from_real_trlc(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            rsl = self._write(tmp, "types.rsl", _RSL)
-            fm = self._write(tmp, "fm.trlc", _FM_TRLC)
-            cm = self._write(tmp, "cm.trlc", _CM_TRLC)
-            template = self._write(tmp, "tmpl.rst", "{body}\n")
-            chains = self._write(
-                tmp,
-                "chains.json",
-                json.dumps(
-                    [
-                        {
-                            "fm_fqn": "TestFmea.FmA",
-                            "fm_name": "Fm A",
-                            "puml": "a.puml",
-                            "control_measures": ["TestFmea.CmA"],
-                        }
-                    ]
-                ),
-            )
-            out = os.path.join(tmp, "fmea.rst")
-
-            self._run_main(
-                [
-                    "fmea_assembler",
-                    "--output",
-                    out,
-                    "--template",
-                    template,
-                    "--title",
-                    "Test FMEA",
-                    "--chains",
-                    chains,
-                    "--failuremodes",
-                    fm,
-                    "--controlmeasures",
-                    cm,
-                    "--spec",
-                    rsl,
-                ]
-            )
-
-            with open(out, encoding="utf-8") as fh:
-                rst = fh.read()
-
-            # Title + overview table + FM dropdown + inline FTA + control measures.
-            self.assertIn("Test FMEA", rst)
-            self.assertIn("Overview", rst)
-            self.assertIn(".. list-table::", rst)
-            self.assertIn(".. dropdown:: TestFmea.FmA\n", rst)
-            self.assertIn(":name: fmea-testfmea-fma", rst)
-            self.assertIn(".. grid-item-card:: Description", rst)
-            self.assertIn(".. rubric:: Root Cause Analysis", rst)
-            self.assertIn(".. uml:: a.puml", rst)
-            self.assertIn("Control Measures", rst)
-            # Real rendered record content (proves TRLCRST actually parsed).
-            self.assertIn("fm a description", rst)
-            self.assertIn("cm a description", rst)
-
-    def test_malformed_chains_json_exits_nonzero(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            template = self._write(tmp, "tmpl.rst", "{body}\n")
-            bad = self._write(tmp, "chains.json", "{ this is not json")
-            out = os.path.join(tmp, "fmea.rst")
-            with self.assertRaises(SystemExit) as ctx:
-                self._run_main(
-                    [
-                        "fmea_assembler",
-                        "--output",
-                        out,
-                        "--template",
-                        template,
-                        "--title",
-                        "T",
-                        "--chains",
-                        bad,
-                    ]
-                )
-            self.assertEqual(ctx.exception.code, 1)
-
-    def test_missing_body_placeholder_exits_nonzero(self):
-        with tempfile.TemporaryDirectory() as tmp:
-            # Template without the required {body} placeholder.
-            template = self._write(tmp, "tmpl.rst", "no placeholder here\n")
-            chains = self._write(tmp, "chains.json", "[]")
-            out = os.path.join(tmp, "fmea.rst")
-            with self.assertRaises(SystemExit) as ctx:
-                self._run_main(
-                    [
-                        "fmea_assembler",
-                        "--output",
-                        out,
-                        "--template",
-                        template,
-                        "--title",
-                        "T",
-                        "--chains",
-                        chains,
-                    ]
-                )
-            self.assertEqual(ctx.exception.code, 1)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/bazel/rules/rules_score/test/test_safety_analysis_assembler.py b/bazel/rules/rules_score/test/test_safety_analysis_assembler.py
new file mode 100644
index 00000000..a5109cb2
--- /dev/null
+++ b/bazel/rules/rules_score/test/test_safety_analysis_assembler.py
@@ -0,0 +1,496 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+"""Unit tests for the safety-analysis page assembler layout logic."""
+
+import json
+import os
+import sys
+import tempfile
+import unittest
+
+import safety_analysis_assembler as fa
+
+
+class _Type:
+    def __init__(self, name):
+        self.name = name
+
+
+class _Obj:
+    def __init__(self, name, type_name, fields=None):
+        self.name = name
+        self.n_typ = _Type(type_name)
+        self._fields = fields or {}
+
+    def to_python_dict(self):
+        return self._fields
+
+
+class _FakeRenderer:
+    """Minimal stand-in for ``TRLCRST`` exercising the assembler layout."""
+
+    def __init__(self, objs):
+        self._objs = objs
+
+    def objects_by_fqn(self):
+        return self._objs
+
+    def render_table_to_string(self, columns, fqns=None, name_header="Name", link_fn=None):
+        if fqns is None:
+            fqns = list(self._objs)
+        if link_fn is not None:
+            rows = "\n".join(link_fn(f, self._objs[f].name) for f in fqns)
+        else:
+            rows = "\n".join(self._objs[f].name for f in fqns)
+        return f"TABLE[{name_header}]\n{rows}\n"
+
+    def render_records_to_string(self, fqns, fields):
+        return "RECORDS(" + ",".join(fqns) + ")\n"
+
+    def field_value_for(self, fqn, field_name, records=None):
+        return self._objs[fqn].to_python_dict().get(field_name, "")
+
+
+def _objs():
+    """FailureMode/Mitigation records plus a single FtaFailureMode/RootCause pair
+    covering ``Lib.FM_A`` (via ``Lib.CM_1``); ``Lib.FM_Orphan``/``Lib.CM_Orphan``
+    are not referenced by any generated stub."""
+    return {
+        "Lib.FM_A": _Obj(
+            "FM_A",
+            "FailureMode",
+            {
+                "guideword": "LossOfFunction",
+                "safety": "B",
+                "interface": "Lib.Api",
+                "failureeffect": "world ends",
+                "description": "fm a description",
+            },
+        ),
+        "Lib.FM_Orphan": _Obj("FM_Orphan", "FailureMode", {"safety": "QM", "guideword": "TooLate"}),
+        "Lib.CM_1": _Obj(
+            "CM_1",
+            "Mitigation",
+            {"safety": "B", "description": "cm one", "root_causes": ["Lib.RC_A"]},
+        ),
+        "Lib.CM_Orphan": _Obj("CM_Orphan", "Mitigation", {"safety": "D"}),
+        "Lib.FFM_A": _Obj(
+            "FFM_A",
+            "FtaFailureMode",
+            {"title": "Failure mode A", "diagram": "fta_a.puml", "line": 1, "failure_modes": ["Lib.FM_A"]},
+        ),
+        "Lib.RC_A": _Obj(
+            "RC_A",
+            "RootCause",
+            {"title": "Root cause A", "diagram": "fta_a.puml", "line": 2, "failure_modes": ["Lib.FFM_A"]},
+        ),
+    }
+
+
+def _objs_no_fta():
+    """FailureMode/Mitigation records only, no generated FtaFailureMode/RootCause
+    stubs at all (mirrors an ``safety_analysis()`` target with no ``root_causes`` diagrams)."""
+    return {fqn: obj for fqn, obj in _objs().items() if obj.n_typ.name in ("FailureMode", "Mitigation")}
+
+
+class AnchorTest(unittest.TestCase):
+    def test_anchor_is_sanitised_lowercase(self):
+        self.assertEqual(fa._anchor("Lib.FM_A"), "safety-analysis-lib-fm-a")
+
+    def test_ref_targets_anchor(self):
+        self.assertEqual(
+            fa._ref("Lib.FM_A", "FM_A"),
+            ":ref:`FM_A <safety-analysis-lib-fm-a>`",
+        )
+
+
+class ChainDerivationTest(unittest.TestCase):
+    """Unit tests for the obj_map-driven chain-derivation helpers."""
+
+    def setUp(self):
+        self.obj_map = _objs()
+
+    def test_root_causes_for_fta_failure_mode_finds_matching_root_causes(self):
+        self.assertEqual(fa._root_causes_for_fta_failure_mode(self.obj_map, "Lib.FFM_A"), ["Lib.RC_A"])
+
+    def test_root_causes_for_fta_failure_mode_empty_when_unreferenced(self):
+        self.assertEqual(fa._root_causes_for_fta_failure_mode(self.obj_map, "Lib.NoSuchTE"), [])
+
+    def test_measures_for_root_cause_finds_matching_measures(self):
+        self.assertEqual(fa._measures_for_root_cause(self.obj_map, "Lib.RC_A"), ["Lib.CM_1"])
+
+    def test_measures_for_root_cause_includes_aou_type(self):
+        obj_map = dict(self.obj_map)
+        obj_map["Lib.Aou_1"] = _Obj("Aou_1", "AoU", {"root_causes": ["Lib.RC_A"]})
+        self.assertCountEqual(
+            fa._measures_for_root_cause(obj_map, "Lib.RC_A"),
+            ["Lib.CM_1", "Lib.Aou_1"],
+        )
+
+    def test_measures_for_root_cause_includes_compreq_type(self):
+        obj_map = dict(self.obj_map)
+        obj_map["Lib.Cr_1"] = _Obj(
+            "Cr_1",
+            "CompReq",
+            {"derived_from": [{"item": "Lib.RC_A", "version": None}]},
+        )
+        self.assertCountEqual(
+            fa._measures_for_root_cause(obj_map, "Lib.RC_A"),
+            ["Lib.CM_1", "Lib.Cr_1"],
+        )
+
+    def test_measures_for_root_cause_compreq_other_union_members_ignored(self):
+        obj_map = dict(self.obj_map)
+        # A CompReq derived from a FeatReq/AssumedSystemReq/AoU (not this
+        # RootCause) must not count as covering it.
+        obj_map["Lib.Cr_Unrelated"] = _Obj(
+            "Cr_Unrelated",
+            "CompReq",
+            {"derived_from": [{"item": "Lib.SomeFeatReq", "version": 1}]},
+        )
+        self.assertEqual(fa._measures_for_root_cause(obj_map, "Lib.RC_A"), ["Lib.CM_1"])
+
+    def test_chains_for_failure_mode_covered(self):
+        chains = fa._chains_for_failure_mode(self.obj_map, "Lib.FM_A")
+        self.assertEqual(len(chains), 1)
+        self.assertEqual(chains[0]["ffm_fqn"], "Lib.FFM_A")
+        self.assertEqual(chains[0]["puml"], "fta_a.puml")
+        self.assertEqual(chains[0]["measures"], ["Lib.CM_1"])
+
+    def test_chains_for_failure_mode_orphan_is_empty(self):
+        self.assertEqual(fa._chains_for_failure_mode(self.obj_map, "Lib.FM_Orphan"), [])
+
+
+class UncoveredRootCausesTest(unittest.TestCase):
+    def test_covered_root_cause_is_not_reported(self):
+        obj_map = _objs()
+        self.assertEqual(fa._uncovered_root_causes(obj_map), [])
+
+    def test_uncovered_root_cause_is_reported(self):
+        obj_map = _objs()
+        obj_map["Lib.RC_Orphan"] = _Obj(
+            "RC_Orphan", "RootCause", {"title": "Orphan", "diagram": "fta_a.puml", "line": 3, "failure_modes": []}
+        )
+        self.assertEqual(fa._uncovered_root_causes(obj_map), ["Lib.RC_Orphan"])
+
+
+class BuildBodyTest(unittest.TestCase):
+    def setUp(self):
+        self.renderer = _FakeRenderer(_objs())
+
+    def test_overview_and_chain_section_rendered(self):
+        body = fa._build_body(self.renderer, "Title")
+        self.assertIn("Title\n=====", body)
+        self.assertIn("Overview", body)
+        # Top-level grouping sections.
+        self.assertIn("Failure Modes\n-------------", body)
+        # FM dropdown titled by its full fqn only (no ASIL in the heading).
+        self.assertIn(".. dropdown:: Lib.FM_A\n", body)
+        self.assertNotIn(".. dropdown:: Lib.FM_A :bdg", body)
+        self.assertIn(":name: safety-analysis-lib-fm-a", body)
+        # Attributes as a grid of cards; no inner requirement id.
+        self.assertNotIn(".. requirement:definition::", body)
+        self.assertIn(".. grid:: 2", body)
+        # Guideword / ASIL are bare centred grid items (no card chrome).
+        self.assertIn(".. grid-item::", body)
+        self.assertIn(":class: sd-text-center", body)
+        self.assertIn(":bdg-info:`LossOfFunction`", body)
+        self.assertIn(":bdg-warning:`ASIL B`", body)
+        self.assertNotIn(".. grid-item-card:: Guideword", body)
+        self.assertIn(".. grid-item-card:: Interface", body)
+        # Description as a prominent card.
+        self.assertIn(".. grid-item-card:: Description", body)
+        self.assertIn("fm a description", body)
+        # Root Cause Analysis rubric over the inline FTA + per-FM CM cards.
+        self.assertIn(".. rubric:: Root Cause Analysis", body)
+        self.assertIn(".. uml:: fta_a.puml", body)
+        self.assertIn(".. rubric:: Safety Measures", body)
+        # CM card: bold ID with inline kind + ASIL badges in the card body (no card title).
+        self.assertIn(".. grid-item-card::\n", body)
+        self.assertIn("**CM_1**", body)
+        self.assertIn(":bdg-warning:`Mitigation`", body)
+        self.assertIn(":bdg-warning:`ASIL B`", body)
+        # Attribute grid uses a gutter to separate the badge row from the cards.
+        self.assertIn(":gutter: 3", body)
+
+    def test_global_measures_section_lists_all(self):
+        body = fa._build_body(self.renderer, "Title")
+        self.assertIn("Safety Measures\n---------------", body)
+        self.assertIn("**CM_1**", body)
+        self.assertIn("**CM_Orphan**", body)
+        self.assertIn(":bdg-warning:`Mitigation`", body)
+
+    def test_orphan_failure_mode_rendered_without_fta(self):
+        body = fa._build_body(self.renderer, "Title")
+        # Orphan FM still appears as a dropdown, but with no FTA / RCA rubric.
+        self.assertIn(".. dropdown:: Lib.FM_Orphan\n", body)
+        self.assertEqual(body.count(".. rubric:: Root Cause Analysis"), 1)
+
+    def test_no_fta_failure_modes_renders_all_failure_modes_without_fta(self):
+        renderer = _FakeRenderer(_objs_no_fta())
+        body = fa._build_body(renderer, "Title")
+        self.assertIn(".. dropdown:: Lib.FM_A\n", body)
+        self.assertIn(".. dropdown:: Lib.FM_Orphan\n", body)
+        self.assertNotIn(".. uml::", body)
+
+
+# Minimal self-contained TRLC model: defines the FailureMode / SafetyMeasure /
+# Mitigation / AoU / CompReq / FtaFailureMode / RootCause types the assembler keys
+# on, so main() runs a real TRLCRST parse (catching contract drift the
+# _FakeRenderer cannot). Everything lives in one package (unlike the real
+# ScoreReq model) since this test does not need to exercise cross-package
+# stub imports.
+_RSL = """\
+package TestSafetyAnalysis
+
+type FailureMode {
+    guideword optional String
+    safety optional String
+    interface optional String
+    failureeffect optional String
+    description optional String
+}
+
+abstract type FtaEvent {
+    title String
+    diagram String
+    line Integer
+}
+
+type FtaFailureMode extends FtaEvent {
+    failure_modes FailureMode [1..*]
+}
+
+type RootCause extends FtaEvent {
+    failure_modes FtaFailureMode [1..*]
+}
+
+abstract type SafetyMeasure {
+    safety optional String
+    description optional String
+    root_causes RootCause [1..*]
+}
+
+type Mitigation extends SafetyMeasure {
+}
+
+type AoU {
+    safety optional String
+    description optional String
+    root_causes optional RootCause [1..*]
+}
+
+tuple CompReqSourceId {
+    item RootCause
+    separator @
+    version optional Integer
+}
+
+type CompReq {
+    safety optional String
+    description optional String
+    derived_from CompReqSourceId [1..*]
+}
+"""
+
+_FM_TRLC = """\
+package TestSafetyAnalysis
+
+FailureMode FmA {
+    guideword = "TooLate"
+    safety = "ASIL_D"
+    interface = "Lib.Api"
+    failureeffect = "downstream timeout"
+    description = "fm a description"
+}
+"""
+
+_MITIGATION_TRLC = """\
+package TestSafetyAnalysis
+
+Mitigation CmA {
+    safety = "ASIL_D"
+    description = "cm a description"
+    root_causes = [TestSafetyAnalysis.RcA]
+}
+"""
+
+_MEASURES_TRLC = """\
+package TestSafetyAnalysis
+
+CompReq CrB {
+    description = "cr b description"
+    derived_from = [TestSafetyAnalysis.RcB@1]
+}
+"""
+
+_FTA_TRLC = """\
+package TestSafetyAnalysis
+
+FtaFailureMode FfmA {
+    title = "Failure mode A"
+    diagram = "a.puml"
+    line = 1
+    failure_modes = [TestSafetyAnalysis.FmA]
+}
+
+RootCause RcA {
+    title = "Root cause A"
+    diagram = "a.puml"
+    line = 2
+    failure_modes = [TestSafetyAnalysis.FfmA]
+}
+
+RootCause RcB {
+    title = "Root cause B"
+    diagram = "a.puml"
+    line = 3
+    failure_modes = [TestSafetyAnalysis.FfmA]
+}
+
+RootCause RcUncovered {
+    title = "Root cause uncovered"
+    diagram = "a.puml"
+    line = 4
+    failure_modes = [TestSafetyAnalysis.FfmA]
+}
+"""
+
+
+class MainIntegrationTest(unittest.TestCase):
+    """End-to-end main(): real TRLCRST parse of failuremodes + safetymeasures +
+    measures + fta_events.trlc -> safety_analysis.rst (+ uncovered_root_causes.json)."""
+
+    def _write(self, directory, name, content):
+        path = os.path.join(directory, name)
+        with open(path, "w", encoding="utf-8") as fh:
+            fh.write(content)
+        return path
+
+    def _run_main(self, argv):
+        saved = sys.argv
+        try:
+            sys.argv = argv
+            fa.main()
+        finally:
+            sys.argv = saved
+
+    def test_full_page_assembled_from_real_trlc(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            rsl = self._write(tmp, "types.rsl", _RSL)
+            fm = self._write(tmp, "fm.trlc", _FM_TRLC)
+            cm = self._write(tmp, "cm.trlc", _MITIGATION_TRLC)
+            measures = self._write(tmp, "measures.trlc", _MEASURES_TRLC)
+            fta = self._write(tmp, "fta_events.trlc", _FTA_TRLC)
+            template = self._write(tmp, "tmpl.rst", "{body}\n")
+            out = os.path.join(tmp, "safety_analysis.rst")
+            uncovered_out = os.path.join(tmp, "uncovered_root_causes.json")
+
+            self._run_main(
+                [
+                    "safety_analysis_assembler",
+                    "--output",
+                    out,
+                    "--template",
+                    template,
+                    "--title",
+                    "Test FMEA",
+                    "--fta-events",
+                    fta,
+                    "--failuremodes",
+                    fm,
+                    "--safetymeasures",
+                    cm,
+                    "--measures",
+                    measures,
+                    "--spec",
+                    rsl,
+                    "--uncovered-root-causes-output",
+                    uncovered_out,
+                ]
+            )
+
+            with open(out, encoding="utf-8") as fh:
+                rst = fh.read()
+
+            # Title + overview table + FM dropdown + inline FTA + safety measures.
+            self.assertIn("Test FMEA", rst)
+            self.assertIn("Overview", rst)
+            self.assertIn(".. list-table::", rst)
+            self.assertIn(".. dropdown:: TestSafetyAnalysis.FmA\n", rst)
+            self.assertIn(":name: safety-analysis-testsafetyanalysis-fma", rst)
+            self.assertIn(".. grid-item-card:: Description", rst)
+            self.assertIn(".. rubric:: Root Cause Analysis", rst)
+            self.assertIn(".. uml:: a.puml", rst)
+            self.assertIn("Safety Measures", rst)
+            # Real rendered record content (proves TRLCRST actually parsed).
+            self.assertIn("fm a description", rst)
+            self.assertIn("cm a description", rst)
+            # CompReq (from --measures) rendered as a kind-badged control measure.
+            self.assertIn("cr b description", rst)
+            self.assertIn(":bdg-success:`Control Measure`", rst)
+
+            # RcA is covered by the Mitigation, RcB by the CompReq; RcUncovered
+            # is addressed by neither and must be the sole coverage gap.
+            with open(uncovered_out, encoding="utf-8") as fh:
+                uncovered = json.load(fh)
+            self.assertEqual(uncovered, ["TestSafetyAnalysis.RcUncovered"])
+
+    def test_malformed_fta_events_exits_nonzero(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            template = self._write(tmp, "tmpl.rst", "{body}\n")
+            bad = self._write(tmp, "fta_events.trlc", "this is not valid trlc @@@ syntax")
+            out = os.path.join(tmp, "safety_analysis.rst")
+            with self.assertRaises(SystemExit) as ctx:
+                self._run_main(
+                    [
+                        "safety_analysis_assembler",
+                        "--output",
+                        out,
+                        "--template",
+                        template,
+                        "--title",
+                        "T",
+                        "--fta-events",
+                        bad,
+                    ]
+                )
+            self.assertEqual(ctx.exception.code, 1)
+
+    def test_missing_body_placeholder_exits_nonzero(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            # Template without the required {body} placeholder.
+            template = self._write(tmp, "tmpl.rst", "no placeholder here\n")
+            # Trivial stub, matching what safety_analysis.bzl emits when there are no
+            # root_causes diagrams at all.
+            fta = self._write(tmp, "fta_events.trlc", "// no root cause diagrams\npackage T\n")
+            out = os.path.join(tmp, "safety_analysis.rst")
+            with self.assertRaises(SystemExit) as ctx:
+                self._run_main(
+                    [
+                        "safety_analysis_assembler",
+                        "--output",
+                        out,
+                        "--template",
+                        template,
+                        "--title",
+                        "T",
+                        "--fta-events",
+                        fta,
+                    ]
+                )
+            self.assertEqual(ctx.exception.code, 1)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/bazel/rules/rules_score/trlc/config/score_requirements_model.rsl b/bazel/rules/rules_score/trlc/config/score_requirements_model.rsl
index 5d81cc62..3b9fc21d 100644
--- a/bazel/rules/rules_score/trlc/config/score_requirements_model.rsl
+++ b/bazel/rules/rules_score/trlc/config/score_requirements_model.rsl
@@ -45,7 +45,7 @@ abstract type RequirementSafety "Extension of Requirement that carries an ASIL c
 }
 
 ///////////////////////////////
-// S-Core Requirements Model
+// Requirements Chain
 ///////////////////////////////
 
 type AssumedSystemReq "System-level requirement received from the wider operational context (e.g. platform)." extends RequirementSafety {
@@ -70,35 +70,13 @@ tuple FeatReqId {
     version Integer
 }
 
-type ControlMeasure "A design or operational measure that detects, prevents, or limits a failure mode." extends RequirementSafety {
-    mitigates    "Reference to the FailureMode or safety concern that this requirement mitigates."
-                 optional String
-}
-
-type AoU "Assumption of Use — a safety-relevant condition that a user must fulfil." extends ControlMeasure {
-}
-
-tuple CompReqSourceId {
-    item    [FeatReq, AssumedSystemReq, AoU]
-    separator @
-    version Integer
-}
-
-type CompReq "Component-level requirement allocated to a specific software component." extends RequirementSafety {
-    derived_from "Versioned references to the FeatReq, AssumedSystemReq, or received AoU items this component requirement is derived from. An AoU reference must come from a target listed directly in this target's deps (the dependable_element's own assumptions_of_use or one received/forwarded from its deps). Omit only for component-internal requirements with no feature-level parent."
-                CompReqSourceId[1 .. *]
-}
-
-tuple CompReqId {
-    item    CompReq
-    separator @
-    version Integer
-}
-
 ///////////////////////////////
 // Safety Analyses
 ///////////////////////////////
 
+// Failure Modes & FTA-generated stubs
+// ------------------------------------
+
 enum Guideword "HAZOP-style guide words used to categorize failure mode." {
 
     // -------------------------------------------------------------------------
@@ -162,16 +140,72 @@ type FailureMode "A potential failure of a system function, described using one
                    optional String
 }
 
-type PreventiveMeasure "A measure that prevents a failure mode from occurring in the first place." {
+// FtaFailureMode / RootCause records are generated by puml_cli from
+// $FailureMode(...) / $RootCause(...) macro calls in FTA .puml diagrams (see
+// puml_fta) into a per-safety-analysis `fta_events.trlc` file -- do not author these
+// records by hand.
+
+abstract type FtaEvent "Base type for FTA-diagram-generated stub records; generated, do not edit by hand." {
+    title   "Human-readable label of this event, taken from the diagram."
+            String
+    diagram "Basename of the source .puml diagram this event was generated from."
+            String
+    line    "Source line of the originating macro call within its diagram."
+            Integer
 }
 
-type Mitigation "A measure that reduces the severity or probability of a failure mode's effect." extends AssumedSystemReq {
-    mitigates    "Reference to the FailureMode or safety concern that this requirement mitigates."
-                 optional String
+type FtaFailureMode "A fault-tree top-level node, generated from a $FailureMode(...) macro call." extends FtaEvent {
+    failure_modes "The FailureMode(s) this node represents in the fault tree."
+                  FailureMode[1 .. *]
 }
 
-tuple Measure {
-    item    [ControlMeasure, PreventiveMeasure, Mitigation]
+type RootCause "A fault-tree root cause (leaf node), generated from a $RootCause(...) macro call." extends FtaEvent {
+    failure_modes "The FtaFailureMode(s) this root cause's ancestry connects to (usually one, but a shared root cause may appear in more than one fault tree)."
+                  FtaFailureMode[1 .. *]
+}
+
+// Measures
+// --------
+//
+// Every fault-tree root cause (RootCause) must be addressed by at least one
+// concrete measure: a CompReq (control measure, via derived_from), an AoU
+// (preventive measure, via root_causes) or a Mitigation (via root_causes,
+// arguing the root cause does not apply). SafetyMeasure itself is never
+// instantiated directly -- it only exists so Mitigation can inherit the
+// mandatory root_causes field.
+
+abstract type SafetyMeasure "Base type for measures that address one or more fault-tree root causes." extends RequirementSafety {
+    root_causes  "Fault-tree root causes that this measure addresses."
+                 RootCause[1 .. *]
+}
+
+type Mitigation "Argues that a fault-tree root cause does not apply in this context, rather than actively preventing or controlling it." extends SafetyMeasure {
+    justification "Explanation of why this root cause cannot occur, or is otherwise irrelevant, in this context."
+                  String
+}
+
+type AoU "Assumption of Use — a safety-relevant condition that a user must fulfil. Acts as a preventive measure when it addresses a fault-tree root cause." extends RequirementSafety {
+    root_causes  "Fault-tree root causes that this assumption of use prevents."
+                 optional RootCause[1 .. *]
+}
+
+///////////////////////////////
+// Component Requirements
+///////////////////////////////
+
+tuple CompReqSourceId {
+    item    [FeatReq, AssumedSystemReq, AoU, RootCause]
+    separator @
+    version optional Integer
+}
+
+type CompReq "Component-level requirement allocated to a specific software component. Acts as a control measure when derived_from references a fault-tree root cause (RootCause)." extends RequirementSafety {
+    derived_from "Versioned references to the FeatReq, AssumedSystemReq, received AoU, or fault-tree RootCause (root cause, unversioned) items this component requirement is derived from. An AoU reference must come from a target listed directly in this target's deps (the dependable_element's own assumptions_of_use or one received/forwarded from its deps). Omit only for component-internal requirements with no feature-level parent."
+                CompReqSourceId[1 .. *]
+}
+
+tuple CompReqId {
+    item    CompReq
     separator @
     version Integer
 }
diff --git a/plantuml/fta_metamodel.puml b/plantuml/fta_metamodel.puml
index 770f7a54..fe509e78 100644
--- a/plantuml/fta_metamodel.puml
+++ b/plantuml/fta_metamodel.puml
@@ -29,8 +29,37 @@ sprite $transferin <svg width="60" height="70" viewBox="0 0 60 70" xmlns="http:/
 'skinparam linetype polyline
 'skinparam linetype ortho
 
-!procedure $TopEvent($name, $alias)
-  rectangle "$name" as $alias
+' $FailureMode(name, fm1, fm2, ..., fm8): a fault-tree top-level node covering
+' one or more failure modes, each given as a TRLC 'Package.Name' fully-qualified
+' name. The *first* failure mode ($fm1) doubles as this node's alias -- the
+' connection point every gate/root-cause ancestor attaches to. Any further
+' failure modes ($fm2..$fm8) are rendered as extra notes so a reader can see
+' at a glance that this node covers more than one failure mode. PlantUML
+' procedures have no true variadic arguments, only trailing defaults, so the
+' argument count is capped at 8 failure modes per node.
+!procedure $FailureMode($name, $fm1, $fm2="", $fm3="", $fm4="", $fm5="", $fm6="", $fm7="", $fm8="")
+  rectangle "$name" as $fm1
+  !if ($fm2 != "")
+  note right of $fm1: $fm2
+  !endif
+  !if ($fm3 != "")
+  note right of $fm1: $fm3
+  !endif
+  !if ($fm4 != "")
+  note right of $fm1: $fm4
+  !endif
+  !if ($fm5 != "")
+  note right of $fm1: $fm5
+  !endif
+  !if ($fm6 != "")
+  note right of $fm1: $fm6
+  !endif
+  !if ($fm7 != "")
+  note right of $fm1: $fm7
+  !endif
+  !if ($fm8 != "")
+  note right of $fm1: $fm8
+  !endif
 !endprocedure
 
 !procedure $IntermediateEvent($name, $alias, $connection)
@@ -38,7 +67,7 @@ sprite $transferin <svg width="60" height="70" viewBox="0 0 60 70" xmlns="http:/
   $alias -u-> $connection
 !endprocedure
 
-!procedure $BasicEvent($name, $alias, $connection)
+!procedure $RootCause($name, $alias, $connection)
   usecase "$name" as $alias
   $alias -u-> $connection
 !endprocedure
diff --git a/plantuml/parser/puml_cli/src/main.rs b/plantuml/parser/puml_cli/src/main.rs
index 7575e09c..6eab76ae 100644
--- a/plantuml/parser/puml_cli/src/main.rs
+++ b/plantuml/parser/puml_cli/src/main.rs
@@ -27,7 +27,7 @@ use class_serializer::ClassSerializer;
 use component_serializer::ComponentSerializer;
 use sequence_serializer::SequenceSerializer;
 
-use puml_fta::{lobster_document, FtaChain, FtaModel};
+use puml_fta::{merge_stub_events, render_trlc_stub, FtaModel, StubEvent};
 use puml_idmap::{write_empty_idmap_to_file, write_idmap_to_file, IdMapModel};
 use puml_lobster::{write_lobster_to_file, LobsterModel};
 use puml_parser::{
@@ -105,13 +105,18 @@ struct Args {
     /// Output directory for Fault-Tree-Analysis artifacts (optional).
     /// When set, every input diagram is treated as an FTA: its
     /// ``fta_metamodel.puml`` include is inlined and the metamodel-inlined
-    /// ``.puml`` is written to this directory, alongside an aggregated
-    /// ``root_causes.lobster`` (lobster-act-trace) and ``fta_chains.json``
-    /// describing the per-failure-mode chains.  No FlatBuffers / component
-    /// processing is performed in this mode.
+    /// ``.puml`` is written to this directory, alongside ``fta_events.trlc``
+    /// (the generated ``FailureMode``/``RootCause`` stub records; see
+    /// ``--fta-package``).  No FlatBuffers / component processing is
+    /// performed in this mode.
     #[arg(long)]
     fta_output_dir: Option<String>,
 
+    /// TRLC package name for the generated ``fta_events.trlc`` stub file.
+    /// Required together with ``--fta-output-dir``.
+    #[arg(long)]
+    fta_package: Option<String>,
+
     /// Output directory for generated idmap sidecar files (optional).
     /// When set, a <stem>.idmap.json is written for each resolved diagram,
     /// recording the defines/references used by the clickable_plantuml
@@ -184,7 +189,14 @@ fn run() -> Result<(), Box<dyn std::error::Error>> {
         if args.output_stem.is_some() {
             return Err("--output-stem cannot be combined with --fta-output-dir".into());
         }
-        return run_fta(&args, dir, log_level);
+        let Some(fta_package) = &args.fta_package else {
+            return Err("--fta-package is required together with --fta-output-dir".into());
+        };
+        return run_fta(&args, dir, fta_package, log_level);
+    }
+
+    if args.fta_package.is_some() {
+        return Err("--fta-package requires --fta-output-dir".into());
     }
 
     if let Some(name) = &args.source_name {
@@ -332,12 +344,15 @@ fn run() -> Result<(), Box<dyn std::error::Error>> {
     Ok(())
 }
 
-/// FTA processing pipeline: inline the metamodel, parse the fault-tree macro
-/// calls, and emit the metamodel-inlined `.puml`, an aggregated
-/// `root_causes.lobster`, and `fta_chains.json`.
+/// FTA processing pipeline: parse the fault-tree macro calls straight from
+/// each source diagram (the metamodel's ``!procedure`` definitions carry no
+/// fault-tree topology themselves) and emit the generated ``fta_events.trlc``
+/// stub. Diagrams are analysis-only here; they are staged/rendered as-authored
+/// by the Bazel rule, not rewritten by this pipeline.
 fn run_fta(
     args: &Args,
     output_dir: &str,
+    fta_package: &str,
     log_level: LogLevel,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let out = PathBuf::from(output_dir);
@@ -352,10 +367,9 @@ fn run_fta(
     let mut sorted: Vec<Rc<PathBuf>> = inputs.into_iter().collect();
     sorted.sort();
 
-    let mut all_items: Vec<serde_json::Value> = Vec::new();
-    let mut all_chains: Vec<FtaChain> = Vec::new();
-    // Chains/lobster items reference each diagram by basename; two inputs sharing
-    // a basename (in different directories) would be indistinguishable downstream.
+    let mut all_stub_events: Vec<StubEvent> = Vec::new();
+    // Stub events reference each diagram by basename; two inputs sharing a
+    // basename (in different directories) would be indistinguishable downstream.
     let mut seen_basenames: HashSet<String> = HashSet::new();
     // Mirrors the collision guard in the main resolve path: two input files
     // whose file *stem* collides (independent of the basename check above,
@@ -389,7 +403,7 @@ fn run_fta(
         }
 
         // Analysis only: the fault-tree topology comes entirely from the
-        // `$TopEvent(...)` / `$BasicEvent(...)` / gate macro *calls*, which the
+        // `$FailureMode(...)` / `$RootCause(...)` / gate macro *calls*, which the
         // procedure parser reads straight from the source (the `!include
         // fta_metamodel.puml` line is inert text).  The diagram is rendered
         // as-authored by Sphinx/PlantUML, which finds the metamodel via the
@@ -397,8 +411,7 @@ fn run_fta(
         let source = fs::read_to_string(file.as_path())?;
         let parsed = ProcedureParserService.parse_file(file, &source, log_level)?;
         let model = FtaModel::from_procedure_file(&parsed)?;
-        all_items.extend(model.lobster_items(basename));
-        all_chains.extend(model.chains(basename));
+        all_stub_events.extend(model.stub_events(basename)?);
 
         if let Some(ref idir_str) = args.idmap_output_dir {
             let idir = PathBuf::from(idir_str);
@@ -426,14 +439,10 @@ fn run_fta(
         debug!("Processed FTA diagram: {}", file.display());
     }
 
-    let lobster = lobster_document(all_items);
+    let merged_stub_events = merge_stub_events(all_stub_events)?;
     fs::write(
-        out.join("root_causes.lobster"),
-        serde_json::to_string_pretty(&lobster)? + "\n",
-    )?;
-    fs::write(
-        out.join("fta_chains.json"),
-        serde_json::to_string_pretty(&all_chains)? + "\n",
+        out.join("fta_events.trlc"),
+        render_trlc_stub(fta_package, &merged_stub_events),
     )?;
     Ok(())
 }
@@ -894,13 +903,13 @@ mod fta_pipeline_tests {
     // expander to inline.  Topology is read from the original macro calls, so
     // the bodies are irrelevant.
     const TEST_METAMODEL: &str = "@startuml\n\
-        !procedure $TopEvent($name, $alias)\n\
+        !procedure $FailureMode($name, $alias)\n\
         rectangle \"$name\" as $alias\n\
         !endprocedure\n\
         !procedure $OrGate($alias, $connection)\n\
         rectangle \" \" as $alias\n\
         !endprocedure\n\
-        !procedure $BasicEvent($name, $alias, $connection)\n\
+        !procedure $RootCause($name, $alias, $connection)\n\
         usecase \"$name\" as $alias\n\
         !endprocedure\n\
         @enduml\n";
@@ -923,12 +932,12 @@ mod fta_pipeline_tests {
         fs::write(path, content).unwrap();
     }
 
-    fn diagram(fm_name: &str, fm_fqn: &str, cm_fqn: &str) -> String {
+    fn diagram(fm_name: &str, fm_fqn: &str, cm_alias: &str) -> String {
         format!(
             "@startuml\n!include fta_metamodel.puml\n\
-             $TopEvent(\"{fm_name}\", \"{fm_fqn}\")\n\
+             $FailureMode(\"{fm_name}\", \"{fm_fqn}\")\n\
              $OrGate(\"OG\", \"{fm_fqn}\")\n\
-             $BasicEvent(\"a control measure\", \"{cm_fqn}\", \"OG\")\n@enduml\n",
+             $RootCause(\"a control measure\", \"{cm_alias}\", \"OG\")\n@enduml\n",
         )
     }
 
@@ -940,41 +949,35 @@ mod fta_pipeline_tests {
         }
         argv.push("--fta-output-dir".to_string());
         argv.push(out.to_str().unwrap().to_string());
+        argv.push("--fta-package".to_string());
+        argv.push("TestFta".to_string());
         Args::parse_from(argv)
     }
 
     #[test]
-    fn run_fta_emits_lobster_and_chains_without_rewriting_diagram() {
+    fn run_fta_emits_trlc_stub_without_rewriting_diagram() {
         let dir = unique_dir("emit");
         write(&dir.join("fta_metamodel.puml"), TEST_METAMODEL);
         let a = dir.join("a.puml");
-        write(&a, &diagram("FM A", "Lib.FmA", "Lib.CmA"));
+        write(&a, &diagram("FM A", "Lib.FmA", "CmA"));
         let out = dir.join("out");
 
         let args = args_for(&out, &[&a]);
-        run_fta(&args, out.to_str().unwrap(), LogLevel::Warn).expect("run_fta");
+        run_fta(&args, out.to_str().unwrap(), "TestFta", LogLevel::Warn).expect("run_fta");
 
         // FTA mode is analysis-only: it does not rewrite or emit the diagram
         // (Sphinx/PlantUML renders the authored .puml, resolving the metamodel
         // via the global include path).
         assert!(!out.join("a.puml").exists());
 
-        // Lobster: act-trace envelope with a top + basic event.
-        let lobster: serde_json::Value =
-            serde_json::from_str(&fs::read_to_string(out.join("root_causes.lobster")).unwrap())
-                .unwrap();
-        assert_eq!(lobster["schema"], "lobster-act-trace");
-        let data = lobster["data"].as_array().unwrap();
-        assert_eq!(data.len(), 2);
-
-        // Chains: one failure-mode chain carrying its control measure.
-        let chains: serde_json::Value =
-            serde_json::from_str(&fs::read_to_string(out.join("fta_chains.json")).unwrap())
-                .unwrap();
-        let chains = chains.as_array().unwrap();
-        assert_eq!(chains.len(), 1);
-        assert_eq!(chains[0]["fm_fqn"], "Lib.FmA");
-        assert_eq!(chains[0]["control_measures"][0], "Lib.CmA");
+        // TRLC stub: the failure mode's alias collapses to its last segment.
+        let trlc = fs::read_to_string(out.join("fta_events.trlc")).unwrap();
+        assert!(trlc.contains("package TestFta"));
+        assert!(trlc.contains("import Lib"));
+        assert!(trlc.contains("ScoreReq.FtaFailureMode FmA {"));
+        assert!(trlc.contains("failure_modes = [Lib.FmA]"));
+        assert!(trlc.contains("ScoreReq.RootCause CmA {"));
+        assert!(trlc.contains("failure_modes = [FmA]"));
 
         fs::remove_dir_all(&dir).ok();
     }
@@ -985,24 +988,16 @@ mod fta_pipeline_tests {
         write(&dir.join("fta_metamodel.puml"), TEST_METAMODEL);
         let a = dir.join("a.puml");
         let b = dir.join("b.puml");
-        write(&a, &diagram("FM A", "Lib.FmA", "Lib.CmA"));
-        write(&b, &diagram("FM B", "Lib.FmB", "Lib.CmB"));
+        write(&a, &diagram("FM A", "Lib.FmA", "CmA"));
+        write(&b, &diagram("FM B", "Lib.FmB", "CmB"));
         let out = dir.join("out");
 
         let args = args_for(&out, &[&a, &b]);
-        run_fta(&args, out.to_str().unwrap(), LogLevel::Warn).expect("run_fta");
+        run_fta(&args, out.to_str().unwrap(), "TestFta", LogLevel::Warn).expect("run_fta");
 
-        let chains: serde_json::Value =
-            serde_json::from_str(&fs::read_to_string(out.join("fta_chains.json")).unwrap())
-                .unwrap();
-        let fqns: Vec<&str> = chains
-            .as_array()
-            .unwrap()
-            .iter()
-            .map(|c| c["fm_fqn"].as_str().unwrap())
-            .collect();
-        assert!(fqns.contains(&"Lib.FmA"));
-        assert!(fqns.contains(&"Lib.FmB"));
+        let trlc = fs::read_to_string(out.join("fta_events.trlc")).unwrap();
+        assert!(trlc.contains("ScoreReq.FtaFailureMode FmA {"));
+        assert!(trlc.contains("ScoreReq.FtaFailureMode FmB {"));
 
         fs::remove_dir_all(&dir).ok();
     }
@@ -1017,12 +1012,12 @@ mod fta_pipeline_tests {
         write(&d2.join("fta_metamodel.puml"), TEST_METAMODEL);
         let f1 = d1.join("fta.puml");
         let f2 = d2.join("fta.puml");
-        write(&f1, &diagram("FM A", "Lib.FmA", "Lib.CmA"));
-        write(&f2, &diagram("FM B", "Lib.FmB", "Lib.CmB"));
+        write(&f1, &diagram("FM A", "Lib.FmA", "CmA"));
+        write(&f2, &diagram("FM B", "Lib.FmB", "CmB"));
         let out = dir.join("out");
 
         let args = args_for(&out, &[&f1, &f2]);
-        let err = run_fta(&args, out.to_str().unwrap(), LogLevel::Warn).unwrap_err();
+        let err = run_fta(&args, out.to_str().unwrap(), "TestFta", LogLevel::Warn).unwrap_err();
         assert!(err.to_string().contains("duplicate FTA diagram basename"));
 
         fs::remove_dir_all(&dir).ok();
diff --git a/plantuml/parser/puml_fta/src/lib.rs b/plantuml/parser/puml_fta/src/lib.rs
index b4a3ef5e..ca786c5c 100644
--- a/plantuml/parser/puml_fta/src/lib.rs
+++ b/plantuml/parser/puml_fta/src/lib.rs
@@ -14,29 +14,21 @@
 //! Fault-Tree-Analysis (FTA) model and emitters.
 //!
 //! Consumes the procedure parser's [`ProcedureFile`] (the stream of
-//! `$TopEvent(...)` / `$BasicEvent(...)` / gate macro calls produced after
-//! `fta_metamodel.puml` has been inlined) and turns it into:
-//!
-//! * a [`lobster-act-trace`] JSON document (`root_causes.lobster`) — schema
-//!   compatible with the legacy `safety_analysis_tools.py` so the
-//!   `dependability_analysis` traceability test is unaffected, and
-//! * an ordered list of *chains* (`fta_chains.json`) describing, per failure
-//!   mode, the inline diagram and the control measures (basic events) that
-//!   trace up to it — consumed by the FMEA page assembler.
-//!
-//! [`lobster-act-trace`]: https://github.com/bmw-software-engineering/lobster
+//! `$FailureMode(...)` / `$RootCause(...)` / gate macro calls produced after
+//! `fta_metamodel.puml` has been inlined) and turns it into the generated
+//! `FailureMode`/`RootCause` TRLC stub records (`fta_events.trlc`, see
+//! [`render_trlc_stub`]) consumed by the `safety_analysis` rule.
 
 use std::collections::HashMap;
 
 use log::warn;
 use procedure_preprocessor::{Arg, MacroCallDef, ProcedureFile, Statement};
 use serde::Serialize;
-use serde_json::{json, Value};
 
 /// Procedure macro names recognised in an FTA diagram.
-const TOP_EVENT: &str = "$TopEvent";
+const FAILURE_MODE: &str = "$FailureMode";
 const INTERMEDIATE_EVENT: &str = "$IntermediateEvent";
-const BASIC_EVENT: &str = "$BasicEvent";
+const ROOT_CAUSE: &str = "$RootCause";
 const AND_GATE: &str = "$AndGate";
 const OR_GATE: &str = "$OrGate";
 const TRANSFER_IN_GATE: &str = "$TransferInGate";
@@ -44,12 +36,12 @@ const TRANSFER_IN_GATE: &str = "$TransferInGate";
 /// The kind of a node in a fault tree.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum NodeKind {
-    /// `$TopEvent` — the failure mode at the root of the tree.
-    TopEvent,
+    /// `$FailureMode` — the root of the tree; covers one or more failure modes.
+    FailureMode,
     /// `$IntermediateEvent` — a named intermediate node.
     IntermediateEvent,
-    /// `$BasicEvent` — a leaf root cause / control measure.
-    BasicEvent,
+    /// `$RootCause` — a leaf root cause / control measure.
+    RootCause,
     /// `$AndGate`, `$OrGate`, `$TransferInGate` — a logic gate.  Use
     /// [`FtaNode::gate_kind`] to distinguish which one.
     Gate,
@@ -58,15 +50,15 @@ pub enum NodeKind {
 /// Which specific gate macro produced a [`NodeKind::Gate`] node.
 ///
 /// `NodeKind::Gate` alone does not distinguish an internal `$AndGate`/`$OrGate`
-/// from a `$TransferInGate` (which links to another diagram's top event).
+/// from a `$TransferInGate` (which links to another diagram's failure mode).
 /// Consumers that need that distinction (e.g. `puml_idmap`) must match on this
 /// field rather than guessing from the node's `alias` shape.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 pub enum GateKind {
     And,
     Or,
-    /// Transfers into another diagram's top event; `alias` is that top
-    /// event's TRLC fully-qualified name.
+    /// Transfers into another diagram's failure mode; `alias` is that
+    /// failure mode's TRLC fully-qualified name.
     TransferIn,
 }
 
@@ -76,15 +68,19 @@ pub struct FtaNode {
     pub kind: NodeKind,
     /// Human readable display name (events only; gates carry `None`).
     pub name: Option<String>,
-    /// Alias / identifier.  For top and basic events this is the TRLC
-    /// fully-qualified name of the corresponding record.
+    /// Alias / identifier.  For a failure mode this is always the same as the
+    /// first entry of `failure_modes` (a TRLC fully-qualified name); for a
+    /// root cause it is a plain TRLC identifier.
     pub alias: String,
     /// Alias of the parent node this node connects upward to.  `None` for the
-    /// top event (the root).
+    /// failure mode (the root).
     pub connection: Option<String>,
     /// `Some` only when `kind == NodeKind::Gate`; identifies which gate macro
     /// produced this node. `None` for all other kinds.
     pub gate_kind: Option<GateKind>,
+    /// `NodeKind::FailureMode` only: TRLC fully-qualified names of the failure
+    /// modes this failure mode covers.  Empty for every other kind.
+    pub failure_modes: Vec<String>,
     /// 1-based line of the macro call in its source diagram.
     /// `None` when the line is unavailable (e.g. synthesised nodes in tests).
     pub line: Option<usize>,
@@ -96,19 +92,26 @@ pub struct FtaModel {
     pub nodes: Vec<FtaNode>,
 }
 
-/// One failure-mode chain: the failure mode together with the control measures
-/// (basic events) whose ancestry reaches it, plus the diagram to render.
+/// One record to emit into the generated TRLC stub package (see
+/// [`render_trlc_stub`]).  Produced per-diagram by [`FtaModel::stub_events`]
+/// and merged across every diagram of an `fta_package` by
+/// [`merge_stub_events`].
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
-pub struct FtaChain {
-    /// Fully-qualified name of the failure mode (top event alias).
-    pub fm_fqn: String,
-    /// Human readable failure mode name.
-    pub fm_name: String,
-    /// Basename of the preprocessed `.puml` diagram to render inline.
-    pub puml: String,
-    /// Fully-qualified names of the control measures for this chain, in the
-    /// order they appear in the diagram.
-    pub control_measures: Vec<String>,
+pub struct StubEvent {
+    /// `NodeKind::FailureMode` or `NodeKind::RootCause` — never any other kind.
+    pub kind: NodeKind,
+    /// TRLC record name within the generated `fta_package` (see [`stub_name`]).
+    pub stub_name: String,
+    pub title: String,
+    /// Basename of the source `.puml` diagram (first diagram, if merged).
+    pub diagram: String,
+    /// Source line in `diagram` (first diagram, if merged).
+    pub line: usize,
+    /// `FailureMode` only: fully-qualified names of the failure modes it covers.
+    pub failure_modes: Vec<String>,
+    /// `RootCause` only: `stub_name`s of the failure modes it contributes to,
+    /// merged (order-preserving, de-duplicated) across every diagram.
+    pub fta_failure_modes: Vec<String>,
 }
 
 #[derive(Debug, thiserror::Error)]
@@ -117,6 +120,42 @@ pub enum FtaError {
     MissingArgs { macro_name: String, expected: usize },
     #[error("FTA macro {macro_name} expected a string argument at position {index}")]
     NonStringArg { macro_name: String, index: usize },
+    #[error(
+        "FTA macro $FailureMode at line {line}: failure mode {fm_fqn:?} is not a valid TRLC \
+         fully-qualified name (expected 'Package.Name')"
+    )]
+    InvalidFailureModeFqn { line: usize, fm_fqn: String },
+    #[error(
+        "FTA {diagram}:{line}: $RootCause alias {alias:?} must be a plain TRLC identifier -- \
+         dotted 'Package.Name' aliases are no longer supported for root causes"
+    )]
+    InvalidRootCauseAlias {
+        diagram: String,
+        line: usize,
+        alias: String,
+    },
+    #[error(
+        "FTA stub {stub_name:?} is declared as both a FailureMode (in {first_diagram}) and a \
+         RootCause (in {second_diagram}); stub names must be unique across all diagrams \
+         sharing an fta_package"
+    )]
+    StubKindClash {
+        stub_name: String,
+        first_diagram: String,
+        second_diagram: String,
+    },
+    #[error(
+        "FTA stub {stub_name:?} has a different title in {first_diagram} ({first_title:?}) than \
+         in {second_diagram} ({second_title:?}); use the same title everywhere the same root \
+         cause or failure mode is referenced"
+    )]
+    StubTitleMismatch {
+        stub_name: String,
+        first_diagram: String,
+        first_title: String,
+        second_diagram: String,
+        second_title: String,
+    },
 }
 
 /// Legacy guardrail (ported from `safety_analysis_tools.py`): a TRLC
@@ -127,11 +166,21 @@ fn is_valid_trlc_fqn(alias: &str) -> bool {
     if parts.len() != 2 {
         return false;
     }
-    parts.iter().all(|part| {
-        let mut chars = part.chars();
-        let first_ok = matches!(chars.next(), Some(c) if c.is_ascii_alphabetic() || c == '_');
-        first_ok && chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
-    })
+    parts.iter().all(|part| is_valid_identifier(part))
+}
+
+/// A single TRLC identifier: `[A-Za-z_][A-Za-z0-9_]*`.
+fn is_valid_identifier(s: &str) -> bool {
+    let mut chars = s.chars();
+    let first_ok = matches!(chars.next(), Some(c) if c.is_ascii_alphabetic() || c == '_');
+    first_ok && chars.all(|c| c.is_ascii_alphanumeric() || c == '_')
+}
+
+/// Derive the local TRLC stub identifier from a diagram alias: a legacy
+/// dotted alias (`Package.Name`) collapses to its last segment; any other
+/// alias (new-style diagrams) is used verbatim.
+fn stub_name(alias: &str) -> &str {
+    alias.rsplit('.').next().unwrap_or(alias)
 }
 
 fn string_arg(call: &MacroCallDef, index: usize) -> Result<String, FtaError> {
@@ -158,29 +207,57 @@ impl FtaModel {
                 continue;
             };
             let line = call.line;
+
             let node = match call.name.as_str() {
-                TOP_EVENT => FtaNode {
-                    kind: NodeKind::TopEvent,
-                    name: Some(string_arg(call, 0)?),
-                    alias: string_arg(call, 1)?,
-                    connection: None,
-                    gate_kind: None,
-                    line,
-                },
+                FAILURE_MODE => {
+                    if call.args.len() < 2 {
+                        return Err(FtaError::MissingArgs {
+                            macro_name: call.name.clone(),
+                            expected: 2,
+                        });
+                    }
+                    let name = string_arg(call, 0)?;
+                    let mut failure_modes = Vec::with_capacity(call.args.len() - 1);
+                    for i in 1..call.args.len() {
+                        let fm_fqn = string_arg(call, i)?;
+                        if !is_valid_trlc_fqn(&fm_fqn) {
+                            return Err(FtaError::InvalidFailureModeFqn {
+                                line: line.unwrap_or(0),
+                                fm_fqn,
+                            });
+                        }
+                        if !failure_modes.contains(&fm_fqn) {
+                            failure_modes.push(fm_fqn);
+                        }
+                    }
+                    // Non-empty: the loop above ran at least once (`args.len() >= 2`).
+                    let alias = failure_modes[0].clone();
+                    FtaNode {
+                        kind: NodeKind::FailureMode,
+                        name: Some(name),
+                        alias,
+                        connection: None,
+                        gate_kind: None,
+                        failure_modes,
+                        line,
+                    }
+                }
                 INTERMEDIATE_EVENT => FtaNode {
                     kind: NodeKind::IntermediateEvent,
                     name: Some(string_arg(call, 0)?),
                     alias: string_arg(call, 1)?,
                     connection: Some(string_arg(call, 2)?),
                     gate_kind: None,
+                    failure_modes: Vec::new(),
                     line,
                 },
-                BASIC_EVENT => FtaNode {
-                    kind: NodeKind::BasicEvent,
+                ROOT_CAUSE => FtaNode {
+                    kind: NodeKind::RootCause,
                     name: Some(string_arg(call, 0)?),
                     alias: string_arg(call, 1)?,
                     connection: Some(string_arg(call, 2)?),
                     gate_kind: None,
+                    failure_modes: Vec::new(),
                     line,
                 },
                 AND_GATE | OR_GATE | TRANSFER_IN_GATE => {
@@ -196,28 +273,16 @@ impl FtaModel {
                         alias: string_arg(call, 0)?,
                         connection: Some(string_arg(call, 1)?),
                         gate_kind: Some(gate_kind),
+                        failure_modes: Vec::new(),
                         line,
                     }
                 }
                 // Unknown / cosmetic macros are not part of the topology.
                 _ => continue,
             };
-            // Top and basic events carry TRLC fully-qualified names that must
-            // resolve to requirements in the traceability chain; warn (rather
-            // than fail) on a malformed alias so the build still produces output.
-            if matches!(node.kind, NodeKind::TopEvent | NodeKind::BasicEvent)
-                && !is_valid_trlc_fqn(&node.alias)
-            {
-                warn!(
-                    "FTA {} at line {}: alias {:?} is not a valid TRLC fully-qualified \
-                     name (expected 'Package.Record')",
-                    call.name,
-                    node.line.unwrap_or(0),
-                    node.alias,
-                );
-            }
             nodes.push(node);
         }
+
         Ok(Self { nodes })
     }
 
@@ -246,14 +311,14 @@ impl FtaModel {
 
     /// Resolve the top-event (failure-mode) alias a node ultimately connects to
     /// by walking the `connection` parent links upward.  Returns `None` when the
-    /// chain does not terminate at a known top event (dangling or cyclic
+    /// chain does not terminate at a known failure mode (dangling or cyclic
     /// diagram).  `by_alias` is the precomputed [`alias_index`], so each step is
     /// O(1).
     fn root_for(&self, start: &FtaNode, by_alias: &HashMap<&str, &FtaNode>) -> Option<String> {
         let mut current = start;
         // Bound the walk by node count to defend against cyclic connections.
         for _ in 0..=self.nodes.len() {
-            if current.kind == NodeKind::TopEvent {
+            if current.kind == NodeKind::FailureMode {
                 return Some(current.alias.clone());
             }
             let parent_alias = current.connection.as_deref()?;
@@ -262,93 +327,186 @@ impl FtaModel {
         None
     }
 
-    /// Assemble ordered failure-mode chains for `puml_basename`.
-    ///
-    /// Basic events whose ancestry does not terminate at a known top event are
-    /// not silently discarded: each emits a `warn!` naming the alias, diagram
-    /// and line so a malformed fault tree is visible in the build log rather
-    /// than quietly losing a control measure from the safety chain.
-    pub fn chains(&self, puml_basename: &str) -> Vec<FtaChain> {
+    /// Assemble the [`StubEvent`]s this diagram contributes to the generated
+    /// TRLC stub package (see [`render_trlc_stub`]).  One entry per failure mode
+    /// (with its `failure_modes`) and one per root cause reachable from a top
+    /// event (with the `stub_name` of that failure mode); root causes that do
+    /// not connect to any failure mode are dropped with a `warn!` naming the
+    /// alias, diagram and line so a malformed fault tree is visible in the
+    /// build log rather than quietly losing a root cause from the safety
+    /// chain.
+    pub fn stub_events(&self, puml_basename: &str) -> Result<Vec<StubEvent>, FtaError> {
         let by_alias = self.alias_index();
-        let mut chains: Vec<FtaChain> = self
-            .iter_kind(NodeKind::TopEvent)
-            .map(|fm| FtaChain {
-                fm_fqn: fm.alias.clone(),
-                fm_name: fm.name.clone().unwrap_or_else(|| fm.alias.clone()),
-                puml: puml_basename.to_string(),
-                control_measures: Vec::new(),
-            })
-            .collect();
+        let mut out = Vec::new();
+
+        for te in self.iter_kind(NodeKind::FailureMode) {
+            let line = te.line.unwrap_or(0);
+            // `te.alias` is `te.failure_modes[0]`, already validated as a TRLC
+            // fully-qualified name by `from_procedure_file`, so its last
+            // segment (see `stub_name`) is guaranteed to be a valid identifier.
+            let name = stub_name(&te.alias);
+            out.push(StubEvent {
+                kind: NodeKind::FailureMode,
+                stub_name: name.to_string(),
+                title: te.name.clone().unwrap_or_default(),
+                diagram: puml_basename.to_string(),
+                line,
+                failure_modes: te.failure_modes.clone(),
+                fta_failure_modes: Vec::new(),
+            });
+        }
 
-        for basic in self.iter_kind(NodeKind::BasicEvent) {
-            match self.root_for(basic, &by_alias) {
-                Some(root) => {
-                    if let Some(chain) = chains.iter_mut().find(|c| c.fm_fqn == root) {
-                        chain.control_measures.push(basic.alias.clone());
+        for be in self.iter_kind(NodeKind::RootCause) {
+            let line = be.line.unwrap_or(0);
+            if !is_valid_identifier(&be.alias) {
+                return Err(FtaError::InvalidRootCauseAlias {
+                    diagram: puml_basename.to_string(),
+                    line,
+                    alias: be.alias.clone(),
+                });
+            }
+            let Some(root_alias) = self.root_for(be, &by_alias) else {
+                warn!(
+                    "FTA {}:{}: root cause {:?} does not connect to any failure mode; \
+                     it is dropped from the generated TRLC stub",
+                    puml_basename, line, be.alias,
+                );
+                continue;
+            };
+            out.push(StubEvent {
+                kind: NodeKind::RootCause,
+                stub_name: be.alias.clone(),
+                title: be.name.clone().unwrap_or_default(),
+                diagram: puml_basename.to_string(),
+                line,
+                failure_modes: Vec::new(),
+                fta_failure_modes: vec![stub_name(&root_alias).to_string()],
+            });
+        }
+
+        Ok(out)
+    }
+}
+
+/// Merge [`StubEvent`]s collected across every diagram of one `fta_package`
+/// into a single, deduplicated set (one entry per `stub_name`): a root cause
+/// shared by several diagrams keeps a single record with its `fta_failure_modes`
+/// merged. Returns an error when the same `stub_name` is used for both a top
+/// and a root cause, or with two different titles.
+pub fn merge_stub_events(events: Vec<StubEvent>) -> Result<Vec<StubEvent>, FtaError> {
+    let mut merged: HashMap<String, StubEvent> = HashMap::new();
+    for ev in events {
+        match merged.get_mut(&ev.stub_name) {
+            None => {
+                merged.insert(ev.stub_name.clone(), ev);
+            }
+            Some(existing) => {
+                if existing.kind != ev.kind {
+                    return Err(FtaError::StubKindClash {
+                        stub_name: ev.stub_name,
+                        first_diagram: existing.diagram.clone(),
+                        second_diagram: ev.diagram,
+                    });
+                }
+                if existing.title != ev.title {
+                    return Err(FtaError::StubTitleMismatch {
+                        stub_name: ev.stub_name,
+                        first_diagram: existing.diagram.clone(),
+                        first_title: existing.title.clone(),
+                        second_diagram: ev.diagram,
+                        second_title: ev.title,
+                    });
+                }
+                for fm in ev.failure_modes {
+                    if !existing.failure_modes.contains(&fm) {
+                        existing.failure_modes.push(fm);
+                    }
+                }
+                for te in ev.fta_failure_modes {
+                    if !existing.fta_failure_modes.contains(&te) {
+                        existing.fta_failure_modes.push(te);
                     }
                 }
-                None => warn!(
-                    "FTA {}:{}: basic event {:?} does not connect to any top event; \
-                     it is dropped from every failure-mode chain",
-                    puml_basename,
-                    basic.line.unwrap_or(0),
-                    basic.alias,
-                ),
             }
         }
-        chains
     }
 
-    /// Emit `lobster-act-trace` items for the top and basic events, mirroring
-    /// the legacy `safety_analysis_tools.py` schema (tag `fta <alias>`,
-    /// `refs: [req <alias>]`).
-    pub fn lobster_items(&self, source_file: &str) -> Vec<Value> {
-        self.nodes
-            .iter()
-            .filter(|n| matches!(n.kind, NodeKind::TopEvent | NodeKind::BasicEvent))
-            .map(|n| {
-                let kind = match n.kind {
-                    NodeKind::TopEvent => "TopEvent",
-                    NodeKind::BasicEvent => "BasicEvent",
-                    _ => unreachable!(),
-                };
-                json!({
-                    "tag": format!("fta {}", n.alias),
-                    "location": {
-                        "kind": "file",
-                        "file": source_file,
-                        "line": n.line.map(|l| json!(l)).unwrap_or(Value::Null),
-                        "column": null,
-                    },
-                    "name": n.alias,
-                    "messages": [],
-                    "just_up": [],
-                    "just_down": [],
-                    "just_global": [],
-                    "refs": [format!("req {}", n.alias)],
-                    "framework": "PlantUML",
-                    "kind": kind,
-                })
-            })
-            .collect()
+    let mut result: Vec<StubEvent> = merged.into_values().collect();
+    result.sort_by(|a, b| {
+        let rank = |k: NodeKind| if k == NodeKind::FailureMode { 0 } else { 1 };
+        (rank(a.kind), &a.stub_name).cmp(&(rank(b.kind), &b.stub_name))
+    });
+    Ok(result)
+}
+
+/// Escape a Rust string as a TRLC string literal (including the surrounding
+/// quotes).
+fn trlc_string_literal(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() + 2);
+    out.push('"');
+    for c in s.chars() {
+        match c {
+            '\\' => out.push_str("\\\\"),
+            '"' => out.push_str("\\\""),
+            '\n' => out.push_str("\\n"),
+            _ => out.push(c),
+        }
     }
+    out.push('"');
+    out
 }
 
-/// Wrap lobster items in the standard `lobster-act-trace` envelope, sorted by
-/// tag for deterministic output.
-pub fn lobster_document(mut items: Vec<Value>) -> Value {
-    items.sort_by(|a, b| {
-        a["tag"]
-            .as_str()
-            .unwrap_or("")
-            .cmp(b["tag"].as_str().unwrap_or(""))
-    });
-    json!({
-        "data": items,
-        "generator": "puml_fta",
-        "schema": "lobster-act-trace",
-        "version": 3,
-    })
+/// Render merged [`StubEvent`]s (see [`merge_stub_events`]) as one TRLC file:
+/// a `FailureMode`/`RootCause` record per event, importing `ScoreReq` plus every
+/// package referenced by a `failure_modes` fully-qualified name. Output order
+/// is deterministic (see [`merge_stub_events`]) and every record carries a
+/// `<diagram>:<line>` comment pointing back at its source macro call.
+pub fn render_trlc_stub(package: &str, events: &[StubEvent]) -> String {
+    let mut fm_packages: std::collections::BTreeSet<&str> = std::collections::BTreeSet::new();
+    for ev in events {
+        for fm in &ev.failure_modes {
+            if let Some((pkg, _)) = fm.rsplit_once('.') {
+                fm_packages.insert(pkg);
+            }
+        }
+    }
+
+    let mut out = String::new();
+    out.push_str("// GENERATED by puml_cli from FTA diagrams -- do not edit\n");
+    out.push_str(&format!("package {}\n\n", package));
+    out.push_str("import ScoreReq\n");
+    for pkg in fm_packages {
+        out.push_str(&format!("import {}\n", pkg));
+    }
+    out.push('\n');
+
+    for ev in events {
+        out.push_str(&format!("// {}:{}\n", ev.diagram, ev.line));
+        match ev.kind {
+            NodeKind::FailureMode => {
+                out.push_str(&format!(
+                    "ScoreReq.FtaFailureMode {} {{\n  title = {}\n  diagram = {}\n  line = {}\n  failure_modes = [{}]\n}}\n\n",
+                    ev.stub_name,
+                    trlc_string_literal(&ev.title),
+                    trlc_string_literal(&ev.diagram),
+                    ev.line,
+                    ev.failure_modes.join(", "),
+                ));
+            }
+            NodeKind::RootCause => {
+                out.push_str(&format!(
+                    "ScoreReq.RootCause {} {{\n  title = {}\n  diagram = {}\n  line = {}\n  failure_modes = [{}]\n}}\n\n",
+                    ev.stub_name,
+                    trlc_string_literal(&ev.title),
+                    trlc_string_literal(&ev.diagram),
+                    ev.line,
+                    ev.fta_failure_modes.join(", "),
+                ));
+            }
+            _ => unreachable!("StubEvent::kind is always FailureMode or RootCause"),
+        }
+    }
+    out
 }
 
 #[cfg(test)]
@@ -375,13 +533,13 @@ mod tests {
     }
 
     const SAMPLE: &str = r#"
-!procedure $TopEvent($name, $alias)
+!procedure $FailureMode($name, $alias)
   rectangle "$name" as $alias
 !endprocedure
 !procedure $IntermediateEvent($name, $alias, $connection)
   rectangle "$name" as $alias
 !endprocedure
-!procedure $BasicEvent($name, $alias, $connection)
+!procedure $RootCause($name, $alias, $connection)
   usecase "$name" as $alias
 !endprocedure
 !procedure $OrGate($alias, $connection)
@@ -390,13 +548,13 @@ mod tests {
 !procedure $AndGate($alias, $connection)
   rectangle " " as $alias
 !endprocedure
-$TopEvent("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
+$FailureMode("SampleFailureMode takes over the world", "SampleLibrary.SampleFailureMode")
 $OrGate("OG1", "SampleLibrary.SampleFailureMode")
 $IntermediateEvent("SampleFailureMode is Angry", "IEF", "OG1")
-$BasicEvent("Just bad luck", "SampleLibrary.JustBadLuck", "OG1")
+$RootCause("Just bad luck", "JustBadLuck", "OG1")
 $AndGate("AG2", "IEF")
-$BasicEvent("No More Cookies", "SampleLibrary.NoMoreCookies", "AG2")
-$BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
+$RootCause("No More Cookies", "NoMoreCookies", "AG2")
+$RootCause("No More Coffee", "NoMoreCoffee", "AG2")
 "#;
 
     fn model_from(content: &str) -> FtaModel {
@@ -410,47 +568,30 @@ $BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
     #[test]
     fn builds_all_topology_nodes() {
         let model = model_from(SAMPLE);
-        assert_eq!(model.iter_kind(NodeKind::TopEvent).count(), 1);
-        assert_eq!(model.iter_kind(NodeKind::BasicEvent).count(), 3);
+        assert_eq!(model.iter_kind(NodeKind::FailureMode).count(), 1);
+        assert_eq!(model.iter_kind(NodeKind::RootCause).count(), 3);
         assert_eq!(model.iter_kind(NodeKind::Gate).count(), 2);
         assert_eq!(model.iter_kind(NodeKind::IntermediateEvent).count(), 1);
     }
 
     #[test]
-    fn chain_groups_basic_events_under_failure_mode() {
+    fn stub_events_groups_root_causes_under_failure_mode() {
         let model = model_from(SAMPLE);
-        let chains = model.chains("sample_fta.puml");
-        assert_eq!(chains.len(), 1);
-        let chain = &chains[0];
-        assert_eq!(chain.fm_fqn, "SampleLibrary.SampleFailureMode");
-        assert_eq!(chain.puml, "sample_fta.puml");
+        let stubs = model.stub_events("sample_fta.puml").expect("stub events");
+        let mut root_causes: Vec<&str> = stubs
+            .iter()
+            .filter(|e| e.kind == NodeKind::RootCause)
+            .map(|e| e.stub_name.as_str())
+            .collect();
+        root_causes.sort_unstable();
         assert_eq!(
-            chain.control_measures,
-            vec![
-                "SampleLibrary.JustBadLuck",
-                "SampleLibrary.NoMoreCookies",
-                "SampleLibrary.NoMoreCoffee",
-            ]
+            root_causes,
+            vec!["JustBadLuck", "NoMoreCoffee", "NoMoreCookies"]
         );
-    }
-
-    #[test]
-    fn lobster_items_match_legacy_schema() {
-        let model = model_from(SAMPLE);
-        let doc = lobster_document(model.lobster_items("sample_fta.puml"));
-        assert_eq!(doc["schema"], "lobster-act-trace");
-        assert_eq!(doc["version"], 3);
-        let data = doc["data"].as_array().unwrap();
-        // 1 top event + 3 basic events.
-        assert_eq!(data.len(), 4);
-        let top = data
+        assert!(stubs
             .iter()
-            .find(|i| i["name"] == "SampleLibrary.SampleFailureMode")
-            .unwrap();
-        assert_eq!(top["tag"], "fta SampleLibrary.SampleFailureMode");
-        assert_eq!(top["refs"][0], "req SampleLibrary.SampleFailureMode");
-        assert_eq!(top["kind"], "TopEvent");
-        assert_eq!(top["framework"], "PlantUML");
+            .filter(|e| e.kind == NodeKind::RootCause)
+            .all(|e| e.fta_failure_modes == vec!["SampleFailureMode".to_string()]));
     }
 
     #[test]
@@ -465,55 +606,39 @@ $BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
     }
 
     #[test]
-    fn multiple_top_events_get_separate_chains() {
-        let chains = model_from_stmts(vec![
-            mk_call(TOP_EVENT, &["FM one", "Lib.FmA"], 1),
+    fn multiple_fta_failure_modes_produce_independent_stub_entries() {
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["FM one", "Lib.FmA"], 1),
             mk_call(OR_GATE, &["OGA", "Lib.FmA"], 2),
-            mk_call(BASIC_EVENT, &["cm a", "Lib.CmA", "OGA"], 3),
-            mk_call(TOP_EVENT, &["FM two", "Lib.FmB"], 4),
+            mk_call(ROOT_CAUSE, &["cm a", "CmA", "OGA"], 3),
+            mk_call(FAILURE_MODE, &["FM two", "Lib.FmB"], 4),
             mk_call(OR_GATE, &["OGB", "Lib.FmB"], 5),
-            mk_call(BASIC_EVENT, &["cm b", "Lib.CmB", "OGB"], 6),
-        ])
-        .chains("d.puml");
-
-        assert_eq!(chains.len(), 2);
-        let a = chains.iter().find(|c| c.fm_fqn == "Lib.FmA").unwrap();
-        assert_eq!(a.control_measures, vec!["Lib.CmA"]);
-        let b = chains.iter().find(|c| c.fm_fqn == "Lib.FmB").unwrap();
-        assert_eq!(b.control_measures, vec!["Lib.CmB"]);
-    }
-
-    #[test]
-    fn dangling_basic_event_is_dropped_from_chains() {
-        // Basic event connects to a gate alias that does not exist.
-        let chains = model_from_stmts(vec![
-            mk_call(TOP_EVENT, &["FM", "Lib.Fm"], 1),
-            mk_call(BASIC_EVENT, &["cm", "Lib.Cm", "MissingGate"], 2),
-        ])
-        .chains("d.puml");
-
-        assert_eq!(chains.len(), 1);
-        assert!(chains[0].control_measures.is_empty());
+            mk_call(ROOT_CAUSE, &["cm b", "CmB", "OGB"], 6),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        let a = stubs.iter().find(|e| e.stub_name == "CmA").unwrap();
+        assert_eq!(a.fta_failure_modes, vec!["FmA".to_string()]);
+        let b = stubs.iter().find(|e| e.stub_name == "CmB").unwrap();
+        assert_eq!(b.fta_failure_modes, vec!["FmB".to_string()]);
     }
 
     #[test]
     fn cyclic_connections_terminate_without_hanging() {
-        // G1 -> G2 -> G1 cycle, no reachable top event.  The bounded walk must
-        // return without looping forever.
-        let chains = model_from_stmts(vec![
+        // G1 -> G2 -> G1 cycle, no reachable failure mode.  The bounded walk must
+        // return without looping forever, and the root cause is dropped.
+        let model = model_from_stmts(vec![
             mk_call(OR_GATE, &["G1", "G2"], 1),
             mk_call(OR_GATE, &["G2", "G1"], 2),
-            mk_call(BASIC_EVENT, &["cm", "Lib.Cm", "G1"], 3),
-        ])
-        .chains("d.puml");
-
-        assert!(chains.is_empty());
+            mk_call(ROOT_CAUSE, &["cm", "Cm", "G1"], 3),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        assert!(stubs.is_empty());
     }
 
     #[test]
     fn missing_argument_is_an_error() {
         let file = ProcedureFile {
-            stmts: vec![mk_call(TOP_EVENT, &["only name"], 1)],
+            stmts: vec![mk_call(FAILURE_MODE, &["only name"], 1)],
         };
         let err = FtaModel::from_procedure_file(&file).unwrap_err();
         assert!(matches!(err, FtaError::MissingArgs { .. }));
@@ -523,7 +648,7 @@ $BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
     fn non_string_argument_is_an_error() {
         let file = ProcedureFile {
             stmts: vec![Statement::MacroCall(MacroCallDef {
-                name: TOP_EVENT.to_string(),
+                name: FAILURE_MODE.to_string(),
                 args: vec![Arg::Number(1), Arg::String("Lib.Fm".to_string())],
                 line: Some(1),
             })],
@@ -533,50 +658,238 @@ $BasicEvent("No More Coffee", "SampleLibrary.NoMoreCoffee", "AG2")
     }
 
     #[test]
-    fn lobster_document_sorted_by_tag() {
-        let doc = lobster_document(
-            model_from_stmts(vec![
-                mk_call(TOP_EVENT, &["FM", "Lib.Zeta"], 1),
-                mk_call(OR_GATE, &["OG", "Lib.Zeta"], 2),
-                mk_call(BASIC_EVENT, &["cm", "Lib.Alpha", "OG"], 3),
-            ])
-            .lobster_items("d.puml"),
+    fn duplicate_alias_last_write_wins_and_root_cause_is_attributed_correctly() {
+        // Two failure modes happen to share the same failure-mode alias; only
+        // the last one is reachable via `alias_index`, so the root cause's
+        // ancestry resolves through it regardless of which node "wins".
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["FM first", "Lib.Fm"], 1),
+            mk_call(FAILURE_MODE, &["FM second", "Lib.Fm"], 2),
+            mk_call(OR_GATE, &["OG", "Lib.Fm"], 3),
+            mk_call(ROOT_CAUSE, &["cm", "Cm", "OG"], 4),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        let top_names: Vec<&str> = stubs
+            .iter()
+            .filter(|e| e.kind == NodeKind::FailureMode)
+            .map(|e| e.stub_name.as_str())
+            .collect();
+        assert_eq!(top_names, vec!["Fm", "Fm"]);
+        let be = stubs
+            .iter()
+            .find(|e| e.kind == NodeKind::RootCause)
+            .unwrap();
+        assert_eq!(be.stub_name, "Cm");
+        assert_eq!(be.fta_failure_modes, vec!["Fm".to_string()]);
+    }
+
+    #[test]
+    fn failure_mode_alias_equals_first_failure_mode() {
+        let model = model_from_stmts(vec![mk_call(FAILURE_MODE, &["FM", "Lib.Fm"], 1)]);
+        let te = model.iter_kind(NodeKind::FailureMode).next().unwrap();
+        assert_eq!(te.alias, "Lib.Fm");
+        assert_eq!(te.failure_modes, vec!["Lib.Fm".to_string()]);
+    }
+
+    #[test]
+    fn failure_mode_with_multiple_failure_modes_dedups_and_keeps_order() {
+        let model = model_from_stmts(vec![mk_call(
+            FAILURE_MODE,
+            &["Top", "Lib.A", "Lib.B", "Lib.A"],
+            1,
+        )]);
+        let te = model.iter_kind(NodeKind::FailureMode).next().unwrap();
+        assert_eq!(te.alias, "Lib.A");
+        assert_eq!(
+            te.failure_modes,
+            vec!["Lib.A".to_string(), "Lib.B".to_string()]
         );
-        let data = doc["data"].as_array().unwrap();
-        let tags: Vec<&str> = data.iter().map(|i| i["tag"].as_str().unwrap()).collect();
-        let mut expected = tags.clone();
-        expected.sort_unstable();
-        assert_eq!(tags, expected);
-        assert_eq!(data[0]["name"], "Lib.Alpha");
     }
 
     #[test]
-    fn lobster_items_carry_source_line() {
-        let items = model_from_stmts(vec![mk_call(TOP_EVENT, &["FM", "Lib.Fm"], 7)])
-            .lobster_items("d.puml");
-        assert_eq!(items[0]["location"]["line"], 7);
+    fn failure_mode_rejects_invalid_failure_mode_fqn() {
+        let file = ProcedureFile {
+            stmts: vec![mk_call(FAILURE_MODE, &["Top", "NotDotted"], 2)],
+        };
+        let err = FtaModel::from_procedure_file(&file).unwrap_err();
+        assert!(matches!(
+            err,
+            FtaError::InvalidFailureModeFqn { line: 2, .. }
+        ));
     }
 
     #[test]
-    fn duplicate_alias_last_write_wins_and_basic_event_is_attributed_correctly() {
-        // Two top events share the same alias; only the second should be
-        // reachable via `alias_index`, and the basic event must end up in the
-        // chain for the winning (second) entry.
-        let chains = model_from_stmts(vec![
-            mk_call(TOP_EVENT, &["FM first", "Lib.Fm"], 1),
-            mk_call(TOP_EVENT, &["FM second", "Lib.Fm"], 2),
-            mk_call(OR_GATE, &["OG", "Lib.Fm"], 3),
-            mk_call(BASIC_EVENT, &["cm", "Lib.Cm", "OG"], 4),
-        ])
-        .chains("d.puml");
-        // Two chain entries (one per TopEvent node), but the basic event
-        // connects through OG → Lib.Fm which resolves to the last-write node.
-        assert_eq!(chains.len(), 2);
-        let with_cm: Vec<_> = chains
+    fn stub_events_collapses_failure_mode_alias_to_last_segment() {
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["FM", "Lib.Fm"], 1),
+            mk_call(OR_GATE, &["OG", "Lib.Fm"], 2),
+            mk_call(ROOT_CAUSE, &["cm", "Cm", "OG"], 3),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        let te = stubs
             .iter()
-            .filter(|c| !c.control_measures.is_empty())
-            .collect();
-        assert_eq!(with_cm.len(), 1);
-        assert_eq!(with_cm[0].control_measures, vec!["Lib.Cm"]);
+            .find(|e| e.kind == NodeKind::FailureMode)
+            .unwrap();
+        assert_eq!(te.stub_name, "Fm");
+        assert_eq!(te.failure_modes, vec!["Lib.Fm".to_string()]);
+        let be = stubs
+            .iter()
+            .find(|e| e.kind == NodeKind::RootCause)
+            .unwrap();
+        assert_eq!(be.stub_name, "Cm");
+        assert_eq!(be.fta_failure_modes, vec!["Fm".to_string()]);
+    }
+
+    #[test]
+    fn stub_events_new_style_diagram_uses_plain_names() {
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["Top", "Lib.A", "Lib.B"], 1),
+            mk_call(OR_GATE, &["OG", "Lib.A"], 4),
+            mk_call(ROOT_CAUSE, &["Root", "TooBig", "OG"], 5),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        let te = stubs
+            .iter()
+            .find(|e| e.kind == NodeKind::FailureMode)
+            .unwrap();
+        assert_eq!(te.stub_name, "A");
+        assert_eq!(
+            te.failure_modes,
+            vec!["Lib.A".to_string(), "Lib.B".to_string()]
+        );
+        let be = stubs
+            .iter()
+            .find(|e| e.kind == NodeKind::RootCause)
+            .unwrap();
+        assert_eq!(be.stub_name, "TooBig");
+        assert_eq!(be.fta_failure_modes, vec!["A".to_string()]);
+    }
+
+    #[test]
+    fn root_cause_rejects_dotted_alias() {
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["FM", "Lib.Fm"], 1),
+            mk_call(OR_GATE, &["OG", "Lib.Fm"], 2),
+            mk_call(ROOT_CAUSE, &["cm", "Lib.Cm", "OG"], 3),
+        ]);
+        let err = model.stub_events("d.puml").unwrap_err();
+        assert!(matches!(
+            err,
+            FtaError::InvalidRootCauseAlias { line: 3, .. }
+        ));
+    }
+
+    #[test]
+    fn stub_events_drops_dangling_root_cause_with_warning() {
+        let model = model_from_stmts(vec![
+            mk_call(FAILURE_MODE, &["FM", "Lib.Fm"], 1),
+            mk_call(ROOT_CAUSE, &["cm", "Cm", "MissingGate"], 2),
+        ]);
+        let stubs = model.stub_events("d.puml").expect("stub events");
+        assert!(!stubs.iter().any(|e| e.kind == NodeKind::RootCause));
+    }
+
+    #[test]
+    fn merge_stub_events_unions_fta_failure_modes_for_shared_root_cause() {
+        let a = StubEvent {
+            kind: NodeKind::RootCause,
+            stub_name: "Shared".into(),
+            title: "shared root cause".into(),
+            diagram: "a.puml".into(),
+            line: 1,
+            failure_modes: vec![],
+            fta_failure_modes: vec!["TeA".into()],
+        };
+        let b = StubEvent {
+            fta_failure_modes: vec!["TeB".into()],
+            diagram: "b.puml".into(),
+            line: 2,
+            ..a.clone()
+        };
+        let merged = merge_stub_events(vec![a, b]).expect("merge");
+        assert_eq!(merged.len(), 1);
+        assert_eq!(
+            merged[0].fta_failure_modes,
+            vec!["TeA".to_string(), "TeB".to_string()]
+        );
+    }
+
+    #[test]
+    fn merge_stub_events_errors_on_kind_clash() {
+        let te = StubEvent {
+            kind: NodeKind::FailureMode,
+            stub_name: "X".into(),
+            title: "t".into(),
+            diagram: "a.puml".into(),
+            line: 1,
+            failure_modes: vec!["Lib.Fm".into()],
+            fta_failure_modes: vec![],
+        };
+        let be = StubEvent {
+            kind: NodeKind::RootCause,
+            diagram: "b.puml".into(),
+            line: 2,
+            failure_modes: vec![],
+            fta_failure_modes: vec!["Other".into()],
+            ..te.clone()
+        };
+        let err = merge_stub_events(vec![te, be]).unwrap_err();
+        assert!(matches!(err, FtaError::StubKindClash { .. }));
+    }
+
+    #[test]
+    fn merge_stub_events_errors_on_title_mismatch() {
+        let a = StubEvent {
+            kind: NodeKind::RootCause,
+            stub_name: "X".into(),
+            title: "one title".into(),
+            diagram: "a.puml".into(),
+            line: 1,
+            failure_modes: vec![],
+            fta_failure_modes: vec!["Te".into()],
+        };
+        let b = StubEvent {
+            title: "different title".into(),
+            diagram: "b.puml".into(),
+            line: 2,
+            ..a.clone()
+        };
+        let err = merge_stub_events(vec![a, b]).unwrap_err();
+        assert!(matches!(err, FtaError::StubTitleMismatch { .. }));
+    }
+
+    #[test]
+    fn render_trlc_stub_emits_package_imports_and_records() {
+        let events = vec![
+            StubEvent {
+                kind: NodeKind::FailureMode,
+                stub_name: "TeOne".into(),
+                title: "top \"quoted\"".into(),
+                diagram: "d.puml".into(),
+                line: 4,
+                failure_modes: vec!["Lib.A".into(), "Other.B".into()],
+                fta_failure_modes: vec![],
+            },
+            StubEvent {
+                kind: NodeKind::RootCause,
+                stub_name: "BeOne".into(),
+                title: "root cause".into(),
+                diagram: "d.puml".into(),
+                line: 8,
+                failure_modes: vec![],
+                fta_failure_modes: vec!["TeOne".into()],
+            },
+        ];
+        let out = render_trlc_stub("MyFta", &events);
+        assert!(out.contains("package MyFta"));
+        assert!(out.contains("import ScoreReq"));
+        assert!(out.contains("import Lib"));
+        assert!(out.contains("import Other"));
+        assert!(out.contains("ScoreReq.FtaFailureMode TeOne {"));
+        assert!(out.contains("failure_modes = [Lib.A, Other.B]"));
+        assert!(out.contains("top \\\"quoted\\\""));
+        assert!(out.contains("ScoreReq.RootCause BeOne {"));
+        assert!(out.contains("failure_modes = [TeOne]"));
+        assert!(out.contains("// d.puml:4"));
     }
 }
diff --git a/plantuml/parser/puml_idmap/src/lib.rs b/plantuml/parser/puml_idmap/src/lib.rs
index 46b1c293..ed105fdb 100644
--- a/plantuml/parser/puml_idmap/src/lib.rs
+++ b/plantuml/parser/puml_idmap/src/lib.rs
@@ -341,12 +341,12 @@ fn is_trlc_fqn(alias: &str) -> bool {
 
 /// Produce an [`IdMapFile`] from a resolved FTA model.
 ///
-/// A node is a **define** when it is the tree's top event (`NodeKind::TopEvent`,
+/// A node is a **define** when it is the tree's failure mode (`NodeKind::FailureMode`,
 /// `connection` is `None` — a relation sink never used as a source).
 /// A gate node is a **reference** only when [`FtaNode::gate_kind`] is
 /// `GateKind::TransferIn` (a `$TransferInGate` pointing to another diagram's
-/// top event); `GateKind::And`/`GateKind::Or` gates are internal and produce
-/// no cross-diagram link. All other nodes (basic/intermediate events) are
+/// failure mode); `GateKind::And`/`GateKind::Or` gates are internal and produce
+/// no cross-diagram link. All other nodes (root-cause/intermediate events) are
 /// likewise internal.
 fn fta_model_to_idmap(model: &FtaModel, source: &str) -> IdMapFile {
     let mut defines = Vec::new();
@@ -354,7 +354,7 @@ fn fta_model_to_idmap(model: &FtaModel, source: &str) -> IdMapFile {
 
     for node in &model.nodes {
         match node.kind {
-            NodeKind::TopEvent => {
+            NodeKind::FailureMode => {
                 defines.push(IdMapEntry {
                     alias: node.alias.clone(),
                     id: node.alias.clone(),
@@ -374,7 +374,7 @@ fn fta_model_to_idmap(model: &FtaModel, source: &str) -> IdMapFile {
                     id: node.alias.clone(),
                 });
             }
-            _ => {} // BasicEvent, IntermediateEvent, $AndGate/$OrGate — internal, no link.
+            _ => {} // RootCause, IntermediateEvent, $AndGate/$OrGate — internal, no link.
         }
     }
 
@@ -1021,15 +1021,16 @@ mod tests {
             alias: alias.to_string(),
             connection: None,
             gate_kind,
+            failure_modes: Vec::new(),
             line: None,
         }
     }
 
     #[test]
-    fn fta_top_event_is_define_and_transfer_gate_is_reference() {
+    fn fta_failure_mode_is_define_and_transfer_gate_is_reference() {
         let model = FtaModel {
             nodes: vec![
-                fta_node(NodeKind::TopEvent, None, "pkg.TopFailure"),
+                fta_node(NodeKind::FailureMode, None, "pkg.TopFailure"),
                 // $TransferInGate: alias is a foreign top-event FQN → reference.
                 fta_node(
                     NodeKind::Gate,
@@ -1042,8 +1043,8 @@ mod tests {
                 // cross-diagram reference (regression test).
                 fta_node(NodeKind::Gate, Some(GateKind::And), "And.Gate1"),
                 fta_node(NodeKind::Gate, Some(GateKind::Or), "OG"),
-                // Basic events are internal even when the alias looks like an FQN.
-                fta_node(NodeKind::BasicEvent, None, "pkg.Cause"),
+                // Root causes are internal even when the alias looks like an FQN.
+                fta_node(NodeKind::RootCause, None, "pkg.Cause"),
                 fta_node(NodeKind::IntermediateEvent, None, "IE"),
             ],
         };
diff --git a/plantuml/sphinx/clickable_plantuml/README.md b/plantuml/sphinx/clickable_plantuml/README.md
index a564691c..beb1b224 100644
--- a/plantuml/sphinx/clickable_plantuml/README.md
+++ b/plantuml/sphinx/clickable_plantuml/README.md
@@ -173,14 +173,14 @@ Given the resolved model of one `.puml` diagram:
    - It has member variables or methods (class diagrams).
    - The diagram's `@startuml <name>` matches its alias or display name
      (component and class diagrams).
-   - It is a `$TopEvent` node — the tree root whose `connection` is `None`,
+   - It is a `$FailureMode` node — the tree root whose `connection` is `None`,
      never used as a relation source (FTA diagrams).
 2. **references** – Elements that link away to another diagram:
    - Top-level leaf boxes and relation endpoints (component diagrams).
    - All participants (sequence diagrams — no defines in sequence).
    - `$TransferInGate` nodes whose alias is a TRLC-style FQN
-     (`Package.Record`) referencing another diagram's top event (FTA diagrams).
-   - Internal FTA nodes (`$BasicEvent`, `$IntermediateEvent`, `$AndGate`,
+     (`Package.Record`) referencing another diagram's failure-mode node (FTA diagrams).
+   - Internal FTA nodes (`$RootCause`, `$IntermediateEvent`, `$AndGate`,
      `$OrGate`) are omitted — they do not cross-link to other diagrams.
 
 ### Concrete example