System

{{entity:Surgical Robot System}} ({{hex:D4ED3019}}), interim QC pass triggered at session 359 — four sessions since the last QC at session 355. The project now holds 272 requirements across 6 documents, with 240 trace links and baseline {{stk:BL-SESURGICALROBOT-016}} created at session close. Decomposition status remains in-progress, consistent with interim QC scope.

Findings

Lint reported 106 findings across the project, with the three highest-priority issues all pointing to the same structural gap: the {{entity:Kinematics Engine}} ({{hex:41F53309}}), {{entity:Trajectory Generator}} ({{hex:41F53B08}}), and {{entity:Real-Time Protocol Engine}} ({{hex:50B57B08}}) are all classified as purely digital/virtual components but carried no cybersecurity requirements. These three components sit on the critical motion-control path — the pipeline that translates surgeon hand motion to joint servo commands — and digital components on a safety-critical pipeline without authentication or integrity checking represent an unacceptable gap for a surgical system operating under IEC 62304 and IEC 62443.

Two additional structural issues emerged: {{stk:ARC-MAIN-015}}, {{stk:ARC-MAIN-016}}, and {{stk:ARC-MAIN-017}} were near-identical architecture decision records all documenting the FPGA/algorithm layer separation for the Motion Control System, and all three lacked a verification method. Four ARC requirements ({{stk:ARC-MAIN-015}}, {{stk:ARC-MAIN-016}}, {{stk:ARC-MAIN-017}}, {{stk:ARC-MAIN-018}}) were orphaned with no trace links.

Spray pattern check identified {{sys:SYS-MAIN-002}} with 19 outbound links, all lacking link rationale. The links were reviewed individually — {{sys:SYS-MAIN-002}} is the single-point-failure safe-state requirement and legitimately cascades across every subsystem — but the linkset requires rationale documentation, left as residual for the next QC pass.

Verification count: 3/272 requirements (all ARC) were missing a verification method. Missing rationale: 0/272. Missing verification on SUB+IFC: 0 (verified gate passed).

Corrections

Duplicate ARC purge: {{stk:ARC-MAIN-016}} and {{stk:ARC-MAIN-017}} duplicated {{stk:ARC-MAIN-015}} verbatim. Neither carried trace links. Both were tagged and deleted. {{stk:ARC-MAIN-015}} received Inspection verification, as did the deleted entries before removal.

Cybersecurity requirements — three new entries ({{sub:REQ-SESURGICALROBOT-029}}, {{sub:REQ-SESURGICALROBOT-030}}, {{sub:REQ-SESURGICALROBOT-031}}):

• {{entity:Kinematics Engine}}: HMAC-SHA256 per-frame authentication on joint-space command inputs, with 1ms rejection window matching the 1kHz servo rate and mandatory logging to the {{entity:Procedure Data Recorder}}.
• {{entity:Trajectory Generator}}: RSA-2048 signed workspace envelope loaded from write-protected memory at startup, with per-waypoint validation before trajectory generation and controlled stop within 50ms on rejection.
• {{entity:Real-Time Protocol Engine}}: IEEE 1588v2 PTP with HMAC-SHA256 MAC authentication, discarding unauthenticated sync frames and entering safe hold state within 10ms when authenticated timing is unavailable.

All three requirements trace to {{sys:SYS-MAIN-002}} — which lists software exceptions and communication loss as failure modes requiring safe state within 250ms — with distinct rationale on each link explaining the specific attack vector being closed.

Three verification procedures ({{stk:REQ-SESURGICALROBOT-032}}, {{stk:REQ-SESURGICALROBOT-033}}, {{stk:REQ-SESURGICALROBOT-034}}) were created, each with full injection test descriptions at operational rates.

Orphaned ARC links: {{stk:ARC-MAIN-015}} linked to {{sys:SYS-MAIN-002}} (FPGA watchdog implements 250ms safe-state); {{stk:ARC-MAIN-018}} linked to {{sys:SYS-MAIN-001}} (linear pipeline topology chosen to meet 1ms end-to-end latency budget — distributed alternative rejected at 0.2-0.4ms per IPC hop).

Decomposition

flowchart TB
  n0["Tremor Rejection Filter"]
  n1["Motion Scaling Module"]
  n2["Kinematics Engine"]
  n3["Workspace Safety Enforcer"]
  n4["Joint Servo Controller"]
  n5["Real-Time Compute Node"]
  n6(["Surgeon Console"])
  n7["Patient-Side Cart"]
  n8["Trajectory Generator"]
  n6 -->|6-DOF vel cmds 1kHz| n0
  n0 -->|filtered vel 1kHz| n1
  n2 -->|joint setpoints| n3
  n3 -->|validated cmds| n4
  n4 -->|CAN-FD 5Mbps| n7
  n3 -->|fault signal| n5
  n5 -->|heartbeat 200Hz| n0
  n1 -->|scaled velocity 1kHz| n8
  n8 -->|Cartesian poses 1kHz| n2

Residual

{{sys:SYS-MAIN-002}} spray pattern (19 outbound links, all missing link rationale) was inspected and found to be architecturally justified — every subsystem participates in the 250ms safe-state budget — but adding rationale to 19 existing links exceeded this session’s budget. Flagged for the next QC pass. The ontological mismatch findings for {{entity:Procedure Data Recorder}} and {{entity:motion control}} (physical constraints without Physical Object trait) were noted but are low-severity and do not block progress.

Next

Full-pass QC will be triggered when DECOMPOSITION_STATUS reaches first-pass-complete. Before that, the next decomposition session should address the DECOMP_TARGET: verifying Haptic, Power, Instrument, and Safety-Interlock subsystem coverage for any remaining component gaps, then mark status to first-pass-complete to initiate full QC.