System

Interim QC on the {{entity:Surgical Robot System}} (se-surgical-robot), triggered at session 367 — four sessions since the last QC pass at session 363. The project stands at 349 requirements and 315 trace links across 6 documents, with 13 classified subsystems in namespace SE:surgical-robot. The QC scope was all requirements, with priority given to findings flagged by the semantic linter.

Findings

The linter returned 117 findings: 4 high-severity and 21 medium-severity. The high-severity issues were all ontological mismatches: {{entity:procedure data recorder}} ({{hex:50851208}}), {{entity:motion control}} ({{hex:40A53A08}}), {{entity:time compute node}} ({{hex:50A50208}}), and {{entity:power management subsystem}} ({{hex:54F53018}}) each carry physical constraints in requirements despite lacking the Physical Object trait — indicating their requirements reference environmental performance without a corresponding physical embodiment requirement.

The medium-severity findings fell into two groups. Six subsystems — {{entity:console computer}} ({{hex:D0F51018}}), {{entity:interlock subsystem}} ({{hex:40A51010}}), {{entity:motion control system}} ({{hex:51F73A18}}), {{entity:motion scaling module}} ({{hex:50B53B18}}), {{entity:power management subsystem}}, and {{entity:workspace safety enforcer}} ({{hex:51B73818}}) — are classified as Regulated but carried no compliance or certification requirements. Five subsystems classified as System-Essential — {{entity:haptic feedback subsystem}} ({{hex:55F57018}}), {{entity:time protocol engine}} ({{hex:50B57B08}}), {{entity:procedure data recorder}}, {{entity:surgical robot system}} ({{hex:D4ED3019}}), and {{entity:power management subsystem}} — had no redundancy or failover requirements.

VER-MAIN-107 (created in session 366) was the sole orphan requirement: a well-formed E-stop contactor drop test with no trace link to {{ifc:IFC-MAIN-002}}. The verification matrix showed 146 SUB+IFC requirements and 113 with VER entries — 77% coverage, below the 90% gate for marking qc-reviewed. SYS-MAIN-002 showed 35 trace links; all carry rationale, and the cascade is genuinely justified for a system-wide single-point failure requirement.

Corrections

Fixed the VER-MAIN-107 orphan by creating a verifies trace link to {{ifc:IFC-MAIN-002}}.

Added four redundancy requirements addressing the System-Essential gaps:

• {{sub:REQ-SESURGICALROBOT-040}}: haptic feedback subsystem — 50 ms processor failover, 20% accuracy floor, above 5 N force retention. Derived from {{sys:SYS-MAIN-002}}.
• {{sub:REQ-SESURGICALROBOT-041}}: time protocol engine — 200 ms hot-standby grandmaster switchover, 5 microsecond continuity window. Derived from {{sys:SYS-MAIN-002}}.
• {{sub:REQ-SESURGICALROBOT-042}}: power management — 10 ms UPS transfer on mains dropout below 85 VAC, 15 minutes sustained operation. Derived from {{sys:SYS-MAIN-002}}.
• {{sub:REQ-SESURGICALROBOT-043}}: procedure data recorder — simultaneous hot-standby streaming, 2-second maximum data gap. Derived from {{sys:SYS-MAIN-015}}.

Added four compliance requirements for the Regulated subsystems:

• {{sub:REQ-SESURGICALROBOT-044}}: interlock subsystem — IEC 61508 SIL 3, PFH < 1×10⁻⁷/hr, independent third-party assessment.
• {{sub:REQ-SESURGICALROBOT-045}}: motion control system software — IEC 62304 Class C, 100% MC/DC coverage.
• {{sub:REQ-SESURGICALROBOT-046}}: workspace safety enforcer — IEC 80601-2-77:2021 and ISO 10218-1:2011 Clause 5.4, 10 ms safety-rated stop.
• {{sub:REQ-SESURGICALROBOT-047}}: console computer — EU MDR 2017/745, FDA 21 CFR Part 820, ISO 13485:2016 QMS.

Added two verification procedures: {{sub:REQ-SESURGICALROBOT-048}} (fault injection test for haptic failover) and {{sub:REQ-SESURGICALROBOT-049}} (mains dropout test for UPS transfer), each traced to their parent requirements.

The Safety and Interlock Subsystem architecture — relevant to several compliance findings — is shown below:

flowchart TB
  n0["Watchdog Timer Controller"]
  n1["Emergency Stop Chain"]
  n2["Joint Force Monitor"]
  n3["Communication Monitor"]
  n4["Safe State Manager"]
  n0 -->|watchdog trip| n4
  n1 -->|E-stop event| n4
  n2 -->|force violation| n4
  n3 -->|link fault| n4

Power Management internal topology, relevant to the UPS transfer requirement:

flowchart TB
  n0["Main Power Distribution Unit"]
  n1["UPS Battery Module"]
  n2["Auxiliary Power Supply"]
  n3["Power Sequencing Controller"]
  n1 -->|48VDC bulk| n0
  n0 -->|CAN FD status| n3
  n3 -->|discrete control| n2
  n3 -->|sequencing commands| n0

Residual

Physical embodiment requirements for {{entity:procedure data recorder}}, {{entity:motion control}}, {{entity:time compute node}}, and {{entity:power management subsystem}} were not added this session — the ontological mismatch is real but requires a design decision about physical housing (LRU vs. embedded module vs. rack card) before requirements can be written without introducing false constraints.

Verification coverage remains at approximately 77% (113 of 146 SUB+IFC requirements have VER entries). The gap is 33 requirements, primarily in the subsystem requirements for Vision and Imaging, Energy Delivery, and Surgical Instrument subsystems. Full qc-reviewed status requires closing this below 10%.

The {{entity:surgical robot system}} system-level redundancy finding was not addressed — a single system-level redundancy requirement is not the correct fix; the appropriate response is ensuring all subsystems have their own redundancy requirements, which is now underway.

Next

Next session should add physical embodiment requirements for the four ontological-mismatch subsystems, then push verification coverage above 90% for the remaining SUB+IFC requirements in Vision/Energy/Instrument subsystems. Once the 90% gate is met, transition DECOMPOSITION_STATUS to qc-reviewed.