Steel, electronics and Class C software in one tree.
One regulator judges the whole machine, so the whole machine lives in one graph: the software safety class falls out of the hardware risk, automatically.
| Assembly / part | Qty | Mass |
|---|---|---|
Robot-assisted platformSYS-001 | 388.70 kg | |
6-axis robotic armARM-100 | ×1 | 32.50 kg |
Mobile cartCART-110 | ×1 | 310.00 kg |
Optical navigation stationNAV-300 | ×1 | 46.00 kg |
Control workstationWKS-400 | ×1 | 0.00 kg |
Planning softwareSW-500 | ×1 | Class C |
Motion control softwareSW-510 | ×1 | Class C |
Confirmation softwareSW-520 | ×1 | Class B ≠ C |
Sterile instrument guideGUID-200 | ×1 | 0.12 kg |
The workstation reads 0.00 kg because its children are software. That is also why the roll-up and the declared mass disagree; see the limits below.
A reference workspace built on the structure of a real class of programme, not a customer deployment. Manufacturer, suppliers, hospital sites, clinicians and commercial names are removed. Every figure on this page is read off that live workspace.
Five trades, five tools, one regulator
One tree, and the numbers compute themselves
Safety class is argued, not derived
IEC 62304 asks what harm the software can cause. That severity lives in another tool, so the class gets set in a meeting and defended from memory.
The class is a consequence
Severity rises from the risks a module controls, and the class follows. A standing filter lists every module whose declared class disagrees. It found one.
No BOM holds a byte and a bracket
PLM parts have a mass and a supplier. Software has neither, so it leaves the BOM.
A 32 kg arm and a module are the same object
Both are components with a domain. Mass rolls up through mechanics, safety class through risk, in the same tree, with no bridge to maintain.
“Are we ready?” takes a week
Someone rebuilds a spreadsheet from four sources. By Monday it is wrong again, and nobody can say which line moved.
Readiness is a screen, not a report
Coverage, approvals, open changes and risks above threshold are computed from the tree. Nobody assembles them.
Harm sets severity, severity sets the software class
The models doing the work
Read it backwards and it answers an auditor
This module is Class C because of that harm.
Three risks, one typed column
A reviewer enters probability. Severity is read through to the harm; the index and the level follow.
| Risk | Severity | Probability | Risk index | Level |
|---|---|---|---|---|
| RSK-01 · Insertion along a deviated trajectory | 4 | 2 | 8 | ALARP |
| RSK-02 · Uncontrolled motion with needle engaged | 3 | 2 | 6 | ALARP |
| RSK-03 · Loss of patient tracking under EM noise | 2 | 3 | 6 | ALARP |
ƒ Risk index is computed by Koddex, not typed by anyone.
The module the graph disagreed with
Confirmation software
SW-520- Domain
- Software (IEC 62304)
- Version
- v3.2.1
- Allocated requirement
- Confirm trajectory before advance
- Max severity
- 4max(severity of the risks it controls)
- Declared 62304 class
- Class B
- Computed 62304 class
- Class Cseverity ≥ 3 → Class C
Three formulas do most of the work
Derived in public from the mechanical hazard, not decided in a room.
A permanent filter, not an audit. It currently returns one module.
388.70 kg from the leaves against 520.00 kg declared. Both on screen, which is the useful state.
Software sits in the BOM, under the station that runs it
| Assembly / part | Qty | Mass |
|---|---|---|
Robot-assisted platformSYS-001locked | 388.70 kg | |
6-axis robotic armARM-100locked | ×1 | 32.50 kg |
Mobile cartCART-110in review | ×1 | 310.00 kg |
Optical navigation stationNAV-300locked | ×1 | 46.00 kg |
Control workstationWKS-400locked | ×1 | 0.00 kg |
Planning softwareSW-500locked | ×1 | Class C |
Motion control softwareSW-510locked | ×1 | Class C |
Confirmation softwareSW-520in review | ×1 | Class B ≠ C |
Sterile instrument guideGUID-200in review | ×1 | 0.12 kg |
Patient marker crownREF-310locked | ×1 | 0.08 kg |
The workstation reads 0.00 kg because its children are software. That is also why the roll-up and the declared mass disagree; see the limits below.
Four sites point at the design. None holds a copy
| Site | Region | Procedures | Status | Operated by |
|---|---|---|---|---|
| SITE-01 | Europe | 450 | In service since 2021 | Interventional radiology |
| SITE-02 | North America | 210 | In service since 2023 | Interventional radiology |
| SITE-03 | Europe | 12 | Installed, training running | Interventional radiology |
| SITE-04 | Europe | 0 | Installation planned, Q4 | To be confirmed |
“Which sites run a misclassified module?” is one traversal, not four phone calls.
What changed
| PLM + eQMS + risk sheet + ALM | One graph | |
|---|---|---|
| Where software lives | Outside the BOM | In the BOM, under its station |
| Justifying a 62304 class | Rebuilt by hand, years later | Derived, permanently |
| Finding a misclassified module | A review campaign, if anyone runs one | A filter that returns one item |
| Answering “are we ready” | A spreadsheet from four sources | A cockpit that computes nothing itself |
| A site asking what it runs | An export, stale on arrival | The same item R&D edits |
What this does not do
A roll-up only reflects its model
The workstation reads 0.00 kg because its only children are software, so the total lands at 388.70 kg against 520.00 kg declared. The graph shows the gap. It did not fix it.
A suggested class is not a justification
It flags that the declared class disagrees. The segregation argument and the software safety case a notified body will read are still yours to write.
This is a reference workspace
Not a customer deployment. No timeline, saving or audit outcome is claimed here, because none was measured.
Frequently asked questions
Can one tool hold a 310 kg cart and a software module?
They are the same object type: a component with a domain. Mass roll-ups return zero for software, risk roll-ups return a class for both.
How is the IEC 62304 class computed?
Each component takes the maximum severity of the risks its requirements control. Severity 3 or above suggests Class C. The declared class stays human, so the two can disagree.
We are a robotics team outside medtech. Does this transfer?
The medical standards are the vocabulary, not the shape. A performance level in machinery safety or a DAL in avionics is the same graph with other names.