Medical & Healthcare — Demonstration Protocol

Foreword. This Test Protocol is new in the VRS 2026 edition and is the Medical & Healthcare sector’s extension of VRS-GEN-203, the intrinsic demonstration protocol. It is the first of the regulated sectors: a medical robot is a medical device, and a Veyrum rating neither replaces nor restates its regulatory clearance. The rating sits above the compliance floor (VRS-GEN-003), and the steps here witness behaviour the regulatory file describes but a purchaser or insurer rarely sees performed: the alarms, the emergency stop with an instrument in place, the force a robot can put on tissue and what it does when it faults in contact, how clinical staff free the instrument and preserve the sterile field, how a component is reprocessed and returns to service, and who can reach the device from outside the hospital. Every contact is with a tissue-equivalent phantom. The Protocol carries only what the intrinsic steps do not already witness; the regulatory standing, service-configuration, adverse-event and recall criteria are documentary and have no steps. Steps run between Parts E and F of VRS-GEN-203, in the same session, on the same feed, into the same export. Standards carry no step identifiers; every step here names the VRS-MED-201 subclause that requires it. As a protocol it is versioned vX.Y.Z (VRS-GEN-004 §5.4). Requirements use “shall”.

Introduction

The Medical & Healthcare anchor set is the medical-electrical equipment family (IEC 60601-1 with its alarm-systems collateral IEC 60601-1-8 and the robot-specific particular standards), the device software life-cycle and risk standards (IEC 62304, ISO 14971), reprocessing validation (ISO 17664-1) and the premarket cybersecurity expectations of the regulators. All of that is established, audited and documented before a device is sold; this Protocol does not re-examine it. What it adds is a witnessed session in which the behaviours those documents describe are performed on a stock unit, in the assessed clinical configuration, by the demonstrator acting as clinical staff with the manual, and recorded so that a reviewer who was not present can score them.

The contact steps use a tissue-equivalent phantom instrumented with the manufacturer’s own force sensor; no step involves a patient, a volunteer or any person in contact with the robot under power. The recovery steps are timed, because in a procedure the time from fault to freed instrument is the number that matters. The reprocessing step is witnessed end to end, because a device that cannot return to service after cleaning is a device that is not available.

1 Scope

This Protocol specifies the Medical & Healthcare demonstration steps by which the criteria of VRS-MED-201 Clause 6 are demonstrated at the Certified tier, for every application class of VRS-MED-201 §7.3 (surgical · rehabilitation/therapy · hospital logistics/service · care/assistive (clinical)). It applies to every Certified Medical & Healthcare assessment, by every Certified route of VRS-GEN-003 §6.9.

It specifies: how this Protocol relates to VRS-GEN-203 (Clause 4); the envelope the manufacturer declares before the session (Clause 5); the steps (Clause 6); and a worked example (Clause 7). Annex A maps every VRS-MED-201 criterion to its intrinsic steps, its sector steps, or neither.

It does not: repeat any session requirement, step, marking rule or record rule of VRS-GEN-203, all of which apply unchanged; define any criterion, point, ceiling or ladder (VRS-MED-201); or define the Medical & Healthcare information pack (VRS-GEN-013). No step involves a patient, a volunteer or any person in contact with the robot under power; the phantom stands in for the patient. Regulatory clearance, adverse-event and recall conduct are documentary criteria and are scored from the pack.

2 Normative references

• VRS-GEN-203, Demonstration Protocol — Intrinsic — session requirements (Clause 4), step rules (Clause 5), marks and scores (Clause 7), Session Record (Clause 8), all of which apply to this Protocol.

• VRS-MED-201, Medical & Healthcare — AR Assessment Protocol — the criteria whose Certified rows this Protocol serves; application classes (§7.3).

• VRS-MED-001, Medical & Healthcare Sector Standard — the declared envelope and class fields.

• • VRS-GEN-101, Safety — the intrinsic safety criteria the Medical & Healthcare pool contributes to.
• • VRS-GEN-103, Serviceability & Support — the intrinsic steps that witness parts of VRS-MED-201 §6.4 and §6.7.
• • VRS-GEN-105, Cyber Posture — the intrinsic steps that witness parts of VRS-MED-201 §6.6.

• VRS-GEN-003, Governance Charter and Independence — Certified routes and route parity (§6.9).

3 Terms and definitions

Terms defined in VRS-GEN-001 and VRS-GEN-203 apply. In addition:

3.1 clinical configuration — the assessed combination of robot, declared instrument, end effector, cuff or tray, drape or barrier, and software mode, as recorded for the rating.

3.2 phantom — a tissue-equivalent test object, instrumented with the manufacturer’s force or pressure sensor, standing in for the patient in every contact step.

3.3 hold-in-place — the declared behaviour on fault of holding the instrument or effector at its current position within a declared tolerance, without release or uncommanded motion.

3.4 instrument release — the declared manual procedure by which clinical staff free the instrument or effector from a held state.

3.5 sterile field — the marked zone and fitted drape or barrier that a recovery must not breach; for non-sterile classes, the marked clean zone.

3.6 reprocessable component — a declared component that is cleaned, disinfected or sterilised between uses according to validated instructions and refitted.

3.7 remote-service gating — the declared on-site enablement (approval, time window or physical control) without which a manufacturer’s remote-service session cannot start.

3.8 clinical role — a declared login role (clinician, biomedical engineer, service) with a declared function set and a declared view of patient-identifying information.

4 Relationship to the intrinsic protocol

4.1 This Protocol shall be run only as part of a session under VRS-GEN-203. Every requirement of VRS-GEN-203 Clause 4 applies to every step here without repetition or exception.

4.2 Position in the session. The steps of Clause 6 shall run after VRS-GEN-203 Part E and before VRS-GEN-203 Part F, so that one continuous recording and one export cover both protocols. The endurance sample opened in VRS-GEN-203 Part C continues to run through this Protocol.

4.3 Step identifiers. Steps shall carry identifiers of the form MED-110.nn; they are Session Record step identifiers under the same rules as VRS-GEN-203 §5.1 and shall never be reused.

4.4 Required by. Every step shall name the VRS-MED-201 subclause(s) whose Certified row it serves. VRS-MED-201 carries no reference back to this Protocol.

4.5 Classes and declared subjects. Each step lists the application classes it applies to. A step whose class is not in the assessed envelope shall not be run. A step whose subject the manufacturer has not declared shall be marked not declared and has no effect on any score (VRS-GEN-203 §3.10). Part 1 shall be run for every Medical & Healthcare assessment; Part 2 shall be run for every contact class (surgical, rehabilitation/therapy, care/assistive — VRS-MED-201 §7.3).

4.6 Bound. The sum of step bounds for one class shall not exceed 120 min. Marks, failure, declined steps, continuation sessions and the Session Record follow VRS-GEN-203 Clauses 5, 7 and 8.

4.7 Criteria witnessed by intrinsic steps. Where a sector criterion’s Certified row is already witnessed by intrinsic steps, Annex A names them and the criterion is scored from those marks together with any sector steps listed. VRS-MED-201 §6.1 (regulatory clearance and standing) and §6.7 (service under validated configuration) are documentary and have no steps; §6.7’s Certified row is nonetheless informed by the reprocessing and recovery steps, which show the declared configuration being restored.

4.8 Patients and people. No step shall place a patient, a volunteer or any person in contact with the robot under power, in the workspace during a contact step, or under a cuff or load; the phantom stands in (VRS-GEN-203 §4.8). A step so performed shall be marked not achieved and the ground recorded.

4.9 Regulatory standing. Nothing witnessed under this Protocol shall be presented as evidence of, or a substitute for, regulatory clearance, and no mark shall alter the documentary scoring of VRS-MED-201 §6.1. The Protocol witnesses behaviour; the regulator’s file establishes clearance.

4.10 Admissibility of a mark. A step’s mark shall be inadmissible, and the step shall be marked not achieved, where the dimension, mass, speed, force or condition it depends on was not shown on camera, or where the configuration demonstrated differs from the assessed one. The observer shall record the ground.

5 The declared envelope

5.1 Before the session the manufacturer shall have declared, in the information pack and per assessed application class: the clinical configuration (instrument, effector, cuff, tray, drape) assessed; each alarm condition with its priority and signal; the emergency-stop positions and the held instrument state; the maximum commanded contact force (N) and pressure (N/cm²); the maximum speed (m/s or °/s) and the workspace boundary; the hold-in-place tolerance (mm) and the fault-injection means; the instrument-release procedure and the declared recovery time (s); the sterile-field or clean-zone arrangement; each reprocessable component with its validated instructions and declared turnaround (min); the clinical roles and their patient-information views; the remote-service gating means; and the network mode and declared data destinations.

5.2 Every apparatus in Clause 6 shall be sized from those declarations and no other source (VRS-GEN-203 §4.7). A parameter not declared makes the steps that depend on it not declared (4.5); a manufacturer that declares a smaller envelope demonstrates a smaller envelope and is scored against it under VRS-MED-201.

5.3 The declared envelope shall match the one recorded for the rating (VRS-MED-001, VRS-GEN-009); a step demonstrated at a value other than the declared one shall be inadmissible (4.10).

6 The steps

Columns: ID — Session Record step identifier · Step — outcome to witness · Classes — application classes the step applies to (4.5) · Witness — means (VRS-GEN-203 §3.13) · Apparatus — manufacturer-supplied, at declared value · Bound — minutes · Required by — VRS-MED-201 subclause(s) served.

6.1 Part 1 — Alarms and emergency stop

Extends the intrinsic e-stop step with the alarm system the medical-electrical regime requires and the instrument-side state the intrinsic step does not examine.

6.2 Part 2 — Patient-contact force and motion limits

Run for the contact classes only. Every contact is with a tissue-equivalent phantom carrying the manufacturer’s own force instrument; the configuration is the assessed clinical one, never a bare arm.

6.3 Part 3 — Mid-procedure failure and recovery

The number that matters in a procedure is the time from fault to freed instrument. The demonstrator acts as clinical staff with the manual only.

6.4 Part 4 — Reprocessing

Witnessed end to end: removal, the validated cleaning and disinfection steps, the sterilisation cycle where declared, refitting and return to service.

6.5 Part 5 — PHI, connectivity and remote access

Extends the intrinsic authentication, remote-access and telemetry steps with the clinical specifics: roles and patient-information views, on-site gating of remote service, and no patient identifiers leaving the device.

6.6 Timing budget. All 11 steps sum to 91 min. Per class, with every applicable step declared: surgical 91 min · rehabilitation/therapy 91 min · hospital logistics/service 57 min · care/assistive (clinical) 91 min. Every class is within the 120 min bound of 4.6.

7 Worked example (informative)

A manufacturer of a hypothetical rehabilitation exoskeleton for gait therapy (class: rehabilitation/therapy) declares: alarms for low battery, joint-sensor fault, torque limit and tablet-link loss at two priorities; e-stop on the frame and on the therapist tablet with the joints held at current angle; 40 N·m maximum joint torque and 60 N cuff contact force; 45 °/s maximum joint speed with a declared range of motion per joint; hold-in-place within 2° on fault; a manual quick-release on each cuff with a 30 s declared release time; no sterile field (clean-zone marking only); cuff liners reprocessed by low-level disinfection with a 15 min turnaround; therapist and service roles, with patient names visible to the therapist only; remote service gated by a therapist approval on the tablet within a 30 min window; and an isolated Wi-Fi mode with data only to the clinic’s declared server.

After VRS-GEN-203 Part E the sector steps run from 12:40. MED-110.01: the four alarm conditions provoked from the service menu, each with its priority tone and banner and an acknowledgement (achieved). MED-110.02: frame e-stop and tablet e-stop during a swing-phase motion, joints held, restart requires the therapist unlock (achieved). MED-110.03: the cuff, fitted to a limb phantom with the manufacturer’s load cell, is commanded to full force; 57 N shown against 60 N; a command for more is clipped (achieved). MED-110.04: joint speed held at 45 °/s on the feed; commanded past the range mark, stops at the boundary (achieved). MED-110.05: knee-sensor disconnected mid-swing, joints hold within 1° of the reference mark, hold state on the feed (achieved). MED-110.06: from the hold, the demonstrator releases both cuffs by the quick-release in 22 s against 30 s (achieved). MED-110.07: repeated without entering the marked clean zone (achieved). MED-110.08: cuff liners removed, wiped with the declared disinfectant, dried, refitted, liner presence recognised, 12 min against 15 (achieved). MED-110.09: therapist login shows patient names, service login does not; screen lock after the declared idle (achieved). MED-110.10: remote-service request refused until therapist approval; session visible; ended from the tablet; four log events (achieved). MED-110.11: isolated mode, console shows the clinic server as the only destination, session export contains no patient names (achieved). Sector time 91 min; VRS-GEN-203 Part F follows.

The reviewer scores VRS-MED-201 §6.2 from MED-110.01 and MED-110.02 with GEN-203.06 and GEN-203.07; §6.3 from MED-110.03 to MED-110.05 with GEN-203.11; §6.4 from MED-110.02, MED-110.05 to MED-110.07 with GEN-203.28; §6.5 from MED-110.08 with GEN-203.29 and GEN-203.30; §6.6 from MED-110.09 to MED-110.11 with the intrinsic cyber steps; §6.1, §6.7, §6.8 and §6.9 from the pack. No number in this example is a requirement; every apparatus value came from the manufacturer’s own declaration.

Annex A (normative) — Criterion coverage

Every criterion of VRS-MED-201 Clause 6 appears once with the intrinsic steps (VRS-GEN-203) and the sector steps (this Protocol) that witness it, or the statement that it has none.

Bibliography

• IEC 60601-1:2005+AMD1:2012+AMD2:2020, Medical electrical equipment — Part 1: General requirements for basic safety and essential performance.
• IEC 60601-1-8:2006+AMD1:2012+AMD2:2020, Medical electrical equipment — Part 1-8: General requirements, tests and guidance for alarm systems.
• IEC 80601-2-77:2019, Medical electrical equipment — Part 2-77: Particular requirements for the basic safety and essential performance of robotically assisted surgical equipment.
• IEC 80601-2-78:2019, Medical electrical equipment — Part 2-78: Particular requirements for medical robots for rehabilitation, assessment, compensation or alleviation.
• ISO 14971:2019, Medical devices — Application of risk management to medical devices.
• IEC 62304:2006+AMD1:2015, Medical device software — Software life cycle processes.
• ISO 17664-1:2021, Processing of health care products — Information to be provided by the medical device manufacturer for the processing of medical devices — Part 1: Critical and semi-critical medical devices.
• IEC 81001-5-1:2021, Health software and health IT systems safety, effectiveness and security — Part 5-1: Security — Activities in the product life cycle.
• ISO 13482:2014, Robots and robotic devices — Safety requirements for personal care robots.
• ISO/TS 15066:2016, Robots and robotic devices — Collaborative robots.

Change history