Ottava Reality

Ottava began as Verb Surgical, the 2015 Google-J&J joint venture intended to combine Alphabet's machine-learning capability with J&J's surgical-instrument and procedure expertise. J&J acquired full control of Verb around the end of 2019, integrated it into its Ethicon surgical business, and rebranded the platform as Ottava. The current architecture is a four-arm, table-integrated system intended to differentiate from da Vinci's cart-mounted topology on operating-room footprint, room-turnover time, and integration with existing Ethicon energy and stapling instruments, categories where J&J already owns the standard of care. The IDE study planned for 2025 marks the formal entry into the FDA pathway for general-surgery indications.

Monarch, sold by the Auris business and acquired into J&J's Ethicon-adjacent portfolio, addresses robotic bronchoscopy and is an established commercial endoluminal platform in pulmonology. Monarch is already in service; Ottava is approaching first-in-human general-surgery use. The two platforms share, at the architectural level, the same problem: a robotic system whose actuators apply force inside a living patient under the authority of a credentialed clinician, with autonomy boundaries that will move outward over the product lifetime under FDA's evolving Predetermined Change Control Plan (PCCP) framework.

Technical execution is on the way to maturity. The architectural element that is not yet articulated, in either platform's public posture, is how stage-gated surgical autonomy is decomposed, governed, and verified: not as an internal engineering convention, but as a structure the FDA, the credentialing surgeon, and the institution can audit.

Emerging Deployment Trajectory

The IDE-to-PMA pathway for general-surgery robotics is no longer a single-snapshot review. Under PCCP, FDA expects the manufacturer to declare, before clearance, the envelope of changes the device may make over its lifecycle without re-submission, together with the verification regime that bounds those changes. For a surgical robot, the most consequential changes will be expansions of assistive automation: a knot-tying assist, a tissue-retraction assist, a suturing assist, each of which moves a slice of actuation authority from the surgeon to the platform under a defined activation condition.

Each of those expansions is a governed-actuation problem, not a perception problem. The question is not whether the system can identify a suture line; the question is what mode the actuation is in when it pulls on that line, what consequences the mode authorizes, what the surgeon's authority is over the commitment, and what the post-actuation record looks like. Without an architectural substrate that names those modes and produces those records, every PCCP expansion is litigated case-by-case rather than admitted under a declared envelope.

Architectural Fit and Composition

Governed actuation supplies the same primitives in the surgical context that it supplies in the autonomous-vehicle context, with the actuator surface remapped from a surgical-tool actuator, which the disclosure names explicitly, in place of a steering or braking actuator. The graduated-actuation mode selector decomposes the platform's authority across the disclosed modes, from advisory (the platform records what actuation it would have taken without physically executing it) through consultative (the platform emits a confirmation request to the surgeon and awaits confirmation before execution), constrained (execution subject to magnitude, rate, or scope limits), and stage-gated (execution in a sequence of stages with admissibility re-evaluation between stages, enabling interruption before the next stage). Each mode carries declared activation conditions and, through the reversibility-aware commitment-point evaluator, an explicit classification of which stage is the point beyond which the actuation becomes irreversible. The harm-minimization deviation mechanism selects the actuation path that minimizes composite projected harm when no available path avoids all harm, and de-escalates the selected mode when a newly consumed observation lowers admissibility mid-execution. Post-actuation verification produces a per-commitment lineage artifact, recording the inputs, the mode selected, the commitment-point transit, and the observed-versus-expected effect, that the institution's quality program, the surgeon's credentialing file, and the PCCP review can each consume.

Composition across Ottava and Monarch matters. The two platforms address different anatomical domains but share a common surgeon-authority abstraction. A governed-actuation substrate declared at the J&J Medical Devices level, rather than at the individual-platform level, lets Ottava's general-surgery autonomy expansions and Monarch's endoluminal autonomy expansions land under a common governance vocabulary that FDA can read once and apply twice. That is the cross-platform leverage J&J has and that platform-only competitors do not.

The Ethicon instrument portfolio adds a third axis. Energy devices and staplers carry their own actuation envelopes, clamp force, jaw temperature, fire timing, that today are governed by device-internal logic. Treating those envelopes as participants in the same governed-actuation substrate, rather than as black-box subsystems, lets the platform reason about combined commitments (apply energy then fire stapler then release tissue) as a single decomposable sequence rather than as three opaque events.

J&J Position

With governed actuation as a declared substrate across Ottava, Monarch, and the Ethicon instrument line, J&J gains architectural alignment with the FDA's PCCP regulatory direction rather than chasing it. Ottava enters the IDE study with a governance posture that anticipates the autonomy expansions the product will pursue post-clearance, rather than constraining itself to a static-device review and re-opening the file at each expansion. Monarch's installed base contributes verification artifacts back into the same substrate, accelerating the empirical case for cross-platform autonomy moves.

The institutional adoption case is just as load-bearing as the regulatory case. Health systems evaluating a new robotic platform ask, in addition to the clinical-evidence question, what governance machinery the platform brings to the institution's quality and credentialing programs. A platform whose every commitment produces an auditable, mode-tagged artifact integrates into a hospital's Morbidity and Mortality conference, its surgeon credentialing file, and its risk-management program with materially less custom integration than a platform that produces only event logs. That is an adoption-friction reduction at exactly the moment Ottava is asking institutions to make a multi-year capital commitment against an installed competitor.

The strategic position improves against Intuitive not on raw capability, that race is decades long, but on the architectural posture under which the next decade of capability will be admitted by regulators and adopted by institutions. That posture is what governed actuation provides, and it is what the public posture has so far left underspecified.

Building It

A skilled implementer can construct this substrate on top of an existing surgical-robotics stack without redesigning the manipulator. The disclosure treats every surgical-tool actuator as a governed mutation: a proposed actuation, specifying an actuator, a command, and parameters, is submitted to a composite admissibility evaluator rather than driven directly. The evaluator ingests credentialed observations (surgeon authority, instrument-envelope state, forecast and dispositional inputs) and returns one of a bounded set of outcomes: admit, gate (permit under added constraints), defer (hold pending corroboration, with an expiration), solicit (actively query for missing observations), reject (with a reason class such as insufficient authority, stale observation, or capability-envelope incompatibility), or escalate. The outcome drives the graduated-actuation mode selector, which maps admissibility to a mode on the continuum from disabled through advisory, consultative, constrained, stage-gated, and full, rather than a binary permit-or-deny.

Embodiments and variations a builder can enumerate from the disclosure: mode sets tuned per actuator class (a monopolar energy actuator gated more tightly than a retraction actuator); confidence thresholds modulated by a depleted capability envelope or elevated dispositional readings so that an instrument operating outside nominal conditions requires higher admissibility for full mode; reversibility classes (reversible, partially reversible, irreversible, time-bounded, condition-bounded, composite) that raise thresholds for irreversible sub-steps and prefer late-commitment, stage-gated execution of composite actions such as apply-energy then fire-stapler then release; emergency preemption bounded by a per-authority preemption budget and an expiration, so an override authority cannot be exercised without rate limit or after its window; and a lineage record of every evaluation, mode selection, preemption, commitment-point transit, and verification outcome. The primitive is disclosed as substrate-agnostic, modality-agnostic, and domain-agnostic, so the same construction applies across the Ottava, Monarch, and Ethicon instrument surfaces and to any other actuated effector.

Disclosure Scope

The invention described here, governed actuation as a composite-admissibility-gated, reversibility-aware, lineage-recorded actuation substrate, is disclosed in U.S. Provisional Application No. 64/049,409. The mechanisms attributed to the invention (the composite admissibility evaluator and its admit/gate/defer/solicit/reject/escalate outcomes, graduated actuation modes, reversibility-aware commitment-point evaluation, preemption budgets, harm-minimization deviation, and actuation provenance) trace to that filing.

References to Johnson & Johnson, Ottava, Verb Surgical, Monarch, Auris, Ethicon, Intuitive Surgical, da Vinci, and to FDA regulatory frameworks including the IDE pathway and the Predetermined Change Control Plan are provided as external market and regulatory context, described from public information, and are not claims of the filing. Product names and marks belong to their respective owners. Nothing here asserts a specific capability, certification, clearance, contract, or incident of any named product beyond what is publicly reported; the comparison is scoped to the architectural axis, composite admissibility, reversibility-aware commitment, and governed revocable actuation, that the provisional application provides.