Design for Interpretability: Meeting the Certification Challenge for Surgical Robots