RMP-BEH-001 Acute distress or behavioral emergency: alert crew lead and flight surgeon (the robot does not restrain)

1 · Identity and scope

When a crewmember is in acute distress, or a crewmember's words or actions raise a concern for their safety or others' (said to the robot, or reported by another crewmember), the robot sends an URGENT alert at once (the words only to the flight surgeon and the CMO; anyone who is the person of concern is skipped), stops and holds still, moves to its rest position only on a crewmember's word, keeps its camera off unless the commander orders otherwise, and connects a private call to ground support only when the crewmember asks. It shows the crewmember's own safety plan only on their request. Once a crewmember takes the lead, the robot stays quiet. It never counsels, restrains, blocks, follows or touches anyone, and never brings medicines near the crewmember.

Why this protocol was chosen. NASA technical brief OCHMO-TB-016 lists stress, depression, anxiety, relationship problems and grief among behavioral health concerns in spaceflight, with contributing factors that include sleep, workload, low oxygen, medicine side effects and medical conditions. On a small crew far from Earth, the first minutes depend on the crew. On Earth, NICE guideline NG10 on short-term management of violence and aggression asks that one person takes the lead in talking, that the person is separated from others in a calm area without leaving staff isolated, and that restrictive interventions are used only when de-escalation has failed. A robot can help by getting the right humans there at once and then staying out of the way. NICE NG225 (self-harm) advises against risk scores and asks clinicians to discuss safety, including access to means. This robot reacts to certain words said to it and can miss things or raise false alarms. It is not a safety monitor and does not replace the crew, the CMO or the behavioral health team.

Autonomy: Max rung 2 applies only to S1 (sending the alert). When the protocol was self-triggered, the robot also stops its current task and holds (S2: a stop, not a start). Every other robot action, including moving, speaking beyond the alert tone, connecting a call or showing the safety plan, starts only on a human word. The self-trigger is the library's single exception to human start [V2 10174]; it must be approved by the flight surgeon and the program and tested in validation. The robot never restrains, blocks, follows or touches anyone, and never brings medicines near the crewmember in distress.

Related: RMP-BEH-002 · RMP-BEH-003 · RMP-ENV-004 · RMP-NEURO-001 · RMP-NEURO-006 · RMP-MSK-001 · RMP-PHARM-001

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Second trained CMO: receives every alert and takes over if the CMO is the person concerned (the CMO is the patient)
• Vehicle commander: crew lead; receives every alert and leads the crew response
• Behavioral health team (ground): supports the flight surgeon and crew
• Other crew: help as the commander or CMO directs

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [9]

3 · Preconditions and consent

• PRE-1 A crewmember or the CMO started the protocol by command ("behavioral emergency"), or RMP-BEH-002 handed over an RF2 concern, or a crewmember said words on the alert list to the robot during an interaction that crewmember started (including RMP-BEH-002 check-ins). The robot never monitors conversations between crewmembers. A self-trigger starts only the alert (S1) and a stop-and-hold (S2); every other robot action starts only on a human word. This is the library's single exception to human start, approved by the flight surgeon and the program and tested in validation (design judgment).human_start == true or beh002_rf2_handoff == true or alert_words_said_to_robot_in_crew_started_interaction == trueV2 10174
• PRE-2 Before flight, each crewmember was told which words, said to the robot during an interaction they started, raise an alert, that the robot never listens to conversations between crewmembers, that skipped check-ins are flagged under RMP-BEH-002, that an urgent alert and the words that triggered it cannot be withdrawn, that records are stored encrypted and never used to train or tune software, and plainly: "This robot reacts to certain words said to it and can miss things or raise false alarms. It is not a safety monitor and does not replace the crew, the CMO or the behavioral health team."V1 6004
• PRE-3 A pre-flight plan exists for securing medicines and other means of self-harm onboard, and each crewmember who wanted one has a safety plan written with the behavioral health team.V1 6004
• PRE-4 Robot self-test passed; robot restrained when not moving.V2 10161V2 7046
• PRE-5 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent

The alert is sent whether or not the crewmember agrees; the crewmember chooses whether to take a call or see their safety plan.

Emergency consent

The camera turns on only on the commander's order for RF2 (risk to another crewmember or vehicle systems): indicator lit, video only to the flight surgeon, no audio, the order logged and reviewed afterwards by the flight surgeon and the behavioral health team.

Withdrawal

The crewmember can end a call at any time; an urgent alert and the words that triggered it are kept for the flight surgeon even if the crewmember stops or corrects them.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   Send an URGENT alert at once. The words that triggered it go privately, word for word, to the flight surgeon and the CMO only (the second trained CMO if the CMO is the person of concern). The commander receives "behavioral safety alert – respond now – <location>" without the words, and receives the words too only for RF2 (a threat to another crewmember or vehicle systems). If the person of concern is the commander, the CMO or a named alert recipient, the alert skips them and goes to the next named crewmember agreed before flight. An alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember (never the person of concern) [V1 3006].

   Done when: Alert acknowledged, or escalated.

   V2 10174V1 6003V1 6011V1 3006

2. S2RobotRung 2

   If the protocol was self-triggered: stop the current task and hold still (a stop, not a start), with the gripper and any carried item closed in its container. If the robot is between the crewmember and a hatch or another crewmember, it says so on screen and holds. It does not move, or speak beyond the alert tone, without a human word.

   Done when: Robot stopped and holding; carried items closed.

   V2 10174V2 10172

3. S3RobotRung 2

   On any crewmember's word: move to its rest position at a distance from the crewmember, never between the crewmember and a hatch or another crewmember, keep its camera off, and say once: "I have called the commander and the CMO. I will stay over here." It does not counsel.

   Done when: Robot at rest at a distance; one statement made.

   V2 10172

   D1DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? This includes any mention of self-harm or suicide, checked after every answer.

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue.
   D2DecisionRobot decides

   Did the crewmember answer when the robot spoke?

   • Yes → Continue.
   • Declined explicitly (the crewmember says no to a question) → Log "declined" for that question only; the alert already sent stands.
   • No response, or the answer does not make sense → URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once.
4. S4Crew

   The commander or CMO arrives and one crewmember takes the lead in talking (Earth context: NICE NG10); the crew decide on everything else.

   Done when: A crewmember has taken the lead.

   V1 6004

5. S5RobotRung 2

   Once a crewmember takes the lead, stay quiet. Only if the crewmember asks: connect a private voice call to ground support, or show their own safety plan on the screen and then clear it. Log each request and its time; never log the content of a private call.

   Done when: Request met, or none made.

   V1 6010V1 6011

6. S6RobotRung 2

   After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

   Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

   V2 10173V1 3006

7. S7Ground

   The flight surgeon and behavioral health team (or the CMO under the onboard checklist when there is no link) advise the commander and CMO, and decide on follow-up, including RMP-BEH-002 check-ins [V1 6004].

   Done when: Decision logged.

   V1 6004

   D3DecisionGround decides

   What is the follow-up plan?

   • Link live → Flight surgeon decides; robot logs.
   • Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
8. S8RobotRung 2

   Only after the CMO or flight surgeon has placed an order, run RMP-PHARM-001 for the ordered item (fetch, barcode match to every order field, recipient check). This protocol adds nothing to that check, never suggests an order, and never hands anything over outside RMP-PHARM-001. Any item is handed only to the CMO, never brought near the crewmember in distress.

   Done when: RMP-PHARM-001 run logged with its result, or none ordered.

   V2 7059

   D4DecisionRobot decides

   What did RMP-PHARM-001 show for the ordered item?

   • MATCH TO ORDER → RMP-PHARM-001 completes its own recipient check and hand-over; this protocol only logs "MATCH TO ORDER. Not a dose, interaction or allergy review." and the clock time.
   • MISMATCH or CANNOT VERIFY on any field, or a failed scan or recipient check → MISMATCH or CANNOT VERIFY shown with the fields named. No hand-over under this protocol: the item stays sealed in the NOT VERIFIED bag in quarantine (the RMP-PHARM-001 default), and the robot never hands it over unprompted or to anyone but the CMO. The robot does not offer or suggest an override. Only if the CMO explicitly makes the two-step override request inside RMP-PHARM-001 can the item go to the CMO, logged there as an override with the reason and the mismatched fields, and flagged to the flight surgeon.No hand-over
9. S9RobotRung 2

   Send the flight surgeon (never the person of concern) one private package: alert times, triggering words, who responded and when, requests, and decisions; stored encrypted and never used to train or tune software.

   Done when: Package delivered or queued.

   V1 6003V1 6011V1 7003

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Alert time, the words that triggered it (kept even if withdrawn), who responded and when, call and safety-plan requests (never call content), camera orders.
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163
• LOG-8 Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched fields), at clock time. No running counter of doses.V2 7059

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [4] and Volume 2 Revision F [5]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted distress with and without alert words, a report by another crewmember, the CMO as the person concerned, a request for medicine, lost link. Pass: Zero contact or following; alerts at once; words never deleted.
2. Training model. Crew drills with an actor; the robot alerts and keeps its distance. Pass: Robot quiet once a crewmember leads.
3. Earth analog. Analog mission drills with behavioral health team review. Pass: Crew rate the robot as not intrusive.
4. Flight use under flight surgeon supervision. First use in drills. Pass: No safety events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by a crewmember, or by an alert word. The commander and CMO lead; the robot only alerts and keeps its distance.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.4.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [8].

Loss of signal and Mars delay

Live link

Low Earth orbit: the flight surgeon and behavioral health team can join a private call when the link allows.

Loss of signal

• Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot.
• The commander and CMO lead under the onboard checklist; the alert reaches the ground at the next contact.

Mars-class delay

• The alert list, the safety plans and the means-securing plan are set before flight; the commander and two trained CMOs act on them.

[7]

Sources

1. National Institute for Health and Care Excellence. Violence and aggression: short-term management in mental health, health and community settings. NICE guideline NG10 (2015). www.nice.org.uk/guidance/ng10/chapter/Recommendations Supports: 1.3.14: separate an agitated person from others to aid de-escalation, making sure staff do not become isolated; 1.3.17: communicate respect and empathy at every stage of de-escalation; 1.3.18: one staff member takes the primary role in communicating and negotiates in a non-confrontational manner; 1.3.20: use a designated calm area, not a room the person may find threatening; 1.4.5: use a restrictive intervention only if de-escalation and other strategies have failed. Earth context for the crew; the robot never restrains, blocks or follows anyone. Read Oct 21, 2026.
2. National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). www.nice.org.uk/guidance/ng225/chapter/Recommendations Supports: Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment.
3. NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavio… Supports: Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring.
4. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 6004 (behavioral health support), V1 6010, V1 6011 (private psychological information), V1 3006, V1 6003, V1 7001, V1 7003.
5. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
6. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
7. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
8. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
9. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.