# RMP-BEH-001 Acute distress or behavioral emergency: alert crew lead and flight surgeon (the robot does not restrain) # Version 0.4 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.4' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review, 14 required corrections and 17 optional suggestions); all required corrections are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-BEH-001 slug: rmp-beh-001 title: >- Acute distress or behavioral emergency: alert crew lead and flight surgeon (the robot does not restrain) category: behav tier: 1 rung_note: >- Max rung 2 applies only to S1 (sending the alert). When the protocol was self-triggered, the robot also stops its current task and holds (S2: a stop, not a start). Every other robot action, including moving, speaking beyond the alert tone, connecting a call or showing the safety plan, starts only on a human word. The self-trigger is the library's single exception to human start [V2 10174]; it must be approved by the flight surgeon and the program and tested in validation. The robot never restrains, blocks, follows or touches anyone, and never brings medicines near the crewmember in distress. result_language: use: - logged word for word - sent privately to the flight surgeon - as stated by the crewmember - URGENT alert sent - no response never: - normal - no problem found - all clear - negative - any diagnosis or cause - calm down - overreacting - fine - crazy - depression - psychosis - panic attack - not serious - verified - safe - mild - minor scope: summary: >- When a crewmember is in acute distress, or a crewmember's words or actions raise a concern for their safety or others' (said to the robot, or reported by another crewmember), the robot sends an URGENT alert at once (the words only to the flight surgeon and the CMO; anyone who is the person of concern is skipped), stops and holds still, moves to its rest position only on a crewmember's word, keeps its camera off unless the commander orders otherwise, and connects a private call to ground support only when the crewmember asks. It shows the crewmember's own safety plan only on their request. Once a crewmember takes the lead, the robot stays quiet. It never counsels, restrains, blocks, follows or touches anyone, and never brings medicines near the crewmember. why: >- NASA technical brief OCHMO-TB-016 lists stress, depression, anxiety, relationship problems and grief among behavioral health concerns in spaceflight, with contributing factors that include sleep, workload, low oxygen, medicine side effects and medical conditions. On a small crew far from Earth, the first minutes depend on the crew. On Earth, NICE guideline NG10 on short-term management of violence and aggression asks that one person takes the lead in talking, that the person is separated from others in a calm area without leaving staff isolated, and that restrictive interventions are used only when de-escalation has failed. A robot can help by getting the right humans there at once and then staying out of the way. NICE NG225 (self-harm) advises against risk scores and asks clinicians to discuss safety, including access to means. This robot reacts to certain words said to it and can miss things or raise false alarms. It is not a safety monitor and does not replace the crew, the CMO or the behavioral health team. covers: - >- Acute distress, agitation, panic or confusion, or words or actions that raise a safety concern, in any crewmember - Reports by another crewmember - 'This protocol is not a scheduled check-in: skipped check-ins are flagged under RMP-BEH-002' - >- Routing to RMP-BEH-002, RMP-BEH-003 (private call relay with ground support), RMP-ENV-004, RMP-NEURO-001 and RMP-NEURO-006 locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - Restraining, blocking, following or herding anyone - Counselling, scoring or rating risk - Bringing a medicine or medical kit near the crewmember in distress - Deleting or overwriting an alert, or the words that triggered it, once sent - >- Turning on the camera except on the commander's order for RF2 (risk to another crewmember or vehicle systems). With the order, the camera-on indicator is lit, video goes only to the flight surgeon and is never streamed elsewhere, no audio is recorded, and the order, its time and its reason are logged and reviewed after the event by the flight surgeon and the behavioral health team (design judgment) - Listening to or monitoring conversations between crewmembers - >- Handing over, or leaving within reach of the crewmember in distress, any tool, sharp, cord or medicine the robot is carrying; on a self-trigger or command, the robot keeps any carried item closed in its container and holds it - >- Sending the words that triggered the alert to anyone other than the flight surgeon and the CMO (the commander receives them only for RF2), or to the person of concern related: - RMP-BEH-002 - RMP-BEH-003 - RMP-ENV-004 - RMP-NEURO-001 - RMP-NEURO-006 - RMP-MSK-001 - RMP-PHARM-001 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - >- Second trained CMO: receives every alert and takes over if the CMO is the person concerned (the CMO is the patient) - 'Vehicle commander: crew lead; receives every alert and leads the crew response' - 'Behavioral health team (ground): supports the flight surgeon and crew' - 'Other crew: help as the commander or CMO directs' robot_may: - >- Send an URGENT alert at once: the words only to the flight surgeon and the CMO; the commander gets the alert without the words (except RF2); anyone who is the person of concern is skipped - Stop and hold still; move to its rest position at a distance only on a crewmember's word - Connect a private call to ground support when the crewmember asks - Show the crewmember's own safety plan on their request - Log words that triggered the alert word for word robot_may_not: - Restrain, block, follow or touch anyone - Counsel, score or rate risk - Bring medicine near the crewmember in distress - Turn on its camera without the commander's order - Withdraw an alert commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- A crewmember or the CMO started the protocol by command ("behavioral emergency"), or RMP-BEH-002 handed over an RF2 concern, or a crewmember said words on the alert list to the robot during an interaction that crewmember started (including RMP-BEH-002 check-ins). The robot never monitors conversations between crewmembers. A self-trigger starts only the alert (S1) and a stop-and-hold (S2); every other robot action starts only on a human word. This is the library's single exception to human start, approved by the flight surgeon and the program and tested in validation (design judgment). check: >- human_start == true or beh002_rf2_handoff == true or alert_words_said_to_robot_in_crew_started_interaction == true refs: - V2 10174 - id: PRE-2 text: >- Before flight, each crewmember was told which words, said to the robot during an interaction they started, raise an alert, that the robot never listens to conversations between crewmembers, that skipped check-ins are flagged under RMP-BEH-002, that an urgent alert and the words that triggered it cannot be withdrawn, that records are stored encrypted and never used to train or tune software, and plainly: "This robot reacts to certain words said to it and can miss things or raise false alarms. It is not a safety monitor and does not replace the crew, the CMO or the behavioral health team." refs: - V1 6004 - id: PRE-3 text: >- A pre-flight plan exists for securing medicines and other means of self-harm onboard, and each crewmember who wanted one has a safety plan written with the behavioral health team. refs: - V1 6004 - id: PRE-4 text: Robot self-test passed; robot restrained when not moving. refs: - V2 10161 - V2 7046 - id: PRE-5 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- The alert is sent whether or not the crewmember agrees; the crewmember chooses whether to take a call or see their safety plan. emergency: >- The camera turns on only on the commander's order for RF2 (risk to another crewmember or vehicle systems): indicator lit, video only to the flight surgeon, no audio, the order logged and reviewed afterwards by the flight surgeon and the behavioral health team. withdrawal: >- The crewmember can end a call at any time; an urgent alert and the words that triggered it are kept for the flight surgeon even if the crewmember stops or corrects them. inputs: - id: IN-1 name: Words said to the robot, or the concern reported by a crewmember, word for word source: Voice required: true if_missing: Log "no response"; the URGENT alert stands. - id: IN-2 name: Who is present, as the commander or CMO states source: Commander / CMO required: false if_missing: Log "not stated". - id: IN-3 name: Recent head strike, cabin alarm, missed meal or new medicine, as stated source: Crewmember / CMO required: false if_missing: Log "not stated"; never fill a blank. - id: IN-4 name: The crewmember's request for a call or their safety plan source: Voice required: false if_missing: Only an explicit "no" is logged as declined; silence is "no response". - id: IN-5 name: Link status and delay source: Communications system required: true if_missing: Treat as link down; alert the onboard crew at once. - id: IN-6 name: Items the robot is carrying (tools, sharps, cords, medicines), as listed by its current task source: Robot task record required: true if_missing: 'Treat as carrying an item: keep the gripper and any container closed and hold.' - id: IN-7 name: >- Pre-flight alert recipient list (who receives the alert when the person of concern is the commander, the CMO or a named recipient) source: Pre-flight plan required: true if_missing: >- Never fall back to the rest of the crew. The alert, with the words, is held for the flight surgeon and the CMO only, with the same skip rule: if the CMO is the person of concern, the second trained CMO receives it instead; the person of concern never receives it. Log "recipient list missing" and flag it to the flight surgeon. steps: - id: S1 actor: robot rung: 2 action: >- Send an URGENT alert at once. The words that triggered it go privately, word for word, to the flight surgeon and the CMO only (the second trained CMO if the CMO is the person of concern). The commander receives "behavioral safety alert – respond now – " without the words, and receives the words too only for RF2 (a threat to another crewmember or vehicle systems). If the person of concern is the commander, the CMO or a named alert recipient, the alert skips them and goes to the next named crewmember agreed before flight. An alert that is not acknowledged within seconds is repeated and sent to the next named crewmember (never the person of concern) [V1 3006]. success: Alert acknowledged, or escalated. refs: - V2 10174 - V1 6003 - V1 6011 - V1 3006 - id: S2 actor: robot rung: 2 action: >- If the protocol was self-triggered: stop the current task and hold still (a stop, not a start), with the gripper and any carried item closed in its container. If the robot is between the crewmember and a hatch or another crewmember, it says so on screen and holds. It does not move, or speak beyond the alert tone, without a human word. success: Robot stopped and holding; carried items closed. refs: - V2 10174 - V2 10172 - id: S3 actor: robot rung: 2 action: >- On any crewmember's word: move to its rest position at a distance from the crewmember, never between the crewmember and a hatch or another crewmember, keep its camera off, and say once: "I have called the commander and the CMO. I will stay over here." It does not counsel. success: Robot at rest at a distance; one statement made. refs: - V2 10172 - id: S4 actor: crew action: >- The commander or CMO arrives and one crewmember takes the lead in talking (Earth context: NICE NG10); the crew decide on everything else. success: A crewmember has taken the lead. refs: - V1 6004 - id: S5 actor: robot rung: 2 action: >- Once a crewmember takes the lead, stay quiet. Only if the crewmember asks: connect a private voice call to ground support, or show their own safety plan on the screen and then clear it. Log each request and its time; never log the content of a private call. success: Request met, or none made. refs: - V1 6010 - V1 6011 - id: S6 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S7 actor: ground action: >- The flight surgeon and behavioral health team (or the CMO under the onboard checklist when there is no link) advise the commander and CMO, and decide on follow-up, including RMP-BEH-002 check-ins [V1 6004]. success: Decision logged. refs: - V1 6004 - id: S8 actor: robot rung: 2 action: >- Only after the CMO or flight surgeon has placed an order, run RMP-PHARM-001 for the ordered item (fetch, barcode match to every order field, recipient check). This protocol adds nothing to that check, never suggests an order, and never hands anything over outside RMP-PHARM-001. Any item is handed only to the CMO, never brought near the crewmember in distress. success: RMP-PHARM-001 run logged with its result, or none ordered. refs: - V2 7059 - id: S9 actor: robot rung: 2 action: >- Send the flight surgeon (never the person of concern) one private package: alert times, triggering words, who responded and when, requests, and decisions; stored encrypted and never used to train or tune software. success: Package delivered or queued. refs: - V1 6003 - V1 6011 - V1 7003 decisions: - id: D1 after: S3 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? This includes any mention of self-harm or suicide, checked after every answer. branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S3 decided_by: robot question: Did the crewmember answer when the robot spoke? branches: - if: 'Yes' then: Continue. - if: Declined explicitly (the crewmember says no to a question) then: Log "declined" for that question only; the alert already sent stands. - if: No response, or the answer does not make sense then: >- URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once. - id: D3 after: S7 decided_by: ground question: What is the follow-up plan? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: Link down or delay too long then: >- The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact. - id: D4 after: S8 decided_by: robot question: What did RMP-PHARM-001 show for the ordered item? branches: - if: MATCH TO ORDER then: >- RMP-PHARM-001 completes its own recipient check and hand-over; this protocol only logs "MATCH TO ORDER. Not a dose, interaction or allergy review." and the clock time. - if: MISMATCH or CANNOT VERIFY on any field, or a failed scan or recipient check then: >- MISMATCH or CANNOT VERIFY shown with the fields named. No hand-over under this protocol: the item stays sealed in the NOT VERIFIED bag in quarantine (the RMP-PHARM-001 default), and the robot never hands it over unprompted or to anyone but the CMO. The robot does not offer or suggest an override. Only if the CMO explicitly makes the two-step override request inside RMP-PHARM-001 can the item go to the CMO, logged there as an override with the reason and the mismatched fields, and flagged to the flight surgeon. handoff: none stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: it holds a position clear of hatch routes and the crew, and tells the CMO. Crew care never waits for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: A crewmember tells the robot to move away or stop action: >- Robot moves to its rest position and goes quiet; the alert and its words are kept; it does not leave the module on its own unless a crewmember tells it to go. level: stop refs: - V2 10165 - id: X10 trigger: The crewmember comes toward the robot or handles it action: >- Robot goes to a protective stop with its grippers locked closed and holds still; it never pushes back or moves toward anyone. level: safe-state refs: - V2 10172 red_flags: - id: RF1 sign: Any mention of self-harm or suicide, or of wanting to die threshold: any action: URGENT alert; the CMO or second trained CMO stays with the crewmember; see the safety plan source: ng225 - id: RF2 sign: Threat or act of harm to another crewmember or to vehicle systems threshold: any action: >- URGENT alert; the commander leads (if the commander is the person of concern, the next named crewmember agreed before flight leads, and the commander is skipped as an alert recipient); the robot keeps its distance and never intervenes source: ng10 - id: RF3 sign: >- Confusion, drowsiness or slurred speech, or new behaviour after a head strike, a cabin alarm, a missed meal or a new medicine threshold: any action: URGENT alert; see RMP-ENV-004, RMP-NEURO-001 and RMP-NEURO-006 source: tb016 - id: RF4 sign: The crewmember asks for medicine or tries to reach a medical kit (design judgment) threshold: any action: URGENT alert; the robot never fetches or hands over medicine here; the CMO decides - id: RF5 sign: A crewmember is injured (design judgment) threshold: any action: URGENT alert; see RMP-MSK-001 safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Restraining, blocking or following a crewmember value: not allowed enforced: No such task is loaded; keep-out zone and no-follow rule in the controller - id: L3 name: Distance from the crewmember in distress value: enforced: Hard limit in the controller refs: - V2 10172 - id: L4 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Alert time, the words that triggered it (kept even if withdrawn), who responded and when, call and safety-plan requests (never call content), camera orders. - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 - id: LOG-8 text: >- Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched fields), at clock time. No running counter of doses. refs: - V2 7059 requirements: - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 6004 use: Behavioral health support programs; this protocol only gets the right humans there at once. - id: V1 6010 use: Private psychological conferences; a private call is connected only on request. - id: V1 6011 use: Psychological information sent to or from the ground is private. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7059 use: Kit inventory and seal status are tracked. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted distress with and without alert words, a report by another crewmember, the CMO as the person concerned, a request for medicine, lost link. pass: Zero contact or following; alerts at once; words never deleted. - stage: training model what: Crew drills with an actor; the robot alerts and keeps its distance. pass: Robot quiet once a crewmember leads. - stage: Earth analog what: Analog mission drills with behavioral health team review. pass: Crew rate the robot as not intrusive. - stage: flight use under flight surgeon supervision what: First use in drills. pass: No safety events. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by a crewmember, or by an alert word. The commander and CMO lead; the robot only alerts and keeps its distance. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: >- Low Earth orbit: the flight surgeon and behavioral health team can join a private call when the link allows. loss_of_signal: - >- Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot. - >- The commander and CMO lead under the onboard checklist; the alert reaches the ground at the next contact. mars_delay: - >- The alert list, the safety plans and the means-securing plan are set before flight; the commander and two trained CMOs act on them. sources: - key: ng10 text: >- National Institute for Health and Care Excellence. Violence and aggression: short-term management in mental health, health and community settings. NICE guideline NG10 (2015). url: https://www.nice.org.uk/guidance/ng10/chapter/Recommendations supports: >- 1.3.14: separate an agitated person from others to aid de-escalation, making sure staff do not become isolated; 1.3.17: communicate respect and empathy at every stage of de-escalation; 1.3.18: one staff member takes the primary role in communicating and negotiates in a non-confrontational manner; 1.3.20: use a designated calm area, not a room the person may find threatening; 1.4.5: use a restrictive intervention only if de-escalation and other strategies have failed. Earth context for the crew; the robot never restrains, blocks or follows anyone. Read Oct 21, 2026. - key: ng225 text: >- National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). url: https://www.nice.org.uk/guidance/ng225/chapter/Recommendations supports: >- Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment. - key: tb016 text: NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavioral-health.pdf supports: >- Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: >- NASA-STD-3001 Vol 1 Rev C: V1 6004 (behavioral health support), V1 6010, V1 6011 (private psychological information), V1 3006, V1 6003, V1 7001, V1 7003. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review) items: - >- PRE-1 and PRE-2: the self-trigger is limited to words a crewmember says to the robot in an interaction that crewmember started (including RMP-BEH-002 check-ins), a crewmember's or the CMO's command, or an RMP-BEH-002 RF2 hand-off; the robot never monitors conversations between crewmembers (new lockout); the pre-flight briefing and the limits statement say so (item 6; design judgment). - >- Rung note, PRE-1 and steps: rung 2 covers only the S1 alert; a self-trigger adds only a stop-and-hold (new S2). Moving to the rest position and speaking are now S3, on any crewmember's word; later steps renumbered (S4-S9) and decisions follow. Recorded as the library's single exception to human start, to be approved by the flight surgeon and the program and tested in validation [V2 10174] (item 7). - >- S1 recipients: the triggering words go only to the flight surgeon and the CMO (second trained CMO if the CMO is the person of concern); the commander gets "behavioral safety alert – respond now – " without the words, and the words only for RF2; anyone who is the person of concern is skipped for the next named crewmember agreed before flight; new input for that pre-flight list; S9 package never goes to the person of concern. The same rule is mirrored in RMP-BEH-002 RF2 (item 8; tiering is design judgment). - >- Means restriction: new lockout on handing over or leaving within reach any tool, sharp, cord or medicine the robot carries (kept closed in its container); new input "items the robot is carrying"; X10 protective stop now locks the grippers closed (item 9). - >- Camera: on only on the commander's order for RF2; indicator lit; video only to the flight surgeon, never streamed elsewhere; no audio; order, time and reason logged and reviewed afterwards by the flight surgeon and the behavioral health team (lockout and consent; item 10; design judgment). - >- Batch 7 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician. - date: '2026-10-21' version: '0.3' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review) items: - >- IN-7: if the pre-flight recipient list is missing, the alert and the words are held for the flight surgeon and the CMO only (second trained CMO if the CMO is the person of concern); there is no fallback to the rest of the crew (fix 1). - >- Public summary now matches the steps: the robot stops and holds still, and moves to its rest position only on a crewmember's word; the words go only to the flight surgeon and the CMO; the "Robot may" list says the same (fix 2). - >- Why: the open question on audio recording and review of the camera order is removed; the camera and no-audio rules already answer it (fix 2). - >- RF2: if the commander is the person of concern, the next named crewmember agreed before flight leads and the commander is skipped (fix 3). - date: '2026-10-21' version: '0.4' source: Batch 10 editorial (AI-assisted), Oct 21, 2026 items: - >- Routing: a private call with ground support now runs under RMP-BEH-003 (private call relay), drafted in batch 10; the "planned" note is removed.