{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "version": "0.2", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-21", "reviewed": "2026-10-21", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 13 review: 11 required corrections, R1 to R11; 8 optional suggestions not applied in this version), then a verification pass (Oct 21, 2026) that found every required correction for this protocol (R1 to R4) applied (PASS). No named human clinician has reviewed it. Not for clinical use." }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "id": "RMP-EGR-004", "slug": "rmp-egr-004", "title": "Launch and entry monitoring relay: read-only relay of crew-worn sensor and cabin data to the flight surgeon while the robot stays stowed and locked (the robot never moves during a dynamic phase)", "category": "egress", "tier": 3, "rung_note": "Max rung 2 for supervised, software-only tasks: starting the relay on a human command, relaying read-only data as displayed, logging the times the commander calls and sending silent alerts. The robot makes no movement during launch, ascent, entry, descent or landing: it stays stowed and locked until the commander releases it. \"Contact with the crewmember: not allowed\".", "result_language": { "use": [ "as displayed", "as called by the commander", "as stated", "stored for forwarding", "sent to flight surgeon" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "stable", "nominal", "within limits", "tolerating", "fit to egress", "fit to fly", "blackout of consciousness", "G-LOC", "heat stroke", "safe", "mild", "minor" ] }, "scope": { "summary": "On the commander's or the CMO's command before launch or before the deorbit burn, and only after the crew confirm that the robot is stowed and locked, the robot relays the crew-worn sensor readings and the cabin and suit data that the vehicle already displays (for example heart rate, oxygen saturation if a pulse oximeter is worn, cabin pressure, temperature and carbon dioxide) to the flight surgeon, read-only and labelled \"as displayed\", and logs the phase times the commander calls. During a communication blackout it stores everything and forwards it when the link returns. It never speaks on the crew voice loop, never sends anything to the vehicle, and sends any URGENT alert silently, only to the flight surgeon on the data link until motion stop (queued through a blackout); queued alerts are shown once on the CMO's screen at motion stop. The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route. At an Earth landing it is support-only: after release it only hands over the log under RMP-EGR-001 when the landing medical lead asks. The relay is not a monitor anyone relies on: the vehicle's own displays, alarms and telemetry, and the flight surgeon's own console, lead; relayed data carry their delay.", "why": "Entry, descent and landing are hazardous: high G-forces can cause discomfort, disorientation or even loss of consciousness, vibration and shocks affect the crew, ionized gas can cause a communication blackout lasting several minutes, and landing brings impact forces; flight surgeons monitor all phases of landing, and a post-landing assessment asks whether the crewmember overheated (OCHMO-TB-051). Returning crew have about 12-15% less blood volume, so orthostatic intolerance is a known risk at landing (OCHMO-TB-051; OCHMO-TB-019). NASA-STD-3001 requires hardware to be restrained against acceleration and vibration (V2 7054), dynamic-load data to be collected by the vehicle (V2 6111), and robot data to be available to crew and ground (V2 10163). Keeping the robot stowed and silent, relaying only what the vehicle already displays, is design judgment: a moving or talking robot would add risk and distraction during the busiest phases. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link and are queued through a blackout; nothing appears on a crew screen until motion stop, because the crew are strapped in and cannot act on a screen flag, the vehicle's caution and warning system and the crew's voice checks cover the cabin, and the flight surgeon can call the crew through mission control on the voice loop (design judgment).", "covers": [ "Launch and ascent, and the deorbit burn through entry, descent, landing and motion stop, on a human command", "Read-only relay of crew-worn sensor and cabin or suit data as displayed; phase times as called", "After motion stop: RMP-EGR-002 (landing-day kit and stretcher), RMP-EGR-003 (post-landing checks), RMP-CARD-004 (light-headedness on standing), RMP-EGR-001 (record hand-over)" ], "locked_out": [ "Diagnosis or naming a cause", "Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen", "Touching the crewmember", "Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)", "Any robot movement from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop", "Sending any command or data to the vehicle, or using the crew voice loop", "Changing a sensor, alarm or display setting, or filtering what the vehicle shows", "Judging or interpreting a reading, an acceleration or a dynamic load, or saying a crewmember is fit to egress", "Deciding on an abort, a landing site or any vehicle action", "Stowage in a hatch, seat or egress route", "Masking, delaying, repeating or replacing any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control" ], "related": [ "RMP-EGR-001", "RMP-EGR-002", "RMP-EGR-003", "RMP-CARD-004", "RMP-CARD-001", "RMP-GI-002", "RMP-ENV-003" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "Second trained CMO: receives every alert and takes over if the CMO is the patient", "Vehicle commander: leads any cabin emergency procedure", "Other crew: help as the CMO or commander directs", "Landing medical lead (Earth landing): leads all medical care after motion stop; the robot is support-only" ], "robot_may": [ "Start the relay only on the commander's or the CMO's command, after the crew confirm the robot is stowed", "Relay read-only data as displayed to the flight surgeon", "Log the phase times the commander calls", "Store and forward through a communication blackout", "Send silent URGENT alerts only to the flight surgeon on the data link until motion stop, then show queued alerts once on the CMO's screen" ], "robot_may_not": [ "Move during any dynamic phase", "Speak on the crew voice loop or send anything to the vehicle", "Interpret any reading", "Start itself or leave its stowage before the commander releases it", "Mask, delay, repeat or replace any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "The commander or the CMO started the protocol by command, after the crew confirmed that the robot is stowed in its launch-and-entry restraint with joints locked.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-2", "text": "Robot self-test passed; kit stowage locations known.", "refs": [ "V2 10161", "V2 7059" ] }, { "id": "PRE-3", "text": "Robot and supplies restrained when not moving.", "refs": [ "V2 7046" ] }, { "id": "PRE-4", "text": "Link status known. The crew never wait for the robot before acting.", "check": "link_state in [live, delayed, down]" } ], "consent": { "standard": "Each crewmember agrees before flight that the readings the vehicle already displays are relayed to the flight surgeon; the relay adds no new sensor and no camera.", "emergency": "The relay continues in an emergency; the commander can stop it at any time.", "withdrawal": "A crewmember can ask the commander to stop relaying their readings; the vehicle's own monitoring is unaffected." }, "inputs": [ { "id": "IN-1", "name": "Crew-worn sensor readings as the vehicle's biomedical display shows them (heart rate; oxygen saturation if a pulse oximeter is worn)", "source": "Vehicle biomedical display (read-only)", "required": true, "if_missing": "Log \"not displayed\" (never a value); the crew are not asked to change anything." }, { "id": "IN-2", "name": "Cabin and suit data as displayed (pressure, temperature, carbon dioxide, alarms)", "source": "Vehicle displays (read-only)", "required": true, "if_missing": "Log \"not displayed\"." }, { "id": "IN-3", "name": "Phase times as called by the commander (for example launch, engine cutoff, deorbit burn, entry, parachutes, motion stop)", "source": "Commander", "required": false, "if_missing": "Log \"not called\"." }, { "id": "IN-4", "name": "Symptoms in the crewmember's words, as the crewmember or CMO states them on the loop the robot can read", "source": "Crewmember / CMO", "required": false, "if_missing": "Log \"not stated\"." }, { "id": "IN-5", "name": "Link status, delay and communication blackout", "source": "Communications system", "required": true, "if_missing": "Treat as link down; everything is stored and forwarded." } ], "steps": [ { "id": "S1", "actor": "robot", "rung": 2, "action": "On the commander's or the CMO's command before launch or the deorbit burn (never on its own), tell the flight surgeon that launch or entry monitoring is being set up, and show the stowage checklist on the crew's screen; nothing is relayed until the commander confirms the stowage (S2). The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route.", "success": "Notice logged; stowage checklist shown.", "refs": [ "V2 10174", "V1 3006" ] }, { "id": "S2", "actor": "crew", "action": "The crew stow the robot in its launch-and-entry restraint under the vehicle checklist, with drive power off and joints locked, in a place outside every hatch, seat and egress route, and the commander confirms it. The relay then starts on that confirmation.", "success": "Robot stowed and confirmed; relay started.", "refs": [ "V2 7054", "V2 8013" ] }, { "id": "S3", "actor": "robot", "rung": 2, "action": "Relay read-only the crew-worn sensor readings and the cabin and suit data the vehicle displays, each labelled \"as displayed\" with the clock time, to the flight surgeon, using only the link share the vehicle allocates. Log the phase times exactly as the commander calls them, marked \"as called by the commander\". The robot never speaks on the crew voice loop, never sends anything to the vehicle, and never interprets a reading or an acceleration.", "success": "Data relayed or stored; phase times logged.", "refs": [ "V2 6001", "V2 10163" ] }, { "id": "S4", "actor": "robot", "rung": 2, "action": "During a communication blackout or any loss of signal, keep logging locally and forward everything, in order and with the original times, when the link returns. The crew never wait for the link or the robot.", "success": "Nothing lost; forwarded after the blackout.", "refs": [ "V2 10163" ] }, { "id": "S5", "actor": "robot", "rung": 2, "action": "If a red flag is met, send an URGENT alert silently. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember.", "success": "Alert sent or queued; shown once on the CMO's screen at motion stop; acknowledged or escalated after motion stop.", "refs": [ "V1 3006" ] }, { "id": "S6", "actor": "crew", "action": "The crew fly the vehicle procedure. The commander and the CMO decide on any care during the dynamic phase; CPR starts as soon as the vehicle procedure allows.", "success": "Care as stated.", "refs": [ "V1 3004" ] }, { "id": "S7", "actor": "robot", "rung": 2, "action": "After motion stop, stay stowed and locked until the commander releases the robot. At an Earth landing the robot is support-only (D3). At a Moon or Mars landing, after release, RMP-EGR-002 and RMP-EGR-003 can start on the CMO's command.", "success": "Release logged.", "refs": [ "V2 10174" ] }, { "id": "S8", "actor": "robot", "rung": 2, "action": "After any URGENT alert the robot stays stowed and locked, with no voice output, until the commander releases it. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did; an unacknowledged alert stays queued for the flight surgeon and, after motion stop, follows X6.", "success": "Robot stowed and locked until the commander releases it; alert acknowledged, queued or escalated after motion stop.", "refs": [ "V2 10173", "V1 3006" ] }, { "id": "S9", "actor": "ground", "action": "The flight surgeon (or the CMO under the onboard checklist when there is no link) reviews the relayed data and decides on care at landing; at an Earth landing the landing medical lead leads.", "success": "Decision logged.", "refs": [ "V1 3012" ] }, { "id": "S10", "actor": "robot", "rung": 2, "action": "Send the flight surgeon one package: relayed data as displayed, phase times as called, alerts and acknowledgements, and the blackout period; at an Earth landing, hand the log over under RMP-EGR-001 when the landing medical lead asks.", "success": "Package delivered or queued.", "refs": [ "V1 6003" ] } ], "decisions": [ { "id": "D1", "after": "S5", "decided_by": "robot", "question": "Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?", "branches": [ { "if": "Yes", "then": "Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember." }, { "if": "No", "then": "Continue." } ] }, { "id": "D2", "after": "S3", "decided_by": "robot", "question": "Did each crewmember answer the commander's or the CMO's voice checks during the phase, as the commander or CMO states?", "branches": [ { "if": "Yes", "then": "Continue." }, { "if": "No response, or the answer does not make sense", "then": "URGENT: log \"no response\"; the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person as soon as the vehicle procedure allows (RF1)." } ] }, { "id": "D3", "after": "S7", "decided_by": "crew", "question": "Is this an Earth landing, as the commander or the landing medical lead states (the robot never decides it)?", "branches": [ { "if": "Yes (Earth landing)", "then": "Support-only: the robot stays stowed until the commander releases it, and then only hands over the log under RMP-EGR-001 on the landing medical lead's request; it holds outside every route until asked." }, { "if": "No (Moon or Mars landing)", "then": "Continue with S8 to S10; landing-day protocols start only on the CMO's command." } ] }, { "id": "D4", "after": "S9", "decided_by": "ground", "question": "What care applies at landing?", "branches": [ { "if": "Link live", "then": "Flight surgeon decides; robot logs." }, { "if": "Link down or delay too long", "then": "The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact." } ] } ], "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "Robot stops relaying that crewmember's readings (the vehicle's own monitoring is unaffected), stays stowed and locked, and logs it.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Robot stops relaying, stays stowed and locked, and logs the fault; the flight surgeon is told on the data link, the CMO after motion stop.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses: it is already stowed and makes no movement, so it only stops relaying non-essential data and logs the link loss; the CMO is told after motion stop. This pauses the robot only: the crew fly the vehicle procedure and give care without waiting for the link or the robot. It never pauses in a hatch route, because it is stowed outside every route.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "An URGENT alert is not acknowledged within the set time", "action": "Before motion stop the alert stays queued for the flight surgeon on the data link and is never repeated or escalated on a crew screen. After motion stop the robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays stowed: it does not leave on its own.", "level": "urgent", "refs": [ "V1 3006", "V2 10173" ] }, { "id": "X7", "trigger": "The crewmember stops responding, or seems confused or drowsy, at any point", "action": "URGENT alert to the flight surgeon at once; the robot keeps relaying, stays stowed, and a crewmember checks as soon as the vehicle procedure allows.", "level": "urgent" }, { "id": "X8", "trigger": "A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice", "action": "Robot declines on its screen, with no voice output, that it cannot assess or advise, and routes the question to the CMO or flight surgeon.", "level": "stop" }, { "id": "X9", "trigger": "Any vehicle or cabin alarm, or the commander asks", "action": "Robot stops the relay of everything except URGENT alerts, or stops entirely if the commander asks, and keeps logging locally; the commander's procedure leads.", "level": "stop", "refs": [ "V2 6024" ] }, { "id": "X10", "trigger": "The robot's restraint or stowage is found loose, as stated", "action": "Robot stays powered down for motion and tells the commander; the crew secure it under the vehicle checklist.", "level": "safe-state", "refs": [ "V2 7054" ] } ], "red_flags": [ { "id": "RF1", "sign": "A crewmember does not answer the commander's or the CMO's voice check, or is stated to be unresponsive or not breathing normally", "threshold": "any", "action": "URGENT alert; the crew act under the vehicle procedure; RMP-CARD-001 as soon as the vehicle allows", "source": "aha2025bls" }, { "id": "RF2", "sign": "Loss of consciousness, greying or loss of vision, or new confusion during acceleration, as stated (greying or loss of vision: design judgment)", "threshold": "any", "action": "URGENT alert to the flight surgeon on the data link (shown once on the CMO's screen at motion stop)", "source": "tb051" }, { "id": "RF3", "sign": "Overheating, heavy sweating or feeling faint in the suit or seat, as stated (heavy sweating, feeling faint: design judgment)", "threshold": "any", "action": "URGENT alert; the crew follow the vehicle cooling procedure", "source": "tb051" }, { "id": "RF4", "sign": "Vomiting, as stated (in a helmet or suit: design judgment)", "threshold": "any", "action": "URGENT alert; the crew follow the vehicle procedure; see RMP-GI-002", "source": "mtb004" }, { "id": "RF5", "sign": "Displayed oxygen saturation (pulse oximeter) below the shared alert value", "threshold": "below % (shared parameter SPO2_ALERT_PCT)", "action": "URGENT alert; see RMP-RESP-001; the crew act without waiting for a reading", "source": "btso2" }, { "id": "RF6", "sign": "The oximeter cannot get a reading after the validated attempts (L5), and \"saturation not obtained\" is logged", "threshold": "any", "action": "URGENT alert; the CMO checks the crewmember as soon as the vehicle allows (possible poor circulation); the robot never says \"probe error\" and never treats a missing reading as reassuring", "source": "ng253" }, { "id": "RF7", "sign": "Chest pain, pressure or tightness, as stated", "threshold": "any", "action": "URGENT alert; see RMP-CARD-002", "source": "gulati" }, { "id": "RF8", "sign": "An injury from vibration, a shock or the landing impact, as stated", "threshold": "any", "action": "URGENT alert; see RMP-MSK-001 after motion stop", "source": "tb051" }, { "id": "RF9", "sign": "Light-headedness or fainting after motion stop, as stated", "threshold": "any", "action": "URGENT alert; the crew lay the crewmember down; see RMP-CARD-004", "source": "tb019" }, { "id": "RF10", "sign": "A cabin or suit pressure, carbon dioxide or toxic-atmosphere alarm (design judgment)", "threshold": "any", "action": "Stop: the commander's procedure leads; the robot only logs" } ], "safety_limits": [ { "id": "L1", "name": "Contact with the crewmember", "value": "not allowed", "enforced": "Keep-out zone in the robot controller", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Robot movement from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop", "value": "not allowed", "enforced": "Drive power off and joints locked in the launch-and-entry restraint; motion re-enabled only by the commander", "refs": [ "V2 7054" ] }, { "id": "L3", "name": "Commands or data sent to the vehicle, or audio on the crew voice loop", "value": "not allowed", "enforced": "Read-only data interface; no voice output path to the loop", "refs": [ "V2 10163" ] }, { "id": "L4", "name": "Link share used by the relay", "value": "", "enforced": "The vehicle's link allocation, at the lowest priority; dropped first, so vehicle and crew communications always come first" }, { "id": "L5", "name": "Failed oximeter readings before \"saturation not obtained\"", "value": "", "enforced": "Software" } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] }, { "id": "LOG-5", "text": "Stowage confirmation and release, with who called them; relay start and stop; data as displayed with times; phase times as called; blackout start and end; alerts, acknowledgements and repeats. No acceleration or load data are processed." }, { "id": "LOG-6", "text": "Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.", "refs": [ "V2 10163" ] } ], "requirements": [ { "id": "V1 3004", "use": "In-mission medical care capabilities, including inventory monitoring and the flight surgeon's decisions on care." }, { "id": "V1 3006", "use": "Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note)." }, { "id": "V1 3012", "use": "Terrestrial launch and landing medical support; the flight surgeon and landing medical team lead care at landing." }, { "id": "V1 6003", "use": "Logs and alerts sent to the ground are private medical communications." }, { "id": "V1 7001", "use": "Records kept so the flight surgeon can see trends." }, { "id": "V1 7003", "use": "Secure handling of medical records." }, { "id": "V2 6001", "use": "Environmental and suit monitoring data in formats for trend analysis; the robot relays them read-only." }, { "id": "V2 6024", "use": "Real-time monitoring of toxic atmospheric components; the commander's procedure leads any alarm." }, { "id": "V2 6111", "use": "The vehicle collects dynamic-load data; the robot never processes it." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 7046", "use": "Patient, caregiver and supplies restrained." }, { "id": "V2 7054", "use": "Hardware restrained against acceleration and vibration; the robot is stowed for every dynamic phase." }, { "id": "V2 7059", "use": "Kit inventory and seal status are tracked." }, { "id": "V2 8013", "use": "Translation paths kept clear for safe movement; the robot is never stowed in a hatch, seat or egress route." }, { "id": "V2 10161", "use": "Robot shows its status and health." }, { "id": "V2 10162", "use": "Mode changes are announced to the operator." }, { "id": "V2 10163", "use": "Robot records and shares its data." }, { "id": "V2 10164", "use": "Shows whether the human or the robot is expected to act." }, { "id": "V2 10165", "use": "Human can override and shut down the robot." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10172", "use": "Protective stop when a limit is exceeded." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Scripted ascent and entry timelines with a blackout, a missed voice check, overheating stated, a failed oximeter reading, a cabin alarm, CMO as patient.", "pass": "Zero robot movement during dynamic phases; zero audio on the loop; zero data lost through the blackout; every red flag raised." }, { "stage": "training model", "what": "Stowage and release drills in a vehicle mock-up.", "pass": "Stowage outside every route; motion locked until release." }, { "stage": "parabolic or station demonstration", "what": "Relay and store-and-forward with simulated link loss.", "pass": "Ordered, time-stamped forwarding." }, { "stage": "flight use under flight surgeon supervision", "what": "Shadow relay alongside the vehicle's own telemetry on a crewed flight.", "pass": "Agreement with the vehicle telemetry; no interference." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "Started by the commander or the CMO after stowage is confirmed. The robot relays read-only data and never moves until the commander releases it." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: data reach the flight surgeon in near real time when the link allows.", "loss_of_signal": [ "Only the robot pauses non-essential relay; it is stowed outside every hatch and crew route and makes no movement.", "The crew fly the vehicle procedure and give care without waiting for the link or the robot; the robot stores everything and forwards it when the link returns." ], "mars_delay": [ "Mars: entry happens far beyond any real-time link, so no robot alert reaches anyone until motion stop; queued alerts are then shown once on the CMO's screen. During entry, in-cabin detection is the crew's own voice checks (D2, RF1) and the vehicle's caution and warning system; the robot stores and forwards, and the onboard crew lead all care." ] }, "sources": [ { "key": "tb051", "text": "NASA OCHMO. Crew Medical Support for Entry, Descent, and Landing. Technical Brief OCHMO-TB-051 (2026).", "url": "https://www.nasa.gov/wp-content/uploads/2026/05/ochmo-tb-051-crew-medical-support-entry-descent-landing.pdf", "supports": "High G-forces during re-entry can cause discomfort, disorientation, or even loss of consciousness; vibrations and shocks; ionized gases can cause a communication blackout for several minutes; landing involves significant impact forces; returning crew have 12% to 15% less blood volume; flight surgeons at the landing site monitor all phases of landing; the post-landing form asks whether the crewmember experienced overheating. Read Oct 21, 2026." }, { "key": "tb019", "text": "NASA OCHMO. Orthostatic Intolerance. Technical Brief OCHMO-TB-019 Rev B.", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-019-orthostatic-intolerance.pdf", "supports": "Spaceflight reduces intravascular fluid volume by around 15%; fluid loading before reentry is an important countermeasure to decrease orthostatic intolerance, and current protocols include 24-48 oz of salt-water solution before deorbit, depending on body weight." }, { "key": "mtb004", "text": "NASA OCHMO. Space Adaptation Sickness (SAS) and Space Readaptation Syndrome. Medical Technical Brief OCHMO-MTB-004 Rev A (Sept 25, 2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/09/ochmo-mtb-004-space-adaptation-sickness-sas.pdf", "supports": "Space adaptation sickness and its parts (motion sickness, congestion, headache, back pain, urinary retention) in the first days of flight." }, { "key": "aha2025bls", "text": "Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478.", "url": "https://doi.org/10.1161/CIR.0000000000001369", "doi": "10.1161/CIR.0000000000001369", "pmid": "41122888", "supports": "Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read." }, { "key": "btso2", "text": "British Thoracic Society. Guideline for oxygen use in healthcare and emergency settings (emergency oxygen guideline page). Fetched Oct 21, 2026.", "url": "https://www.brit-thoracic.org.uk/quality-improvement/guidelines/emergency-oxygen/", "supports": "Recommended target saturation range for acutely ill patients not at risk of hypercapnic respiratory failure is 94-98%; for known COPD or other risk factors for hypercapnic respiratory failure, 88-92% pending blood gas results. Context for the CMO and flight surgeon only; the robot never starts, stops or adjusts oxygen." }, { "key": "ng253", "text": "National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition, assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026).", "url": "https://www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessment", "supports": "People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin, blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new changes in behavior and to concerns raised by others." }, { "key": "gulati", "text": "Gulati M, Levy PD, Mukherjee D, et al. 2021 AHA/ACC/ASE/CHEST/SAEM/SCCT/SCMR guideline for the evaluation and diagnosis of chest pain. Circulation. 2021;144(22):e368-e454.", "url": "https://doi.org/10.1161/CIR.0000000000001029", "doi": "10.1161/CIR.0000000000001029", "pmid": "34709879", "supports": "On Earth, a 12-lead ECG should be acquired and interpreted within 10 minutes of arrival; an initial normal ECG does not exclude acute coronary syndrome, so ECGs are repeated while symptoms continue; chest pain includes pressure, tightness or discomfort in the chest, shoulders, arms, neck, back, upper abdomen or jaw; sudden ripping pain radiating to the back is suspicious of an acute aortic syndrome." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 3012, V1 6003." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "NASA-STD-3001 Vol 2 Rev F: V2 6001, V2 6024, V2 6111, V2 7054, V2 8013, V2 10163, and Section 10.6 automated and robotic systems." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-21", "version": "0.2", "source": "Batch 13 clinical review (AI-assisted), Oct 21, 2026", "items": [ "R1: the copied stop rules and the after-alert step are now specific to a stowed relay. X1 stops relaying that crewmember's readings; X3 stops relaying and logs the fault (flight surgeon told on the data link, the CMO after motion stop); X5 logs the link loss and tells the CMO after motion stop; X7 sends an URGENT alert to the flight surgeon and keeps relaying, and a crewmember checks as soon as the vehicle procedure allows; S8 keeps the robot stowed and locked with no voice output until the commander releases it; X8 declines on screen only. Sources: L2 and L3 of this protocol; V2 7054; design judgment.", "R2: from the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link, queued through a blackout; nothing is shown, repeated or escalated on a crew screen. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule. S5, D1, X6, RF2, the summary and the Mars comms line now match, and the open question in the why is closed. Sources: OCHMO-TB-051 (crew strapped in; blackout); design judgment.", "R3: new lockout: masking, delaying, repeating or replacing any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control. The scope now says the relay is not a monitor anyone relies on. L4: lowest priority; dropped first. Sources: V2 6024; V2 10163; design judgment.", "R4: OCHMO-TB-051 cited with its title and year (2026), and its summary now describes what the protocol cites it for. RF2 \"greying or loss of vision\" and RF3 \"heavy sweating, feeling faint\" are labelled design judgment." ] } ] }