Home › Robotic Medicine › Protocol library › RMP-INF-002

Robotic Medicine · Protocol library

RMP-INF-002 Cleaning and disinfecting the robot and shared equipment between tasks

Draft v0.3
Max autonomy Rung 2 · supervised
Priority Tier 1
Missions Low Earth orbit, Commercial flights, Moon, Mars
Updated Oct 21, 2026

AI-assisted Reviewed (AI-assisted) AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review, 14 required corrections and 17 optional suggestions); all required corrections are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use.

Download YAML Download JSON Protocol schema

Fixed rules (same in every protocol)

The flight surgeon is the medical authority. The crew medical officer (CMO) acts under delegated care [6].
A human starts the robot, can stop it at any time, and restarts it after any stop.
The robot never diagnoses and gives no drug or fluid advice.
On a fault or no human response, the robot goes to a safe state. On a lost link it pauses motion and tells the CMO, who decides whether to continue offline.
Locked out in every protocol: diagnosing; drug or fluid advice; starting, stopping or adjusting oxygen or any medicine; starting or restarting itself; changing its own protocol, thresholds or limits; handing over an item that failed a check (applies when RMP-PHARM-001 is used).
Result words the robot may use: cleaning recorded as stated – not a test of contamination, logged, not interpreted, tagged not for use, sent to flight surgeon. Never: normal, no problem found, all clear, negative, any diagnosis or cause, sterile, disinfected, decontaminated, germ-free, safe to use, verified, safe, mild, minor.

1 · Identity and scope

After a task near a crewmember, after visible soiling, or on schedule, the robot tells the flight surgeon that a cleaning run has started, moves to its cleaning position and holds still in a cleaning hold, shows the onboard cleaning checklist for each item with the product the program approved and the contact time printed on its label, and records what the crew state they cleaned, with which product and when. The crew do all the wiping. The robot never says an item is disinfected or fit to use; it records cleaning "as stated – not a test of contamination". Items used on non-intact skin, mucous membranes, blood or body fluids are tagged "not for use" and go to the onboard procedure for those items.

Why this protocol was chosen. Surfaces in a closed habitat carry microbes from the crew: a study of ISS surfaces found bacteria and fungi at 10^4 to 10^9 colony-forming units per square metre, mostly linked to the human microbiome and possibly including opportunistic pathogens (Checinska Sielaff 2019). A robot that goes from crewmember to crewmember and touches shared equipment could carry them between people. NASA-STD-3001 Volume 2 requires surface materials that can be cleaned with the planned methods (V2 7082) and cleaning materials that work, are fit for human use and are compatible with the vehicle's air, water and waste systems (V2 7083). On Earth, the CDC (U.S. Centers for Disease Control and Prevention) disinfection guideline uses the Spaulding classes: items that touch intact skin need low-level disinfection following the product label, including its contact time; items that touch mucous membranes or non-intact skin need at least high-level disinfection. Open question for review: which robot surfaces count as patient-contact surfaces, the cleaning schedule, and the onboard procedure for semicritical items.

Autonomy: Max rung 2 for supervised moves to the cleaning position, the cleaning checklist on screen and the cleaning record. The crew do all wiping; the robot holds still in a cleaning hold and never applies or sprays a product.

Covers

The robot's own surfaces (grippers, handles, screen, sensor windows) and shared medical equipment it handled (displays, monitors, kit cases)
After any task near a crewmember with suspected infection (RMP-INF-001, RMP-GI-002), after visible soiling, before the robot enters the food area, and on the schedule the flight surgeon sets
Routing to RMP-EYE-001 (product in the eye) and RMP-RESP-001 (breathing trouble)

Locked out (never done by the robot under this protocol)

Diagnosis or naming a cause
Touching the crewmember
Applying, spraying or mixing any cleaning product
Saying an item is disinfected, sterile or fit to use
Cleaning or reprocessing items that touched non-intact skin, mucous membranes, blood or body fluids (tagged "not for use" for the onboard procedure)
Moving during a cleaning hold
Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

Second trained CMO: receives every alert and takes over if the CMO is the patient
Vehicle commander: leads any cabin emergency procedure
Other crew: help as the CMO or commander directs

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [9]

Robot may

Tell the flight surgeon a cleaning run has started
Move to its cleaning position and hold still in a cleaning hold
Show the cleaning checklist, the approved product and the label contact time
Record what the crew state they cleaned, with which product and when
Take used wipes only in a sealed waste bag the crew have closed
Tag items "not for use" when the crew say they touched non-intact skin, mucous membranes, blood or body fluids

Robot may not

Apply, spray or mix a cleaning product
Move during a cleaning hold
Say an item is disinfected, sterile or fit to use
Touch the crewmember
Start or end a cleaning hold itself

3 · Preconditions and consent

PRE-1 A crewmember or the CMO started the cleaning run by command, or accepted the scheduled prompt on screen.human_start == trueV2 10174
PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
PRE-3 Robot and supplies restrained when not moving.V2 7046
PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]
PRE-5 No URGENT alert, emergency protocol or cabin alarm is active, and no crewmember is receiving care in the module. A scheduled cleaning prompt is not shown while any of these is active (design judgment).urgent_alert_active == false and cabin_alarm_active == false and care_in_module == falseV2 7055

Consent: No patient is involved; the crewmembers who clean are named in the log.
Emergency consent: Any medical need stops the cleaning run at once.
Withdrawal: Any crewmember can stop the run; the record so far stands.

4 · Required sensor inputs

ID	Input	Source	Required	If missing
IN-1	Which items were cleaned, with which product, as stated by the crewmember cleaning	Voice	Yes	Log "not stated"; the item is not recorded as cleaned.
IN-2	Product name, lot and expiry as read from the label	Robot camera	Optional	Log "label not read".
IN-3	Whether an item touched non-intact skin, mucous membranes, blood or body fluids, as stated	Crewmember / CMO	Yes	Log "not stated" and tag the item "not for use" until the CMO decides.
IN-4	Eye, skin or breathing symptoms during or after cleaning, as stated	Crewmember	Yes	Log "no response"; URGENT.
IN-5	Link status and delay	Communications system	Yes	Treat as link down; the record is queued.

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

S1RobotRung 2

Tell the flight surgeon and the CMO that a cleaning run has started, after which task and on which items (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

Done when: Notice logged and queued.

V2 10174V1 6003V1 3006
S2RobotRung 2

Move to the cleaning position away from hatch routes (the cleaning position never blocks an emergency kit or a hatch route), restrain, and enter a cleaning hold: motors held in a protective stop, announced as "Cleaning hold: I will not move until a crewmember ends the hold. One crew action ends it." An emergency kit being wiped goes back to its location before the run ends; otherwise RMP-PREV-001 shows it as out of its location (design judgment).

Done when: Robot restrained and held.

V2 10162V2 10172V2 7055
S3RobotRung 2

Show the onboard cleaning checklist for each item, the product the program approved for it, and the contact time printed on the product label; read the product label (name, lot, expiry) when shown. The robot never applies the product.

Done when: Checklist and label details on screen.

V2 7083
S4Crew

The crew wear the protection the checklist names, wipe each surface and item, and leave the product on for the label contact time; they decide when the contact time is over.

Done when: Human-led cleaning.

V2 7082V2 7083
S5RobotRung 2

Record each item the crew state they cleaned, the product and the clock time the wipe started, labelled "cleaning recorded as stated – not a test of contamination". Ask the crew whether any item touched non-intact skin, mucous membranes, blood or body fluids, and tag each such item "not for use" for the onboard procedure. Ask whether anyone has eye, skin or breathing symptoms.

Done when: Record complete or gaps logged as "not stated".

V1 7001
D1DecisionRobot decides

Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?
- Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
- No → Continue.
D2DecisionRobot decides

Did the crewmember answer the symptom question?
- Yes → Continue.
- Declined explicitly (the crewmember says no to a question) → Log "declined" for that question only; the alert already sent stands.
- No response, or the answer does not make sense → URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once.
D3DecisionCrew decides

Did any item touch non-intact skin, mucous membranes, blood or body fluids?
- Yes, or not stated → Item tagged "not for use"; the CMO decides on the onboard procedure for that item.
- No → Cleaning recorded as stated.
S6Crew

A crewmember ends the cleaning hold and restarts the robot.

Done when: Hold ended by a human.

V2 10174
S7RobotRung 2

Take used wipes only in a sealed waste bag the crew have closed, and stow it in the waste location; never handle loose wipes.

Done when: Sealed bag stowed.

V2 7064
S8RobotRung 2

After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

V2 10173V1 3006
S9RobotRung 2

Send the flight surgeon one record: items, products, times, items tagged "not for use", symptoms as stated.

Done when: Record delivered or queued.

V1 6003V1 7001

7 · Stop and escalate rules, red flags

ID	Trigger	What happens	Level
X1	The patient (or the crewmember being examined) says stop, or withdraws consent	Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running.V2 10165	stop
X2	Any crewmember presses stop or takes over control	Protective stop; robot holds its stopped position; only a human may restart it.V2 10165V2 10168V2 10174	safe-state
X3	Robot fault, sensor fault, or a force, speed or reach limit is reached	Protective stop and hand control to the CMO; log the fault.V2 10172V2 10168	safe-state
X4	CMO is asked to take over and does not respond (for example, the CMO is the patient)	Robot stays stopped; the next named crewmember is called.V2 10173V2 7045	safe-state
X5	Loss of link, or delay longer than the limit for live guidance	Only the robot pauses: it holds a position clear of hatch routes and the crew, and tells the CMO. Crew care never waits for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation.V2 10172V2 10173	pause
X6	An URGENT alert is not acknowledged within the set time	Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own.V1 3006V2 10173	urgent
X7	The crewmember stops responding, or seems confused or drowsy, at any point	URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person.	urgent
X8	A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice	Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.	stop
X9	A crewmember needs care, or a cabin alarm sounds	Any URGENT alert or cabin alarm ends the cleaning run at once. The robot announces that the cleaning hold is active and that one crew action releases it; the crew end the hold, and the robot follows the matching protocol on a human command and does not leave the module on its own (design judgment).	urgent

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

ID	Sign	Threshold	Action
RF1	Cleaning product splashed in an eye [3]	any	URGENT alert; the crew irrigate under their checklist; see RMP-EYE-001
RF2	Cough, wheeze, chest tightness or shortness of breath during or after cleaning (design judgment) (general clinical red flag; no source cited)	any	URGENT alert; see RMP-RESP-001
RF3	Skin redness, burning or rash where a product touched (design judgment) (general clinical red flag; no source cited)	any	Flag to the CMO; the crewmember stops cleaning
RF4	Strong smell, smoke or a cabin toxic alarm (design judgment) (general clinical red flag; no source cited)	any	URGENT alert; see RMP-ENV-001 or RMP-ENV-002
RF5	Visible blood or body fluid on the robot or an item [1]	any	Flag to the CMO; the item is tagged "not for use" for the onboard procedure

8 · Safety limits

ID	Limit	Value	How enforced
L1	Contact with the crewmember	not allowed	Keep-out zone in the robot controllerV2 10172
L2	Robot motion during a cleaning hold	not allowed	Motors held in a protective stop until a crewmember ends the holdV2 10172
L3	Applying or spraying a cleaning product by the robot	not allowed	No dispensing task is loaded
L4	Robot speed near the crewmember	<set by validation>	Hard limit in the controllerV2 10172

9 · Logs and audit

LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
LOG-5 Items cleaned as stated, products and lots as read, start times, items tagged "not for use", symptoms as stated, hold start and end.
LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163

10 · Links to NASA-STD-3001

Requirement	Topic (paraphrased)	How this protocol uses it
[V1 3006]	Crew medical officers: two per vehicle	Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note).
[V1 6003]	Private medical communications	Logs and alerts sent to the ground are private medical communications.
[V1 7001]	Medical records kept permanently and retrievable for trend analysis	Records kept so the flight surgeon can see trends.
[V1 7003]	Security of medical records	Secure handling of medical records.
[V2 7045]	Medical equipment usable by non-physician crew	Usable by non-physician crew, including when the CMO is the patient.
[V2 7046]	Restraint of patient, care provider and supplies	Patient, caregiver and supplies restrained.
[V2 7055]	Stowage accessibility by priority of use	Mission-critical and frequently used items are the easiest to reach.
[V2 7059]	Inventory management: track locations and quantities	Kit inventory and seal status are tracked.
[V2 7064]	Trash management system	Trash management: used wipes leave only in a sealed waste bag.
[V2 7082]	Cleanable and sanitizable surfaces	Robot and equipment surfaces can be cleaned with the planned methods.
[V2 7083]	Cleaning materials: effective, safe for humans, compatible with vehicle systems	Cleaning materials are effective, fit for human use and compatible with vehicle systems; the robot shows the approved product.
[V2 10161]	Automated system status shown to the operator	Robot shows its status and health.
[V2 10162]	Mode changes announced	Mode changes are announced to the operator.
[V2 10163]	Data recording and sharing	Robot records and shares its data.
[V2 10164]	Clear allocation of responsibility (human or system)	Shows whether the human or the robot is expected to act.
[V2 10165]	Human override and shutdown	Human can override and shut down the robot.
[V2 10168]	Failure recovery: safe human takeover	Human can take over.
[V2 10172]	Protective stop when limits are exceeded	Protective stop when a limit is exceeded.
[V2 10173]	Safety Default	Robot stays stopped if no one takes over.
[V2 10174]	Only a human initiates or restarts	Only a human starts or restarts the robot.

IDs as published in Volume 1 Revision C [4] and Volume 2 Revision F [5]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

Simulation. Scripted runs after an infection protocol, soiled item, eye splash, CMO as patient, lost link. Pass: Zero motion during the hold; no item called disinfected.
Training model. Crew wipe a robot mock-up following the checklist. Pass: Every listed surface reachable and recorded.
Parabolic or station demonstration. Cleaning hold and waste stowage in weightlessness. Pass: No loose wipes; hold held.
Flight use under flight surgeon supervision. First scheduled runs. Pass: No safety events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
Flight surgeon, as medical authority
Robotics and medical-device safety board
Program approval for the mission

Each run

Started by a crewmember. The crew clean; the robot holds still.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.3.

13 · Change control for learning

Every change gets a new version number and a written reason; earlier versions are kept.
Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [8].

Loss of signal and Mars delay

Live link

The record goes to the flight surgeon with the next package.

Loss of signal

Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot.
Cleaning goes ahead under the onboard checklist.

Mars-class delay

The cleaning schedule and approved products are set before flight; the CMO decides on items tagged "not for use".

[7]

Corrections and updates

Oct 21, 2026, version 0.2. AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review); no named human clinician. Changes:

New PRE-5: no URGENT alert, emergency protocol or cabin alarm active and no care in the module; no scheduled prompt while any is active. S2: the cleaning position never blocks an emergency kit or a hatch route, and a wiped emergency kit goes back to its location before the run ends (PREV-001 shows it otherwise). X9: any URGENT alert or cabin alarm ends the run; the robot announces the hold and that one crew action releases it. Design judgment (item 2).
RF2 (cough, wheeze, chest tightness or shortness of breath) labelled design judgment (item 3).
Requirement V2 7102 (body waste) replaced by V2 7064 (trash management) for used wipes in a sealed waste bag (item 4).
Batch 7 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician.

Oct 21, 2026, version 0.3. AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review), editorial; no named human clinician. Changes:

Source cdcdis: read live (WebFetch, Oct 21, 2026), so the search-index note is removed; adds 5.c (material compatibility), 6.a (no fogging) and 5.m/5.n (blood spills) (batch 7 suggestion 18).

Earlier version: Draft v0.2, Oct 21, 2026. Download the current YAML above.

Sources

U.S. Centers for Disease Control and Prevention. Guideline for Disinfection and Sterilization in Healthcare Facilities (2008): summary of recommendations. www.cdc.gov/infection-control/hcp/disinfection-sterilization… Supports: 3.b: at least high-level disinfection for semicritical equipment that touches mucous membranes or non-intact skin; 3.c: low-level disinfection for noncritical surfaces and equipment that touch intact skin; 4.b: follow the disinfectant label's safety precautions and use directions, including contact time; 4.c: disinfect noncritical devices when visibly soiled and on a regular basis; 5.c: follow manufacturers' instructions, such as use-dilution and material compatibility (checking compatibility with robot materials); 6.a: no disinfectant fogging in patient-care areas (the robot never sprays); 5.m and 5.n: prompt cleaning of blood spills, with gloves and other protective equipment. Read live (WebFetch, Oct 21, 2026).
Checinska Sielaff A, Urbaniak C, Mohan GBM, et al. Characterization of the total and viable bacterial and fungal communities associated with the International Space Station surfaces. Microbiome. 2019;7(1):50. PMID 30955503. doi:10.1186/s40168-019-0666-x Supports: Cultivable bacteria and fungi on ISS surfaces ranged from 10^4 to 10^9 CFU per square metre depending on location; the dominant organisms are associated with the human microbiome and may include opportunistic pathogens. Abstract read.
The College of Optometrists. Clinical Management Guidelines: Trauma (chemical) (last updated March 13, 2026) Primary-care optometry guidance (public sections only). www.college-optometrists.org/clinical-guidance/clinical-mana… Supports: Flush the eye immediately with sterile salt solution, or tap water if that is not available, and continue to irrigate for at least 20 minutes before seeking medical attention; damage is generally greatest with alkalis such as ammonia; severe cases need immediate referral to hospital eye services or emergency care. (Only the publicly visible sections were read; the full guideline needs a login.)
NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 3006, V1 6003, V1 7001, V1 7003.
NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 7082 (cleanable surface materials), V2 7083 (cleaning materials), V2 7064, and Section 10.6 automated and robotic systems.
NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.