Home › Robotic Medicine › Protocol library › RMP-RAD-001

Robotic Medicine · Protocol library

RMP-RAD-001 Solar particle event: shelter logistics and dosimeter readouts

Draft v0.3
Max autonomy Rung 2 · supervised
Priority Tier 1
Missions Low Earth orbit, Commercial flights, Moon, Mars
Updated Oct 21, 2026

AI-assisted Reviewed (AI-assisted) AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review, 14 required corrections and 17 optional suggestions); all required corrections are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use.

Download YAML Download JSON Protocol schema

Fixed rules (same in every protocol)

The flight surgeon is the medical authority. The crew medical officer (CMO) acts under delegated care [5].
A human starts the robot, can stop it at any time, and restarts it after any stop.
The robot never diagnoses and gives no drug or fluid advice.
On a fault or no human response, the robot goes to a safe state. On a lost link it pauses motion and tells the CMO, who decides whether to continue offline.
Locked out in every protocol: diagnosing; drug or fluid advice; starting, stopping or adjusting oxygen or any medicine; starting or restarting itself; changing its own protocol, thresholds or limits; handing over an item that failed a check (applies when RMP-PHARM-001 is used).
Result words the robot may use: dose as displayed, logged, not interpreted, reading not obtained, sent to flight surgeon, as stated by the crewmember. Never: normal, no problem found, all clear, negative, any diagnosis or cause, dose acceptable, low dose, below limit, within limits, no exposure, radiation sickness, all-clear (unless the commander announced it), safe, mild, minor.

1 · Identity and scope

When the vehicle radiation monitor alarms, the ground warns of a solar particle event (SPE), or the commander orders the crew to shelter, the robot alerts the flight surgeon at once, announces the alarm as displayed, clears the routes to the shelter and to the hatches, moves the stowage the shelter plan lists to the positions the plan shows on the commander's command, then restrains itself out of every route. It reads and logs the vehicle monitor and each active personal dosimeter as displayed, with clock times, and logs symptoms as stated. The commander decides when the crew shelter and when they come out. The robot never says what a dose means.

Why this protocol was chosen. SPEs (bursts of high-energy protons from the Sun) can expose a crew to large doses within hours. NASA-STD-3001 Volume 1 requires that all exposures are kept as low as reasonably achievable (V1 4029) and that crew are protected from the design reference SPE to below 250 mSv effective dose (V1 4031); Volume 2 requires monitoring of each crewmember's exposure (V2 6162) and an alarm to crew and operations teams when dose rates exceed set thresholds, even when the ground link is down (V2 6164). NASA technical brief OCHMO-TB-020 notes that a storm shelter can be built by rearranging water containers and other hydrogen-rich stowage, and that early warning lets the crew configure the shelter in time. Moving heavy stowage while the crew shelter is a task a robot could help with. NASA's evidence report on acute radiation syndromes lists nausea, vomiting, loss of appetite and fatigue as the most likely early effects, with possible skin injury. Open question for review: which stowage the shelter plan lets the robot move, and whether symptom prompts during shelter should be on screen only.

Autonomy: Max rung 2 for supervised moves of listed stowage (for example water containers) to shelter positions on the commander's command, route clearing, and reading displayed dosimeter values. The robot never enters a crewmember's route, never decides when to shelter or when to come out, and never says what a dose means.

Covers

A radiation monitor alarm, a ground SPE warning, or the commander's shelter order
Route clearing, shelter stowage moves and dosimeter readouts during the event and after the commander's all-clear
EVA crew return is led by the commander and the EVA procedure; the robot only keeps routes clear
Routing to RMP-RAD-003 (symptom tracking after the event), RMP-GI-002 and RMP-EVA-001

Locked out (never done by the robot under this protocol)

Diagnosis or naming a cause
Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen
Touching the crewmember
Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)
Deciding when to shelter or when to leave the shelter
Entering or stopping in a crewmember's route to the shelter or a hatch
Saying a dose is acceptable, low or within limits, or comparing a dose with a limit
Dose-interval cues for any medicine (the robot never says when a medicine is due; any medicine runs through RMP-PHARM-001); radiation dose readings are logged as displayed only
Moving stowage the shelter plan does not list, or over or around a crewmember

Related: RMP-RAD-002 · RMP-RAD-003 · RMP-GI-002 · RMP-EVA-001 · RMP-SKIN-002 · RMP-MSK-001

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

Second trained CMO: receives every alert and takes over if the CMO is the patient
Vehicle commander: leads the shelter procedure and announces the all-clear
Radiation operations team (ground): advises the commander and flight surgeon
Other crew: help as the commander directs

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [8]

Robot may

Alert the flight surgeon at once
Announce the alarm as displayed
Clear routes to the shelter and the hatches
Move listed stowage to shelter positions on the commander's command
Read and log the monitor and active dosimeters as displayed
Log symptoms as stated

Robot may not

Decide when to shelter or come out
Say what a dose means
Enter a crewmember's route
Touch the crewmember
Start without a human command

3 · Preconditions and consent

PRE-1 The commander or the CMO started the protocol by command after a radiation alarm, a ground SPE warning or a shelter order.human_start == trueV2 10174
PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
PRE-3 Robot and supplies restrained when not moving.V2 7046
PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent: Dosimeter readings and symptoms are recorded as part of the crew medical record; the crewmember shows or reads their own dosimeter.
Emergency consent: Route clearing and stowage moves go ahead on the commander's command.
Withdrawal: A crewmember can decline to show a dosimeter; the robot logs "not shown" and the vehicle monitor record stands.

4 · Required sensor inputs

ID	Input	Source	Required	If missing
IN-1	The alarm or warning as displayed, and the commander's order	Vehicle radiation monitor / commander	Yes	Log "not stated"; treat the alarm as active until the commander says otherwise.
IN-2	Vehicle monitor dose rate and dose as displayed	Vehicle radiation monitor	Yes	Log "reading not obtained" (never zero).
IN-3	Each active personal dosimeter reading as displayed or read out by its wearer	Personal dosimeter / crewmember	Optional	Log "reading not obtained" (never zero).
IN-4	Nausea, vomiting, fatigue or skin symptoms, as stated	Crewmember	Optional	Log "not stated".
IN-5	Crew accounting as the commander states it	Commander	Yes	Log "not accounted"; never assume accounted.
IN-6	Link status and delay	Communications system	Yes	Treat as link down; the vehicle alarm still stands.

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

S1RobotRung 2

Send an URGENT "radiation shelter" alert to the flight surgeon and the CMO at once, and announce the alarm or warning exactly as displayed. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

Done when: Alert acknowledged, or escalated.

V2 6164V2 10174V1 3006
S2RobotRung 2

Clear the routes to the shelter and to the hatches of loose items first, then hold at a position out of every route until the commander gives the next command.

Done when: Routes clear; robot out of the routes.

V2 7055
S3RobotRung 2

On the commander's command, move only the stowage the shelter plan lists (for example water containers) to the positions the plan shows, along routes no crewmember is using; stop and hold whenever a crewmember comes within the keep-out distance, and never place anything over or around a crewmember. Record each item moved and its new location.

Done when: Listed items in place, or stopped by the commander; inventory updated.

Limit: <set by validation>

V2 7059
D3DecisionCrew decides

Is any crewmember in or near the route of the next stowage move?
- Yes, or not known → Robot holds where it is, out of the route, until the commander says the route is clear.
- No (stated by the commander) → Continue the move.
S4Crew

The commander leads the shelter procedure, states the crew accounting, and leads any EVA return under the EVA procedure; the CMO checks the crew.

Done when: Crew sheltered as the commander states.

V1 4029V1 4031
S5RobotRung 2

Restrain itself at its shelter-plan position outside the shelter and out of every route. Read and log the vehicle monitor dose rate and dose as displayed, and each active personal dosimeter as its wearer shows or reads it, with clock times; send them to the flight surgeon and the radiation operations team when the link allows. A missing reading is logged as "reading not obtained", never as zero.

Done when: Readings logged with times.

V2 6162V2 6164V1 7001
S6RobotRung 2

Show a symptom prompt on screen (nausea, vomiting, tiredness, skin redness) that the crew can accept; log answers word for word.

Done when: Answers logged or "not stated".

V1 6003
D1DecisionRobot decides

Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?
- Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
- No → Continue.
D2DecisionRobot decides

Did each crewmember answer the symptom prompt, or say they want to skip it?
- Yes → Continue.
- Declined explicitly (the crewmember says no to a question) → Log "declined" for that question only; the alert already sent stands.
- No response, or the answer does not make sense → URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once.
S7RobotRung 2

After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

V2 10173V1 3006
S8Ground

The flight surgeon and radiation operations team (or the CMO and commander under the onboard checklist when there is no link) advise; the commander decides when the shelter ends and announces the all-clear [V1 4029].

Done when: All-clear announced by the commander.

V1 4029
D4DecisionGround decides

When does the shelter end, and what follow-up is needed?
- Link live → Flight surgeon decides; robot logs.
- Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
S9RobotRung 2

After the commander's all-clear, and on the commander's command, return the moved stowage to the locations recorded in S3 and update the inventory record; show any item not returned as "not returned".

Done when: Stowage returned or listed as not returned.

V2 7059V2 7055
S10RobotRung 2

Send the flight surgeon one package: alarm and order times, crew accounting as stated, readings as displayed, symptoms as stated, stowage moves and decisions.

Done when: Package delivered or queued.

V1 6003V1 7001V1 7003

7 · Stop and escalate rules, red flags

ID	Trigger	What happens	Level
X1	The patient (or the crewmember being examined) says stop, or withdraws consent	Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running.V2 10165	stop
X2	Any crewmember presses stop or takes over control	Protective stop; robot holds its stopped position; only a human may restart it.V2 10165V2 10168V2 10174	safe-state
X3	Robot fault, sensor fault, or a force, speed or reach limit is reached	Protective stop and hand control to the CMO; log the fault.V2 10172V2 10168	safe-state
X4	CMO is asked to take over and does not respond (for example, the CMO is the patient)	Robot stays stopped; the next named crewmember is called.V2 10173V2 7045	safe-state
X5	Loss of link, or delay longer than the limit for live guidance	Only the robot pauses: it holds a position clear of hatch routes and the crew, and tells the CMO. Crew care never waits for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation.V2 10172V2 10173	pause
X6	An URGENT alert is not acknowledged within the set time	Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own.V1 3006V2 10173	urgent
X7	The crewmember stops responding, or seems confused or drowsy, at any point	URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person.	urgent
X8	A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice	Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.	stop
X9	A crewmember needs a route the robot or a moved item is in	Robot stops, clears the route at once if it can do so without contact, otherwise holds still and announces where it is; it does not leave the module on its own.V2 10172	safe-state
X10	Robot faults during the event (radiation can upset electronics)	Protective stop at its position; the commander decides whether a crewmember moves it.V2 10172V2 10168	safe-state

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

ID	Sign	Threshold	Action
RF1	Nausea or vomiting during or after the event, as stated [2]	any	URGENT alert; see RMP-GI-002; the flight surgeon decides
RF2	Skin redness or burning, as stated [2]	any	Flag to the flight surgeon; see RMP-SKIN-002
RF3	Unusual tiredness or weakness, as stated [2]	any	Flag to the flight surgeon
RF4	A crewmember is on an EVA or outside the shelter when the alarm sounds [1]	any	URGENT alert; the commander leads the return under the EVA procedure; see RMP-EVA-001
RF5	A personal dosimeter or the vehicle monitor shows its own alarm [1]	any	URGENT alert; the commander and flight surgeon decide
RF6	Injury while moving stowage or getting to the shelter (design judgment) (general clinical red flag; no source cited)	any	URGENT alert; see RMP-MSK-001

8 · Safety limits

ID	Limit	Value	How enforced
L1	Contact with the crewmember	not allowed	Keep-out zone in the robot controllerV2 10172
L2	Robot in a crewmember's route to the shelter or a hatch	not allowed	Keep-out map of routes in the robot controller
L3	Mass and size of each stowage item the robot moves	<set by validation>	Hard limit in the controller
L4	Robot speed near the crewmember	<set by validation>	Hard limit in the controllerV2 10172

9 · Logs and audit

LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
LOG-5 Alarm and order times, crew accounting as stated, each reading as displayed with time, symptoms as stated, stowage moves and returns.
LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163

10 · Links to NASA-STD-3001

Requirement	Topic (paraphrased)	How this protocol uses it
[V1 3006]	Crew medical officers: two per vehicle	Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note).
[V1 4029]	Radiation exposure kept as low as reasonably achievable (ALARA)	Radiation exposures kept as low as reasonably achievable; sheltering is part of that.
[V1 4031]	Protection from the design reference solar particle event	Protection from the design reference solar particle event; the commander leads the shelter procedure.
[V1 6003]	Private medical communications	Logs and alerts sent to the ground are private medical communications.
[V1 7001]	Medical records kept permanently and retrievable for trend analysis	Records kept so the flight surgeon can see trends.
[V1 7003]	Security of medical records	Secure handling of medical records.
[V2 6162]	Individual crew radiation exposure monitoring	Each crewmember's exposure is monitored; the robot logs readings as displayed.
[V2 6164]	Radiation alerts above set thresholds	The radiation monitor alarms crew and operations teams above set thresholds, even with the link down; the robot announces the alarm as displayed.
[V2 7045]	Medical equipment usable by non-physician crew	Usable by non-physician crew, including when the CMO is the patient.
[V2 7046]	Restraint of patient, care provider and supplies	Patient, caregiver and supplies restrained.
[V2 7055]	Stowage accessibility by priority of use	Mission-critical items stay accessible; routes to the shelter and hatches are cleared first.
[V2 7059]	Inventory management: track locations and quantities	Stowage moved for the shelter is tracked and returned.
[V2 10161]	Automated system status shown to the operator	Robot shows its status and health.
[V2 10162]	Mode changes announced	Mode changes are announced to the operator.
[V2 10163]	Data recording and sharing	Robot records and shares its data.
[V2 10164]	Clear allocation of responsibility (human or system)	Shows whether the human or the robot is expected to act.
[V2 10165]	Human override and shutdown	Human can override and shut down the robot.
[V2 10168]	Failure recovery: safe human takeover	Human can take over.
[V2 10172]	Protective stop when limits are exceeded	Protective stop when a limit is exceeded.
[V2 10173]	Safety Default	Robot stays stopped if no one takes over.
[V2 10174]	Only a human initiates or restarts	Only a human starts or restarts the robot.

IDs as published in Volume 1 Revision C [3] and Volume 2 Revision F [4]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

Simulation. Scripted alarm, ground warning, crewmember on EVA, robot fault, CMO as patient, lost link. Pass: Zero route intrusions; no dose interpreted; missing readings never zero.
Training model. Shelter drill with the robot moving listed stowage. Pass: Shelter configured within the time the plan sets.
Parabolic or station demonstration. Stowage moves in weightlessness with no crew in the routes. Pass: Keep-out held.
Flight use under flight surgeon supervision. First use in shelter drills. Pass: No safety events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
Flight surgeon, as medical authority
Robotics and medical-device safety board
Program approval for the mission

Each run

Started by the commander or the CMO. The commander leads the shelter procedure and announces the all-clear.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.3.

13 · Change control for learning

Every change gets a new version number and a written reason; earlier versions are kept.
Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [7].

Loss of signal and Mars delay

Live link

Low Earth orbit: the radiation operations team and flight surgeon advise the commander when the link allows.

Loss of signal

Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot.
The vehicle alarm and the onboard shelter procedure stand without the ground.

Mars-class delay

The shelter plan, the stowage list and the alarm thresholds are set before flight; the commander and CMO act on them.

[6]

Corrections and updates

Oct 21, 2026, version 0.2. AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review); no named human clinician. Changes:

Source tb020 retitled "Design for Ionizing Radiation Protection. Technical Brief OCHMO-TB-020 Rev G (2025)" (brief dated June 6, 2025) (item 5).
Batch 7 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician.

Oct 21, 2026, version 0.3. Batch 12 editorial (AI-assisted), Oct 21, 2026; no named human clinician. Changes:

The scope now routes symptom tracking after the event to RMP-RAD-003, which exists as a v0.1 draft.

Earlier version: Draft v0.2, Oct 21, 2026. Download the current YAML above.

Sources

NASA OCHMO. Design for Ionizing Radiation Protection. Technical Brief OCHMO-TB-020 Rev G (2025). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-020-radiati… Supports: Shielding is effective against solar particle events (SPEs); monitoring, accurate event determination, dosimetry and timely reporting to alert crew to seek shelter are essential. A storm shelter can add about 10 cm water equivalent in crew quarters, for example by rearranging water containers and other high-hydrogen items; radiation alerting gives early warning so the crew can configure the shelter; real-time alert dosimetry protects EVA crew if the EVA is ended within 2 hours with access to shielding. Read Oct 21, 2026.
NASA Human Research Program. Evidence Report: Risk of Acute Radiation Syndromes due to Solar Particle Events (2016). humanresearchroadmap.nasa.gov/evidence/reports/Acute.pdf Supports: The acute radiation effects most likely in the prodromal phase after an SPE exposure are nausea, vomiting, anorexia and fatigue, with possible skin injury. Read Oct 21, 2026.
NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 4029 (ALARA), V1 4031 (design reference SPE, below 250 mSv effective dose), V1 3006, V1 6003, V1 7001, V1 7003.
NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 6162 (individual exposure monitoring), V2 6164 (alarm above set thresholds, even with the link down), V2 7055, V2 7059, and Section 10.6 automated and robotic systems.
NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.