{
  "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json",
  "schema_version": "0.3",
  "id": "RMP-RENAL-001",
  "slug": "rmp-renal-001",
  "former_ids": [
    "ASSIST-US-RENAL-001"
  ],
  "title": "Assisted diagnostic ultrasound for a suspected kidney stone",
  "version": "0.7",
  "status": "draft",
  "conceptual": true,
  "not_for_clinical_use": true,
  "category": "renal",
  "tier": 1,
  "max_autonomy": 2,
  "missions": [
    "leo",
    "commercial",
    "moon",
    "mars"
  ],
  "updated": "2026-10-21",
  "review": {
    "state": "reviewed-ai-assisted",
    "reviewed": "2026-10-20",
    "human_clinician_review": false,
    "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. The clinical content (from the Part 1 example) was first reviewed on Oct 18, 2026; the full-format structure was reviewed on Oct 20, 2026, and all corrections are applied in this version (see Corrections)."
  },
  "fixed_rules": {
    "flight_surgeon_is_medical_authority": true,
    "cmo_acts_under_delegated_care": true,
    "human_starts_and_restarts_robot": true,
    "robot_never_diagnoses": true,
    "no_drug_or_fluid_advice_by_robot": true,
    "safe_state_on_fault_or_no_response": true,
    "lost_link_pause_then_cmo_decides": true
  },
  "robot_lockouts": {
    "diagnosis": true,
    "drug_or_fluid_advice": true,
    "starting_stopping_or_adjusting_oxygen_or_any_medicine": true,
    "self_start_or_self_restart": true,
    "changing_own_protocol_thresholds_or_limits": true,
    "handing_over_a_mismatched_item_as_verified": true
  },
  "result_language": {
    "use": [
      "non-diagnostic",
      "images acquired, for human review",
      "flagged for human review"
    ],
    "never": [
      "normal",
      "no problem found",
      "all clear",
      "negative",
      "any diagnosis or cause",
      "no stone"
    ]
  },
  "scope": {
    "summary": "The robot positions and holds an ultrasound probe, captures and labels standard kidney and bladder views, and sends them to the flight surgeon, while the CMO leads and can take over at any moment. Diagnostic imaging only.",
    "why": "Kidney stone risk is higher in flight, and ultrasound is the imaging available on board. This is the worked example from Part 1 of the Robotic Medicine series, and the scenario the ground console simulates.",
    "covers": [
      "Suspected kidney stone in a crewmember: right and left kidney views, bladder views including ureteral jets, optional color Doppler \"twinkle\" views"
    ],
    "locked_out": [
      "Ultrasonic stone propulsion, burst-wave lithotripsy, and needle or nephrostomy guidance (investigational; out of scope)",
      "Any treatment, fluid or medication advice",
      "Interpreting images"
    ],
    "related": [
      "RMP-RENAL-002",
      "RMP-PREV-003"
    ]
  },
  "roles": {
    "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.",
    "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.",
    "others": [
      "Treatment is decided by humans only: pain relief (anti-inflammatory first), anti-nausea medicine and tamsulosin are decided by the CMO and flight surgeon; no forced or high-volume fluids for acute colic"
    ],
    "robot_may": [
      "Position and hold the probe",
      "Capture and label images",
      "Send images live or store-and-forward"
    ],
    "robot_may_not": [
      "Diagnose",
      "Give treatment, fluid or medication advice",
      "Use therapeutic ultrasound modes"
    ],
    "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)"
  },
  "preconditions": [
    {
      "id": "PRE-1",
      "text": "A crewmember started the run by command.",
      "check": "human_start == true",
      "refs": [
        "V2 10174"
      ]
    },
    {
      "id": "PRE-2",
      "text": "Patient consent recorded (voice or touch confirmation, logged)."
    },
    {
      "id": "PRE-3",
      "text": "CMO present and able to take over at any moment.",
      "refs": [
        "V2 10168",
        "V2 10164"
      ]
    },
    {
      "id": "PRE-4",
      "text": "Patient, caregiver and robot restrained.",
      "refs": [
        "V2 7046"
      ]
    },
    {
      "id": "PRE-5",
      "text": "Ultrasound and gel checked; robot self-test passed.",
      "refs": [
        "V2 10161"
      ]
    },
    {
      "id": "PRE-6",
      "text": "Link check: flight surgeon agrees to this run, or link down / delay too long and the CMO proceeds under the pre-approved onboard checklist."
    }
  ],
  "consent": {
    "standard": "Patient consent recorded by voice or touch confirmation and logged.",
    "emergency": "If the patient cannot consent: proceed only on a CMO and flight surgeon emergency decision, logged.",
    "withdrawal": "Patient says stop: stop, retract probe, alert CMO."
  },
  "inputs": [
    {
      "id": "IN-1",
      "name": "Ultrasound image stream with quality score",
      "source": "Ultrasound device",
      "required": true,
      "if_missing": "Hand probe control to the CMO or ground."
    },
    {
      "id": "IN-2",
      "name": "Probe position and contact force",
      "source": "Robot sensors",
      "required": true,
      "if_missing": "Protective stop."
    },
    {
      "id": "IN-3",
      "name": "Patient vital signs (heart rate, blood pressure, temperature)",
      "source": "Monitor",
      "required": true,
      "if_missing": "CMO measures and enters them."
    },
    {
      "id": "IN-4",
      "name": "Urine output and urine dipstick result",
      "source": "Entered by the CMO (robot records only)",
      "required": true,
      "if_missing": "Log as missing; flag for the flight surgeon."
    },
    {
      "id": "IN-5",
      "name": "Communications status and current delay",
      "source": "Communications system",
      "required": true,
      "if_missing": "Treat as link down."
    }
  ],
  "steps": [
    {
      "id": "S1",
      "actor": "crew",
      "action": "Confirm patient position and expose scan areas.",
      "success": "CMO confirms."
    },
    {
      "id": "S2",
      "actor": "robot",
      "rung": 2,
      "action": "Right kidney views; automatic image-quality check.",
      "success": "Views meet the quality threshold."
    },
    {
      "id": "S3",
      "actor": "robot",
      "rung": 2,
      "action": "Left kidney, same views as right, for side-by-side comparison.",
      "success": "Views meet the quality threshold."
    },
    {
      "id": "S4",
      "actor": "robot",
      "rung": 2,
      "action": "Bladder views, including the ureteral jet on each side.",
      "success": "Views captured."
    },
    {
      "id": "S5",
      "actor": "robot",
      "rung": 2,
      "action": "Optional color Doppler \"twinkle\" views (twinkle may be harder to see at high cabin CO2; animal data only).",
      "success": "Views captured or skipped."
    },
    {
      "id": "S6",
      "actor": "robot",
      "rung": 2,
      "action": "Label images and attach them to the medical record; send to the flight surgeon live, or store-and-forward if no link.",
      "success": "Delivery confirmed or queued.",
      "refs": [
        "V1 7003"
      ]
    }
  ],
  "decisions": [
    {
      "id": "D1",
      "after": "S1",
      "decided_by": "crew",
      "question": "Is the delay Mars-class, or the link down? (Set before scanning.)",
      "branches": [
        {
          "if": "Yes",
          "then": "No real-time guidance; onboard checklist plus store-and-forward only."
        },
        {
          "if": "No",
          "then": "Live guidance allowed."
        }
      ]
    },
    {
      "id": "D2",
      "after": "S3",
      "decided_by": "robot",
      "question": "Is image quality still low after the allowed attempts?",
      "branches": [
        {
          "if": "Yes",
          "then": "Hand probe control to the CMO or ground."
        },
        {
          "if": "No",
          "then": "Continue."
        }
      ]
    },
    {
      "id": "D3",
      "after": "S4",
      "decided_by": "ground",
      "question": "Does the collecting system look swollen (possible blockage)? Decided by the flight surgeon when the link is live; otherwise by the CMO under the onboard checklist, with flight surgeon review at the next contact.",
      "branches": [
        {
          "if": "Possible swelling seen (by the human reviewer)",
          "then": "Flag for human review; the robot does not interpret."
        },
        {
          "if": "Scan without findings",
          "then": "Report \"non-diagnostic\", never \"normal\" or \"no stone\". Ultrasound can miss ureteral stones, and swelling may not show early; CT is the reference test on Earth but is not available in flight."
        }
      ]
    },
    {
      "id": "D4",
      "after": "S6",
      "decided_by": "robot",
      "question": "Did the images reach the flight surgeon?",
      "branches": [
        {
          "if": "Yes",
          "then": "Log delivery; wait for the human decision."
        },
        {
          "if": "No (link down or queued)",
          "then": "Keep queued; show the CMO the onboard checklist page; resend at the next contact."
        }
      ]
    }
  ],
  "stop_rules": [
    {
      "id": "X1",
      "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent",
      "action": "Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running.",
      "level": "stop",
      "refs": [
        "V2 10165"
      ]
    },
    {
      "id": "X2",
      "trigger": "Any crewmember presses stop or takes over control",
      "action": "Protective stop; robot holds its stopped position; only a human may restart it.",
      "level": "safe-state",
      "refs": [
        "V2 10165",
        "V2 10168",
        "V2 10174"
      ]
    },
    {
      "id": "X3",
      "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached",
      "action": "Protective stop and hand control to the CMO; log the fault.",
      "level": "safe-state",
      "refs": [
        "V2 10172",
        "V2 10168"
      ]
    },
    {
      "id": "X4",
      "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)",
      "action": "Robot stays stopped; the next named crewmember is called.",
      "level": "safe-state",
      "refs": [
        "V2 10173",
        "V2 7045"
      ]
    },
    {
      "id": "X5",
      "trigger": "Loss of link, or delay longer than the limit for live guidance",
      "action": "Only the robot pauses; crew care never waits for the link or the robot. Robot pauses any movement in its stopped position and tells the CMO. The CMO decides whether to continue offline under the pre-approved onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent to the flight surgeon at the next contact.",
      "level": "pause",
      "refs": [
        "V2 10172",
        "V2 10173"
      ]
    },
    {
      "id": "X6",
      "trigger": "Pain increases during scanning",
      "action": "Stop, retract probe, alert CMO.",
      "level": "stop"
    }
  ],
  "red_flags": [
    {
      "id": "RF1",
      "sign": "Temperature, shaking chills or unstable vital signs",
      "threshold": "temperature <set by clinical lead> or higher",
      "action": "Stop; URGENT call to the flight surgeon. A suspected infected, blocked kidney needs urgent drainage plus antibiotics; from low Earth orbit this means planning evacuation. Onboard nephrostomy is not an established capability. The flight surgeon decides antibiotics and evacuation; the robot does not.",
      "source": "eau"
    },
    {
      "id": "RF2",
      "sign": "No or very low urine output",
      "threshold": "<set by clinical lead>",
      "action": "URGENT call to the flight surgeon"
    },
    {
      "id": "RF3",
      "sign": "Known single kidney, or swelling on both sides (as judged by a human reviewer)",
      "threshold": "any",
      "action": "URGENT call"
    },
    {
      "id": "RF4",
      "sign": "Pain or vomiting not controlled by onboard medicines",
      "threshold": "any",
      "action": "URGENT call"
    },
    {
      "id": "RF5",
      "sign": "Dipstick positive for nitrite or leukocytes, with symptoms",
      "threshold": "any",
      "action": "URGENT call"
    },
    {
      "id": "RF6",
      "sign": "Rising creatinine, where it can be measured",
      "threshold": "<set by clinical lead>",
      "action": "URGENT call"
    }
  ],
  "safety_limits": [
    {
      "id": "L1",
      "name": "Probe force",
      "value": "<set by validation>",
      "enforced": "Force sensing; protective stop",
      "refs": [
        "V2 10172"
      ]
    },
    {
      "id": "L2",
      "name": "Probe speed",
      "value": "<set by validation>",
      "enforced": "Hard limit",
      "refs": [
        "V2 10172"
      ]
    },
    {
      "id": "L3",
      "name": "Session time",
      "value": "<set by validation>",
      "enforced": "Timer"
    },
    {
      "id": "L4",
      "name": "Delay limit for live guidance",
      "value": "<set by validation>",
      "enforced": "Communications monitor"
    }
  ],
  "logs": [
    {
      "id": "LOG-1",
      "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.",
      "refs": [
        "V2 10163",
        "V2 10164"
      ]
    },
    {
      "id": "LOG-2",
      "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.",
      "refs": [
        "V2 10162",
        "V2 10172"
      ]
    },
    {
      "id": "LOG-3",
      "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.",
      "refs": [
        "V1 6003",
        "V1 7003"
      ]
    },
    {
      "id": "LOG-4",
      "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.",
      "refs": [
        "V1 7001"
      ]
    }
  ],
  "requirements": [
    {
      "id": "V1 3006",
      "use": "Two crew medical officers per vehicle for NASA programs (see the commercial-flight note)."
    },
    {
      "id": "V1 3007",
      "use": "Evacuation to definitive care for a suspected infected, blocked kidney from low Earth orbit."
    },
    {
      "id": "V1 6003",
      "use": "Private medical communications."
    },
    {
      "id": "V1 7001",
      "use": "Records kept in a permanent, retrievable form for trend analysis."
    },
    {
      "id": "V1 7003",
      "use": "Secure medical records."
    },
    {
      "id": "V2 7045",
      "use": "Usable when the CMO is the patient; next named crewmember answers."
    },
    {
      "id": "V2 7046",
      "use": "Restraints."
    },
    {
      "id": "V2 10161",
      "use": "Status shown."
    },
    {
      "id": "V2 10162",
      "use": "Mode changes are announced to the operator."
    },
    {
      "id": "V2 10163",
      "use": "Data recorded and shared."
    },
    {
      "id": "V2 10164",
      "use": "Shows who acts."
    },
    {
      "id": "V2 10165",
      "use": "Human override."
    },
    {
      "id": "V2 10168",
      "use": "Human takeover."
    },
    {
      "id": "V2 10172",
      "use": "Protective stop."
    },
    {
      "id": "V2 10173",
      "use": "Robot stays stopped if no one takes over."
    },
    {
      "id": "V2 10174",
      "use": "Only a human starts or restarts the robot."
    }
  ],
  "validation": [
    {
      "stage": "simulation",
      "what": "Simulated scans and the ground console scenarios at station, Moon and Mars delays.",
      "pass": "Pass criteria set in advance."
    },
    {
      "stage": "training model",
      "what": "Ultrasound training model (phantom).",
      "pass": "Image quality and force limits met; criteria set in advance."
    },
    {
      "stage": "Earth analog",
      "what": "Analog crew with remote flight surgeons.",
      "pass": "Criteria set in advance."
    },
    {
      "stage": "parabolic or station demonstration",
      "what": "Flight demonstration.",
      "pass": "Criteria set in advance."
    }
  ],
  "signoff": {
    "protocol": [
      "Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)",
      "Flight surgeon, as medical authority",
      "Robotics and medical-device safety board",
      "Program approval for the mission"
    ],
    "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.",
    "each_run": "Flight surgeon agreement when the link allows; otherwise the CMO under the pre-approved onboard checklist, with flight surgeon review of images and logs at the next contact."
  },
  "change_control": [
    "Every change gets a new version number and a written reason; earlier versions are kept.",
    "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.",
    "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.",
    "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.",
    "The robot never changes its own protocol, thresholds or limits."
  ],
  "comms": {
    "live": "Low Earth orbit: the flight surgeon can watch and guide live.",
    "loss_of_signal": [
      "Only the robot pauses; crew care never waits for the link or the robot.",
      "The robot pauses the probe in its stopped position (or retracts it) and tells the CMO. The CMO decides whether to continue under the onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged for the flight surgeon."
    ],
    "mars_delay": [
      "Mars-class delay: no real-time guidance; onboard checklist plus store-and-forward only.",
      "With up to about 21-23 minutes one way and blackouts of about 2-3 weeks, every threshold must be set before flight."
    ],
    "max_delay_for_live_guidance": "<set by validation>"
  },
  "sources": [
    {
      "key": "renal",
      "text": "NASA Human Research Program. Evidence Report: Risk of Renal Stone Formation (2024).",
      "url": "https://humanresearchroadmap.nasa.gov/evidence/other/2024%20Renal%20Evidence%20Report_Final.pdf",
      "supports": "Imaging steps and limits of ultrasound; no CT in flight; onboard urine dipstick testing; evacuation rather than onboard nephrostomy from low Earth orbit."
    },
    {
      "key": "eau",
      "text": "European Association of Urology. EAU Guidelines on Urolithiasis.",
      "url": "https://uroweb.org/guidelines/urolithiasis",
      "supports": "An infected, obstructed kidney needs urgent drainage plus antibiotics."
    },
    {
      "key": "harper",
      "text": "Harper JD, Cunitz BW, Dunmire B, et al. First in human clinical trial of ultrasonic propulsion of kidney stones. J Urol. 2016;195(4 Pt 1):956-964.",
      "url": "https://doi.org/10.1016/j.juro.2015.10.131",
      "doi": "10.1016/j.juro.2015.10.131",
      "pmid": "26521719",
      "supports": "Ultrasonic stone propulsion is still investigational."
    },
    {
      "key": "worster",
      "text": "Worster AS, Bhanich Supapol W. Fluids and diuretics for acute ureteric colic. Cochrane Database Syst Rev. 2012;(2):CD004926.",
      "url": "https://doi.org/10.1002/14651858.CD004926.pub3",
      "doi": "10.1002/14651858.CD004926.pub3",
      "pmid": "22336806",
      "supports": "No reliable evidence that forced fluids help in acute colic."
    },
    {
      "key": "tb044",
      "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).",
      "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf",
      "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist."
    },
    {
      "key": "v1",
      "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).",
      "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf",
      "supports": "Requirement IDs beginning V1."
    },
    {
      "key": "v2",
      "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.",
      "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2",
      "supports": "Requirement IDs beginning V2."
    },
    {
      "key": "marsdelay",
      "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).",
      "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf",
      "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction."
    },
    {
      "key": "faa460",
      "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.",
      "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460",
      "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants."
    }
  ],
  "corrections": [
    {
      "date": "2026-10-20",
      "version": "0.3",
      "source": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026",
      "items": [
        "Added a precondition that a crewmember started the run ([V2 10174]).",
        "D2 now says the flight surgeon decides when the link is live, otherwise the CMO under the onboard checklist.",
        "The Mars-class / link-down decision now comes right after S1, before scanning.",
        "X6 now covers only increasing pain; \"patient says stop\" stays in X1.",
        "Per-run sign-off wording confirmed (flight surgeon when the link allows; otherwise the CMO, with later review).",
        "Loss of link (X5) now pauses the probe and the CMO decides whether to continue.",
        "Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build."
      ]
    },
    {
      "date": "2026-10-21",
      "version": "0.4",
      "source": "Batch 5 editorial (AI-assisted), Oct 21, 2026",
      "items": [
        "Renal evidence report citation now includes \"(approved for public release September 23, 2024)\", matching RMP-RENAL-004 (batch 4 optional item 44).",
        "Library-wide \"safe\" wording in inherited stop rules and requirement uses rewritten per batch 4 review item 49 (holds its stopped position / stays stopped / take over / Robot stays stopped). Schema level name safe-state unchanged."
      ]
    },
    {
      "date": "2026-10-21",
      "version": "0.4",
      "source": "Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49",
      "items": [
        "Inherited stop-rule and requirement wording: \"holds a safe position\" → \"holds its stopped position\"; \"stays in its safe state\" → \"stays stopped\"; \"take over safely\" → \"take over\"; \"Robot stays safe if no one takes over\" → \"Robot stays stopped if no one takes over\". Schema level name safe-state and never-word list entry \"safe\" unchanged."
      ]
    },
    {
      "date": "2026-10-21",
      "version": "0.5",
      "source": "Batch 6 editorial (AI-assisted), Oct 21, 2026",
      "items": [
        "Renal evidence report citation label changed from \"(approved for public release September 23, 2024)\" to \"(2024)\", the site's year-only citation convention.",
        "Requirement use for [V2 10173] changed from \"Safe default.\" to \"Robot stays stopped if no one takes over.\" (batch 5 review item 25; editorial, behaviour unchanged)."
      ]
    },
    {
      "date": "2026-10-21",
      "version": "0.6",
      "source": "Batch 7 editorial (AI-assisted), Oct 21, 2026",
      "items": [
        "Citation labels changed to the site's year-only convention: \"(approved for public release <date>)\" now reads \"(YYYY)\", and NASA-STD-3001 Volume 2 \"Revision F (approved July 14, 2026)\" now reads \"(Rev F, 2026)\" (sources: v2). Editorial; no change to steps, thresholds or limits."
      ]
    },
    {
      "date": "2026-10-21",
      "version": "0.7",
      "source": "Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026",
      "items": [
        "X5 and the comms loss-of-signal branch now open with \"Only the robot pauses; crew care never waits for the link or the robot.\" (batch 7 review suggestion 29). Editorial; robot behaviour unchanged."
      ]
    }
  ]
}