# RMP-RENAL-001 Assisted diagnostic ultrasound for a suspected kidney stone # Version 0.7 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' id: RMP-RENAL-001 slug: rmp-renal-001 former_ids: - ASSIST-US-RENAL-001 title: Assisted diagnostic ultrasound for a suspected kidney stone version: '0.7' status: draft conceptual: true not_for_clinical_use: true category: renal tier: 1 max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted reviewed: '2026-10-20' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. The clinical content (from the Part 1 example) was first reviewed on Oct 18, 2026; the full-format structure was reviewed on Oct 20, 2026, and all corrections are applied in this version (see Corrections). fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true result_language: use: - non-diagnostic - images acquired, for human review - flagged for human review never: - normal - no problem found - all clear - negative - any diagnosis or cause - no stone scope: summary: >- The robot positions and holds an ultrasound probe, captures and labels standard kidney and bladder views, and sends them to the flight surgeon, while the CMO leads and can take over at any moment. Diagnostic imaging only. why: >- Kidney stone risk is higher in flight, and ultrasound is the imaging available on board. This is the worked example from Part 1 of the Robotic Medicine series, and the scenario the ground console simulates. covers: - >- Suspected kidney stone in a crewmember: right and left kidney views, bladder views including ureteral jets, optional color Doppler "twinkle" views locked_out: - >- Ultrasonic stone propulsion, burst-wave lithotripsy, and needle or nephrostomy guidance (investigational; out of scope) - Any treatment, fluid or medication advice - Interpreting images related: - RMP-RENAL-002 - RMP-PREV-003 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - >- Treatment is decided by humans only: pain relief (anti-inflammatory first), anti-nausea medicine and tamsulosin are decided by the CMO and flight surgeon; no forced or high-volume fluids for acute colic robot_may: - Position and hold the probe - Capture and label images - Send images live or store-and-forward robot_may_not: - Diagnose - Give treatment, fluid or medication advice - Use therapeutic ultrasound modes commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: A crewmember started the run by command. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Patient consent recorded (voice or touch confirmation, logged). - id: PRE-3 text: CMO present and able to take over at any moment. refs: - V2 10168 - V2 10164 - id: PRE-4 text: Patient, caregiver and robot restrained. refs: - V2 7046 - id: PRE-5 text: Ultrasound and gel checked; robot self-test passed. refs: - V2 10161 - id: PRE-6 text: >- Link check: flight surgeon agrees to this run, or link down / delay too long and the CMO proceeds under the pre-approved onboard checklist. consent: standard: Patient consent recorded by voice or touch confirmation and logged. emergency: 'If the patient cannot consent: proceed only on a CMO and flight surgeon emergency decision, logged.' withdrawal: 'Patient says stop: stop, retract probe, alert CMO.' inputs: - id: IN-1 name: Ultrasound image stream with quality score source: Ultrasound device required: true if_missing: Hand probe control to the CMO or ground. - id: IN-2 name: Probe position and contact force source: Robot sensors required: true if_missing: Protective stop. - id: IN-3 name: Patient vital signs (heart rate, blood pressure, temperature) source: Monitor required: true if_missing: CMO measures and enters them. - id: IN-4 name: Urine output and urine dipstick result source: Entered by the CMO (robot records only) required: true if_missing: Log as missing; flag for the flight surgeon. - id: IN-5 name: Communications status and current delay source: Communications system required: true if_missing: Treat as link down. steps: - id: S1 actor: crew action: Confirm patient position and expose scan areas. success: CMO confirms. - id: S2 actor: robot rung: 2 action: Right kidney views; automatic image-quality check. success: Views meet the quality threshold. - id: S3 actor: robot rung: 2 action: Left kidney, same views as right, for side-by-side comparison. success: Views meet the quality threshold. - id: S4 actor: robot rung: 2 action: Bladder views, including the ureteral jet on each side. success: Views captured. - id: S5 actor: robot rung: 2 action: >- Optional color Doppler "twinkle" views (twinkle may be harder to see at high cabin CO2; animal data only). success: Views captured or skipped. - id: S6 actor: robot rung: 2 action: >- Label images and attach them to the medical record; send to the flight surgeon live, or store-and-forward if no link. success: Delivery confirmed or queued. refs: - V1 7003 decisions: - id: D1 after: S1 decided_by: crew question: Is the delay Mars-class, or the link down? (Set before scanning.) branches: - if: 'Yes' then: No real-time guidance; onboard checklist plus store-and-forward only. - if: 'No' then: Live guidance allowed. - id: D2 after: S3 decided_by: robot question: Is image quality still low after the allowed attempts? branches: - if: 'Yes' then: Hand probe control to the CMO or ground. - if: 'No' then: Continue. - id: D3 after: S4 decided_by: ground question: >- Does the collecting system look swollen (possible blockage)? Decided by the flight surgeon when the link is live; otherwise by the CMO under the onboard checklist, with flight surgeon review at the next contact. branches: - if: Possible swelling seen (by the human reviewer) then: Flag for human review; the robot does not interpret. - if: Scan without findings then: >- Report "non-diagnostic", never "normal" or "no stone". Ultrasound can miss ureteral stones, and swelling may not show early; CT is the reference test on Earth but is not available in flight. - id: D4 after: S6 decided_by: robot question: Did the images reach the flight surgeon? branches: - if: 'Yes' then: Log delivery; wait for the human decision. - if: No (link down or queued) then: Keep queued; show the CMO the onboard checklist page; resend at the next contact. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses; crew care never waits for the link or the robot. Robot pauses any movement in its stopped position and tells the CMO. The CMO decides whether to continue offline under the pre-approved onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent to the flight surgeon at the next contact. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: Pain increases during scanning action: Stop, retract probe, alert CMO. level: stop red_flags: - id: RF1 sign: Temperature, shaking chills or unstable vital signs threshold: temperature or higher action: >- Stop; URGENT call to the flight surgeon. A suspected infected, blocked kidney needs urgent drainage plus antibiotics; from low Earth orbit this means planning evacuation. Onboard nephrostomy is not an established capability. The flight surgeon decides antibiotics and evacuation; the robot does not. source: eau - id: RF2 sign: No or very low urine output threshold: action: URGENT call to the flight surgeon - id: RF3 sign: Known single kidney, or swelling on both sides (as judged by a human reviewer) threshold: any action: URGENT call - id: RF4 sign: Pain or vomiting not controlled by onboard medicines threshold: any action: URGENT call - id: RF5 sign: Dipstick positive for nitrite or leukocytes, with symptoms threshold: any action: URGENT call - id: RF6 sign: Rising creatinine, where it can be measured threshold: action: URGENT call safety_limits: - id: L1 name: Probe force value: enforced: Force sensing; protective stop refs: - V2 10172 - id: L2 name: Probe speed value: enforced: Hard limit refs: - V2 10172 - id: L3 name: Session time value: enforced: Timer - id: L4 name: Delay limit for live guidance value: enforced: Communications monitor logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 requirements: - id: V1 3006 use: Two crew medical officers per vehicle for NASA programs (see the commercial-flight note). - id: V1 3007 use: Evacuation to definitive care for a suspected infected, blocked kidney from low Earth orbit. - id: V1 6003 use: Private medical communications. - id: V1 7001 use: Records kept in a permanent, retrievable form for trend analysis. - id: V1 7003 use: Secure medical records. - id: V2 7045 use: Usable when the CMO is the patient; next named crewmember answers. - id: V2 7046 use: Restraints. - id: V2 10161 use: Status shown. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Data recorded and shared. - id: V2 10164 use: Shows who acts. - id: V2 10165 use: Human override. - id: V2 10168 use: Human takeover. - id: V2 10172 use: Protective stop. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: Simulated scans and the ground console scenarios at station, Moon and Mars delays. pass: Pass criteria set in advance. - stage: training model what: Ultrasound training model (phantom). pass: Image quality and force limits met; criteria set in advance. - stage: Earth analog what: Analog crew with remote flight surgeons. pass: Criteria set in advance. - stage: parabolic or station demonstration what: Flight demonstration. pass: Criteria set in advance. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Flight surgeon agreement when the link allows; otherwise the CMO under the pre-approved onboard checklist, with flight surgeon review of images and logs at the next contact. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: the flight surgeon can watch and guide live.' loss_of_signal: - Only the robot pauses; crew care never waits for the link or the robot. - >- The robot pauses the probe in its stopped position (or retracts it) and tells the CMO. The CMO decides whether to continue under the onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged for the flight surgeon. mars_delay: - 'Mars-class delay: no real-time guidance; onboard checklist plus store-and-forward only.' - >- With up to about 21-23 minutes one way and blackouts of about 2-3 weeks, every threshold must be set before flight. max_delay_for_live_guidance: sources: - key: renal text: 'NASA Human Research Program. Evidence Report: Risk of Renal Stone Formation (2024).' url: https://humanresearchroadmap.nasa.gov/evidence/other/2024%20Renal%20Evidence%20Report_Final.pdf supports: >- Imaging steps and limits of ultrasound; no CT in flight; onboard urine dipstick testing; evacuation rather than onboard nephrostomy from low Earth orbit. - key: eau text: European Association of Urology. EAU Guidelines on Urolithiasis. url: https://uroweb.org/guidelines/urolithiasis supports: An infected, obstructed kidney needs urgent drainage plus antibiotics. - key: harper text: >- Harper JD, Cunitz BW, Dunmire B, et al. First in human clinical trial of ultrasonic propulsion of kidney stones. J Urol. 2016;195(4 Pt 1):956-964. url: https://doi.org/10.1016/j.juro.2015.10.131 doi: 10.1016/j.juro.2015.10.131 pmid: '26521719' supports: Ultrasonic stone propulsion is still investigational. - key: worster text: >- Worster AS, Bhanich Supapol W. Fluids and diuretics for acute ureteric colic. Cochrane Database Syst Rev. 2012;(2):CD004926. url: https://doi.org/10.1002/14651858.CD004926.pub3 doi: 10.1002/14651858.CD004926.pub3 pmid: '22336806' supports: No reliable evidence that forced fluids help in acute colic. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: Requirement IDs beginning V1. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-20' version: '0.3' source: AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 items: - Added a precondition that a crewmember started the run ([V2 10174]). - >- D2 now says the flight surgeon decides when the link is live, otherwise the CMO under the onboard checklist. - The Mars-class / link-down decision now comes right after S1, before scanning. - X6 now covers only increasing pain; "patient says stop" stays in X1. - >- Per-run sign-off wording confirmed (flight surgeon when the link allows; otherwise the CMO, with later review). - Loss of link (X5) now pauses the probe and the CMO decides whether to continue. - >- Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build. - date: '2026-10-21' version: '0.4' source: Batch 5 editorial (AI-assisted), Oct 21, 2026 items: - >- Renal evidence report citation now includes "(approved for public release September 23, 2024)", matching RMP-RENAL-004 (batch 4 optional item 44). - >- Library-wide "safe" wording in inherited stop rules and requirement uses rewritten per batch 4 review item 49 (holds its stopped position / stays stopped / take over / Robot stays stopped). Schema level name safe-state unchanged. - date: '2026-10-21' version: '0.4' source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49 items: - >- Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position"; "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and never-word list entry "safe" unchanged. - date: '2026-10-21' version: '0.5' source: Batch 6 editorial (AI-assisted), Oct 21, 2026 items: - >- Renal evidence report citation label changed from "(approved for public release September 23, 2024)" to "(2024)", the site's year-only citation convention. - >- Requirement use for [V2 10173] changed from "Safe default." to "Robot stays stopped if no one takes over." (batch 5 review item 25; editorial, behaviour unchanged). - date: '2026-10-21' version: '0.6' source: Batch 7 editorial (AI-assisted), Oct 21, 2026 items: - >- Citation labels changed to the site's year-only convention: "(approved for public release )" now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev F, 2026)" (sources: v2). Editorial; no change to steps, thresholds or limits. - date: '2026-10-21' version: '0.7' source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026 items: - >- X5 and the comms loss-of-signal branch now open with "Only the robot pauses; crew care never waits for the link or the robot." (batch 7 review suggestion 29). Editorial; robot behaviour unchanged.