Testing Robot Care in Simulation and Earth Analogs, and Who Signs Off

Why testing and sign-off come next

Part 1 framed autonomy rungs and a 13-part protocol skeleton, including validation and human sign-off as required parts [15]. Part 2 walked one library entry, RMP-RENAL-001, and showed that those parts are already fields in the YAML: validation[] and signoff [1][16].

This Part 3 opens those fields. It asks two linked questions:

1. In what order should a care-robot protocol be stress-tested before anyone trusts it near a crewmember?
2. Who must say yes — once for the protocol itself, and again for each run — at each autonomy rung?

Nothing here invents a new clinical protocol. It explains the validation and sign-off pattern the library already uses, and how Earth analogs fit that pattern without being mistaken for flight proof.

The ladder already in the YAML

RMP-RENAL-001’s validation block (and the same pattern on other library drafts) is explicit [1][2]:

Pass criteria are written before the campaign, not scored after the fact to fit the result [1][15]. A change that touches the patient, thresholds, limits or software that affects patient contact repeats validation from the simulation stage [1]. That change-control idea borrows the spirit of the FDA’s predetermined change-control plan approach for AI-enabled device software — as a model to learn from, not as a claim that any SMF protocol is an FDA-cleared device [14][1].

Stage 1 — Simulation (including the live console)

Simulation is where delay and responsibility become visible. The ground flight surgeon live console steps through RMP-RENAL-001 at station, Moon and Mars delay presets [5]. It is educational fiction: simulated data, not clinical training. What a useful sim still has to show, even as fiction that a real program would harden:

• A crewmember starts the run; the robot never self-starts [V2 10174] [3].
• Mode changes and who is expected to act are obvious to the operator [V2 10162], [V2 10164].
• On loss of link, only the robot pauses; crew care never waits for the robot or the ground [1][19].
• Every input, decision (with who decided) and hand-off is time-stamped [V2 10163].
• After any protective or emergency stop, only a human may restart [V2 10165], [V2 10174].

Mars-class delay in the console is there to make the Part 2 D1 choice concrete: live guidance versus onboard checklist plus store-and-forward [16][5]. Simulation fails if stop rules can be skipped, if the robot invents a workaround after a failed check, or if logs cannot reconstruct the run for a delayed flight surgeon.

Stage 2 — Training models

Before a probe or tool approaches a person, force, speed, reach and image-quality gates need numbers filled where the YAML still says <set by validation> [1]. An ultrasound training model (phantom) is the natural next step for RENAL-001-class work: can the robot hold the probe within limits, meet the automatic quality check, and hand off cleanly when quality stays low [1]?

This stage is still not “care.” It is metrology and procedure rehearsal. Fail here, and the protocol does not advance.

Stage 3 — Earth analogs (what they buy, and what they don’t)

No analog is spaceflight [18]. For robot care, analogs are useful for ops under stress, not for pretending buoyancy or isolation equals microgravity medicine.

The undersea robot-surgery evaluations (NEEMO-era work reported by Doarn and colleagues) are the closest published analog precedent for medical robotics away from a normal hospital [6]. They support the idea that teleoperation and supervised tasks can be rehearsed in a harsh, enclosed analog. They do not mean a humanoid care robot is cleared for crew care, on Earth or in flight.

Isolation analogs such as HERA and CHAPEA are better thought of as places to rehearse human roles under delay: flight surgeon agreement when the link allows, CMO checklist when it does not, private medical traffic, and the rule that crew care never waits for a paused robot [4][8][9][19]. Saying “tested in CHAPEA” without saying what was tested would overclaim.

A careful analog campaign for a library protocol would script the same preconditions, stop rules and red flags as the YAML, with pass/fail set in advance — and would treat any medication or supply mismatch the way the pharmacy drafts already do: quarantine by default; the robot never hands a mismatched item as verified; a CMO override, if a program ever allows one, is explicit, logged and flagged to the flight surgeon [19]. That is sign-off-relevant testing of a standing library rule, not a new clinical invention.

Stage 4 — Parabolic or station demonstration

Parabolic flight is the only ground-based way to get true 0 g, in short bursts [10][11]. It is a place to check restraint of patient, caregiver and robot, probe dynamics and emergency-stop behavior — not a full stone-workup. A supervised station demonstration is a later, rarer step. The 2024 surgical-robot demonstration discussed in NASA’s Houston We Have a Podcast episode on robotic surgery in space is a flight hardware precedent for medical robotics research on station; it is not robot care of a crewmember [12]. Part 1 already draws that line; Part 3 keeps it.

Who signs off: protocol vs each run

The library splits approval the way Part 1’s framework item 12 requires [15][1]:

Protocol approval (before the protocol may be used at all)

Encoded under signoff.protocol on RMP-RENAL-001 [1]:

1. Clinical lead for the specialty — fills every <set by clinical lead> threshold.
2. Flight surgeon (or the operator’s designated medical authority) — holds medical authority [4].
3. Robotics and medical-device safety board — force/speed/reach, software, lockouts.
4. Program approval for the mission — accepts residual risk and training burden.

Each-run approval (every time the robot is used)

Encoded under signoff.each_run and the human-start precondition [1]:

• Flight surgeon agreement when the link allows.
• Otherwise the CMO under the pre-approved onboard checklist, with flight surgeon review of images and logs at the next contact.
• A crewmember starts the run; after any emergency or protective stop, a human restarts — the robot never restarts itself [V2 10174] [3].

Consent (or a logged emergency consent path) and a CMO able to take over remain preconditions, not paperwork after the fact [1][16].

Sign-off by autonomy rung

Part 1’s three practical rungs map loosely to wider medical-robot autonomy language [13][15][17]. Sign-off gets stricter as the robot does more without a continuous human hand on the loop:

Rung 3 is where Mars-class delay pushes hardest — and where overclaim risk is highest. This series treats rung 3 as a design target with stricter gates, not as something demonstrated for crew care [15][17]. Rung 3 stays a human-gated propose→approve design target. Only Part 5’s rungs 4–5 are contingency / fallback sign-off paths when human support is unavailable or insufficient — not everyday cruise defaults. Across every default rung, NASA-STD-3001 §10.6 still requires override, shut-down, safe mode, failure recovery, responsibility delineation and human-only initiation after emergency stop [3]. Contingency auto-arm would need standards evolution while preserving override (Part 5). Autonomy never removes human reclaim of authority.

What a “pass” must include (thought-experiment checklist)

A program clearing a conceptual library protocol for real use would, at minimum, show evidence that:

1. Hard lockouts hold (no diagnosis language, no drug/fluid advice, no self-start, no self-edited thresholds) [19][1].
2. Stop rules fire in sim and analog drills (patient says stop, force limit, lost link, CMO non-response) [1].
3. Logs let a delayed flight surgeon reconstruct who decided what [V2 10163], [V2 10164].
4. Supply or barcode mismatch → quarantine (for pharmacy-class protocols); no unprompted hand-over of a mismatched item [19].
5. Every <set by validation> and <set by clinical lead> blank is filled by a named human role before flight use [1][2].
6. Change control and rollback are rehearsed; the robot never patches itself [1][14].

Until those are real, the correct public status for every library entry remains what the site already says: conceptual draft; not for clinical use.

Where this sits on the site

• Series hub: Robotic and autonomous medical care
• Part 1 · Part 2 · Part 4 · Part 5
• RMP-RENAL-001 validation and signoff blocks [1]
• Protocol schema [2]
• Ground console [5]
• Capabilities board [17]
• Earth analogs [18]
• Shared safety rules [19]

What comes next

• Part 4 (published): Walking RMP-PHARM-001: barcode check, mismatch quarantine and logged CMO override — walks the pharmacy protocol end to end; still conceptual.
• Part 5 (published): Contingency autonomy for 2027–2033 — fallback rungs 4–5 and certification gates when human support cannot cover.
• Later: other library walks (for example crew-held ultrasound variants), always educational.

Part 3 closes the “how would you test and clear this?” gap that Parts 1 and 2 pointed at. It does not clear any protocol for flight.