Home › Robotic Medicine › Live console
Robotic Medicine · Simulation
Ground flight surgeon live console
What would it be like to supervise a care robot from the ground? This simulation runs the example protocol RMP-RENAL-001 (assisted diagnostic ultrasound for a suspected kidney stone). It models the steps of v0.2; the current library version is v0.7, and its Corrections section lists what changed since. Pick a delay, from the station to Mars, and a scenario. Then try pausing, redirecting or restarting the robot, and watch when your commands actually land.
- The flight surgeon is the medical authority. The crew medical officer (CMO) acts under delegated care, and has authority when the link is down or too slow [5].
- Diagnostic ultrasound only. The robot holds the probe and labels images. It never diagnoses, and never gives drug or fluid advice.
- Humans restart. After any stop or safe state, only a human can restart the robot [4].
Every step completes. Watch how decisions and commands behave at each delay.
About 0.5 s two-way over NASA relay satellites (Khanna 2026).
Run
Time runs 5× faster than real time. Use 120× for Mars delays.
InterjectLive control OKCommands land in about 0.25 s.
Robot modeReadyRung 2 · supervised (protocol maximum)
Current stepNot startedStep timer 0:00 · run 0:00
Ground view age0.25 sWhat you see happened this long ago
Time (ET)--:--:--Simulated clock
Mission elapsed046/03:12:00Day/hh:mm:ss
Robot status (ground view)
CAM 1 · bedsideCamera feed placeholderNo video in this simulation
Current actionWaiting to start.
- Autonomy rung
- Rung 2 · supervised
- Self-test
- Not run
- Emergency-stop chain
- OK
- Force sensors
- Agree
- Joint temperature
- 31 °C
- Imaging depth
- 13 cm
- Faults
- None
Comm delay
LIVE CONTROL OK Commands land in about 0.25 s.
- One way
- 0.25 s
- Round trip
- 0.5 s
- Link quality ILL
- 97%
- Loss of signal
- —
If you send a command nowIt lands during the current step.
- Green one way ≤ 300 ms: live control. Remote surgery aims for under 100 ms one way, and over 300 ms is high risk [2]. Station delays sit above the surgery target; that is acceptable here only because this is supervision of diagnostic imaging (illustrative judgement).
- Amber 0.3 s to 10 s ILL: supervisory only. The robot may have moved on before a command lands.
- Red over 10 s or no link: store-and-forward only. The CMO has authority and runs the onboard checklist [1].
Protocol stepper RMP-RENAL-001 v0.2 (current: v0.7)
Pending decisions
- None
- PRE-1Crew medical officer (CMO) present and able to take over [V2 10168] [V2 10164] [V2 7045]CrewPending
- PRE-2Consent recorded (voice or touch confirmation, logged)CrewPending
- PRE-3Restraint: patient, caregiver and robot [V2 7046]CrewPending
- PRE-4Equipment check: ultrasound, gel, robot self-test [V2 10161]RobotPending
- PRE-5Link check: flight surgeon agrees to this runGround decidesPending
- PRE-6Inputs: vital signs, urine output and dipstick (entered by CMO)CrewPending
- S1Confirm patient position and expose scan areasRobotPending
- S2Right kidney views; auto-check image qualityRobotPending
- S3Left kidney, same views for side-by-side comparisonRobotPending
- S4Bladder views, including the ureteral jet on each sideRobotPending
- D0Decision: run the optional twinkle views?Ground decidesPending
- S5Optional colour Doppler "twinkle" viewsRobotPending
- D1Decision point: image quality and possible swelling, human reviewGround decidesPending
- S6Label images, attach to medical record, send live or store-and-forward [V1 7003]RobotPending
- R1Report by a human reviewer: "non-diagnostic", never "normal"GroundPending
- C1Retract probe, stow arm, safe stateRobotPending
Tags show who acts or decides at each step: Robot Crew Ground. Red flags at any step (fever, chills or unstable vital signs; very low urine output; uncontrolled pain or vomiting; positive dipstick with symptoms; a single kidney or swelling on both sides; the patient says stop) make the robot stop and escalate.
Surgeon controls
Commands travel at the current delay. Consequential commands ask you to confirm first.
Allowed 2–12 N (ILL), below the 15 N hard limit
Allowed 8–18 cm (ILL)
Redirect a branch
Command log queued → sent → received by vehicle → executed
- No commands yet.
“Received” and “executed” are vehicle times. The ground only learns about them one delay later (“confirmed on ground”). Before then, the landing time shown is a projection.
Event and alert feed
- Start a run to see events.
How to use this console
- Choose a communication link and a scenario, then press Start run. The crew medical officer (CMO) starts the run on board.
- Everything on the console is what the ground can see, and it is always one delay old. At Mars distances, the robot may be several steps ahead of what you see.
- Answer pending decisions (tagged Ground). If your answer is too slow, or the link is red, the CMO decides under the pre-approved onboard checklist, and your later answer is marked “superseded”.
- Every command shows when it was queued and sent, and when it was received and executed on the vehicle. In red conditions, commands reach the CMO as recommendations; the CMO decides whether to act.
Thresholds, limits and sources
- Delays. Station: about 0.5 s round trip over NASA relay satellites [2]. Moon: about 1.3 s one way (light time) [7]. Mars: about 3 min one way at closest approach and up to 21–23 min, with blackouts of about 2–3 weeks around solar conjunction [3]. “Mars, typical” (12.5 min) is an illustrative mid-range value.
- Live-control lines. Remote surgery on Earth generally aims for under 100 ms one way, and delays over 300 ms are considered high risk [2]. This console uses 300 ms as the green limit. The amber upper bound (10 s) is illustrative. The protocol leaves “delay_max_for_live_guidance” to be set by validation [1].
- Robot limits. Force (15 N), speed (50 mm/s), pressure range and depth range are illustrative placeholders. The protocol says they are “set by validation”. The fever threshold used in the red-flag scenario (38.0 °C) is also illustrative; the protocol leaves it to the clinical lead.
- Link quality and the relay coverage gap are illustrative.
- Authority and safety rules. The flight surgeon holds medical authority, and the CMO acts under delegated care [5]. Safe state, protective stops and human-only restart follow NASA-STD-3001 Volume 2, Section 10.6 [4]. The steps, red flags and the “non-diagnostic, never normal” rule come from the protocol [1] and NASA’s renal stone evidence report [6].
- Space Medicine Foundation. Could a humanoid robot be a medical crewmember? Part 1, example protocol RMP-RENAL-001 v0.2 (conceptual).
- Khanna R, Li Y, Cook M, et al. Surgery for interplanetary space missions. Br J Surg. 2026;113(3):znag005. PMID 41823369.
- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).
- NASA. NASA-STD-3001, Volume 2, Revision F (2026), Section 10.6 Automated and Robotic Systems (human authority, safe state, human-only restart).
- NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). Flight surgeon holds medical authority; the CMO acts under delegated care.
- NASA Human Research Program. Evidence Report: Risk of Renal Stone Formation (2024).
- Space Medicine Foundation. Signal delay calculator (Moon and Mars light time).
What this simulation does not do
- It is not a model of any real robot, link or mission system, and the ultrasound picture is drawn by the page, not taken from a patient.
- The robot never diagnoses, never interprets images, and never advises on drugs or fluids. Antibiotics, evacuation and all treatment are human decisions.
- Therapeutic ultrasound (stone propulsion, lithotripsy) and needle guidance are locked out, as in the protocol.
Related: Robotic Medicine · RMP-RENAL-001 in the protocol library · Part 1 · Crew Health Command Center · Signal delay calculator · Kidney stone risk · Point-of-care ultrasound