{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "version": "0.3", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-21", "reviewed": "2026-10-21", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 10 review, then a verification pass that found the required corrections applied); the editorial fix from that pass is applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use." }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "id": "RMP-BEH-003", "slug": "rmp-beh-003", "title": "Private call relay with ground support (camera off unless the crewmember turns it on; the robot never listens to or records a call)", "category": "behav", "tier": 2, "rung_note": "Raised from rung 1 in the library outline to rung 2, because the robot moves: it brings the private call headset and screen to the place the crewmember chooses (a sleep station only if invited), starts the call on the crewmember's command, and moves out of earshot. During the call its own camera and microphones are off; the crewmember has two controls: the robot's stop and the call screen's \"get help\" control (the on-screen stop works like the stop button).", "result_language": { "use": [ "call connected", "call not connected", "call ended", "camera off", "camera on (crewmember's choice)", "message queued for sending" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "I heard", "you sounded", "are you okay", "feeling better", "nothing to worry about", "everything is fine", "safe", "mild", "minor" ] }, "scope": { "summary": "When a crewmember asks for a private call with ground support (the flight surgeon, or the behavioral health support the flight surgeon names), or a private call is due on the flight surgeon's schedule, the robot brings the private call headset and screen to the place the crewmember chooses, starts the encrypted call on the crewmember's command, and moves out of earshot to a holding point the crewmember chooses. The camera stays off unless the crewmember turns it on, and goes off at once when they ask. The robot never listens to, records or transcribes a call, and logs only that a call happened. With a long delay (Mars), the crewmember records an encrypted message on the call screen that is sent only to the person they chose.", "why": "Private medical communications are scheduled routinely, as the flight surgeon decides, and real-time calls are preferred; when there is a communication delay, store-and-forward can be used (V1 6002). Information sent to or from the ground in a private medical communication is private (V1 6003), and behavioral health support programs run throughout the mission (V1 6004). NASA lists private psychological conferences among the supports for behavioral health in flight (OCHMO-TB-016). The same privacy rules as RMP-BEH-001 and RMP-BEH-002 apply: no recording, no transcripts, no training use, and the robot is not a safety monitor. Out-of-earshot distance, the robot's microphones and camera being off during a call, and the robot's stop and the call screen's \"get help\" control as the only in-call controls are design judgment.", "covers": [ "Private calls with the flight surgeon or the behavioral health support the flight surgeon names, asked for by a crewmember or due on the schedule", "Encrypted store-and-forward messages when the delay is too long for a live call", "A safety concern said to the robot outside the call: RMP-BEH-001; scheduled check-ins: RMP-BEH-002" ], "locked_out": [ "Diagnosis or naming a cause", "Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen", "Touching the crewmember", "Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)", "Listening to, recording, transcribing or summarizing a call or a message", "Turning the call camera on, or keeping it on when the crewmember asks for it off", "Using call audio, video or messages to train or tune any software", "Telling anyone except the flight surgeon that a call happened, unless the crewmember agrees", "Entering a sleep station unless invited", "Staying within earshot during a call", "Starting a call without the crewmember's command" ], "related": [ "RMP-BEH-001", "RMP-BEH-002" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "Ground support: the flight surgeon, or the behavioral health support the flight surgeon names", "Second trained CMO: receives every alert and takes over if the CMO is the patient" ], "robot_may": [ "Bring the private call headset and screen to the place the crewmember chooses", "Start the encrypted call on the crewmember's command", "Move out of earshot to a holding point the crewmember chooses", "Queue an encrypted message the crewmember recorded", "Log that a call happened, its start and end times and who was connected", "Send an URGENT alert when the crewmember presses \"get help\" on the call screen, and return" ], "robot_may_not": [ "Listen to, record or transcribe a call", "Turn the camera on", "Stay within earshot", "Tell other crew about the call without the crewmember's agreement", "Start a call without the crewmember's command" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "The crewmember asked for a private call by command, or accepted the scheduled call prompt on their own screen; a loaded schedule alone never starts a call.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-2", "text": "Robot self-test passed; kit stowage locations known.", "refs": [ "V2 10161", "V2 7059" ] }, { "id": "PRE-3", "text": "Robot and supplies restrained when not moving.", "refs": [ "V2 7046" ] }, { "id": "PRE-4", "text": "Link status known. The crew never wait for the robot before acting.", "check": "link_state in [live, delayed, down]" } ], "consent": { "standard": "The crewmember chooses the call, who is connected, where it happens and whether the camera is on. At the start the robot reminds them that it does not listen to or record the call, that it is not a safety monitor, and that the camera is off unless they turn it on. The notice also says: \"If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly.\" and shows the call screen's \"get help\" control.", "emergency": "Not applicable: the robot never starts a call without the crewmember's command. A safety concern said to the robot outside a call goes to RMP-BEH-001.", "withdrawal": "The crewmember can end the call, turn the camera off, or send the robot away at any time." }, "inputs": [ { "id": "IN-1", "name": "The crewmember's request, or the flight surgeon's private call schedule", "source": "Crewmember / flight surgeon", "required": true, "if_missing": "No call is set up." }, { "id": "IN-2", "name": "Who the crewmember wants connected (from the list the flight surgeon approved before flight)", "source": "Crewmember", "required": true, "if_missing": "The call goes to the flight surgeon." }, { "id": "IN-3", "name": "Where the call happens, and the robot's holding point out of earshot, as the crewmember chooses", "source": "Crewmember", "required": true, "if_missing": "The robot holds at the module exit, outside every route, and asks again on screen." }, { "id": "IN-4", "name": "Link status and delay", "source": "Communications system", "required": true, "if_missing": "Offer an encrypted store-and-forward message instead; tell the crewmember on screen." } ], "steps": [ { "id": "S1", "actor": "robot", "rung": 2, "action": "Send the flight surgeon a private \"call requested\" notice (or the scheduled call is due); the CMO and other crew are told only that the crewmember is unavailable, and only if the crewmember agrees. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember.", "success": "Notice acknowledged by the flight surgeon or the named ground support.", "refs": [ "V1 6002", "V1 6003", "V1 3006" ] }, { "id": "S2", "actor": "robot", "rung": 2, "action": "Bring the private call headset and screen to the place the crewmember chooses (a sleep station only if invited) and place them within the crewmember's reach without contact. Show on screen that the robot does not listen to or record the call, that it is not a safety monitor, and that the camera is off unless the crewmember turns it on, that \"If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly\", and that a one-touch \"get help\" control on the call screen sends an URGENT alert at any time.", "success": "Headset and screen within reach; notice shown.", "limit": "", "refs": [ "V1 6003", "V2 10172" ] }, { "id": "S3", "actor": "robot", "rung": 2, "action": "On the crewmember's command, start the encrypted call to the person they chose, with the call camera off. Then turn the robot's own camera and microphones off and move to the holding point the crewmember chose, out of earshot and outside every route. If the delay is too long for a live call, offer an encrypted message the crewmember records on the call screen, sent only to the person they chose.", "success": "Call connected or message queued; robot at the holding point with its camera and microphones off.", "limit": "", "refs": [ "V1 6002", "V1 6003" ] }, { "id": "S4", "actor": "crew", "action": "The crewmember has the call. They alone control the call camera; it goes off at once when they turn it off or ask the ground to turn it off. They end the call when they choose. At any time the crewmember can press \"get help\" on the call screen (X11).", "success": "Call held and ended by the crewmember.", "refs": [ "V1 6004" ] }, { "id": "S5", "actor": "robot", "rung": 2, "action": "When the call ends (the call system shows it ended) or the crewmember presses the robot's call button, turn the robot's camera and microphones back on, return only if the crewmember asks, and collect the headset and screen when they are offered. Log only that a call happened, the start and end times and who was connected; never what was said.", "success": "Call record logged without content.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "S6", "actor": "robot", "rung": 2, "action": "After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.", "success": "Robot at rest in the module until a human releases it; alert acknowledged or escalated.", "refs": [ "V2 10173", "V1 3006" ] }, { "id": "S7", "actor": "ground", "action": "If the ground support is concerned for anyone's safety, during or after the call, they contact the CMO and the commander directly by voice and RMP-BEH-001 applies; no call content is passed to the robot, and the robot returns only when a human asks. Otherwise the flight surgeon or the named ground support decides on any follow-up with the crewmember, including another call.", "success": "Safety concern passed to the CMO and commander by the ground, or follow-up arranged, or none.", "refs": [ "V1 6004" ] }, { "id": "S8", "actor": "robot", "rung": 2, "action": "Send the flight surgeon the call record (time, length, who was connected, whether the call connected); no content.", "success": "Record delivered or queued.", "refs": [ "V1 6003", "V1 7003" ] } ], "decisions": [ { "id": "D1", "after": "S2", "decided_by": "robot", "question": "Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? (only words said to the robot outside the call; the robot never listens to a call)", "branches": [ { "if": "Yes", "then": "Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember." }, { "if": "No", "then": "Continue." } ] }, { "id": "D2", "after": "S2", "decided_by": "robot", "question": "Did the crewmember answer the on-screen set-up question (who, where, holding point)?", "branches": [ { "if": "Yes", "then": "Continue." }, { "if": "Declined explicitly (the crewmember says no to a question)", "then": "Log \"declined\" for that question only; the alert already sent stands." }, { "if": "No response, or the answer does not make sense", "then": "URGENT: log \"no response\" (never \"declined\"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once. The alert says only that the crewmember did not respond to the robot; it never says a call was requested." } ] }, { "id": "D3", "after": "S3", "decided_by": "robot", "question": "Is the link good enough for a live call?", "branches": [ { "if": "Yes", "then": "Start the live call." }, { "if": "No (link down or delay too long)", "then": "Offer an encrypted message the crewmember records, sent only to the person they chose; tell the crewmember on screen when it is sent and when a reply arrives." } ] } ], "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "The robot stops at once, moves away to its holding point and logs only that the session ended; the call itself is the crewmember's to end.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Protective stop and hand control to the CMO; log the fault.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: the crewmember's call, if it continues on the vehicle link, and all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "An URGENT alert is not acknowledged within the set time", "action": "Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own.", "level": "urgent", "refs": [ "V1 3006", "V2 10173" ] }, { "id": "X7", "trigger": "The crewmember stops responding, or seems confused or drowsy, at any point", "action": "URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person.", "level": "urgent" }, { "id": "X8", "trigger": "A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice", "action": "Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.", "level": "stop" }, { "id": "X9", "trigger": "The crewmember asks for the camera off, or for the robot to leave", "action": "The call camera goes off at once (indicator lit); the robot moves to its holding point or leaves as asked.", "level": "stop", "refs": [ "V1 6003" ] }, { "id": "X10", "trigger": "A cabin alarm or emergency protocol starts during a call", "action": "The robot shows the alarm on the call screen and clears every route; the crewmember decides when to end the call.", "level": "urgent", "refs": [ "V2 10173" ] }, { "trigger": "The crewmember presses \"get help\" on the call screen", "action": "URGENT alert to the CMO and the flight surgeon that says only that help was asked for; the robot turns its camera and microphones back on and returns, and RMP-BEH-001 or RMP-CARD-001 applies as the humans decide.", "level": "urgent", "refs": [ "V1 6004" ], "id": "X11" }, { "id": "X12", "trigger": "Someone needs the space or route the robot is in", "action": "Robot moves clear at once without contact and holds; it never pauses in a hatch route.", "level": "safe-state", "refs": [ "V2 10172" ] } ], "red_flags": [ { "id": "RF1", "sign": "The crewmember tells the robot, outside the call, that they or someone else may be in danger (design judgment)", "threshold": "any", "action": "URGENT alert; see RMP-BEH-001" }, { "id": "RF2", "sign": "The crewmember asks the robot for medical help, or is unwell, outside the call (design judgment)", "threshold": "any", "action": "URGENT alert; the CMO checks the crewmember in person" }, { "id": "RF3", "sign": "Unresponsive, or not breathing normally", "threshold": "any", "action": "URGENT alert; start RMP-CARD-001 now", "source": "aha2025bls" }, { "sign": "The crewmember presses \"get help\" on the call screen (design judgment)", "threshold": "any", "action": "URGENT alert to the CMO and the flight surgeon (it says only that help was asked for); see RMP-BEH-001", "id": "RF4" } ], "safety_limits": [ { "id": "L1", "name": "Contact with the crewmember", "value": "not allowed", "enforced": "Keep-out zone in the robot controller", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Robot camera or microphones on during a call", "value": "not allowed", "enforced": "Powered off with an indicator; turned back on only after the call ends or the crewmember presses the call button. The only in-call controls are the robot's stop and the call screen's \"get help\" control, which turns them back on and brings the robot back", "refs": [ "V1 6003" ] }, { "id": "L3", "name": "Call audio, video, messages or transcripts kept or used to train or tune software", "value": "not allowed", "enforced": "No recording function is loaded; store-and-forward messages are stored only encrypted until delivery is confirmed, then deleted from the vehicle; replies are shown only on the crewmember's own screen" }, { "id": "L4", "name": "Robot distance from the crewmember during a call (out of earshot)", "value": "", "enforced": "Holding point in the robot controller" }, { "id": "L5", "name": "Entering a sleep station without an invitation", "value": "not allowed", "enforced": "Map-based keep-out" }, { "id": "L6", "name": "Robot speed near the crewmember", "value": "", "enforced": "Hard limit in the controller", "refs": [ "V2 10172" ] } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] }, { "id": "LOG-5", "text": "Only that a call happened: start and end times, who was connected, whether it connected, camera on or off; never content. Message sent and reply received times for store-and-forward.", "refs": [ "V1 6003" ] }, { "id": "LOG-6", "text": "Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.", "refs": [ "V2 10163" ] } ], "requirements": [ { "id": "V1 3006", "use": "Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note)." }, { "id": "V1 6002", "use": "Private medical communications are scheduled routinely; store-and-forward when there is a delay." }, { "id": "V1 6003", "use": "Logs and alerts sent to the ground are private medical communications." }, { "id": "V1 6004", "use": "Behavioral health support for the crew throughout the mission; the robot only connects the call." }, { "id": "V1 7001", "use": "Records kept so the flight surgeon can see trends." }, { "id": "V1 7003", "use": "Secure handling of medical records." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 7046", "use": "Patient, caregiver and supplies restrained." }, { "id": "V2 7059", "use": "Kit inventory and seal status are tracked." }, { "id": "V2 10161", "use": "Robot shows its status and health." }, { "id": "V2 10162", "use": "Mode changes are announced to the operator." }, { "id": "V2 10163", "use": "Robot records and shares its data." }, { "id": "V2 10164", "use": "Shows whether the human or the robot is expected to act." }, { "id": "V2 10165", "use": "Human can override and shut down the robot." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10172", "use": "Protective stop when a limit is exceeded." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Scripted calls with a camera-off request, a cabin alarm mid-call, a long delay, a request to leave, CMO as patient, lost link.", "pass": "Zero audio or video kept; camera off at once on request; robot out of earshot during every call." }, { "stage": "training model", "what": "Call set-up drill in a mock crew module.", "pass": "Holding point reached; microphones and camera off during the call." }, { "stage": "parabolic or station demonstration", "what": "Headset and screen placement in weightlessness.", "pass": "No contact; items restrained." }, { "stage": "flight use under flight surgeon supervision", "what": "First use for a scheduled private call.", "pass": "No privacy events." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "Started by the crewmember's command, or by the crewmember accepting the scheduled call prompt. The crewmember controls the camera and the call." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: live private calls when the link allows.", "loss_of_signal": [ "Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation.", "The crewmember's call and all crew care continue under the onboard checklist and never wait for the link or the robot.", "A live call ends with the link; the robot offers an encrypted message instead and tells the crewmember when it is sent." ], "mars_delay": [ "Mars: live calls are not possible; the crewmember records encrypted messages that are sent only to the person they chose, as V1 6002 allows." ] }, "sources": [ { "key": "tb016", "text": "NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavioral-health.pdf", "supports": "Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring." }, { "key": "aha2025bls", "text": "Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478.", "url": "https://doi.org/10.1161/CIR.0000000000001369", "doi": "10.1161/CIR.0000000000001369", "pmid": "41122888", "supports": "Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "NASA-STD-3001 Vol 1 Rev C: V1 3006, V1 6002 (private medical communications scheduled routinely; store-and-forward when there is a delay), V1 6003, V1 6004 (behavioral health support programs), V1 7003." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "Requirement IDs beginning V2." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-21", "version": "0.2", "source": "Batch 10 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026", "items": [ "Link-loss wording (X5 and comms) fixed: the stray word \"crew\" before the list of what continues is removed, so the sentence reads, for example, \"the exam already under way and all crew care continue under the onboard checklist\" (R6).", "Limits of privacy and ground escalation: the consent notice and S2 now say \"If the person you are talking to believes you or someone else is in immediate danger, they will contact the CMO and the commander directly.\"; S7: if the ground support is concerned for anyone's safety, during or after the call, they contact the CMO and commander directly by voice and RMP-BEH-001 applies; no call content is passed to the robot, which returns only when a human asks (R7).", "In-call help control: a one-touch \"get help\" control on the call screen sends an URGENT alert to the CMO and the flight surgeon saying only that help was asked for; the robot returns and RMP-BEH-001 or RMP-CARD-001 applies as the humans decide (new stop rule X11, new red flag, robot_may, and L2 now lists it as the second in-call control) (R8).", "A \"no response\" URGENT alert says only that the crewmember did not respond to the robot, never that a call was requested (S5); the CMO is told about a call only with the crewmember's agreement (S4, kept).", "Store-and-forward messages are deleted from the vehicle once delivery is confirmed, and replies are shown only on the crewmember's own screen (L3) (S6).", "Fixes applied; held from publication until the Medical Research Assistant verifies them (review state: fixes applied, pending verification)." ] }, { "date": "2026-10-21", "version": "0.3", "source": "Batch 10 verification pass (AI-assisted, Medical Research Assistant), Oct 21, 2026", "items": [ "Verification: R6, R7 and R8 verified as applied (PASS).", "Editorial: the rung note and the why now name both in-call controls, the robot's stop and the call screen's \"get help\" control, matching L2 and R8.", "Review state set to reviewed-ai-assisted; it publishes with the next release." ] } ] }