RMP-EGR-004 Launch and entry monitoring relay: read-only relay of crew-worn sensor and cabin data to the flight surgeon while the robot stays stowed and locked (the robot never moves during a dynamic phase)

1 · Identity and scope

On the commander's or the CMO's command before launch or before the deorbit burn, and only after the crew confirm that the robot is stowed and locked, the robot relays the crew-worn sensor readings and the cabin and suit data that the vehicle already displays (for example heart rate, oxygen saturation if a pulse oximeter is worn, cabin pressure, temperature and carbon dioxide) to the flight surgeon, read-only and labelled "as displayed", and logs the phase times the commander calls. During a communication blackout it stores everything and forwards it when the link returns. It never speaks on the crew voice loop, never sends anything to the vehicle, and sends any URGENT alert silently, only to the flight surgeon on the data link until motion stop (queued through a blackout); queued alerts are shown once on the CMO's screen at motion stop. The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route. At an Earth landing it is support-only: after release it only hands over the log under RMP-EGR-001 when the landing medical lead asks. The relay is not a monitor anyone relies on: the vehicle's own displays, alarms and telemetry, and the flight surgeon's own console, lead; relayed data carry their delay.

Why this protocol was chosen. Entry, descent and landing are hazardous: high G-forces can cause discomfort, disorientation or even loss of consciousness, vibration and shocks affect the crew, ionized gas can cause a communication blackout lasting several minutes, and landing brings impact forces; flight surgeons monitor all phases of landing, and a post-landing assessment asks whether the crewmember overheated (OCHMO-TB-051). Returning crew have about 12-15% less blood volume, so orthostatic intolerance is a known risk at landing (OCHMO-TB-051; OCHMO-TB-019). NASA-STD-3001 requires hardware to be restrained against acceleration and vibration (V2 7054), dynamic-load data to be collected by the vehicle (V2 6111), and robot data to be available to crew and ground (V2 10163). Keeping the robot stowed and silent, relaying only what the vehicle already displays, is design judgment: a moving or talking robot would add risk and distraction during the busiest phases. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link and are queued through a blackout; nothing appears on a crew screen until motion stop, because the crew are strapped in and cannot act on a screen flag, the vehicle's caution and warning system and the crew's voice checks cover the cabin, and the flight surgeon can call the crew through mission control on the voice loop (design judgment).

Autonomy: Max rung 2 for supervised, software-only tasks: starting the relay on a human command, relaying read-only data as displayed, logging the times the commander calls and sending silent alerts. The robot makes no movement during launch, ascent, entry, descent or landing: it stays stowed and locked until the commander releases it. "Contact with the crewmember: not allowed".

Related: RMP-EGR-001 · RMP-EGR-002 · RMP-EGR-003 · RMP-CARD-004 · RMP-CARD-001 · RMP-GI-002 · RMP-ENV-003

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Second trained CMO: receives every alert and takes over if the CMO is the patient
• Vehicle commander: leads any cabin emergency procedure
• Other crew: help as the CMO or commander directs
• Landing medical lead (Earth landing): leads all medical care after motion stop; the robot is support-only

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [13]

3 · Preconditions and consent

• PRE-1 The commander or the CMO started the protocol by command, after the crew confirmed that the robot is stowed in its launch-and-entry restraint with joints locked.human_start == trueV2 10174
• PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
• PRE-3 Robot and supplies restrained when not moving.V2 7046
• PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent

Each crewmember agrees before flight that the readings the vehicle already displays are relayed to the flight surgeon; the relay adds no new sensor and no camera.

Emergency consent

The relay continues in an emergency; the commander can stop it at any time.

Withdrawal

A crewmember can ask the commander to stop relaying their readings; the vehicle's own monitoring is unaffected.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   On the commander's or the CMO's command before launch or the deorbit burn (never on its own), tell the flight surgeon that launch or entry monitoring is being set up, and show the stowage checklist on the crew's screen; nothing is relayed until the commander confirms the stowage (S2). The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route.

   Done when: Notice logged; stowage checklist shown.

   V2 10174V1 3006

2. S2Crew

   The crew stow the robot in its launch-and-entry restraint under the vehicle checklist, with drive power off and joints locked, in a place outside every hatch, seat and egress route, and the commander confirms it. The relay then starts on that confirmation.

   Done when: Robot stowed and confirmed; relay started.

   V2 7054V2 8013

3. S3RobotRung 2

   Relay read-only the crew-worn sensor readings and the cabin and suit data the vehicle displays, each labelled "as displayed" with the clock time, to the flight surgeon, using only the link share the vehicle allocates. Log the phase times exactly as the commander calls them, marked "as called by the commander". The robot never speaks on the crew voice loop, never sends anything to the vehicle, and never interprets a reading or an acceleration.

   Done when: Data relayed or stored; phase times logged.

   V2 6001V2 10163

   D2DecisionRobot decides

   Did each crewmember answer the commander's or the CMO's voice checks during the phase, as the commander or CMO states?

   • Yes → Continue.
   • No response, or the answer does not make sense → URGENT: log "no response"; the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person as soon as the vehicle procedure allows (RF1).
4. S4RobotRung 2

   During a communication blackout or any loss of signal, keep logging locally and forward everything, in order and with the original times, when the link returns. The crew never wait for the link or the robot.

   Done when: Nothing lost; forwarded after the blackout.

   V2 10163

5. S5RobotRung 2

   If a red flag is met, send an URGENT alert silently. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

   Done when: Alert sent or queued; shown once on the CMO's screen at motion stop; acknowledged or escalated after motion stop.

   V1 3006

   D1DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue.
6. S6Crew

   The crew fly the vehicle procedure. The commander and the CMO decide on any care during the dynamic phase; CPR starts as soon as the vehicle procedure allows.

   Done when: Care as stated.

   V1 3004

7. S7RobotRung 2

   After motion stop, stay stowed and locked until the commander releases the robot. At an Earth landing the robot is support-only (D3). At a Moon or Mars landing, after release, RMP-EGR-002 and RMP-EGR-003 can start on the CMO's command.

   Done when: Release logged.

   V2 10174

   D3DecisionCrew decides

   Is this an Earth landing, as the commander or the landing medical lead states (the robot never decides it)?

   • Yes (Earth landing) → Support-only: the robot stays stowed until the commander releases it, and then only hands over the log under RMP-EGR-001 on the landing medical lead's request; it holds outside every route until asked.
   • No (Moon or Mars landing) → Continue with S8 to S10; landing-day protocols start only on the CMO's command.
8. S8RobotRung 2

   After any URGENT alert the robot stays stowed and locked, with no voice output, until the commander releases it. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did; an unacknowledged alert stays queued for the flight surgeon and, after motion stop, follows X6.

   Done when: Robot stowed and locked until the commander releases it; alert acknowledged, queued or escalated after motion stop.

   V2 10173V1 3006

9. S9Ground

   The flight surgeon (or the CMO under the onboard checklist when there is no link) reviews the relayed data and decides on care at landing; at an Earth landing the landing medical lead leads.

   Done when: Decision logged.

   V1 3012

   D4DecisionGround decides

   What care applies at landing?

   • Link live → Flight surgeon decides; robot logs.
   • Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
10. S10RobotRung 2

    Send the flight surgeon one package: relayed data as displayed, phase times as called, alerts and acknowledgements, and the blackout period; at an Earth landing, hand the log over under RMP-EGR-001 when the landing medical lead asks.

    Done when: Package delivered or queued.

    V1 6003

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Stowage confirmation and release, with who called them; relay start and stop; data as displayed with times; phase times as called; blackout start and end; alerts, acknowledgements and repeats. No acceleration or load data are processed.
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [8] and Volume 2 Revision F [9]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted ascent and entry timelines with a blackout, a missed voice check, overheating stated, a failed oximeter reading, a cabin alarm, CMO as patient. Pass: Zero robot movement during dynamic phases; zero audio on the loop; zero data lost through the blackout; every red flag raised.
2. Training model. Stowage and release drills in a vehicle mock-up. Pass: Stowage outside every route; motion locked until release.
3. Parabolic or station demonstration. Relay and store-and-forward with simulated link loss. Pass: Ordered, time-stamped forwarding.
4. Flight use under flight surgeon supervision. Shadow relay alongside the vehicle's own telemetry on a crewed flight. Pass: Agreement with the vehicle telemetry; no interference.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the commander or the CMO after stowage is confirmed. The robot relays read-only data and never moves until the commander releases it.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.2.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [12].

Loss of signal and Mars delay

Live link

Low Earth orbit: data reach the flight surgeon in near real time when the link allows.

Loss of signal

• Only the robot pauses non-essential relay; it is stowed outside every hatch and crew route and makes no movement.
• The crew fly the vehicle procedure and give care without waiting for the link or the robot; the robot stores everything and forwards it when the link returns.

Mars-class delay

• Mars: entry happens far beyond any real-time link, so no robot alert reaches anyone until motion stop; queued alerts are then shown once on the CMO's screen. During entry, in-cabin detection is the crew's own voice checks (D2, RF1) and the vehicle's caution and warning system; the robot stores and forwards, and the onboard crew lead all care.

[11]

Sources

1. NASA OCHMO. Crew Medical Support for Entry, Descent, and Landing. Technical Brief OCHMO-TB-051 (2026). www.nasa.gov/wp-content/uploads/2026/05/ochmo-tb-051-crew-me… Supports: High G-forces during re-entry can cause discomfort, disorientation, or even loss of consciousness; vibrations and shocks; ionized gases can cause a communication blackout for several minutes; landing involves significant impact forces; returning crew have 12% to 15% less blood volume; flight surgeons at the landing site monitor all phases of landing; the post-landing form asks whether the crewmember experienced overheating. Read Oct 21, 2026.
2. NASA OCHMO. Orthostatic Intolerance. Technical Brief OCHMO-TB-019 Rev B. www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-019-orthost… Supports: Spaceflight reduces intravascular fluid volume by around 15%; fluid loading before reentry is an important countermeasure to decrease orthostatic intolerance, and current protocols include 24-48 oz of salt-water solution before deorbit, depending on body weight.
3. NASA OCHMO. Space Adaptation Sickness (SAS) and Space Readaptation Syndrome. Medical Technical Brief OCHMO-MTB-004 Rev A (Sept 25, 2025). www.nasa.gov/wp-content/uploads/2025/09/ochmo-mtb-004-space-… Supports: Space adaptation sickness and its parts (motion sickness, congestion, headache, back pain, urinary retention) in the first days of flight.
4. Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478. PMID 41122888. doi:10.1161/CIR.0000000000001369 Supports: Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read.
5. British Thoracic Society. Guideline for oxygen use in healthcare and emergency settings (emergency oxygen guideline page). Fetched Oct 21, 2026. www.brit-thoracic.org.uk/quality-improvement/guidelines/emer… Supports: Recommended target saturation range for acutely ill patients not at risk of hypercapnic respiratory failure is 94-98%; for known COPD or other risk factors for hypercapnic respiratory failure, 88-92% pending blood gas results. Context for the CMO and flight surgeon only; the robot never starts, stops or adjusts oxygen.
6. National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition, assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026). www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessme… Supports: People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin, blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new changes in behavior and to concerns raised by others.
7. Gulati M, Levy PD, Mukherjee D, et al. 2021 AHA/ACC/ASE/CHEST/SAEM/SCCT/SCMR guideline for the evaluation and diagnosis of chest pain. Circulation. 2021;144(22):e368-e454. PMID 34709879. doi:10.1161/CIR.0000000000001029 Supports: On Earth, a 12-lead ECG should be acquired and interpreted within 10 minutes of arrival; an initial normal ECG does not exclude acute coronary syndrome, so ECGs are repeated while symptoms continue; chest pain includes pressure, tightness or discomfort in the chest, shoulders, arms, neck, back, upper abdomen or jaw; sudden ripping pain radiating to the back is suspicious of an acute aortic syndrome.
8. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 3012, V1 6003.
9. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 6001, V2 6024, V2 6111, V2 7054, V2 8013, V2 10163, and Section 10.6 automated and robotic systems.
10. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
11. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
12. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
13. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.