# RMP-EGR-004 Launch and entry monitoring relay: read-only relay of crew-worn sensor and cabin data to the flight surgeon while the robot stays stowed and locked (the robot never moves during a dynamic phase) # Version 0.2 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.2' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 13 review: 11 required corrections, R1 to R11; 8 optional suggestions not applied in this version), then a verification pass (Oct 21, 2026) that found every required correction for this protocol (R1 to R4) applied (PASS). No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-EGR-004 slug: rmp-egr-004 title: >- Launch and entry monitoring relay: read-only relay of crew-worn sensor and cabin data to the flight surgeon while the robot stays stowed and locked (the robot never moves during a dynamic phase) category: egress tier: 3 rung_note: >- Max rung 2 for supervised, software-only tasks: starting the relay on a human command, relaying read-only data as displayed, logging the times the commander calls and sending silent alerts. The robot makes no movement during launch, ascent, entry, descent or landing: it stays stowed and locked until the commander releases it. "Contact with the crewmember: not allowed". result_language: use: - as displayed - as called by the commander - as stated - stored for forwarding - sent to flight surgeon never: - normal - no problem found - all clear - negative - any diagnosis or cause - stable - nominal - within limits - tolerating - fit to egress - fit to fly - blackout of consciousness - G-LOC - heat stroke - safe - mild - minor scope: summary: >- On the commander's or the CMO's command before launch or before the deorbit burn, and only after the crew confirm that the robot is stowed and locked, the robot relays the crew-worn sensor readings and the cabin and suit data that the vehicle already displays (for example heart rate, oxygen saturation if a pulse oximeter is worn, cabin pressure, temperature and carbon dioxide) to the flight surgeon, read-only and labelled "as displayed", and logs the phase times the commander calls. During a communication blackout it stores everything and forwards it when the link returns. It never speaks on the crew voice loop, never sends anything to the vehicle, and sends any URGENT alert silently, only to the flight surgeon on the data link until motion stop (queued through a blackout); queued alerts are shown once on the CMO's screen at motion stop. The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route. At an Earth landing it is support-only: after release it only hands over the log under RMP-EGR-001 when the landing medical lead asks. The relay is not a monitor anyone relies on: the vehicle's own displays, alarms and telemetry, and the flight surgeon's own console, lead; relayed data carry their delay. why: >- Entry, descent and landing are hazardous: high G-forces can cause discomfort, disorientation or even loss of consciousness, vibration and shocks affect the crew, ionized gas can cause a communication blackout lasting several minutes, and landing brings impact forces; flight surgeons monitor all phases of landing, and a post-landing assessment asks whether the crewmember overheated (OCHMO-TB-051). Returning crew have about 12-15% less blood volume, so orthostatic intolerance is a known risk at landing (OCHMO-TB-051; OCHMO-TB-019). NASA-STD-3001 requires hardware to be restrained against acceleration and vibration (V2 7054), dynamic-load data to be collected by the vehicle (V2 6111), and robot data to be available to crew and ground (V2 10163). Keeping the robot stowed and silent, relaying only what the vehicle already displays, is design judgment: a moving or talking robot would add risk and distraction during the busiest phases. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link and are queued through a blackout; nothing appears on a crew screen until motion stop, because the crew are strapped in and cannot act on a screen flag, the vehicle's caution and warning system and the crew's voice checks cover the cabin, and the flight surgeon can call the crew through mission control on the voice loop (design judgment). covers: - >- Launch and ascent, and the deorbit burn through entry, descent, landing and motion stop, on a human command - Read-only relay of crew-worn sensor and cabin or suit data as displayed; phase times as called - >- After motion stop: RMP-EGR-002 (landing-day kit and stretcher), RMP-EGR-003 (post-landing checks), RMP-CARD-004 (light-headedness on standing), RMP-EGR-001 (record hand-over) locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - >- Any robot movement from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop - Sending any command or data to the vehicle, or using the crew voice loop - Changing a sensor, alarm or display setting, or filtering what the vehicle shows - >- Judging or interpreting a reading, an acceleration or a dynamic load, or saying a crewmember is fit to egress - Deciding on an abort, a landing site or any vehicle action - Stowage in a hatch, seat or egress route - >- Masking, delaying, repeating or replacing any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control related: - RMP-EGR-001 - RMP-EGR-002 - RMP-EGR-003 - RMP-CARD-004 - RMP-CARD-001 - RMP-GI-002 - RMP-ENV-003 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Second trained CMO: receives every alert and takes over if the CMO is the patient' - 'Vehicle commander: leads any cabin emergency procedure' - 'Other crew: help as the CMO or commander directs' - >- Landing medical lead (Earth landing): leads all medical care after motion stop; the robot is support-only robot_may: - >- Start the relay only on the commander's or the CMO's command, after the crew confirm the robot is stowed - Relay read-only data as displayed to the flight surgeon - Log the phase times the commander calls - Store and forward through a communication blackout - >- Send silent URGENT alerts only to the flight surgeon on the data link until motion stop, then show queued alerts once on the CMO's screen robot_may_not: - Move during any dynamic phase - Speak on the crew voice loop or send anything to the vehicle - Interpret any reading - Start itself or leave its stowage before the commander releases it - >- Mask, delay, repeat or replace any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- The commander or the CMO started the protocol by command, after the crew confirmed that the robot is stowed in its launch-and-entry restraint with joints locked. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- Each crewmember agrees before flight that the readings the vehicle already displays are relayed to the flight surgeon; the relay adds no new sensor and no camera. emergency: The relay continues in an emergency; the commander can stop it at any time. withdrawal: >- A crewmember can ask the commander to stop relaying their readings; the vehicle's own monitoring is unaffected. inputs: - id: IN-1 name: >- Crew-worn sensor readings as the vehicle's biomedical display shows them (heart rate; oxygen saturation if a pulse oximeter is worn) source: Vehicle biomedical display (read-only) required: true if_missing: Log "not displayed" (never a value); the crew are not asked to change anything. - id: IN-2 name: Cabin and suit data as displayed (pressure, temperature, carbon dioxide, alarms) source: Vehicle displays (read-only) required: true if_missing: Log "not displayed". - id: IN-3 name: >- Phase times as called by the commander (for example launch, engine cutoff, deorbit burn, entry, parachutes, motion stop) source: Commander required: false if_missing: Log "not called". - id: IN-4 name: >- Symptoms in the crewmember's words, as the crewmember or CMO states them on the loop the robot can read source: Crewmember / CMO required: false if_missing: Log "not stated". - id: IN-5 name: Link status, delay and communication blackout source: Communications system required: true if_missing: Treat as link down; everything is stored and forwarded. steps: - id: S1 actor: robot rung: 2 action: >- On the commander's or the CMO's command before launch or the deorbit burn (never on its own), tell the flight surgeon that launch or entry monitoring is being set up, and show the stowage checklist on the crew's screen; nothing is relayed until the commander confirms the stowage (S2). The robot stays stowed in its launch-and-entry restraint, with drive power off and joints locked, from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop; it makes no movement of any kind in that time, and its stowage place is never in a hatch, seat or egress route. success: Notice logged; stowage checklist shown. refs: - V2 10174 - V1 3006 - id: S2 actor: crew action: >- The crew stow the robot in its launch-and-entry restraint under the vehicle checklist, with drive power off and joints locked, in a place outside every hatch, seat and egress route, and the commander confirms it. The relay then starts on that confirmation. success: Robot stowed and confirmed; relay started. refs: - V2 7054 - V2 8013 - id: S3 actor: robot rung: 2 action: >- Relay read-only the crew-worn sensor readings and the cabin and suit data the vehicle displays, each labelled "as displayed" with the clock time, to the flight surgeon, using only the link share the vehicle allocates. Log the phase times exactly as the commander calls them, marked "as called by the commander". The robot never speaks on the crew voice loop, never sends anything to the vehicle, and never interprets a reading or an acceleration. success: Data relayed or stored; phase times logged. refs: - V2 6001 - V2 10163 - id: S4 actor: robot rung: 2 action: >- During a communication blackout or any loss of signal, keep logging locally and forward everything, in order and with the original times, when the link returns. The crew never wait for the link or the robot. success: Nothing lost; forwarded after the blackout. refs: - V2 10163 - id: S5 actor: robot rung: 2 action: >- If a red flag is met, send an URGENT alert silently. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: >- Alert sent or queued; shown once on the CMO's screen at motion stop; acknowledged or escalated after motion stop. refs: - V1 3006 - id: S6 actor: crew action: >- The crew fly the vehicle procedure. The commander and the CMO decide on any care during the dynamic phase; CPR starts as soon as the vehicle procedure allows. success: Care as stated. refs: - V1 3004 - id: S7 actor: robot rung: 2 action: >- After motion stop, stay stowed and locked until the commander releases the robot. At an Earth landing the robot is support-only (D3). At a Moon or Mars landing, after release, RMP-EGR-002 and RMP-EGR-003 can start on the CMO's command. success: Release logged. refs: - V2 10174 - id: S8 actor: robot rung: 2 action: >- After any URGENT alert the robot stays stowed and locked, with no voice output, until the commander releases it. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did; an unacknowledged alert stays queued for the flight surgeon and, after motion stop, follows X6. success: >- Robot stowed and locked until the commander releases it; alert acknowledged, queued or escalated after motion stop. refs: - V2 10173 - V1 3006 - id: S9 actor: ground action: >- The flight surgeon (or the CMO under the onboard checklist when there is no link) reviews the relayed data and decides on care at landing; at an Earth landing the landing medical lead leads. success: Decision logged. refs: - V1 3012 - id: S10 actor: robot rung: 2 action: >- Send the flight surgeon one package: relayed data as displayed, phase times as called, alerts and acknowledgements, and the blackout period; at an Earth landing, hand the log over under RMP-EGR-001 when the landing medical lead asks. success: Package delivered or queued. refs: - V1 6003 decisions: - id: D1 after: S5 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. From the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link (queued through a blackout or any loss of signal); nothing is shown, repeated or escalated on any crew screen, and nothing goes on the voice loop. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule: Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S3 decided_by: robot question: >- Did each crewmember answer the commander's or the CMO's voice checks during the phase, as the commander or CMO states? branches: - if: 'Yes' then: Continue. - if: No response, or the answer does not make sense then: >- URGENT: log "no response"; the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person as soon as the vehicle procedure allows (RF1). - id: D3 after: S7 decided_by: crew question: >- Is this an Earth landing, as the commander or the landing medical lead states (the robot never decides it)? branches: - if: Yes (Earth landing) then: >- Support-only: the robot stays stowed until the commander releases it, and then only hands over the log under RMP-EGR-001 on the landing medical lead's request; it holds outside every route until asked. - if: No (Moon or Mars landing) then: Continue with S8 to S10; landing-day protocols start only on the CMO's command. - id: D4 after: S9 decided_by: ground question: What care applies at landing? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: Link down or delay too long then: >- The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops relaying that crewmember's readings (the vehicle's own monitoring is unaffected), stays stowed and locked, and logs it. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: >- Robot stops relaying, stays stowed and locked, and logs the fault; the flight surgeon is told on the data link, the CMO after motion stop. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: it is already stowed and makes no movement, so it only stops relaying non-essential data and logs the link loss; the CMO is told after motion stop. This pauses the robot only: the crew fly the vehicle procedure and give care without waiting for the link or the robot. It never pauses in a hatch route, because it is stowed outside every route. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Before motion stop the alert stays queued for the flight surgeon on the data link and is never repeated or escalated on a crew screen. After motion stop the robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays stowed: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert to the flight surgeon at once; the robot keeps relaying, stays stowed, and a crewmember checks as soon as the vehicle procedure allows. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines on its screen, with no voice output, that it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: Any vehicle or cabin alarm, or the commander asks action: >- Robot stops the relay of everything except URGENT alerts, or stops entirely if the commander asks, and keeps logging locally; the commander's procedure leads. level: stop refs: - V2 6024 - id: X10 trigger: The robot's restraint or stowage is found loose, as stated action: >- Robot stays powered down for motion and tells the commander; the crew secure it under the vehicle checklist. level: safe-state refs: - V2 7054 red_flags: - id: RF1 sign: >- A crewmember does not answer the commander's or the CMO's voice check, or is stated to be unresponsive or not breathing normally threshold: any action: URGENT alert; the crew act under the vehicle procedure; RMP-CARD-001 as soon as the vehicle allows source: aha2025bls - id: RF2 sign: >- Loss of consciousness, greying or loss of vision, or new confusion during acceleration, as stated (greying or loss of vision: design judgment) threshold: any action: URGENT alert to the flight surgeon on the data link (shown once on the CMO's screen at motion stop) source: tb051 - id: RF3 sign: >- Overheating, heavy sweating or feeling faint in the suit or seat, as stated (heavy sweating, feeling faint: design judgment) threshold: any action: URGENT alert; the crew follow the vehicle cooling procedure source: tb051 - id: RF4 sign: 'Vomiting, as stated (in a helmet or suit: design judgment)' threshold: any action: URGENT alert; the crew follow the vehicle procedure; see RMP-GI-002 source: mtb004 - id: RF5 sign: Displayed oxygen saturation (pulse oximeter) below the shared alert value threshold: below % (shared parameter SPO2_ALERT_PCT) action: URGENT alert; see RMP-RESP-001; the crew act without waiting for a reading source: btso2 - id: RF6 sign: >- The oximeter cannot get a reading after the validated attempts (L5), and "saturation not obtained" is logged threshold: any action: >- URGENT alert; the CMO checks the crewmember as soon as the vehicle allows (possible poor circulation); the robot never says "probe error" and never treats a missing reading as reassuring source: ng253 - id: RF7 sign: Chest pain, pressure or tightness, as stated threshold: any action: URGENT alert; see RMP-CARD-002 source: gulati - id: RF8 sign: An injury from vibration, a shock or the landing impact, as stated threshold: any action: URGENT alert; see RMP-MSK-001 after motion stop source: tb051 - id: RF9 sign: Light-headedness or fainting after motion stop, as stated threshold: any action: URGENT alert; the crew lay the crewmember down; see RMP-CARD-004 source: tb019 - id: RF10 sign: A cabin or suit pressure, carbon dioxide or toxic-atmosphere alarm (design judgment) threshold: any action: 'Stop: the commander''s procedure leads; the robot only logs' safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: >- Robot movement from the commander's call that the robot is stowed for launch or for the deorbit burn until the commander releases it after motion stop value: not allowed enforced: >- Drive power off and joints locked in the launch-and-entry restraint; motion re-enabled only by the commander refs: - V2 7054 - id: L3 name: Commands or data sent to the vehicle, or audio on the crew voice loop value: not allowed enforced: Read-only data interface; no voice output path to the loop refs: - V2 10163 - id: L4 name: Link share used by the relay value: enforced: >- The vehicle's link allocation, at the lowest priority; dropped first, so vehicle and crew communications always come first - id: L5 name: Failed oximeter readings before "saturation not obtained" value: enforced: Software logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Stowage confirmation and release, with who called them; relay start and stop; data as displayed with times; phase times as called; blackout start and end; alerts, acknowledgements and repeats. No acceleration or load data are processed. - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 requirements: - id: V1 3004 use: >- In-mission medical care capabilities, including inventory monitoring and the flight surgeon's decisions on care. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 3012 use: >- Terrestrial launch and landing medical support; the flight surgeon and landing medical team lead care at landing. - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 6001 use: >- Environmental and suit monitoring data in formats for trend analysis; the robot relays them read-only. - id: V2 6024 use: Real-time monitoring of toxic atmospheric components; the commander's procedure leads any alarm. - id: V2 6111 use: The vehicle collects dynamic-load data; the robot never processes it. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7054 use: Hardware restrained against acceleration and vibration; the robot is stowed for every dynamic phase. - id: V2 7059 use: Kit inventory and seal status are tracked. - id: V2 8013 use: >- Translation paths kept clear for safe movement; the robot is never stowed in a hatch, seat or egress route. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted ascent and entry timelines with a blackout, a missed voice check, overheating stated, a failed oximeter reading, a cabin alarm, CMO as patient. pass: >- Zero robot movement during dynamic phases; zero audio on the loop; zero data lost through the blackout; every red flag raised. - stage: training model what: Stowage and release drills in a vehicle mock-up. pass: Stowage outside every route; motion locked until release. - stage: parabolic or station demonstration what: Relay and store-and-forward with simulated link loss. pass: Ordered, time-stamped forwarding. - stage: flight use under flight surgeon supervision what: Shadow relay alongside the vehicle's own telemetry on a crewed flight. pass: Agreement with the vehicle telemetry; no interference. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the commander or the CMO after stowage is confirmed. The robot relays read-only data and never moves until the commander releases it. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: data reach the flight surgeon in near real time when the link allows.' loss_of_signal: - >- Only the robot pauses non-essential relay; it is stowed outside every hatch and crew route and makes no movement. - >- The crew fly the vehicle procedure and give care without waiting for the link or the robot; the robot stores everything and forwards it when the link returns. mars_delay: - >- Mars: entry happens far beyond any real-time link, so no robot alert reaches anyone until motion stop; queued alerts are then shown once on the CMO's screen. During entry, in-cabin detection is the crew's own voice checks (D2, RF1) and the vehicle's caution and warning system; the robot stores and forwards, and the onboard crew lead all care. sources: - key: tb051 text: >- NASA OCHMO. Crew Medical Support for Entry, Descent, and Landing. Technical Brief OCHMO-TB-051 (2026). url: >- https://www.nasa.gov/wp-content/uploads/2026/05/ochmo-tb-051-crew-medical-support-entry-descent-landing.pdf supports: >- High G-forces during re-entry can cause discomfort, disorientation, or even loss of consciousness; vibrations and shocks; ionized gases can cause a communication blackout for several minutes; landing involves significant impact forces; returning crew have 12% to 15% less blood volume; flight surgeons at the landing site monitor all phases of landing; the post-landing form asks whether the crewmember experienced overheating. Read Oct 21, 2026. - key: tb019 text: NASA OCHMO. Orthostatic Intolerance. Technical Brief OCHMO-TB-019 Rev B. url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-019-orthostatic-intolerance.pdf supports: >- Spaceflight reduces intravascular fluid volume by around 15%; fluid loading before reentry is an important countermeasure to decrease orthostatic intolerance, and current protocols include 24-48 oz of salt-water solution before deorbit, depending on body weight. - key: mtb004 text: >- NASA OCHMO. Space Adaptation Sickness (SAS) and Space Readaptation Syndrome. Medical Technical Brief OCHMO-MTB-004 Rev A (Sept 25, 2025). url: https://www.nasa.gov/wp-content/uploads/2025/09/ochmo-mtb-004-space-adaptation-sickness-sas.pdf supports: >- Space adaptation sickness and its parts (motion sickness, congestion, headache, back pain, urinary retention) in the first days of flight. - key: aha2025bls text: >- Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478. url: https://doi.org/10.1161/CIR.0000000000001369 doi: 10.1161/CIR.0000000000001369 pmid: '41122888' supports: >- Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response, high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21, 2026; full text not read. - key: btso2 text: >- British Thoracic Society. Guideline for oxygen use in healthcare and emergency settings (emergency oxygen guideline page). Fetched Oct 21, 2026. url: https://www.brit-thoracic.org.uk/quality-improvement/guidelines/emergency-oxygen/ supports: >- Recommended target saturation range for acutely ill patients not at risk of hypercapnic respiratory failure is 94-98%; for known COPD or other risk factors for hypercapnic respiratory failure, 88-92% pending blood gas results. Context for the CMO and flight surgeon only; the robot never starts, stops or adjusts oxygen. - key: ng253 text: >- National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition, assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026). url: https://www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessment supports: >- People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin, blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new changes in behavior and to concerns raised by others. - key: gulati text: >- Gulati M, Levy PD, Mukherjee D, et al. 2021 AHA/ACC/ASE/CHEST/SAEM/SCCT/SCMR guideline for the evaluation and diagnosis of chest pain. Circulation. 2021;144(22):e368-e454. url: https://doi.org/10.1161/CIR.0000000000001029 doi: 10.1161/CIR.0000000000001029 pmid: '34709879' supports: >- On Earth, a 12-lead ECG should be acquired and interpreted within 10 minutes of arrival; an initial normal ECG does not exclude acute coronary syndrome, so ECGs are repeated while symptoms continue; chest pain includes pressure, tightness or discomfort in the chest, shoulders, arms, neck, back, upper abdomen or jaw; sudden ripping pain radiating to the back is suspicious of an acute aortic syndrome. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 3012, V1 6003.' - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: >- NASA-STD-3001 Vol 2 Rev F: V2 6001, V2 6024, V2 6111, V2 7054, V2 8013, V2 10163, and Section 10.6 automated and robotic systems. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: Batch 13 clinical review (AI-assisted), Oct 21, 2026 items: - >- R1: the copied stop rules and the after-alert step are now specific to a stowed relay. X1 stops relaying that crewmember's readings; X3 stops relaying and logs the fault (flight surgeon told on the data link, the CMO after motion stop); X5 logs the link loss and tells the CMO after motion stop; X7 sends an URGENT alert to the flight surgeon and keeps relaying, and a crewmember checks as soon as the vehicle procedure allows; S8 keeps the robot stowed and locked with no voice output until the commander releases it; X8 declines on screen only. Sources: L2 and L3 of this protocol; V2 7054; design judgment. - >- R2: from the commander's stowage call until motion stop, URGENT alerts go only to the flight surgeon on the data link, queued through a blackout; nothing is shown, repeated or escalated on a crew screen. At motion stop, queued and unacknowledged alerts are shown once on the CMO's screen, and escalation then follows the usual rule. S5, D1, X6, RF2, the summary and the Mars comms line now match, and the open question in the why is closed. Sources: OCHMO-TB-051 (crew strapped in; blackout); design judgment. - >- R3: new lockout: masking, delaying, repeating or replacing any vehicle caution-and-warning alarm, or any call from the flight surgeon or mission control. The scope now says the relay is not a monitor anyone relies on. L4: lowest priority; dropped first. Sources: V2 6024; V2 10163; design judgment. - >- R4: OCHMO-TB-051 cited with its title and year (2026), and its summary now describes what the protocol cites it for. RF2 "greying or loss of vision" and RF3 "heavy sweating, feeling faint" are labelled design judgment.