RMP-PREV-001 Medical kit and equipment readiness checks: labels, seals, expiry and self-test status

1 · Identity and scope

On the CMO's schedule, or after any kit has been used, the robot goes to each kit and device on the CMO-approved list in its stowage location, reads the kit ID label, seal status and printed expiry dates, and the device self-test and battery indicators as displayed, compares them with the inventory record, and sends a report to the CMO, the flight surgeon and the pharmacy lead. It never opens a kit, so it reports "LABEL, SEAL AND EXPIRY MATCH THE RECORD. Contents not checked." at best. A kit shown as "opened – not restocked" stays flagged until a human restocks and reseals it. The crew do the open-kit checks, device tests, restocking and disposal.

Why this protocol was chosen. Emergency kits only help if they are where the crew expect, sealed and in date. NASA technical brief OCHMO-MTB-012 notes that missions of 1-5 years will outlast the 1-2 year expiration dates of many medicines, and links medicine storage and inventory tracking to NASA-STD-3001 V2 7059. Volume 2 also requires that the stowage identification system works with inventory management (V2 7058), that items have dedicated locations (V2 7052), and that mission-critical items are the easiest to reach (V2 7055). A robot that reads labels and seals in place, without moving or opening anything, can take routine checking off the crew while leaving every judgment to them. Open question for review: which kits and devices are on the check list, how often, and which faults count as emergency-kit faults.

Autonomy: Max rung 2 for supervised reading of kit labels, seals, printed expiry dates and device status displays in place. The robot never opens a kit, never runs a device test, never removes or discards an item, and never calls a kit ready.

Related: RMP-PHARM-001 · RMP-CARD-001 · RMP-RESP-001 · RMP-RESP-003 · RMP-INF-002 · RMP-EGR-001

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Second trained CMO: receives every alert and takes over if the CMO is the patient
• Pharmacy lead (ground): receives every medicine and kit flag
• Other crew: help as the CMO directs

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [7]

3 · Preconditions and consent

• PRE-1 The CMO started the check by command, or accepted the scheduled prompt on screen.human_start == trueV2 10174
• PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
• PRE-3 Robot and supplies restrained when not moving.V2 7046
• PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent

No patient is involved; the CMO approves the check list.

Emergency consent

Any medical need stops the check at once and leaves every kit where the crew can reach it.

Withdrawal

The CMO can stop the check; the report so far stands.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   Tell the flight surgeon and the CMO that a readiness check has started (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

   Done when: Notice logged and queued.

   V2 10174V1 6003V1 3006

2. S2RobotRung 2

   Go to each kit and device on the CMO-approved list in its stowage location and, without opening or moving it, read the kit ID label, seal status and printed expiry dates, and the device self-test and battery indicators as displayed.

   Done when: Each item read, or "CANNOT READ" logged.

   V2 7058V2 7052

3. S3RobotRung 2

   Compare each reading with the inventory record and show the result per item: "LABEL, SEAL AND EXPIRY MATCH THE RECORD. Contents not checked.", or MISMATCH with the reason (seal not intact, past printed expiry, wrong location, missing, failed self-test as displayed, low battery as displayed, no record), or CANNOT READ. A kit shown as "opened – not restocked" stays flagged until a human restocks and reseals it.

   Done when: Result shown for every item.

   V2 7059

   D1DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue.
   D3DecisionRobot decides

   Did the CMO acknowledge each emergency-kit flag (RF2) within <set by validation> minutes?

   • Yes → Log the acknowledgement; the kit-status display keeps the item flagged until a human restocks or resolves it.
   • Not acknowledged in time → Repeat the flag and send it to the second trained CMO, or the next named crewmember; it stays a Flag unless a crewmember needs the kit now (then RF1, URGENT). The kit-status display keeps the item flagged until a human restocks or resolves it.
4. S4Crew

   The CMO and crew do the open-kit checks, run device self-tests, restock and reseal, and dispose of expired medicines through RMP-PHARM-001 as the pharmacy lead directs.

   Done when: Human-led checks.

   V1 3004

5. S5RobotRung 2

   Update the inventory record with what the crew state they restocked, resealed or removed, and on the CMO's command return a kit to its own location; show any emergency kit not in its location as MISMATCH.

   Done when: Record updated as stated.

   V2 7059V2 7055

6. S6RobotRung 2

   After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

   Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

   V2 10173V1 3006

7. S7RobotRung 2

   Send the report to the CMO, the flight surgeon and the pharmacy lead, and ask the CMO to acknowledge it.

   Done when: Report acknowledged or escalated.

   V1 7001V1 6003

   D2DecisionRobot decides

   Did the CMO acknowledge the report?

   • Yes → Log the acknowledgement.
   • No response → URGENT: log "no response" (never "declined"); the report and any emergency-kit flag go to the second trained CMO, or the next named crewmember, who checks on the CMO in person.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Each item read, its result and reason, items restocked or removed as stated, report recipients and acknowledgement.
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163
• LOG-8 Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched fields), at clock time. No running counter of doses.V2 7059

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [2] and Volume 2 Revision F [3]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted checks with broken seals, expired labels, a kit out of place, unreadable labels, a medical event mid-check, lost link. Pass: No kit opened or moved; no item called ready.
2. Training model. Checks on a mock medical stowage area. Pass: Every listed item read or marked CANNOT READ.
3. Parabolic or station demonstration. Label and seal reading in weightlessness. Pass: Read accuracy within the set rate.
4. Flight use under flight surgeon supervision. First scheduled checks. Pass: No safety events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the CMO. The crew do every open-kit check and device test.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.3.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [6].

Loss of signal and Mars delay

Live link

The report goes to the flight surgeon and pharmacy lead with the next package.

Loss of signal

• Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot.
• Checks go ahead offline; flags go to the CMO at once.

Mars-class delay

• The check list, schedule and resupply limits are set before flight; the CMO and pharmacy plan act on them.

[5]

Sources

1. NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmac… Supports: Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059].
2. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7001, V1 7003.
3. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 7043, V2 7052, V2 7055, V2 7058, V2 7059, and Section 10.6 automated and robotic systems.
4. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
5. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
6. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
7. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.