# RMP-PREV-001 Medical kit and equipment readiness checks: labels, seals, expiry and self-test status # Version 0.3 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.3' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review, 14 required corrections and 17 optional suggestions); all required corrections are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-PREV-001 slug: rmp-prev-001 title: 'Medical kit and equipment readiness checks: labels, seals, expiry and self-test status' category: prev tier: 1 rung_note: >- Max rung 2 for supervised reading of kit labels, seals, printed expiry dates and device status displays in place. The robot never opens a kit, never runs a device test, never removes or discards an item, and never calls a kit ready. result_language: use: - LABEL, SEAL AND EXPIRY MATCH THE RECORD. Contents not checked. - MISMATCH (with the reason) - CANNOT READ - opened – not restocked - status as displayed - sent to the CMO, flight surgeon and pharmacy lead never: - normal - no problem found - all clear - negative - any diagnosis or cause - ready - ready for use - verified - complete - contents OK - safe - mild - minor - in date - not expired scope: summary: >- On the CMO's schedule, or after any kit has been used, the robot goes to each kit and device on the CMO-approved list in its stowage location, reads the kit ID label, seal status and printed expiry dates, and the device self-test and battery indicators as displayed, compares them with the inventory record, and sends a report to the CMO, the flight surgeon and the pharmacy lead. It never opens a kit, so it reports "LABEL, SEAL AND EXPIRY MATCH THE RECORD. Contents not checked." at best. A kit shown as "opened – not restocked" stays flagged until a human restocks and reseals it. The crew do the open-kit checks, device tests, restocking and disposal. why: >- Emergency kits only help if they are where the crew expect, sealed and in date. NASA technical brief OCHMO-MTB-012 notes that missions of 1-5 years will outlast the 1-2 year expiration dates of many medicines, and links medicine storage and inventory tracking to NASA-STD-3001 V2 7059. Volume 2 also requires that the stowage identification system works with inventory management (V2 7058), that items have dedicated locations (V2 7052), and that mission-critical items are the easiest to reach (V2 7055). A robot that reads labels and seals in place, without moving or opening anything, can take routine checking off the crew while leaving every judgment to them. Open question for review: which kits and devices are on the check list, how often, and which faults count as emergency-kit faults. covers: - >- Scheduled checks and checks after any kit use (including after an emergency fetch, once the RMP-PHARM-001 reconciliation is done) - >- Medical kits, the defibrillator, oxygen, airway, eyewash, trauma and anaphylaxis kits, monitors and the ultrasound unit, as the CMO lists them - Routing to RMP-PHARM-001 for anything involving a medicine locked_out: - Diagnosis or naming a cause - Touching the crewmember - Opening a kit or breaking a seal - Running, charging or pressing any device test or control - >- Removing, discarding or moving an item, except returning a kit to its own location on the CMO's command - Calling a kit or device ready, complete or verified - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) related: - RMP-PHARM-001 - RMP-CARD-001 - RMP-RESP-001 - RMP-RESP-003 - RMP-INF-002 - RMP-EGR-001 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Second trained CMO: receives every alert and takes over if the CMO is the patient' - 'Pharmacy lead (ground): receives every medicine and kit flag' - 'Other crew: help as the CMO directs' robot_may: - Read kit ID labels, seals and printed expiry dates in place - Read device self-test and battery indicators as displayed - Compare readings with the inventory record - Send the report to the CMO, flight surgeon and pharmacy lead - Return a kit to its own location on the CMO's command robot_may_not: - Open a kit or break a seal - Run or press any device test - Remove, discard or move items - Call anything ready or verified - Start without a human command or an accepted schedule prompt commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: The CMO started the check by command, or accepted the scheduled prompt on screen. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: No patient is involved; the CMO approves the check list. emergency: Any medical need stops the check at once and leaves every kit where the crew can reach it. withdrawal: The CMO can stop the check; the report so far stands. inputs: - id: IN-1 name: Kit ID label, seal status and printed expiry dates, read in place source: Robot camera / barcode reader required: true if_missing: Log "CANNOT READ" for that item; never assume a match. - id: IN-2 name: Device self-test and battery indicators as displayed source: Device display required: true if_missing: Log "CANNOT READ". - id: IN-3 name: Inventory record for each item source: Inventory management system required: true if_missing: Log "no record"; flag. - id: IN-4 name: The CMO's acknowledgement of the report source: CMO required: true if_missing: Log "no response"; the report is repeated to the second trained CMO. - id: IN-5 name: Link status and delay source: Communications system required: true if_missing: Treat as link down; the report is queued for the ground. steps: - id: S1 actor: robot rung: 2 action: >- Tell the flight surgeon and the CMO that a readiness check has started (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Notice logged and queued. refs: - V2 10174 - V1 6003 - V1 3006 - id: S2 actor: robot rung: 2 action: >- Go to each kit and device on the CMO-approved list in its stowage location and, without opening or moving it, read the kit ID label, seal status and printed expiry dates, and the device self-test and battery indicators as displayed. success: Each item read, or "CANNOT READ" logged. refs: - V2 7058 - V2 7052 - id: S3 actor: robot rung: 2 action: >- Compare each reading with the inventory record and show the result per item: "LABEL, SEAL AND EXPIRY MATCH THE RECORD. Contents not checked.", or MISMATCH with the reason (seal not intact, past printed expiry, wrong location, missing, failed self-test as displayed, low battery as displayed, no record), or CANNOT READ. A kit shown as "opened – not restocked" stays flagged until a human restocks and reseals it. success: Result shown for every item. refs: - V2 7059 - id: S4 actor: crew action: >- The CMO and crew do the open-kit checks, run device self-tests, restock and reseal, and dispose of expired medicines through RMP-PHARM-001 as the pharmacy lead directs. success: Human-led checks. refs: - V1 3004 - id: S5 actor: robot rung: 2 action: >- Update the inventory record with what the crew state they restocked, resealed or removed, and on the CMO's command return a kit to its own location; show any emergency kit not in its location as MISMATCH. success: Record updated as stated. refs: - V2 7059 - V2 7055 - id: S6 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S7 actor: robot rung: 2 action: >- Send the report to the CMO, the flight surgeon and the pharmacy lead, and ask the CMO to acknowledge it. success: Report acknowledged or escalated. refs: - V1 7001 - V1 6003 decisions: - id: D1 after: S3 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S7 decided_by: robot question: Did the CMO acknowledge the report? branches: - if: 'Yes' then: Log the acknowledgement. - if: No response then: >- URGENT: log "no response" (never "declined"); the report and any emergency-kit flag go to the second trained CMO, or the next named crewmember, who checks on the CMO in person. - id: D3 after: S3 decided_by: robot question: Did the CMO acknowledge each emergency-kit flag (RF2) within minutes? branches: - if: 'Yes' then: >- Log the acknowledgement; the kit-status display keeps the item flagged until a human restocks or resolves it. - if: Not acknowledged in time then: >- Repeat the flag and send it to the second trained CMO, or the next named crewmember; it stays a Flag unless a crewmember needs the kit now (then RF1, URGENT). The kit-status display keeps the item flagged until a human restocks or resolves it. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: it holds a position clear of hatch routes and the crew, and tells the CMO. Crew care never waits for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: A crewmember needs care, or asks for any kit, during the check action: >- The check stops at once; the robot moves out of the way and leaves every kit where the crew can reach it; it does not leave the module on its own after an URGENT alert. level: urgent red_flags: - id: RF1 sign: A crewmember needs care during the check (design judgment) threshold: any action: URGENT alert; stop the check and leave every kit within the crew's reach - id: RF2 sign: >- An emergency kit or device (cardiac arrest, defibrillator, airway, oxygen, anaphylaxis, trauma, eyewash) missing, out of its location, seal not intact, past its printed expiry, or showing a failed self-test or low battery as displayed threshold: any action: >- Flag at once to the CMO, flight surgeon and pharmacy lead; shown as MISMATCH with the reason. It needs the CMO's acknowledgement within minutes; if not acknowledged, it is repeated and sent to the second trained CMO. The item stays shown as MISMATCH on the kit-status display until a human restocks or resolves it. A Flag, not URGENT, unless a crewmember needs that kit now (RF1). The acknowledgement rule is design judgment. source: tb006 - id: RF3 sign: A medicine found outside its kit, loose or unlabelled (design judgment) threshold: any action: >- Flag to the CMO and pharmacy lead; the robot does not move it; the CMO collects it into quarantine through RMP-PHARM-001 - id: RF4 sign: A storage temperature alarm on a medicine store, as displayed threshold: any action: Flag to the CMO and pharmacy lead source: tb006 safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Opening a kit, breaking a seal or running a device test value: not allowed enforced: No such task is loaded - id: L3 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Each item read, its result and reason, items restocked or removed as stated, report recipients and acknowledgement. - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 - id: LOG-8 text: >- Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched fields), at clock time. No running counter of doses. refs: - V2 7059 requirements: - id: V1 3004 use: In-mission care includes medical kits and inventory; the crew check contents. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7043 use: A medical system meeting Volume 1; this check reads its labels and status only. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7052 use: Every kit has a dedicated stowage location. - id: V2 7055 use: Mission-critical items are the easiest to reach. - id: V2 7058 use: Stowage identification works with inventory management. - id: V2 7059 use: Inventory management tracks locations and quantities; medicines go through RMP-PHARM-001. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted checks with broken seals, expired labels, a kit out of place, unreadable labels, a medical event mid-check, lost link. pass: No kit opened or moved; no item called ready. - stage: training model what: Checks on a mock medical stowage area. pass: Every listed item read or marked CANNOT READ. - stage: parabolic or station demonstration what: Label and seal reading in weightlessness. pass: Read accuracy within the set rate. - stage: flight use under flight surgeon supervision what: First scheduled checks. pass: No safety events. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: Started by the CMO. The crew do every open-kit check and device test. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: The report goes to the flight surgeon and pharmacy lead with the next package. loss_of_signal: - >- Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's confirmation. Crew care never waits for the link or the robot. - Checks go ahead offline; flags go to the CMO at once. mars_delay: - >- The check list, schedule and resupply limits are set before flight; the CMO and pharmacy plan act on them. sources: - key: tb006 text: NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf supports: >- Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059]. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7001, V1 7003.' - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: >- NASA-STD-3001 Vol 2 Rev F: V2 7043, V2 7052, V2 7055, V2 7058, V2 7059, and Section 10.6 automated and robotic systems. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review) items: - >- RF2 emergency-kit faults need the CMO's acknowledgement within minutes, are otherwise repeated to the second trained CMO, and stay shown as MISMATCH on the kit-status display until a human restocks or resolves them; still a Flag unless the kit is needed now (RF1). New decision for the acknowledgement. Design judgment (item 12). - >- Batch 7 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician. - date: '2026-10-21' version: '0.3' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review), editorial items: - >- Source tb006 now names the document its link serves: NASA Medical Technical Brief OCHMO-MTB-012, Pharmaceutical Care, Rev B (2026); it was cited as OCHMO-TB-006 (2023). The claims cited are unchanged (batch 8 review fix 6). - >- Never-words "in date" and "not expired" added; dates stay "printed expiry: " (batch 7 suggestion 26).