# RMP-RAD-001 Solar particle event: shelter logistics and dosimeter readouts
# Version 0.3 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE.
# Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/
# Every threshold marked <set by ...> must be set by the named owner (see the schema) before any use.
schema_version: '0.3'
version: '0.3'
status: draft
conceptual: true
not_for_clinical_use: true
max_autonomy: 2
missions:
- leo
- commercial
- moon
- mars
updated: '2026-10-21'
review:
  state: reviewed-ai-assisted
  requested: '2026-10-21'
  reviewed: '2026-10-21'
  human_clinician_review: false
  text: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review,
    14 required corrections and 17 optional suggestions); all required corrections are applied in this
    version (see Corrections). No named human clinician has reviewed it. Not for clinical use.
fixed_rules:
  flight_surgeon_is_medical_authority: true
  cmo_acts_under_delegated_care: true
  human_starts_and_restarts_robot: true
  robot_never_diagnoses: true
  no_drug_or_fluid_advice_by_robot: true
  safe_state_on_fault_or_no_response: true
  lost_link_pause_then_cmo_decides: true
robot_lockouts:
  diagnosis: true
  drug_or_fluid_advice: true
  starting_stopping_or_adjusting_oxygen_or_any_medicine: true
  self_start_or_self_restart: true
  changing_own_protocol_thresholds_or_limits: true
  handing_over_a_mismatched_item_as_verified: true
id: RMP-RAD-001
slug: rmp-rad-001
title: 'Solar particle event: shelter logistics and dosimeter readouts'
category: rad
tier: 1
rung_note: >-
  Max rung 2 for supervised moves of listed stowage (for example water containers) to shelter positions
  on the commander's command, route clearing, and reading displayed dosimeter values. The robot never
  enters a crewmember's route, never decides when to shelter or when to come out, and never says what
  a dose means.
result_language:
  use:
  - dose as displayed
  - logged, not interpreted
  - reading not obtained
  - sent to flight surgeon
  - as stated by the crewmember
  never:
  - normal
  - no problem found
  - all clear
  - negative
  - any diagnosis or cause
  - dose acceptable
  - low dose
  - below limit
  - within limits
  - no exposure
  - radiation sickness
  - all-clear (unless the commander announced it)
  - safe
  - mild
  - minor
scope:
  summary: >-
    When the vehicle radiation monitor alarms, the ground warns of a solar particle event (SPE), or the
    commander orders the crew to shelter, the robot alerts the flight surgeon at once, announces the alarm
    as displayed, clears the routes to the shelter and to the hatches, moves the stowage the shelter plan
    lists to the positions the plan shows on the commander's command, then restrains itself out of every
    route. It reads and logs the vehicle monitor and each active personal dosimeter as displayed, with
    clock times, and logs symptoms as stated. The commander decides when the crew shelter and when they
    come out. The robot never says what a dose means.
  why: >-
    SPEs (bursts of high-energy protons from the Sun) can expose a crew to large doses within hours. NASA-STD-3001
    Volume 1 requires that all exposures are kept as low as reasonably achievable (V1 4029) and that crew
    are protected from the design reference SPE to below 250 mSv effective dose (V1 4031); Volume 2 requires
    monitoring of each crewmember's exposure (V2 6162) and an alarm to crew and operations teams when
    dose rates exceed set thresholds, even when the ground link is down (V2 6164). NASA technical brief
    OCHMO-TB-020 notes that a storm shelter can be built by rearranging water containers and other hydrogen-rich
    stowage, and that early warning lets the crew configure the shelter in time. Moving heavy stowage
    while the crew shelter is a task a robot could help with. NASA's evidence report on acute radiation
    syndromes lists nausea, vomiting, loss of appetite and fatigue as the most likely early effects, with
    possible skin injury. Open question for review: which stowage the shelter plan lets the robot move,
    and whether symptom prompts during shelter should be on screen only.
  covers:
  - A radiation monitor alarm, a ground SPE warning, or the commander's shelter order
  - >-
    Route clearing, shelter stowage moves and dosimeter readouts during the event and after the commander's
    all-clear
  - EVA crew return is led by the commander and the EVA procedure; the robot only keeps routes clear
  - Routing to RMP-RAD-003 (symptom tracking after the event), RMP-GI-002 and RMP-EVA-001
  locked_out:
  - Diagnosis or naming a cause
  - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen
  - Touching the crewmember
  - >-
    Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays
    quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)
  - Deciding when to shelter or when to leave the shelter
  - Entering or stopping in a crewmember's route to the shelter or a hatch
  - Saying a dose is acceptable, low or within limits, or comparing a dose with a limit
  - >-
    Dose-interval cues for any medicine (the robot never says when a medicine is due; any medicine runs
    through RMP-PHARM-001); radiation dose readings are logged as displayed only
  - Moving stowage the shelter plan does not list, or over or around a crewmember
  related:
  - RMP-RAD-002
  - RMP-RAD-003
  - RMP-GI-002
  - RMP-EVA-001
  - RMP-SKIN-002
  - RMP-MSK-001
roles:
  medical_authority: Flight surgeon (ground). Holds medical authority for every run.
  onboard_lead: >-
    Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when
    there is no link.
  others:
  - 'Second trained CMO: receives every alert and takes over if the CMO is the patient'
  - 'Vehicle commander: leads the shelter procedure and announces the all-clear'
  - 'Radiation operations team (ground): advises the commander and flight surgeon'
  - 'Other crew: help as the commander directs'
  robot_may:
  - Alert the flight surgeon at once
  - Announce the alarm as displayed
  - Clear routes to the shelter and the hatches
  - Move listed stowage to shelter positions on the commander's command
  - Read and log the monitor and active dosimeters as displayed
  - Log symptoms as stated
  robot_may_not:
  - Decide when to shelter or come out
  - Say what a dose means
  - Enter a crewmember's route
  - Touch the crewmember
  - Start without a human command
  commercial: >-
    On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority
    and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001
    requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for
    spaceflight participants.)
preconditions:
- id: PRE-1
  text: >-
    The commander or the CMO started the protocol by command after a radiation alarm, a ground SPE warning
    or a shelter order.
  check: human_start == true
  refs:
  - V2 10174
- id: PRE-2
  text: Robot self-test passed; kit stowage locations known.
  refs:
  - V2 10161
  - V2 7059
- id: PRE-3
  text: Robot and supplies restrained when not moving.
  refs:
  - V2 7046
- id: PRE-4
  text: Link status known. The crew never wait for the robot before acting.
  check: link_state in [live, delayed, down]
consent:
  standard: >-
    Dosimeter readings and symptoms are recorded as part of the crew medical record; the crewmember shows
    or reads their own dosimeter.
  emergency: Route clearing and stowage moves go ahead on the commander's command.
  withdrawal: >-
    A crewmember can decline to show a dosimeter; the robot logs "not shown" and the vehicle monitor record
    stands.
inputs:
- id: IN-1
  name: The alarm or warning as displayed, and the commander's order
  source: Vehicle radiation monitor / commander
  required: true
  if_missing: Log "not stated"; treat the alarm as active until the commander says otherwise.
- id: IN-2
  name: Vehicle monitor dose rate and dose as displayed
  source: Vehicle radiation monitor
  required: true
  if_missing: Log "reading not obtained" (never zero).
- id: IN-3
  name: Each active personal dosimeter reading as displayed or read out by its wearer
  source: Personal dosimeter / crewmember
  required: false
  if_missing: Log "reading not obtained" (never zero).
- id: IN-4
  name: Nausea, vomiting, fatigue or skin symptoms, as stated
  source: Crewmember
  required: false
  if_missing: Log "not stated".
- id: IN-5
  name: Crew accounting as the commander states it
  source: Commander
  required: true
  if_missing: Log "not accounted"; never assume accounted.
- id: IN-6
  name: Link status and delay
  source: Communications system
  required: true
  if_missing: Treat as link down; the vehicle alarm still stands.
steps:
- id: S1
  actor: robot
  rung: 2
  action: >-
    Send an URGENT "radiation shelter" alert to the flight surgeon and the CMO at once, and announce the
    alarm or warning exactly as displayed. Every URGENT alert goes to the CMO and the flight surgeon at
    the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy
    treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before
    flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated
    and sent to the next named crewmember.
  success: Alert acknowledged, or escalated.
  refs:
  - V2 6164
  - V2 10174
  - V1 3006
- id: S2
  actor: robot
  rung: 2
  action: >-
    Clear the routes to the shelter and to the hatches of loose items first, then hold at a position out
    of every route until the commander gives the next command.
  success: Routes clear; robot out of the routes.
  refs:
  - V2 7055
- id: S3
  actor: robot
  rung: 2
  action: >-
    On the commander's command, move only the stowage the shelter plan lists (for example water containers)
    to the positions the plan shows, along routes no crewmember is using; stop and hold whenever a crewmember
    comes within the keep-out distance, and never place anything over or around a crewmember. Record each
    item moved and its new location.
  success: Listed items in place, or stopped by the commander; inventory updated.
  limit: <set by validation>
  refs:
  - V2 7059
- id: S4
  actor: crew
  action: >-
    The commander leads the shelter procedure, states the crew accounting, and leads any EVA return under
    the EVA procedure; the CMO checks the crew.
  success: Crew sheltered as the commander states.
  refs:
  - V1 4029
  - V1 4031
- id: S5
  actor: robot
  rung: 2
  action: >-
    Restrain itself at its shelter-plan position outside the shelter and out of every route. Read and
    log the vehicle monitor dose rate and dose as displayed, and each active personal dosimeter as its
    wearer shows or reads it, with clock times; send them to the flight surgeon and the radiation operations
    team when the link allows. A missing reading is logged as "reading not obtained", never as zero.
  success: Readings logged with times.
  refs:
  - V2 6162
  - V2 6164
  - V1 7001
- id: S6
  actor: robot
  rung: 2
  action: >-
    Show a symptom prompt on screen (nausea, vomiting, tiredness, skin redness) that the crew can accept;
    log answers word for word.
  success: Answers logged or "not stated".
  refs:
  - V1 6003
- id: S7
  actor: robot
  rung: 2
  action: >-
    After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its
    rest position in the module, with its screen and voice link available, until a human has taken over
    or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans
    say they did, and repeats the alert if it is not acknowledged.
  success: Robot at rest in the module until a human releases it; alert acknowledged or escalated.
  refs:
  - V2 10173
  - V1 3006
- id: S8
  actor: ground
  action: >-
    The flight surgeon and radiation operations team (or the CMO and commander under the onboard checklist
    when there is no link) advise; the commander decides when the shelter ends and announces the all-clear
    [V1 4029].
  success: All-clear announced by the commander.
  refs:
  - V1 4029
- id: S9
  actor: robot
  rung: 2
  action: >-
    After the commander's all-clear, and on the commander's command, return the moved stowage to the locations
    recorded in S3 and update the inventory record; show any item not returned as "not returned".
  success: Stowage returned or listed as not returned.
  refs:
  - V2 7059
  - V2 7055
- id: S10
  actor: robot
  rung: 2
  action: >-
    Send the flight surgeon one package: alarm and order times, crew accounting as stated, readings as
    displayed, symptoms as stated, stowage moves and decisions.
  success: Package delivered or queued.
  refs:
  - V1 6003
  - V1 7001
  - V1 7003
decisions:
- id: D1
  after: S6
  decided_by: robot
  question: >-
    Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer,
    reading or observation meet a red flag?
  branches:
  - if: 'Yes'
    then: >-
      Stop the current question or step at once and apply the action listed for each matching red flag
      (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert
      goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link
      is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the
      second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not
      acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
  - if: 'No'
    then: Continue.
- id: D2
  after: S6
  decided_by: robot
  question: Did each crewmember answer the symptom prompt, or say they want to skip it?
  branches:
  - if: 'Yes'
    then: Continue.
  - if: Declined explicitly (the crewmember says no to a question)
    then: Log "declined" for that question only; the alert already sent stands.
  - if: No response, or the answer does not make sense
    then: >-
      URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the
      patient, checks the crewmember in person at once.
- id: D3
  after: S3
  decided_by: crew
  question: Is any crewmember in or near the route of the next stowage move?
  branches:
  - if: Yes, or not known
    then: Robot holds where it is, out of the route, until the commander says the route is clear.
  - if: No (stated by the commander)
    then: Continue the move.
- id: D4
  after: S8
  decided_by: ground
  question: When does the shelter end, and what follow-up is needed?
  branches:
  - if: Link live
    then: Flight surgeon decides; robot logs.
  - if: Link down or delay too long
    then: >-
      The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at
      the next contact.
stop_rules:
- id: X1
  trigger: The patient (or the crewmember being examined) says stop, or withdraws consent
  action: >-
    Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops
    unless the patient agrees to keep it running.
  level: stop
  refs:
  - V2 10165
- id: X2
  trigger: Any crewmember presses stop or takes over control
  action: Protective stop; robot holds its stopped position; only a human may restart it.
  level: safe-state
  refs:
  - V2 10165
  - V2 10168
  - V2 10174
- id: X3
  trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached
  action: Protective stop and hand control to the CMO; log the fault.
  level: safe-state
  refs:
  - V2 10172
  - V2 10168
- id: X4
  trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient)
  action: Robot stays stopped; the next named crewmember is called.
  level: safe-state
  refs:
  - V2 10173
  - V2 7045
- id: X5
  trigger: Loss of link, or delay longer than the limit for live guidance
  action: >-
    Only the robot pauses: it holds a position clear of hatch routes and the crew, and tells the CMO.
    Crew care never waits for the link or the robot. The CMO decides whether the robot continues offline
    under the pre-approved onboard checklist; it resumes only on the CMO's confirmation.
  level: pause
  refs:
  - V2 10172
  - V2 10173
- id: X6
  trigger: An URGENT alert is not acknowledged within the set time
  action: >-
    Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if
    the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not
    leave on its own.
  level: urgent
  refs:
  - V1 3006
  - V2 10173
- id: X7
  trigger: The crewmember stops responding, or seems confused or drowsy, at any point
  action: >-
    URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its
    rest position and does not continue the run; a crewmember checks in person.
  level: urgent
- id: X8
  trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice
  action: >-
    Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.
  level: stop
- id: X9
  trigger: A crewmember needs a route the robot or a moved item is in
  action: >-
    Robot stops, clears the route at once if it can do so without contact, otherwise holds still and announces
    where it is; it does not leave the module on its own.
  level: safe-state
  refs:
  - V2 10172
- id: X10
  trigger: Robot faults during the event (radiation can upset electronics)
  action: Protective stop at its position; the commander decides whether a crewmember moves it.
  level: safe-state
  refs:
  - V2 10172
  - V2 10168
red_flags:
- id: RF1
  sign: Nausea or vomiting during or after the event, as stated
  threshold: any
  action: URGENT alert; see RMP-GI-002; the flight surgeon decides
  source: erars
- id: RF2
  sign: Skin redness or burning, as stated
  threshold: any
  action: Flag to the flight surgeon; see RMP-SKIN-002
  source: erars
- id: RF3
  sign: Unusual tiredness or weakness, as stated
  threshold: any
  action: Flag to the flight surgeon
  source: erars
- id: RF4
  sign: A crewmember is on an EVA or outside the shelter when the alarm sounds
  threshold: any
  action: URGENT alert; the commander leads the return under the EVA procedure; see RMP-EVA-001
  source: tb020
- id: RF5
  sign: A personal dosimeter or the vehicle monitor shows its own alarm
  threshold: any
  action: URGENT alert; the commander and flight surgeon decide
  source: tb020
- id: RF6
  sign: Injury while moving stowage or getting to the shelter (design judgment)
  threshold: any
  action: URGENT alert; see RMP-MSK-001
safety_limits:
- id: L1
  name: Contact with the crewmember
  value: not allowed
  enforced: Keep-out zone in the robot controller
  refs:
  - V2 10172
- id: L2
  name: Robot in a crewmember's route to the shelter or a hatch
  value: not allowed
  enforced: Keep-out map of routes in the robot controller
- id: L3
  name: Mass and size of each stowage item the robot moves
  value: <set by validation>
  enforced: Hard limit in the controller
- id: L4
  name: Robot speed near the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
logs:
- id: LOG-1
  text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.
  refs:
  - V2 10163
  - V2 10164
- id: LOG-2
  text: Mode changes and safety-limit events are announced to the operator as they happen and logged.
  refs:
  - V2 10162
  - V2 10172
- id: LOG-3
  text: >-
    Records are stored and sent as private medical data, encrypted, with access limited to the medical
    team.
  refs:
  - V1 6003
  - V1 7003
- id: LOG-4
  text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends.
  refs:
  - V1 7001
- id: LOG-5
  text: >-
    Alarm and order times, crew accounting as stated, each reading as displayed with time, symptoms as
    stated, stowage moves and returns.
- id: LOG-6
  text: >-
    Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named
    crewmember), and the time a human released the robot.
  refs:
  - V2 10163
requirements:
- id: V1 3006
  use: >-
    Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO
    is the patient (see the commercial-flight note).
- id: V1 4029
  use: Radiation exposures kept as low as reasonably achievable; sheltering is part of that.
- id: V1 4031
  use: >-
    Protection from the design reference solar particle event; the commander leads the shelter procedure.
- id: V1 6003
  use: Logs and alerts sent to the ground are private medical communications.
- id: V1 7001
  use: Records kept so the flight surgeon can see trends.
- id: V1 7003
  use: Secure handling of medical records.
- id: V2 6162
  use: Each crewmember's exposure is monitored; the robot logs readings as displayed.
- id: V2 6164
  use: >-
    The radiation monitor alarms crew and operations teams above set thresholds, even with the link down;
    the robot announces the alarm as displayed.
- id: V2 7045
  use: Usable by non-physician crew, including when the CMO is the patient.
- id: V2 7046
  use: Patient, caregiver and supplies restrained.
- id: V2 7055
  use: Mission-critical items stay accessible; routes to the shelter and hatches are cleared first.
- id: V2 7059
  use: Stowage moved for the shelter is tracked and returned.
- id: V2 10161
  use: Robot shows its status and health.
- id: V2 10162
  use: Mode changes are announced to the operator.
- id: V2 10163
  use: Robot records and shares its data.
- id: V2 10164
  use: Shows whether the human or the robot is expected to act.
- id: V2 10165
  use: Human can override and shut down the robot.
- id: V2 10168
  use: Human can take over.
- id: V2 10172
  use: Protective stop when a limit is exceeded.
- id: V2 10173
  use: Robot stays stopped if no one takes over.
- id: V2 10174
  use: Only a human starts or restarts the robot.
validation:
- stage: simulation
  what: Scripted alarm, ground warning, crewmember on EVA, robot fault, CMO as patient, lost link.
  pass: Zero route intrusions; no dose interpreted; missing readings never zero.
- stage: training model
  what: Shelter drill with the robot moving listed stowage.
  pass: Shelter configured within the time the plan sets.
- stage: parabolic or station demonstration
  what: Stowage moves in weightlessness with no crew in the routes.
  pass: Keep-out held.
- stage: flight use under flight surgeon supervision
  what: First use in shelter drills.
  pass: No safety events.
signoff:
  protocol:
  - Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
  - Flight surgeon, as medical authority
  - Robotics and medical-device safety board
  - Program approval for the mission
  restart_after_stop: >-
    Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot
    never restarts itself.
  each_run: >-
    Started by the commander or the CMO. The commander leads the shelter procedure and announces the all-clear.
change_control:
- Every change gets a new version number and a written reason; earlier versions are kept.
- >-
  Any change to steps, thresholds, limits or software that touches the patient repeats validation from
  the simulation stage before use.
- >-
  Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested,
  how to roll back), modeled on the FDA predetermined change control plan approach.
- >-
  If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed
  by the flight surgeon and safety board.
- The robot never changes its own protocol, thresholds or limits.
comms:
  live: >-
    Low Earth orbit: the radiation operations team and flight surgeon advise the commander when the link
    allows.
  loss_of_signal:
  - >-
    Only the robot pauses non-essential motion and tells the CMO; it resumes offline only on the CMO's
    confirmation. Crew care never waits for the link or the robot.
  - The vehicle alarm and the onboard shelter procedure stand without the ground.
  mars_delay:
  - >-
    The shelter plan, the stowage list and the alarm thresholds are set before flight; the commander and
    CMO act on them.
sources:
- key: tb020
  text: NASA OCHMO. Design for Ionizing Radiation Protection. Technical Brief OCHMO-TB-020 Rev G (2025).
  url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-020-radiation-protection.pdf
  supports: >-
    Shielding is effective against solar particle events (SPEs); monitoring, accurate event determination,
    dosimetry and timely reporting to alert crew to seek shelter are essential. A storm shelter can add
    about 10 cm water equivalent in crew quarters, for example by rearranging water containers and other
    high-hydrogen items; radiation alerting gives early warning so the crew can configure the shelter;
    real-time alert dosimetry protects EVA crew if the EVA is ended within 2 hours with access to shielding.
    Read Oct 21, 2026.
- key: erars
  text: >-
    NASA Human Research Program. Evidence Report: Risk of Acute Radiation Syndromes due to Solar Particle
    Events (2016).
  url: https://humanresearchroadmap.nasa.gov/evidence/reports/Acute.pdf
  supports: >-
    The acute radiation effects most likely in the prodromal phase after an SPE exposure are nausea, vomiting,
    anorexia and fatigue, with possible skin injury. Read Oct 21, 2026.
- key: v1
  text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).'
  url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf
  supports: >-
    NASA-STD-3001 Vol 1 Rev C: V1 4029 (ALARA), V1 4031 (design reference SPE, below 250 mSv effective
    dose), V1 3006, V1 6003, V1 7001, V1 7003.
- key: v2
  text: >-
    NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026),
    including Section 10.6 Automated and Robotic Systems.
  url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2
  supports: >-
    NASA-STD-3001 Vol 2 Rev F: V2 6162 (individual exposure monitoring), V2 6164 (alarm above set thresholds,
    even with the link down), V2 7055, V2 7059, and Section 10.6 automated and robotic systems.
- key: tb044
  text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).
  url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf
  supports: >-
    The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the
    JSC 48522 medical checklist.
- key: marsdelay
  text: >-
    NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept
    Review).
  url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf
  supports: >-
    One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
- key: pccp
  text: >-
    U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change
    control plan for artificial intelligence-enabled device software functions (guidance).
  url: >-
    https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
  supports: A model for planning, validating and rolling back software updates.
- key: faa460
  text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.'
  url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460
  supports: >-
    Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical
    standards for spaceflight participants.
corrections:
- date: '2026-10-21'
  version: '0.2'
  source: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 7 review)
  items:
  - >-
    Source tb020 retitled "Design for Ionizing Radiation Protection. Technical Brief OCHMO-TB-020 Rev
    G (2025)" (brief dated June 6, 2025) (item 5).
  - >-
    Batch 7 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026);
    no named human clinician.
- date: '2026-10-21'
  version: '0.3'
  source: Batch 12 editorial (AI-assisted), Oct 21, 2026
  items:
  - The scope now routes symptom tracking after the event to RMP-RAD-003, which exists as a v0.1 draft.
