RMP-RENAL-001 Assisted diagnostic ultrasound for a suspected kidney stone

1 · Identity and scope

The robot positions and holds an ultrasound probe, captures and labels standard kidney and bladder views, and sends them to the flight surgeon, while the CMO leads and can take over at any moment. Diagnostic imaging only.

Why this protocol was chosen. Kidney stone risk is higher in flight, and ultrasound is the imaging available on board. This is the worked example from Part 1 of the Robotic Medicine series, and the scenario the ground console simulates.

Former ID: ASSIST-US-RENAL-001. First published as the worked example in Part 1.

Related: RMP-RENAL-002 · RMP-PREV-003

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Treatment is decided by humans only: pain relief (anti-inflammatory first), anti-nausea medicine and tamsulosin are decided by the CMO and flight surgeon; no forced or high-volume fluids for acute colic

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [9]

3 · Preconditions and consent

• PRE-1 A crewmember started the run by command.human_start == trueV2 10174
• PRE-2 Patient consent recorded (voice or touch confirmation, logged).
• PRE-3 CMO present and able to take over at any moment.V2 10168V2 10164
• PRE-4 Patient, caregiver and robot restrained.V2 7046
• PRE-5 Ultrasound and gel checked; robot self-test passed.V2 10161
• PRE-6 Link check: flight surgeon agrees to this run, or link down / delay too long and the CMO proceeds under the pre-approved onboard checklist.

Consent

Patient consent recorded by voice or touch confirmation and logged.

Emergency consent

If the patient cannot consent: proceed only on a CMO and flight surgeon emergency decision, logged.

Withdrawal

Patient says stop: stop, retract probe, alert CMO.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1Crew

   Confirm patient position and expose scan areas.

   Done when: CMO confirms.

   D1DecisionCrew decides

   Is the delay Mars-class, or the link down? (Set before scanning.)

   • Yes → No real-time guidance; onboard checklist plus store-and-forward only.
   • No → Live guidance allowed.
2. S2RobotRung 2

   Right kidney views; automatic image-quality check.

   Done when: Views meet the quality threshold.

3. S3RobotRung 2

   Left kidney, same views as right, for side-by-side comparison.

   Done when: Views meet the quality threshold.

   D2DecisionRobot decides

   Is image quality still low after the allowed attempts?

   • Yes → Hand probe control to the CMO or ground.
   • No → Continue.
4. S4RobotRung 2

   Bladder views, including the ureteral jet on each side.

   Done when: Views captured.

   D3DecisionGround decides

   Does the collecting system look swollen (possible blockage)? Decided by the flight surgeon when the link is live; otherwise by the CMO under the onboard checklist, with flight surgeon review at the next contact.

   • Possible swelling seen (by the human reviewer) → Flag for human review; the robot does not interpret.
   • Scan without findings → Report "non-diagnostic", never "normal" or "no stone". Ultrasound can miss ureteral stones, and swelling may not show early; CT is the reference test on Earth but is not available in flight.
5. S5RobotRung 2

   Optional color Doppler "twinkle" views (twinkle may be harder to see at high cabin CO2; animal data only).

   Done when: Views captured or skipped.

6. S6RobotRung 2

   Label images and attach them to the medical record; send to the flight surgeon live, or store-and-forward if no link.

   Done when: Delivery confirmed or queued.

   V1 7003

   D4DecisionRobot decides

   Did the images reach the flight surgeon?

   • Yes → Log delivery; wait for the human decision.
   • No (link down or queued) → Keep queued; show the CMO the onboard checklist page; resend at the next contact.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [6] and Volume 2 Revision F [7]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Simulated scans and the ground console scenarios at station, Moon and Mars delays. Pass: Pass criteria set in advance.
2. Training model. Ultrasound training model (phantom). Pass: Image quality and force limits met; criteria set in advance.
3. Earth analog. Analog crew with remote flight surgeons. Pass: Criteria set in advance.
4. Parabolic or station demonstration. Flight demonstration. Pass: Criteria set in advance.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Flight surgeon agreement when the link allows; otherwise the CMO under the pre-approved onboard checklist, with flight surgeon review of images and logs at the next contact.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.7.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Loss of signal and Mars delay

Live link

Low Earth orbit: the flight surgeon can watch and guide live.

Loss of signal

• Only the robot pauses; crew care never waits for the link or the robot.
• The robot pauses the probe in its stopped position (or retracts it) and tells the CMO. The CMO decides whether to continue under the onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged for the flight surgeon.

Mars-class delay

• Mars-class delay: no real-time guidance; onboard checklist plus store-and-forward only.
• With up to about 21-23 minutes one way and blackouts of about 2-3 weeks, every threshold must be set before flight.

[8]

Delay limit for live guidance

<set by validation>

Sources

1. NASA Human Research Program. Evidence Report: Risk of Renal Stone Formation (2024). humanresearchroadmap.nasa.gov/evidence/other/2024%20Renal%20… Supports: Imaging steps and limits of ultrasound; no CT in flight; onboard urine dipstick testing; evacuation rather than onboard nephrostomy from low Earth orbit.
2. European Association of Urology. EAU Guidelines on Urolithiasis. uroweb.org/guidelines/urolithiasis Supports: An infected, obstructed kidney needs urgent drainage plus antibiotics.
3. Harper JD, Cunitz BW, Dunmire B, et al. First in human clinical trial of ultrasonic propulsion of kidney stones. J Urol. 2016;195(4 Pt 1):956-964. PMID 26521719. doi:10.1016/j.juro.2015.10.131 Supports: Ultrasonic stone propulsion is still investigational.
4. Worster AS, Bhanich Supapol W. Fluids and diuretics for acute ureteric colic. Cochrane Database Syst Rev. 2012;(2):CD004926. PMID 22336806. doi:10.1002/14651858.CD004926.pub3 Supports: No reliable evidence that forced fluids help in acute colic.
5. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
6. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
7. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
8. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
9. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.