Home › Robotic Medicine › Protocol library › Schema

Robotic Medicine · Protocol format

Protocol schema v0.3

Version 0.3 (Oct 20, 2026) adds the CMO-override branch for medicine hand-over after a mismatch. Version 0.2 (Oct 20, 2026) added the lost-link rule, the lockout list, order-match rules for medicines, allowed placeholder owners and a rung check on every robot step, after the AI-assisted review of the first protocol batch. Version 0.1 was published earlier the same day.

Every protocol in the library is written as a YAML file. When the site is built, each file is checked against this JSON Schema (draft 2020-12) plus a few cross-checks; if any file fails, the build stops and nothing is published. The format follows the 13-part framework from Part 1, plus a loss-of-signal and Mars-delay branch.

Download protocol.schema.json

Fields

All 33 top-level fields are required unless marked optional. No other fields are allowed.

Field	Type	Rule
schema_version	always "0.3"
id	string	Library ID, for example RMP-RENAL-001.
slug	string	Lower-case ID; also the page address and file name.
title	string
former_ids (optional)	list
version	string	Draft versions only (0.x).
status	always "draft"
conceptual	always true
not_for_clinical_use	always true
category	one of: cardio, resp, neuro, eyes, ent, gi, renal, msk, skin, infection, env, rad, behav, pharm, eva, egress, prev
tier	one of: 1, 2, 3
tier_note (optional)	string
max_autonomy	one of: 1, 2, 3	Highest autonomy rung: 1 ground-steered, 2 supervised, 3 conditional. Clinical tasks stop at rung 2.
rung_note (optional)	string
missions	list (at least 1)
updated	string
review	object	Review state and honest review text. human_clinician_review is always false: no named human clinician has reviewed any protocol.
fixed_rules	object	Seven rules that must all be true: flight surgeon authority, CMO under delegated care, human start and restart, no diagnosis, no drug or fluid advice, safe state on fault or no response, and on lost link: pause, then the CMO decides whether to continue offline.
result_language	object	Words the robot may use for results, and words it must never use. The "never" list must include "normal".
scope	object	Summary, why it was chosen, what it covers and what is locked out.
roles	object	Medical authority must be the flight surgeon; onboard lead must be the crew medical officer. Protocols used on commercial flights explain who those roles are there.
preconditions	list (at least 1)
consent	object
inputs	list (at least 1)	Each input says what happens if it is missing.
steps	list (at least 3)	Numbered S1..Sn in order. Each names its actor (robot, crew or ground). Every robot action is its own step with a rung no higher than max_autonomy; crew and ground steps carry no rung.
decisions	list (at least 1)	Each decision follows a step and names who decides (robot, crew or ground), with at least two branches.
stop_rules	list (at least 3)	At least three; level is stop, urgent, safe-state or pause. At least one pause rule (lost link) must say the CMO decides.
red_flags	list (at least 1)	Thresholds are placeholders unless a cited source gives the value.
safety_limits	list (at least 2)	Value must be a placeholder with an allowed owner (list below), or "0", "none" or "not allowed".
logs	list (at least 2)
requirements	list (at least 3)	Only NASA-STD-3001 IDs that were read in the standard are allowed (list below). Every ID used anywhere in the file must be listed here.
validation	list (at least 3)	Stages: simulation, training model, Earth analog, parabolic or station demonstration, flight use under flight surgeon supervision.
signoff	object	Restart after a stop must be a human decision.
change_control	list (at least 2)
comms	object	Live, loss-of-signal and Mars-delay branches are all required.
sources	list (at least 2)	Each with an https link; DOI and PubMed ID where they exist. Red-flag sources must point to a listed source.
robot_lockouts (optional)	object	Six lockouts that must all be true in every protocol: diagnosing; drug or fluid advice; starting, stopping or adjusting oxygen or any medicine; starting or restarting itself; changing its own protocol, thresholds or limits; handing over an item that failed a check.
rework_note (optional)	string	Shown when a protocol was substantially reworked.
verification (optional)	object	Required for medicine-handling protocols: all ten order fields (including recipient identity and time window); on a mismatch, quarantine by default, never an unprompted hand-over or one to anyone but the CMO, and a CMO override that is two-step, logged and flagged to the flight surgeon; a match label that says it is not a dose, interaction or allergy review; and a scan-failure rule that bans proxy scanning.
corrections (optional)	list	Dated list of corrections, with the review they came from.

Extra checks at build time

File name equals the slug, and the slug is the lower-case ID.
IDs are unique within each list; steps are numbered S1, S2, … in order.
Every decision follows a step that exists; every robot step has a rung, never above the protocol's maximum.
Every NASA-STD-3001 ID mentioned anywhere is listed under requirements, and the matching volume is cited in sources.
Allowed result words never include "normal".
Every <set by …> placeholder anywhere in the file uses an allowed owner: clinical lead, flight surgeon, validation, program environmental lead with the flight surgeon, pharmacy lead.
Protocols flown on commercial missions explain who the flight surgeon and CMO are on those flights.
Medicine-handling protocols ban "safe to take", "verified safe" and "OK to give".
Every decision branch that shows MISMATCH or CANNOT VERIFY must declare handoff: none (and say "No hand-over"), or cmo-override-only. An override branch must be triggered by the CMO's two-step request and carry an override block: requested by the CMO, two-step confirm, a log with timestamp, CMO identity, reason and mismatched fields, a flight surgeon notification, and the statement "NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged." A test script (scripts/protocols_negtest.py) confirms the build rejects a hand-over without these fields.

Allowed NASA-STD-3001 requirement IDs

[V1 3003]	In-mission preventive care: monitor physiological and psychosocial well-being
[V1 3004]	In-mission medical care capabilities (including inventory, vital signs, imaging and ECG, procedures, restraints, medications, private data transmission)
[V1 3006]	Crew medical officers: two per vehicle
[V1 3007]	Medical evacuation
[V1 3008]	Medical transport: plans and vehicles to move a severely ill or injured crewmember
[V1 3012]	Medical capability at the launch and landing site
[V1 3017]	Post-mission reconditioning starts at egress
[V1 4003]
[V1 4010]	Post-mission sensorimotor reconditioning monitored
[V1 4024]
[V1 4029]	Radiation exposure kept as low as reasonably achievable (ALARA)
[V1 4030]
[V1 4031]	Protection from the design reference solar particle event
[V1 5003]	Crew medical officer training (including toxicology and medical equipment)
[V1 6002]
[V1 6003]	Private medical communications
[V1 6004]	Psychological and behavioral health support programs
[V1 6006]	Medical clearance before each EVA
[V1 6010]	Private psychological conferences scheduled routinely
[V1 6011]	Private psychological communication
[V1 7001]	Medical records kept permanently and retrievable for trend analysis
[V1 7003]	Security of medical records
[V2 6001]
[V2 6004]	Carbon dioxide: 1-hour average partial pressure no more than 3 mmHg
[V2 6009]	DCS treatment capability
[V2 6021]	Atmospheric data displayed in real time (pressure, humidity, temperature, oxygen, CO2)
[V2 6024]
[V2 6025]	Contamination monitoring and alerting (toxic release, leaks)
[V2 6046]
[V2 6059]
[V2 6063]	Remove or isolate released chemical and biological contaminants
[V2 6109]	Minimum water quantities, including water for eye irrigation
[V2 6110]	Water temperatures for each mission and task
[V2 6111]
[V2 6162]	Individual crew radiation exposure monitoring
[V2 6164]	Radiation alerts above set thresholds
[V2 7016]
[V2 7017]
[V2 7022]
[V2 7038]
[V2 7040]
[V2 7042]	Orthostatic intolerance countermeasures for gravity transitions
[V2 7043]	Medical system meets Volume 1 levels of care
[V2 7045]	Medical equipment usable by non-physician crew
[V2 7046]	Restraint of patient, care provider and supplies
[V2 7052]	Dedicated stowage location for relocatable items
[V2 7054]
[V2 7055]	Stowage accessibility by priority of use
[V2 7058]	Stowage identification compatible with inventory management
[V2 7059]	Inventory management: track locations and quantities
[V2 7064]	Trash management system
[V2 7070]
[V2 7081]
[V2 7082]	Cleanable and sanitizable surfaces
[V2 7083]	Cleaning materials: effective, safe for humans, compatible with vehicle systems
[V2 7102]	Body waste (including vomitus) collected and contained
[V2 8013]
[V2 8040]	Mobility aids for assisted ingress and egress
[V2 8055]
[V2 9053]	Protective equipment for expected hazards
[V2 9059]	Fire protection system (detecting, warning and extinguishing)
[V2 9060]	Fire protection system health and status
[V2 9061]	Fire protection system failure alerting
[V2 9062]	Fire protection system manual activation and deactivation
[V2 9063]	Portable fire extinguishers
[V2 10161]	Automated system status shown to the operator
[V2 10162]	Mode changes announced
[V2 10163]	Data recording and sharing
[V2 10164]	Clear allocation of responsibility (human or system)
[V2 10165]	Human override and shutdown
[V2 10166]	Operator may modify configuration within safe limits
[V2 10167]	Range of control
[V2 10168]	Failure recovery: safe human takeover
[V2 10169]	Human decides when to use decision aids
[V2 10170]	Decision aids explain their reasoning
[V2 10171]	Decision aids state their limitations
[V2 10172]	Protective stop when limits are exceeded
[V2 10173]	Safety Default
[V2 10174]	Only a human initiates or restarts
[V2 11032]	LEA suits protect against Type II decompression sickness in a cabin depressurization
[V2 11100]	Pressure suits for protection from cabin depressurization
[V2 12045]	Expedited crew egress after landing

Read in NASA-STD-3001 Volume 1 Revision C (2023) and Volume 2 Revision F (2026) on Oct 20, 2026. Titles are paraphrased.

Protocols that pass this schema (75)

RMP-BEH-001: Acute distress or behavioral emergency: alert crew lead and flight surgeon (the robot does not restrain) (Draft v0.4) · YAML
RMP-BEH-002: Scheduled mood, sleep and workload check-ins: private logging for the flight surgeon, urgent escalation of safety concerns (Draft v0.5) · YAML
RMP-BEH-003: Private call relay with ground support (camera off unless the crewmember turns it on; the robot never listens to or records a call) (Draft v0.3) · YAML
RMP-BEH-004: Sleep and lighting schedule support: shows the schedule the flight surgeon set, silent on-screen light-mode prompts and a private log (the robot never wakes anyone) (Draft v0.2) · YAML
RMP-CARD-001: Cardiac arrest: bring defibrillator and oxygen, stream video (the robot does not run the arrest) (Draft v0.3) · YAML
RMP-CARD-002: Chest pain: vital signs and 12-lead ECG recording support, relay to the flight surgeon (Draft v0.4) · YAML
RMP-CARD-003: Abnormal heart rhythm on monitoring: record, alert crew and ground (Draft v0.2) · YAML
RMP-CARD-004: Light-headedness on standing after landing: alert, kit fetch and vital-sign record (the crew help the crewmember lie down) (Draft v0.4) · YAML
RMP-CARD-005: Scheduled heart rate and blood pressure checks: reminder, preparation checklist and record (the crewmember places the cuff) (Draft v0.3) · YAML
RMP-EGR-001: Medical evacuation preparation: package records, images and logs for handover (Draft v0.3) · YAML
RMP-EGR-002: Landing-day medical kit and stretcher support: kit fetch, clear routes and an empty stretcher in place (people move the crewmember) (Draft v0.4) · YAML
RMP-EGR-003: Post-landing vital signs and symptom checks: the CMO runs the checks, the robot records (balance tests: RMP-NEURO-005) (Draft v0.5) · YAML
RMP-EGR-004: Launch and entry monitoring relay: read-only relay of crew-worn sensor and cabin data to the flight surgeon while the robot stays stowed and locked (the robot never moves during a dynamic phase) (Draft v0.2) · YAML
RMP-ENT-001: Nosebleed: supplies, containment, pressure timing and video, relay to the flight surgeon (the crewmember or CMO applies pressure; the robot never touches the face) (Draft v0.4) · YAML
RMP-ENT-002: Tooth pain, lost filling or lost crown: dental supplies, a sealed container for a loose crown, screen support for the CMO's mouth camera, relay to the flight surgeon and a ground dentist (Draft v0.6) · YAML
RMP-ENT-003: Ear or sinus pain, including after a pressure change: symptom questions first, checked kit fetch, otoscope camera display and relay (the CMO holds the otoscope) (Draft v0.2) · YAML
RMP-ENT-004: Head and nasal congestion, sore throat: symptom log with red-flag escalation (no drug advice) (Draft v0.5) · YAML
RMP-ENV-001: Smoke or fire: bring masks, account for crew, video (Draft v0.3) · YAML
RMP-ENV-002: Ammonia leak: emergency equipment, crew accounting; robot inspects only when the commander sends it (Draft v0.4) · YAML
RMP-ENV-003: Rapid loss of cabin pressure: bring masks, crew accounting (Draft v0.3) · YAML
RMP-ENV-004: High cabin carbon dioxide: read cabin data, check crew symptoms and log for the flight surgeon (Draft v0.6) · YAML
RMP-ENV-005: Chemical on skin or in the eyes: decontamination supplies and a clock-time record (the crew rinse) (Draft v0.2) · YAML
RMP-EVA-001: Suspected decompression sickness after a spacewalk or pressure change: symptom log, equipment fetch, urgent relay to the flight surgeon (the robot never operates the suit, pressure or oxygen) (Draft v0.4) · YAML
RMP-EVA-002: Prebreathe event log: clock times as called by the EVA crew, breaks in prebreathe flagged at once (the procedure timer stays primary) (Draft v0.2) · YAML
RMP-EVA-003: Hand and skin check after a spacewalk: symptom questions first, then a standard photo log for the flight surgeon (Draft v0.2) · YAML
RMP-EYE-001: Eye injury, foreign body or chemical splash: eyewash and containment supplies, timing and video, urgent relay (the robot never touches the eye) (Draft v0.4) · YAML
RMP-EYE-002: Routine vision checks for spaceflight-associated neuro-ocular syndrome: near and distance reading charts, Amsler grid and eye questions, relay to the flight surgeon (the robot never compares results) (Draft v0.5) · YAML
RMP-EYE-003: Retinal photo and OCT imaging: camera positioning support for SANS monitoring (Draft v0.5) · YAML
RMP-EYE-004: Eye ultrasound assist with a crew-held probe on the closed eyelid (diagnostic only): checked kit fetch, preset check, display holding and clip labelling (Draft v0.2) · YAML
RMP-GI-001: Abdominal pain: abdominal ultrasound assist with a crew-held probe (diagnostic only) (Draft v0.4) · YAML
RMP-GI-002: Vomiting or diarrhea: intake and output log, sealed containment and clean-up supplies, relay to the flight surgeon (no drug or fluid advice) (Draft v0.4) · YAML
RMP-GI-003: Constipation and bloating: private bowel and symptom log, relay to the flight surgeon (no drug, fluid or diet advice) (Draft v0.4) · YAML
RMP-INF-001: Fever or feeling feverish: temperature and vital-sign recording support, early escalation to the flight surgeon (Draft v0.4) · YAML
RMP-INF-002: Cleaning and disinfecting the robot and shared equipment between tasks (Draft v0.3) · YAML
RMP-INF-003: Isolating a sick crewmember: supply deliveries and check-ins to reduce contact (the flight surgeon decides on isolation) (Draft v0.2) · YAML
RMP-INF-004: Air, water and surface sample collection: sampling-plan prompts, sample labelling, sealed carries and incubation log (the crew collect every sample) (Draft v0.2) · YAML
RMP-MSK-001: Major trauma: bring trauma kit, video, assist crew (the robot does not lead) (Draft v0.2) · YAML
RMP-MSK-002: Suspected fracture or sprain: splint supplies, video; the crew hold the limb steady (Draft v0.3) · YAML
RMP-MSK-003: Musculoskeletal ultrasound assist with a crew-held probe (diagnostic only) (Draft v0.2) · YAML
RMP-MSK-004: Back pain in flight: symptom tracking with red-flag escalation (no drug, position or exercise advice) (Draft v0.4) · YAML
RMP-MSK-005: Exercise form monitoring by camera: consent-first live view and the exercise specialists' form checklist, with no scoring of the crew (Draft v0.2) · YAML
RMP-NEURO-001: Head injury: urgent relay, supplies, and recording of the checks the CMO does, with prompt-only repeat checks (the robot does not assess) (Draft v0.4) · YAML
RMP-NEURO-002: Stroke warning signs: guided check recording, urgent relay (Draft v0.3) · YAML
RMP-NEURO-003: Seizure: clear the space, time and record, alert crew and ground (Draft v0.3) · YAML
RMP-NEURO-004: Space motion sickness: symptom, vomiting and fluid-intake log, containment supplies, relay to the flight surgeon (no drug advice) (Draft v0.5) · YAML
RMP-NEURO-005: Post-landing balance testing: a crewmember spots, the CMO runs the tests, the robot records (support-only at an Earth landing) (Draft v0.3) · YAML
RMP-NEURO-006: Sleep complaints and sleep-medicine use: private sleep log, prompt-only check-ins after waking, relay to the flight surgeon (the robot never wakes anyone for a check-in and names no medicine) (Draft v0.6) · YAML
RMP-NEURO-007: Headache log: private log, red-flag escalation and routes (carbon dioxide, after a spacewalk or pressure change, head injury, vision change, dehydration); never says what caused it (Draft v0.4) · YAML
RMP-PHARM-001: Fetch a medicine a human has prescribed and match it to the order by barcode (robot checks and logs; no drug advice) (Draft v0.7) · YAML
RMP-PHARM-002: Medicine inventory, expiry and storage-temperature tracking, with a draft resupply list for the pharmacy lead (Draft v0.5) · YAML
RMP-PHARM-003: Dose log after a human gives a medicine: barcode match to the RMP-PHARM-001 order (the robot never gives a dose) (Draft v0.4) · YAML
RMP-PHARM-004: Controlled-medicine count with a crewmember: a blind two-person count, comparison with the inventory record and a private discrepancy flag (no hand-over) (Draft v0.3) · YAML
RMP-PREV-001: Medical kit and equipment readiness checks: labels, seals, expiry and self-test status (Draft v0.3) · YAML
RMP-PREV-002: Periodic health exam support: reminder, checked kit fetch, vital signs as displayed, consented photos and a secure record (the CMO examines) (Draft v0.2) · YAML
RMP-PREV-003: Flight-surgeon-ordered surveillance scans (such as kidney and bladder ultrasound): reminder, checked kit fetch, display holding and clip labelling with a crew-held probe (diagnostic only) (Draft v0.2) · YAML
RMP-PREV-004: Blood and urine sample handling and labelling: checked kit fetch, labels printed at the crewmember's side, label match, sealed transport and cold-stowage log (the robot never handles needles) (Draft v0.3) · YAML
RMP-PREV-005: Exercise session logging: the device's own session record and the crewmember's own words, with no scoring of the crew (no camera) (Draft v0.2) · YAML
RMP-PREV-006: Dental and skin self-check photo log: the crewmember's own self-check, consented standard skin photos, handheld mouth photos (nothing robotic in or near the mouth), and dental symptoms routed to RMP-ENT-002 (Draft v0.2) · YAML
RMP-RAD-001: Solar particle event: shelter logistics and dosimeter readouts (Draft v0.3) · YAML
RMP-RAD-002: Personal dosimeter readout, exchange and logging (the crewmember keeps their own dosimeter; the robot never interprets a reading) (Draft v0.2) · YAML
RMP-RAD-003: Radiation sickness symptoms (nausea, vomiting) after a radiation event: private check-ins, a symptom-onset timeline and urgent relay (Draft v0.2) · YAML
RMP-RENAL-001: Assisted diagnostic ultrasound for a suspected kidney stone (Draft v0.7) · YAML
RMP-RENAL-002: Trouble passing urine: bladder ultrasound support with the crew holding the probe, relay to the flight surgeon (diagnostic only) (Draft v0.6) · YAML
RMP-RENAL-003: Urinary tract infection symptoms: private symptom and dipstick result log, entered by the crewmember (Draft v0.2) · YAML
RMP-RENAL-004: Fluid intake and urine output log for a possible dehydration concern: private log, read-only waste-system data, relay to the flight surgeon (the robot never judges hydration or advises fluids) (Draft v0.4) · YAML
RMP-RENAL-005: Urinary catheter supplies and hygiene support: checked supply fetch, staging outside the hygiene area and sealed waste only (the robot never enters the hygiene area) (Draft v0.2) · YAML
RMP-RESP-001: Shortness of breath: oxygen set-up support, oxygen saturation, relay (Draft v0.2) · YAML
RMP-RESP-002: Choking or blocked airway: bring kit, steady the scene; airway care by crew (Draft v0.3) · YAML
RMP-RESP-003: Severe allergic reaction (possible anaphylaxis): urgent alert, bring the sealed emergency kit and oxygen kit on command, record vital signs (no drug advice) (Draft v0.4) · YAML
RMP-RESP-004: Lung ultrasound assist with a crew-held probe (diagnostic only) (Draft v0.2) · YAML
RMP-RESP-005: Scheduled breathing rate and oxygen saturation (SpO2) checks: reminder, preparation checklist, readings as displayed and a breathing rate counted by the CMO (Draft v0.2) · YAML
RMP-SKIN-001: Wound cleaning and dressing: hold and pass supplies, photo documentation (crew leads) (Draft v0.7) · YAML
RMP-SKIN-002: Burns and scalds: cooling and dressing supplies, cooling start time on request, photo log, urgent relay to the flight surgeon (the crew lead all first aid) (Draft v0.5) · YAML
RMP-SKIN-003: Wound photo log: standard photos at each dressing change for the flight surgeon to track healing (Draft v0.3) · YAML
RMP-SKIN-004: Rash and skin irritation photo log: symptom questions first, then standard consented photos for the flight surgeon (the CMO examines) (Draft v0.2) · YAML