RMP-BEH-004 Sleep and lighting schedule support: shows the schedule the flight surgeon set, silent on-screen light-mode prompts and a private log (the robot never wakes anyone)

1 · Identity and scope

On a crewmember's command, the robot loads the sleep and lighting schedule that the flight surgeon and behavioral health team set (sleep window, and the times for the general, pre-sleep and phase-shift light modes) and shows it on screen. At each scheduled light time it shows a silent on-screen prompt outside sleep stations, which the crewmember can act on or dismiss; the crewmember changes the light themselves. After the crewmember accepts a post-wake prompt, it runs a short private check-in and logs what they state. It never wakes anyone, never enters a sleep station, never changes a light and never advises on sleep. The log is shared only with the crewmember, the flight surgeon and the behavioral health team (the CMO only if the crewmember agrees or a red flag fires).

Why this protocol was chosen. The ISS solid-state lights have general, pre-sleep and phase-shift modes for day-to-day light, the end of the work day and shifting sleep patterns (Maida 2016); NASA-STD-3001 requires lighting that supports alertness, pre-sleep and circadian shifting (V2 8055) and private sleep accommodation (V2 7070). ISS crew slept about 6 hours a night by wrist monitor (Barger 2014), and astronauts sleep less in flight than on Earth (NASA sleep evidence report 2016). Advice on sleep, light and the work schedule belongs to the flight surgeon and behavioral health team, as in RMP-NEURO-006, so the robot only shows their schedule and logs what the crewmember states. Silent prompts, the check-in wording and the log rules are design judgment. Open question for review: whether the robot should ever change a light mode on the crewmember's spoken command, or leave all light control to the crew.

Autonomy: Max rung 2 for showing the sleep and lighting schedule the flight surgeon and behavioral health team set, silent on-screen prompts outside sleep stations, and a private log. The crewmember changes every light themselves; the robot never changes a light, never sounds a tone and never wakes anyone, as in RMP-NEURO-006.

Related: RMP-NEURO-006 · RMP-BEH-002 · RMP-BEH-001 · RMP-NEURO-002

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Second trained CMO: receives every alert and takes over if the CMO is the patient
• Vehicle commander: leads any cabin emergency procedure
• Other crew: help as the CMO or commander directs
• Behavioral health team (ground): sets the sleep and lighting schedule with the flight surgeon

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [12]

3 · Preconditions and consent

• PRE-1 The crewmember started schedule support by command, and the schedule the flight surgeon and behavioral health team set is loaded.human_start == trueV2 10174
• PRE-2 Robot self-test passed; kit stowage locations known.V2 10161V2 7059
• PRE-3 Robot and supplies restrained when not moving.V2 7046
• PRE-4 Link status known. The crew never wait for the robot before acting.link_state in [live, delayed, down]

Consent

The crewmember agrees to schedule prompts and the private log. The log goes only to the crewmember, the flight surgeon and the behavioral health team; the CMO is told only if the crewmember agrees or a red flag fires. Before flight, each crewmember was told that skipped check-ins are flagged under RMP-BEH-002 (not by this protocol), that an urgent alert and the words that triggered it are kept and cannot be withdrawn, that records are stored encrypted and never used to train or tune software, and that this robot can miss things or raise false alarms. A pre-flight plan exists for securing medicines and other means of self-harm, and each crewmember who wanted one has a safety plan written with the behavioral health team.

Emergency consent

A red flag sends an alert as listed; the robot still never wakes anyone (the CMO or commander decides).

Withdrawal

The crewmember can turn prompts off or stop the log at any time.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   On the crewmember's command, load the schedule the flight surgeon and behavioral health team set and show it on screen; send a "schedule support started" note to the flight surgeon (queued if the link is down). The CMO is told only if the crewmember agrees or a red flag fires. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

   Done when: Schedule shown; note sent or queued.

   V1 3006V2 10174

2. S2RobotRung 2

   At each scheduled light-mode time, show a silent on-screen prompt outside sleep stations (for example "Schedule: pre-sleep light from 21:00, as set by the flight surgeon"). The crewmember changes the light themselves or dismisses the prompt; the robot never changes a light, never sounds a tone and never prompts inside a sleep station or during a sleep window.

   Done when: Prompt shown; "acted on" or "prompt dismissed" logged as stated.

   V2 8055V2 7070

3. S3RobotRung 2

   After the crewmember accepts the post-wake prompt (never by waking them), run a short private check-in by voice or on screen, camera off: first say: "This robot listens for certain words and can miss things or raise false alarms. It is not a safety monitor. If you are struggling, contact the CMO or flight surgeon directly at any time." Then red-flag questions first (including any talk of self-harm), then sleep and light times as they state. Log the answers word for word in this protocol's own private log, under its sharing rule. If RMP-NEURO-006 is running, ask the crewmember first whether to add them to that sleep log, and say that the RMP-NEURO-006 log is shared with the CMO; add them only on a clear yes.

   Done when: Answers logged or "no response".

   V1 6003

   D1DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag, including any talk of self-harm or suicide?

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue.
   D2DecisionRobot decides

   Did the crewmember answer the check-in after accepting it, or say they want to skip a question?

   • Yes → Continue.
   • Declined explicitly (the crewmember says no to a question) → Log "declined" for that question only; the alert already sent stands.
   • No response, or the answer does not make sense → URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once.
4. S4RobotRung 2

   Show the crewmember the schedule next to their own logged times as a clock-time timeline, with no words about whether it is good or bad.

   Done when: Timeline shown.

   V1 6003

5. S5Crew

   The crewmember follows or changes their own routine; the commander and the CMO decide any wake-up for a critical task, by their own means.

   Done when: As decided by the crew.

   V2 7070

   D3DecisionRobot decides

   Is a crewmember asleep when a task needs them?

   • Yes → The robot never wakes them: it tells the commander and the CMO on screen, and they decide by their own means.
   • No → Continue.
6. S6RobotRung 2

   After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

   Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

   V2 10173V1 3006

7. S7Ground

   The flight surgeon and behavioral health team (or the CMO under the onboard checklist when there is no link) review the log and decide on any schedule change; the robot loads only a schedule they send.

   Done when: Decision logged.

   V1 3004

   D4DecisionGround decides

   Does the schedule change?

   • Link live → Flight surgeon decides; robot logs.
   • Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
8. S8RobotRung 2

   Send the flight surgeon and the behavioral health team the private log: schedule shown, prompts acted on or dismissed as stated, answers and alerts.

   Done when: Log delivered or queued.

   V1 6003V1 7003

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Schedule loaded and who set it; each prompt shown, acted on or dismissed as stated, or "not shown – sleep window"; check-in answers as stated; who viewed the log. No sleep scores.
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [7] and Volume 2 Revision F [8]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted days with a prompt due in a sleep window, a crewmember asleep before a critical task, self-harm talk at check-in, lost link. Pass: Zero wakings; zero light changes; every red flag raised.
2. Training model. Prompt display drills across modules. Pass: Zero prompts inside sleep stations.
3. Parabolic or station demonstration. Silent movement near sleep stations. Pass: Noise limit held.
4. Flight use under flight surgeon supervision. First week of schedule support. Pass: No safety or privacy events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the crewmember. The flight surgeon and behavioral health team set every schedule; the crew control every light.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.2.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [11].

Loss of signal and Mars delay

Live link

Low Earth orbit: the log reaches the flight surgeon and behavioral health team when the link allows.

Loss of signal

• Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation.
• Crew sleep, care already under way and all other care continue under the onboard checklist and never wait for the link or the robot.
• The loaded schedule keeps showing; the log is queued.

Mars-class delay

• Mars: schedules are set before and during flight with delay; the crew decide on their routine.

[10]

Sources

1. Maida JC. Introduction to the Solid State Based Interior Lighting System for ISS (NASA Technical Reports Server 20160005080, 2016). ntrs.nasa.gov/citations/20160005080 Supports: The ISS solid-state light assemblies have three modes: general (4500 K, the default for day-to-day operations), pre-sleep (2700 K, for the end of the work day, to remove as much melatonin suppression as possible) and phase-shift (6500 K, to suppress melatonin and increase alertness when the circadian rhythm needs to be shifted); each light has its own mode, dimming and on-off buttons. Read Oct 21, 2026 (saved copy in src/b12).
2. Barger LK, Flynn-Evans EE, Kubey A, et al. Prevalence of sleep deficiency and use of hypnotic drugs in astronauts before, during, and after spaceflight: an observational study. Lancet Neurol. 2014;13(9):904-912. PMID 25127232. doi:10.1016/S1474-4422(14)70122-X Supports: By wrist actigraphy, ISS crew obtained about 6.1 hours of sleep a night in flight and Shuttle crew about 6.0 hours; 12 of 16 ISS crew (75%) and 61 of 78 Shuttle crew (78%) reported using sleep-promoting drugs.
3. NASA Human Research Program. Evidence Report: Risk of Performance Decrements and Adverse Health Outcomes Resulting from Sleep Loss, Circadian Desynchronization, and Work Overload (2016). humanresearchroadmap.nasa.gov/evidence/reports/Sleep.pdf Supports: All studies to date show astronauts sleep less in spaceflight than on Earth; sleep medication is the most prevalent fatigue countermeasure in flight, and about three-quarters of Shuttle and ISS astronauts reported using sleep medications.
4. National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). www.nice.org.uk/guidance/ng225/chapter/Recommendations Supports: Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm, or to decide who is offered treatment.
5. National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150. www.nice.org.uk/guidance/cg150/chapter/Recommendations Supports: Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness.
6. NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavio… Supports: Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring.
7. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7003.
8. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 7070, V2 8055, and Section 10.6 automated and robotic systems.
9. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
10. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
11. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
12. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.