{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "id": "RMP-ENV-004", "slug": "rmp-env-004", "title": "High cabin carbon dioxide: read cabin data, check crew symptoms and log for the flight surgeon", "version": "0.6", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "category": "env", "tier": 1, "tier_note": "Moved up from Tier 2: CO2-linked headaches are common, the task is low risk, and the data it collects helps the flight surgeon and engineers.", "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-20", "reviewed": "2026-10-20", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. All corrections from that review are applied in this version (see Corrections). Written with AI assistance; sources self-verified. Version 0.3 is an editorial update from the batch 4 review (item 27) that does not change the reviewed clinical meaning." }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "result_language": { "use": [ "recorded", "above / below the set caution level", "symptom reported" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "caused by CO2", "safe" ] }, "scope": { "summary": "When cabin CO2 rises above a caution level, the robot prompts the crew (\"CO2 above caution level; start check-ins?\"). Only on a crewmember's command, or when a crewmember starts it because of symptoms the crew link to CO2, the robot reads the cabin sensors, carries a portable sensor to where people work and sleep, runs short symptom check-ins with each crewmember, and logs and reports everything to the crew, the environmental team and the flight surgeon until levels settle.", "why": "On the station, the odds of a crewmember reporting a headache doubled for each 1 mmHg rise in CO2. NASA limits the 1-hour average to 3 mmHg, and notes that CO2 can collect in local pockets. Headaches in flight also have other causes, so symptoms go to the CMO rather than being blamed on CO2.", "covers": [ "Cabin CO2 above the caution level", "Crew-reported headache, shortness of breath, dizziness or poor concentration while CO2 is raised" ], "locked_out": [ "Changing life-support or ventilation settings (crew and ground engineers decide)", "Any medicine advice, for example for headache", "Saying symptoms are caused by CO2", "Starting itself on a CO2 caution (it only prompts the crew)", "Entering a sleep station unless the occupant invites it", "Fire, smoke, toxic leaks or rapid pressure loss (see RMP-ENV-001 to -003)" ], "related": [ "RMP-ENV-001", "RMP-ENV-002", "RMP-NEURO-007" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "Environmental and life-support team (ground) and crew: decide on ventilation, scrubbers and moving people", "Each crewmember: answers check-in questions" ], "robot_may": [ "Read and trend cabin CO2 data", "Carry a portable CO2 sensor to occupied areas, keeping clear of crew paths and hatches", "Run symptom check-ins and log answers", "Send summaries to the crew, environmental team and flight surgeon" ], "robot_may_not": [ "Change any vehicle setting", "Give medicine or treatment advice", "Diagnose, or say symptoms come from CO2", "Block a hatch or emergency path" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "A crewmember started the run by command. A CO2 caution only makes the robot prompt the crew; it never starts the run. Passive logging of vehicle CO2 data that already exists needs no robot run.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-2", "text": "Robot and portable sensor self-tests passed; sensor calibration in date.", "refs": [ "V2 10161" ] }, { "id": "PRE-3", "text": "Not a fire, smoke, toxic-leak or pressure emergency. If it is, the vehicle emergency procedure takes over and the robot only helps if crew ask." }, { "id": "PRE-4", "text": "Link status and delay known." } ], "consent": { "standard": "Each crewmember can decline a check-in explicitly; declining is logged, not questioned. Not answering is never logged as declining (see RF5).", "emergency": "Not applicable; no patient contact.", "withdrawal": "Any crewmember can stop the check-ins." }, "inputs": [ { "id": "IN-1", "name": "Cabin CO2 partial pressure, 1-hour average and current value", "source": "Vehicle sensors", "required": true, "if_missing": "Use the portable sensor; if both are missing, alert crew and ground: \"no CO2 data\"." }, { "id": "IN-2", "name": "Local CO2 at sleep stations, exercise and work areas", "source": "Portable sensor carried by the robot", "required": false, "if_missing": "Log as not measured." }, { "id": "IN-3", "name": "Symptom check-in: headache (0-10), dizziness, shortness of breath, poor concentration, vision changes, sleep location", "source": "Voice or touch questionnaire", "required": true, "if_missing": "Log \"no response\" (never \"declined\") and escalate under RF5." }, { "id": "IN-4", "name": "Crew locations and activity (sleep, exercise)", "source": "Crew schedule and robot camera (with crew permission)", "required": false, "if_missing": "Ask the crew." }, { "id": "IN-5", "name": "Link status and delay", "source": "Communications system", "required": true, "if_missing": "Treat as link down." } ], "steps": [ { "id": "S1", "actor": "robot", "rung": 2, "action": "On a crewmember's command, notify the crew, the environmental team and the flight surgeon.", "success": "Crew acknowledge.", "refs": [ "V2 10174" ] }, { "id": "S2", "actor": "robot", "rung": 2, "action": "Read and log the cabin CO2 1-hour average and trend.", "success": "Values logged.", "refs": [ "V2 6004" ] }, { "id": "S3", "actor": "robot", "rung": 2, "action": "Carry the portable sensor to each occupied area and log readings. For sleep stations, only when the occupant invites the robot or places the portable sensor themselves; otherwise mark \"not measured\".", "success": "Each area measured, or marked not measured." }, { "id": "S4", "actor": "robot", "rung": 2, "action": "Run a short symptom check-in with each crewmember and log the answers.", "success": "Each crewmember answered, declined explicitly, or was escalated for no response." }, { "id": "S5", "actor": "robot", "rung": 2, "action": "Send a summary: values against the caution level and a symptom table. No diagnosis and no advice.", "success": "Summary delivered or queued." }, { "id": "S6", "actor": "crew", "action": "Crew and ground decide the environmental response; the CMO sees any crewmember with symptoms.", "success": "Decisions logged." }, { "id": "S7", "actor": "robot", "rung": 2, "action": "Repeat readings and check-ins every minutes until CO2 is below the caution level for minutes and symptoms have eased, then close the event.", "success": "Event closed by a crewmember." } ], "decisions": [ { "id": "D1", "after": "S3", "decided_by": "robot", "question": "Do the vehicle and portable sensors disagree by more than the set amount?", "branches": [ { "if": "Yes", "then": "Flag a possible sensor fault to crew and ground; humans decide which to trust." }, { "if": "No", "then": "Continue." } ] }, { "id": "D2", "after": "S5", "decided_by": "ground", "question": "What environmental response is needed?", "branches": [ { "if": "Link live", "then": "Ground and crew decide; robot logs." }, { "if": "Link down", "then": "Crew follow onboard procedures; robot logs for the ground." } ] }, { "id": "D3", "after": "S4", "decided_by": "robot", "question": "Did every crewmember respond to the check-in within ?", "branches": [ { "if": "Yes (answered or declined)", "then": "Continue." }, { "if": "No response", "then": "URGENT: the robot alerts the CMO and a crewmember checks on them in person (possible incapacitation, RF5)." } ] }, { "id": "D4", "after": "S4", "decided_by": "crew", "question": "Does any crewmember report symptoms?", "branches": [ { "if": "Yes", "then": "CMO assesses; any treatment is decided by the CMO and flight surgeon. Symptoms while CO2 is below the caution level are not assumed to be caused by CO2." }, { "if": "No", "then": "Continue monitoring." } ] } ], "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "The robot stops the check-in for that crewmember at once and moves away; declining is logged, not questioned.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Protective stop and hand control to the CMO; log the fault.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses; crew care never waits for the link or the robot. On loss of link the robot pauses any movement and tells the CMO. On the CMO's confirmation it continues measuring, check-ins and logging offline, and sends everything at the next contact.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "Signs of fire, smoke, a toxic leak or pressure loss", "action": "Robot stops this protocol, keeps paths clear and follows crew instructions under the vehicle emergency procedure.", "level": "urgent" } ], "red_flags": [ { "id": "RF1", "sign": "Confusion, drowsiness that is hard to wake from, or fainting", "threshold": "any", "action": "URGENT call to CMO and flight surgeon" }, { "id": "RF2", "sign": "Shortness of breath at rest, or chest pain", "threshold": "any", "action": "URGENT call; chest pain also starts RMP-CARD-002" }, { "id": "RF3", "sign": "Headache severity", "threshold": " on a 0-10 scale", "action": "CMO assesses" }, { "id": "RF4", "sign": "Cabin CO2 well above the limit", "threshold": "above mmHg", "action": "Crew follow vehicle emergency procedures; robot alerts and logs" }, { "id": "RF5", "sign": "A crewmember does not respond to a check-in", "threshold": "no response within (timing not sourced; safety-design placeholder)", "action": "URGENT: a crewmember checks on them in person; robot alerts the CMO. Never logged as declining." }, { "id": "RF6", "sign": "Sudden-onset severe headache; headache with fever; new weakness, numbness, speech or vision change; reduced alertness", "threshold": "any", "action": "URGENT call to CMO and flight surgeon; never attributed to CO2", "source": "nice150" } ], "safety_limits": [ { "id": "L1", "name": "Robot speed in the cabin", "value": "", "enforced": "Hard limit", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Keep-out zones (hatches, emergency paths, sleep stations unless invited)", "value": "", "enforced": "Map-based keep-out" }, { "id": "L3", "name": "Check-in length per crewmember", "value": "", "enforced": "Timer" } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] } ], "requirements": [ { "id": "V1 3003", "use": "Capability to monitor physiological well-being in flight." }, { "id": "V1 3004", "use": "Medical care includes privacy considerations (sleep stations entered only by invitation)." }, { "id": "V1 3006", "use": "Two crew medical officers per vehicle for NASA programs (see the commercial-flight note)." }, { "id": "V1 5003", "use": "CMO training includes toxicology." }, { "id": "V1 6003", "use": "Private medical communications." }, { "id": "V1 7001", "use": "Records kept for trend analysis." }, { "id": "V1 7003", "use": "Secure records." }, { "id": "V2 6004", "use": "Cabin CO2: 1-hour average no more than 3 mmHg. The standard leaves off-nominal (caution and emergency) CO2 values to lower-level program requirements." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 10161", "use": "Robot shows status and health." }, { "id": "V2 10162", "use": "Mode changes announced." }, { "id": "V2 10163", "use": "Robot records and shares its data." }, { "id": "V2 10164", "use": "Shows whether the human or the robot is expected to act." }, { "id": "V2 10165", "use": "Human override." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10171", "use": "Robot says when a problem is beyond it (for example sensor disagreement)." }, { "id": "V2 10172", "use": "Protective stop." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Replayed cabin CO2 data with simulated crew responses.", "pass": "Correct crew prompts (never a self-start), no-response escalation and summaries in every scripted case; zero advice or cause statements." }, { "stage": "training model", "what": "Mock-up habitat with a controlled CO2 source and portable sensors.", "pass": "Portable and fixed sensor readings within ; zero keep-out violations." }, { "stage": "Earth analog", "what": "Analog habitat crews over weeks.", "pass": "Crew acceptance of check-ins and data completeness at or above ." }, { "stage": "flight use under flight surgeon supervision", "what": "Logging-only mode first, alongside existing procedures.", "pass": "No interference with crew operations; flight surgeon finds the data useful." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "A crewmember command only (a CO2 caution prompts the crew but never starts the run). The flight surgeon and environmental lead review summaries; no real-time approval needed for logging." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: summaries reach the ground within minutes; engineers and the flight surgeon respond in real time.", "loss_of_signal": [ "Only the robot pauses; crew care never waits for the link or the robot.", "The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps measuring, running check-ins and logging offline; crew follow onboard procedures.", "All data sent as one package at the next contact." ], "mars_delay": [ "Ground advice arrives tens of minutes later at best, and not at all during blackouts.", "Caution levels and check-in intervals are set before flight; the crew decide in real time." ] }, "sources": [ { "key": "law", "text": "Law J, Van Baalen M, Foy M, et al. Relationship between carbon dioxide levels and reported headaches on the International Space Station. J Occup Environ Med. 2014;56(5):477-483.", "url": "https://doi.org/10.1097/JOM.0000000000000158", "doi": "10.1097/JOM.0000000000000158", "pmid": "24806559", "supports": "For each 1 mmHg rise in CO2, the odds of a crewmember reporting a headache doubled; keeping headache risk below 1% would need a 7-day average below 2.5 mmHg (ISS range at the time 1-9 mmHg)." }, { "key": "tb033", "text": "NASA OCHMO. Spaceflight Experience and Medical Care. Technical Brief OCHMO-TB-033 (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-033-spaceflight-experience-medical-care.pdf", "supports": "Headaches are more common in spaceflight, with elevated CO2, fluid shifts and pressure changes among contributing factors; pre-mission exams include ECG, eye exams and photo documentation of skin." }, { "key": "nice150", "text": "National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150.", "url": "https://www.nice.org.uk/guidance/cg150/chapter/Recommendations", "supports": "Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "Requirement IDs beginning V1." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "Requirement IDs beginning V2." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-20", "version": "0.2", "source": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026", "items": [ "No self-start: a CO2 caution only prompts the crew; the run starts on a crewmember's command ([V2 10174]).", "[V2 10174] description corrected.", "[V2 6004] description corrected: off-nominal CO2 values are left to program requirements.", "No response to a check-in is now an urgent possible-incapacitation escalation (RF5), never logged as declining; the timeout is an unsourced placeholder.", "CO2 emergency-level owner changed to the program environmental lead with the flight surgeon.", "New red flag RF6: headache red flags not attributed to CO2 (NICE CG150; NASA TB-033).", "X5 link loss: pause, then continue offline on the CMO's confirmation.", "Sleep stations are measured only on the occupant's invitation.", "X1 now stops the check-in for that crewmember (no patient recording in this protocol).", "Loss of link (X5) now means: pause motion, tell the CMO, and continue offline only on the CMO's confirmation (fixes the contradiction with the comms branch).", "Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build." ] }, { "date": "2026-10-20", "version": "0.3", "source": "AI-assisted batch 4 review by the Medical Research Assistant, Oct 20, 2026 (item 27); editorial only, the reviewed clinical meaning is unchanged", "items": [ "Related protocols: the link to RMP-NEURO-006 (retitled to sleep complaints and sleep-medicine use) now points to the planned headache log, RMP-NEURO-007, so headache no longer routes to a sleep protocol. The headache red flags, their levels and their routes are unchanged." ] }, { "date": "2026-10-21", "version": "0.3", "source": "Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49", "items": [ "Inherited stop-rule and requirement wording: \"holds a safe position\" → \"holds its stopped position\"; \"stays in its safe state\" → \"stays stopped\"; \"take over safely\" → \"take over\"; \"Robot stays safe if no one takes over\" → \"Robot stays stopped if no one takes over\". Schema level name safe-state and never-word list entry \"safe\" unchanged." ] }, { "date": "2026-10-21", "version": "0.4", "source": "Batch 6 editorial (AI-assisted), Oct 21, 2026", "items": [ "Requirement use for [V2 10173] changed from \"Safe default.\" to \"Robot stays stopped if no one takes over.\" (batch 5 review item 25; editorial, behaviour unchanged)." ] }, { "date": "2026-10-21", "version": "0.5", "source": "Batch 7 editorial (AI-assisted), Oct 21, 2026", "items": [ "Citation labels changed to the site's year-only convention: \"(approved for public release )\" now reads \"(YYYY)\", and NASA-STD-3001 Volume 2 \"Revision F (approved July 14, 2026)\" now reads \"(Rev F, 2026)\" (sources: v2). Editorial; no change to steps, thresholds or limits." ] }, { "date": "2026-10-21", "version": "0.6", "source": "Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026", "items": [ "X5 and the comms loss-of-signal branch now open with \"Only the robot pauses; crew care never waits for the link or the robot.\" (batch 7 review suggestion 29). Editorial; robot behaviour unchanged." ] } ] }