# RMP-ENV-004 High cabin carbon dioxide: read cabin data, check crew symptoms and log for the flight surgeon # Version 0.6 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' id: RMP-ENV-004 slug: rmp-env-004 title: 'High cabin carbon dioxide: read cabin data, check crew symptoms and log for the flight surgeon' version: '0.6' status: draft conceptual: true not_for_clinical_use: true category: env tier: 1 tier_note: >- Moved up from Tier 2: CO2-linked headaches are common, the task is low risk, and the data it collects helps the flight surgeon and engineers. max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-20' reviewed: '2026-10-20' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. All corrections from that review are applied in this version (see Corrections). Written with AI assistance; sources self-verified. Version 0.3 is an editorial update from the batch 4 review (item 27) that does not change the reviewed clinical meaning. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true result_language: use: - recorded - above / below the set caution level - symptom reported never: - normal - no problem found - all clear - negative - any diagnosis or cause - caused by CO2 - safe scope: summary: >- When cabin CO2 rises above a caution level, the robot prompts the crew ("CO2 above caution level; start check-ins?"). Only on a crewmember's command, or when a crewmember starts it because of symptoms the crew link to CO2, the robot reads the cabin sensors, carries a portable sensor to where people work and sleep, runs short symptom check-ins with each crewmember, and logs and reports everything to the crew, the environmental team and the flight surgeon until levels settle. why: >- On the station, the odds of a crewmember reporting a headache doubled for each 1 mmHg rise in CO2. NASA limits the 1-hour average to 3 mmHg, and notes that CO2 can collect in local pockets. Headaches in flight also have other causes, so symptoms go to the CMO rather than being blamed on CO2. covers: - Cabin CO2 above the caution level - Crew-reported headache, shortness of breath, dizziness or poor concentration while CO2 is raised locked_out: - Changing life-support or ventilation settings (crew and ground engineers decide) - Any medicine advice, for example for headache - Saying symptoms are caused by CO2 - Starting itself on a CO2 caution (it only prompts the crew) - Entering a sleep station unless the occupant invites it - Fire, smoke, toxic leaks or rapid pressure loss (see RMP-ENV-001 to -003) related: - RMP-ENV-001 - RMP-ENV-002 - RMP-NEURO-007 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - >- Environmental and life-support team (ground) and crew: decide on ventilation, scrubbers and moving people - 'Each crewmember: answers check-in questions' robot_may: - Read and trend cabin CO2 data - Carry a portable CO2 sensor to occupied areas, keeping clear of crew paths and hatches - Run symptom check-ins and log answers - Send summaries to the crew, environmental team and flight surgeon robot_may_not: - Change any vehicle setting - Give medicine or treatment advice - Diagnose, or say symptoms come from CO2 - Block a hatch or emergency path commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- A crewmember started the run by command. A CO2 caution only makes the robot prompt the crew; it never starts the run. Passive logging of vehicle CO2 data that already exists needs no robot run. check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot and portable sensor self-tests passed; sensor calibration in date. refs: - V2 10161 - id: PRE-3 text: >- Not a fire, smoke, toxic-leak or pressure emergency. If it is, the vehicle emergency procedure takes over and the robot only helps if crew ask. - id: PRE-4 text: Link status and delay known. consent: standard: >- Each crewmember can decline a check-in explicitly; declining is logged, not questioned. Not answering is never logged as declining (see RF5). emergency: Not applicable; no patient contact. withdrawal: Any crewmember can stop the check-ins. inputs: - id: IN-1 name: Cabin CO2 partial pressure, 1-hour average and current value source: Vehicle sensors required: true if_missing: 'Use the portable sensor; if both are missing, alert crew and ground: "no CO2 data".' - id: IN-2 name: Local CO2 at sleep stations, exercise and work areas source: Portable sensor carried by the robot required: false if_missing: Log as not measured. - id: IN-3 name: >- Symptom check-in: headache (0-10), dizziness, shortness of breath, poor concentration, vision changes, sleep location source: Voice or touch questionnaire required: true if_missing: Log "no response" (never "declined") and escalate under RF5. - id: IN-4 name: Crew locations and activity (sleep, exercise) source: Crew schedule and robot camera (with crew permission) required: false if_missing: Ask the crew. - id: IN-5 name: Link status and delay source: Communications system required: true if_missing: Treat as link down. steps: - id: S1 actor: robot rung: 2 action: On a crewmember's command, notify the crew, the environmental team and the flight surgeon. success: Crew acknowledge. refs: - V2 10174 - id: S2 actor: robot rung: 2 action: Read and log the cabin CO2 1-hour average and trend. success: Values logged. refs: - V2 6004 - id: S3 actor: robot rung: 2 action: >- Carry the portable sensor to each occupied area and log readings. For sleep stations, only when the occupant invites the robot or places the portable sensor themselves; otherwise mark "not measured". success: Each area measured, or marked not measured. - id: S4 actor: robot rung: 2 action: Run a short symptom check-in with each crewmember and log the answers. success: Each crewmember answered, declined explicitly, or was escalated for no response. - id: S5 actor: robot rung: 2 action: 'Send a summary: values against the caution level and a symptom table. No diagnosis and no advice.' success: Summary delivered or queued. - id: S6 actor: crew action: Crew and ground decide the environmental response; the CMO sees any crewmember with symptoms. success: Decisions logged. - id: S7 actor: robot rung: 2 action: >- Repeat readings and check-ins every minutes until CO2 is below the caution level for minutes and symptoms have eased, then close the event. success: Event closed by a crewmember. decisions: - id: D1 after: S3 decided_by: robot question: Do the vehicle and portable sensors disagree by more than the set amount? branches: - if: 'Yes' then: Flag a possible sensor fault to crew and ground; humans decide which to trust. - if: 'No' then: Continue. - id: D2 after: S5 decided_by: ground question: What environmental response is needed? branches: - if: Link live then: Ground and crew decide; robot logs. - if: Link down then: Crew follow onboard procedures; robot logs for the ground. - id: D3 after: S4 decided_by: robot question: Did every crewmember respond to the check-in within ? branches: - if: Yes (answered or declined) then: Continue. - if: No response then: >- URGENT: the robot alerts the CMO and a crewmember checks on them in person (possible incapacitation, RF5). - id: D4 after: S4 decided_by: crew question: Does any crewmember report symptoms? branches: - if: 'Yes' then: >- CMO assesses; any treatment is decided by the CMO and flight surgeon. Symptoms while CO2 is below the caution level are not assumed to be caused by CO2. - if: 'No' then: Continue monitoring. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- The robot stops the check-in for that crewmember at once and moves away; declining is logged, not questioned. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses; crew care never waits for the link or the robot. On loss of link the robot pauses any movement and tells the CMO. On the CMO's confirmation it continues measuring, check-ins and logging offline, and sends everything at the next contact. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: Signs of fire, smoke, a toxic leak or pressure loss action: >- Robot stops this protocol, keeps paths clear and follows crew instructions under the vehicle emergency procedure. level: urgent red_flags: - id: RF1 sign: Confusion, drowsiness that is hard to wake from, or fainting threshold: any action: URGENT call to CMO and flight surgeon - id: RF2 sign: Shortness of breath at rest, or chest pain threshold: any action: URGENT call; chest pain also starts RMP-CARD-002 - id: RF3 sign: Headache severity threshold: on a 0-10 scale action: CMO assesses - id: RF4 sign: Cabin CO2 well above the limit threshold: above mmHg action: Crew follow vehicle emergency procedures; robot alerts and logs - id: RF5 sign: A crewmember does not respond to a check-in threshold: no response within (timing not sourced; safety-design placeholder) action: 'URGENT: a crewmember checks on them in person; robot alerts the CMO. Never logged as declining.' - id: RF6 sign: >- Sudden-onset severe headache; headache with fever; new weakness, numbness, speech or vision change; reduced alertness threshold: any action: URGENT call to CMO and flight surgeon; never attributed to CO2 source: nice150 safety_limits: - id: L1 name: Robot speed in the cabin value: enforced: Hard limit refs: - V2 10172 - id: L2 name: Keep-out zones (hatches, emergency paths, sleep stations unless invited) value: enforced: Map-based keep-out - id: L3 name: Check-in length per crewmember value: enforced: Timer logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 requirements: - id: V1 3003 use: Capability to monitor physiological well-being in flight. - id: V1 3004 use: Medical care includes privacy considerations (sleep stations entered only by invitation). - id: V1 3006 use: Two crew medical officers per vehicle for NASA programs (see the commercial-flight note). - id: V1 5003 use: CMO training includes toxicology. - id: V1 6003 use: Private medical communications. - id: V1 7001 use: Records kept for trend analysis. - id: V1 7003 use: Secure records. - id: V2 6004 use: >- Cabin CO2: 1-hour average no more than 3 mmHg. The standard leaves off-nominal (caution and emergency) CO2 values to lower-level program requirements. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 10161 use: Robot shows status and health. - id: V2 10162 use: Mode changes announced. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human override. - id: V2 10168 use: Human can take over. - id: V2 10171 use: Robot says when a problem is beyond it (for example sensor disagreement). - id: V2 10172 use: Protective stop. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: Replayed cabin CO2 data with simulated crew responses. pass: >- Correct crew prompts (never a self-start), no-response escalation and summaries in every scripted case; zero advice or cause statements. - stage: training model what: Mock-up habitat with a controlled CO2 source and portable sensors. pass: Portable and fixed sensor readings within ; zero keep-out violations. - stage: Earth analog what: Analog habitat crews over weeks. pass: Crew acceptance of check-ins and data completeness at or above . - stage: flight use under flight surgeon supervision what: Logging-only mode first, alongside existing procedures. pass: No interference with crew operations; flight surgeon finds the data useful. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- A crewmember command only (a CO2 caution prompts the crew but never starts the run). The flight surgeon and environmental lead review summaries; no real-time approval needed for logging. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: >- Low Earth orbit: summaries reach the ground within minutes; engineers and the flight surgeon respond in real time. loss_of_signal: - Only the robot pauses; crew care never waits for the link or the robot. - >- The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps measuring, running check-ins and logging offline; crew follow onboard procedures. - All data sent as one package at the next contact. mars_delay: - Ground advice arrives tens of minutes later at best, and not at all during blackouts. - Caution levels and check-in intervals are set before flight; the crew decide in real time. sources: - key: law text: >- Law J, Van Baalen M, Foy M, et al. Relationship between carbon dioxide levels and reported headaches on the International Space Station. J Occup Environ Med. 2014;56(5):477-483. url: https://doi.org/10.1097/JOM.0000000000000158 doi: 10.1097/JOM.0000000000000158 pmid: '24806559' supports: >- For each 1 mmHg rise in CO2, the odds of a crewmember reporting a headache doubled; keeping headache risk below 1% would need a 7-day average below 2.5 mmHg (ISS range at the time 1-9 mmHg). - key: tb033 text: NASA OCHMO. Spaceflight Experience and Medical Care. Technical Brief OCHMO-TB-033 (2023). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-033-spaceflight-experience-medical-care.pdf supports: >- Headaches are more common in spaceflight, with elevated CO2, fluid shifts and pressure changes among contributing factors; pre-mission exams include ECG, eye exams and photo documentation of skin. - key: nice150 text: >- National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150. url: https://www.nice.org.uk/guidance/cg150/chapter/Recommendations supports: >- Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: Requirement IDs beginning V1. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-20' version: '0.2' source: AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 items: - >- No self-start: a CO2 caution only prompts the crew; the run starts on a crewmember's command ([V2 10174]). - '[V2 10174] description corrected.' - '[V2 6004] description corrected: off-nominal CO2 values are left to program requirements.' - >- No response to a check-in is now an urgent possible-incapacitation escalation (RF5), never logged as declining; the timeout is an unsourced placeholder. - CO2 emergency-level owner changed to the program environmental lead with the flight surgeon. - 'New red flag RF6: headache red flags not attributed to CO2 (NICE CG150; NASA TB-033).' - 'X5 link loss: pause, then continue offline on the CMO''s confirmation.' - Sleep stations are measured only on the occupant's invitation. - X1 now stops the check-in for that crewmember (no patient recording in this protocol). - >- Loss of link (X5) now means: pause motion, tell the CMO, and continue offline only on the CMO's confirmation (fixes the contradiction with the comms branch). - >- Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build. - date: '2026-10-20' version: '0.3' source: >- AI-assisted batch 4 review by the Medical Research Assistant, Oct 20, 2026 (item 27); editorial only, the reviewed clinical meaning is unchanged items: - >- Related protocols: the link to RMP-NEURO-006 (retitled to sleep complaints and sleep-medicine use) now points to the planned headache log, RMP-NEURO-007, so headache no longer routes to a sleep protocol. The headache red flags, their levels and their routes are unchanged. - date: '2026-10-21' version: '0.3' source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49 items: - >- Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position"; "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and never-word list entry "safe" unchanged. - date: '2026-10-21' version: '0.4' source: Batch 6 editorial (AI-assisted), Oct 21, 2026 items: - >- Requirement use for [V2 10173] changed from "Safe default." to "Robot stays stopped if no one takes over." (batch 5 review item 25; editorial, behaviour unchanged). - date: '2026-10-21' version: '0.5' source: Batch 7 editorial (AI-assisted), Oct 21, 2026 items: - >- Citation labels changed to the site's year-only convention: "(approved for public release )" now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev F, 2026)" (sources: v2). Editorial; no change to steps, thresholds or limits. - date: '2026-10-21' version: '0.6' source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026 items: - >- X5 and the comms loss-of-signal branch now open with "Only the robot pauses; crew care never waits for the link or the robot." (batch 7 review suggestion 29). Editorial; robot behaviour unchanged.