RMP-EVA-001 Suspected decompression sickness after a spacewalk or pressure change: symptom log, equipment fetch, urgent relay to the flight surgeon (the robot never operates the suit, pressure or oxygen)

1 · Identity and scope

After a spacewalk (EVA), a suited test or any cabin pressure change, if a crewmember reports any new symptom, the robot sends an URGENT possible-DCS alert to the flight surgeon and CMO at once, fetches the DCS treatment equipment and medical kit closed, asks short symptom questions by voice (red flags first), records the time of each symptom against the decompression timeline and what the CMO enters, and offers prompt-only check-ins afterwards. Treatment (suit or cabin pressure, oxygen) is decided by the flight surgeon or CMO and done by the crew.

Why this protocol was chosen. NASA classifies decompression sickness (DCS) as Type I (pain, itching, mild rash) and Type II (neurological, inner ear and cardiopulmonary symptoms), and notes that most cases present between 60 and 240 minutes after decompression. No case has been reported in astronauts working in suits during EVAs, but research subjects testing prebreathe protocols in altitude chambers report about 20% DCS, mild symptoms may be under-reported in an operational setting, and NASA policy requires immediate reporting of any DCS symptom. There is no hyperbaric chamber in flight: on the ISS, treatment uses the suit (more than 95% oxygen) with stacked suit and habitat pressure. Prompt reporting and an accurate timeline are what a helper can add. Suit aches can feel like pain-only DCS, aspirin taken before an EVA can mask mild aches, and NASA warns that the first DCS report during an EVA may be a serious case, so every symptom is URGENT and the robot never calls a symptom mild or puts it down to the suit. Where diving medicine applies: diving guidance is written for divers who become ill on return to the surface and are treated by recompression in a chamber (U.S. Navy Treatment Table 6 is the terrestrial standard). Spaceflight DCS is altitude (hypobaric) DCS after a prebreathe, and there is no chamber. On the ISS, treatment keeps the crewmember in the suit at more than 95% oxygen, with habitat and suit pressure stacked to about 19.0 psia, and the Bends Treatment Apparatus can raise suit pressure further; NASA states that the terrestrial standard may not be achievable, or required, for altitude DCS, and that quick treatment gives a better chance of success [V2 6009]. The parts of diving medicine that transfer are early contact with an expert (here, the flight surgeon), early high-concentration oxygen given by the crew, and a watch for new symptoms of at least 24 hours. Positioning advice, in-water recompression and chamber treatment tables do not transfer. All treatment is decided by the flight surgeon or CMO and done by the crew.

Autonomy: Max rung raised from 1 to 2 for supervised fetching and logging, as in batch 1; the robot never operates the suit, airlock, cabin pressure or oxygen.

Related: RMP-CARD-002 · RMP-ENT-004 · RMP-ENT-003 · RMP-MSK-004 · RMP-NEURO-002 · RMP-NEURO-003 · RMP-CARD-001 · RMP-EVA-002 · RMP-EVA-003 · RMP-ENV-003 · RMP-EGR-001 · RMP-PHARM-001

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• EVA crewmember with symptoms: reports symptoms and can stop questions at any time
• EVA crew and intravehicular crew: run the EVA, suit and pressure emergency procedures
• Second trained CMO: receives alerts if the CMO is the patient (for example, the CMO was on the EVA)

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [11]

3 · Preconditions and consent

• PRE-1 A crewmember (the one with symptoms, the CMO or another crewmember) started the log by command. An EVA timeline event may prompt the crew, but never starts the robot.human_start == trueV2 10174
• PRE-2 The crewmember is inside the pressurized cabin, out of the airlock, or the EVA and suit procedures say the robot may approach. If the crewmember is still suited or in the airlock, the robot only alerts and fetches on request.robot_zone_clear == true
• PRE-3 Robot self-test passed; it knows the stowage location of the DCS treatment equipment and the medical kit.V2 10161
• PRE-4 Robot and supplies restrained when not moving.V2 7046
• PRE-5 Link status and current delay known.link_state in [live, delayed, down]

Consent

The crewmember agrees to questions and recording by voice. They can decline any question; an explicit "no" is logged as declined for that question only. Video needs the crewmember's agreement.

Emergency consent

If the crewmember cannot answer, the URGENT alert stands, the robot asks no more questions and a crewmember checks in person (X7).

Withdrawal

The crewmember can stop questions or recording at any time; the URGENT alert already sent is not withdrawn.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   On a crewmember's command, open the log and send an URGENT "possible DCS" alert to the flight surgeon and the CMO at once, with the time since the most recent decompression. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.

   Done when: Alert acknowledged, or escalated to the next named crewmember.

   V2 10174V1 6003V1 3006

2. S2Crew

   The EVA crew, the CMO and the intravehicular crew follow the EVA, suit and pressure emergency procedures and the onboard checklist. The flight surgeon (or the CMO under the checklist when there is no link) decides treatment; the crew operate the suit, pressure and oxygen.

   Done when: Procedure started; decisions logged by the robot as stated.

   V1 3004V2 6009

3. S3RobotRung 2

   On the CMO's request, fetch the DCS treatment equipment and the medical kit, closed, and restrain them within reach outside the crew's work area and away from the hatch. It never connects, opens or operates them. This is an emergency fetch on a human command (CMO): no barcode check runs before hand-over and nothing waits for one. The robot reads the kit's own label and seal status only if that adds no delay, says "EMERGENCY FETCH – NOT VERIFIED (CMO command)", and "seal not intact" if so, and hands the kit over anyway. The fetch is logged as an override: time, who asked, the reason as stated, kit ID and seal status. It never says "verified".

   Done when: Items restrained within reach; nothing operated by the robot; override logged.

   Limit: <set by validation>

   V2 7046

4. S4RobotRung 2

   Ask the red-flag questions first, then what the symptom is, where, when it started and whether it is changing. Log answers word for word with times against the decompression timeline. D1 is checked after every answer.

   Done when: Answers logged with times, or "no response" logged.

   D1DecisionRobot decides

   Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?

   • Yes → Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
   • No → Continue. The possible-DCS alert from S1 stands; a "no" never cancels it.
   D2DecisionRobot decides

   Did the crewmember answer the question?

   • Yes → Continue.
   • Declined explicitly (the crewmember says no to a question) → Log "declined" for that question only; the alert already sent stands.
   • No response, or the answer does not make sense → URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once.
5. S5RobotRung 2

   Record the vital signs and neurological check results the CMO enters, and the treatments the crew say they gave, time-stamped; never comment on them.

   Done when: Entries logged.

   V1 3004

6. S6RobotRung 2

   When the crew ask and the crewmember agrees, show the onboard checklist on its screen and stream video to the flight surgeon (queued if the link is down).

   Done when: Checklist shown; video streamed or queued.

   V1 6003

7. S7RobotRung 2

   After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.

   Done when: Robot at rest in the module until a human releases it; alert acknowledged or escalated.

   V2 10173V1 3006

8. S8Ground

   The flight surgeon (or the CMO under the onboard checklist when there is no link) decides treatment, how long to watch for new symptoms, work limits, any evacuation [V1 3007], and when the crewmember may next undergo an EVA, a suited test or a cabin pressure reduction [V1 6006]. The robot logs the decisions and never clears anyone.

   Done when: Decision logged.

   V1 3007V1 6006

   D3DecisionGround decides

   What is the treatment and watch plan?

   • Link live → Flight surgeon decides; robot logs.
   • Link down or delay too long → The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact.
9. S9RobotRung 2

   Offer a check-in every <set by flight surgeon> hours during the watch period of <set by flight surgeon> hours after the most recent decompression (for context, diving consensus reviews a "mild" designation over at least 24 hours). At each scheduled time the robot prompts the crewmember on their own screen; it approaches only when the crewmember (or the CMO) accepts, and a prompt never starts the robot. A new or returning symptom at any time is URGENT (RF7).

   Done when: Each prompt accepted, postponed or answered; log closed by a human.

   V2 10174

   D4DecisionRobot decides

   At a check-in or at any time, is there a new or returning symptom?

   • Yes → URGENT alert (RF7) at once; the CMO checks in person.
   • No → Log the answer as given; continue the schedule until a human closes the log.
10. S10RobotRung 2

    Send the flight surgeon one package: decompression timeline and prebreathe log as recorded by the crew, symptom times and answers, CMO entries, treatments as stated, alerts and acknowledgements. When the CMO says the event is over, run RMP-PHARM-001 reconciliation on each kit fetched: record the items the CMO or crew state were used, the remaining contents against the kit list, seal status and expiry, labelled "inventory reconciliation after emergency use – not a check before use". Flag the override to the flight surgeon and the pharmacy lead, and show each kit as "opened – not restocked" until a human restocks and reseals it.

    Done when: Package delivered or queued; kits reconciled or shown as opened – not restocked.

    V1 6003V1 7001V1 7003V2 7059

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Each symptom with its onset time measured from the most recent decompression, so the flight surgeon sees the timeline.
• LOG-6 Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.V2 10163
• LOG-7 Each emergency fetch as an override (time, who asked, reason as stated, kit ID, seal status) and the later inventory reconciliation, labelled "not a check before use".V2 7059

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [7] and Volume 2 Revision F [8]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted post-EVA scenarios with symptoms of every type, no response, symptoms that return, a CMO who was on the EVA, and lost link, at station, Moon and Mars delays. Pass: Every symptom alerts at once; no response escalates; unacknowledged alerts escalate to the next named crewmember; zero DCS or not-DCS, mild or from-the-suit statements; zero contact with suit, pressure or oxygen controls; every emergency fetch logged as an override.
2. Earth analog. Altitude-chamber or EVA training-facility runs with volunteers and a flight surgeon, using the voice questions and equipment fetching (no real symptoms needed). Pass: Timeline accuracy at or above <set by validation>; the robot keeps clear of the chamber and suit controls.
3. Parabolic or station demonstration. Fetching and restraining the DCS treatment equipment and medical kit in weightlessness, without a patient. Pass: Items delivered closed and restrained; keep-out zones held.
4. Flight use under flight surgeon supervision. First use as a logging aid during real EVA days, alongside the usual medical monitoring. Pass: No safety events; the flight surgeon finds the timeline useful.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by a crewmember. Every possible-DCS alert goes to the flight surgeon and CMO at once; treatment is decided by the flight surgeon (or the CMO under the onboard checklist when there is no link).

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.4.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [10].

Loss of signal and Mars delay

Live link

Low Earth orbit: the flight surgeon is on the EVA loop and receives the alert and timeline at once.

Loss of signal

• The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps logging offline.
• Crew oxygen, the DCS (decompression sickness) treatment checklist and CPR continue under the onboard checklist and never wait for the link or the robot.
• Alerts go to the CMO (or the second trained CMO); the CMO decides under the pre-approved onboard checklist.
• At the next contact the robot sends one package: timeline, symptoms, entries, treatments as stated and alerts.

Mars-class delay

• Replies may take up to about 21-23 minutes each way, with blackouts of about 2-3 weeks, so the onboard checklist and trained CMOs lead; the robot's timeline is sent at the next contact.
• The watch period and check-in schedule are set before flight; the CMO acts on them.
• DCS treatment capability and pressures differ by vehicle and suit [V2 6009]. At low-pressure exploration habitats, repressurizing the suit to cabin pressure alone may not resolve symptoms, so the onboard checklist must state what to do next.

[9]

Sources

1. NASA OCHMO. Decompression Sickness (DCS) Risk Mitigation. Technical Brief OCHMO-TB-037 Rev D (Oct 5, 2026). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-037-decompr… Supports: DCS is caused by inert gas bubbles forming during rapid reductions in ambient pressure, most significantly in the move from cabin pressure to EVA suit pressure; NASA classifies DCS as Type I (itching, musculoskeletal pain, mild rashes) and Type II (neurological symptoms, numbness, weakness, cognitive issues, inner ear problems, cardiopulmonary issues), and describes cutis marmorata (a mottled, patterned skin rash); arterial gas embolism can cause stroke-like neurological effects, loss of consciousness and seizures; U.S. Navy protocols are widely adopted on Earth; diagnosis is based on symptoms; the majority of cases present between 60 and 240 minutes and inflammatory responses can last more than 24 hours; no hyperbaric chamber is available in flight, and increasing suit and cabin pressure may be combined to treat symptoms, depending on the scenario; a break in prebreathe rapidly reintroduces nitrogen; NASA has never experienced a Type II event in spaceflight.
2. NASA Human Research Program. Evidence Report: Risk of Reduced Crew Health and Performance due to Decompression Sickness and Hypoxia (2023). humanresearchroadmap.nasa.gov/evidence/reports/Evidence%20Re… Supports: No reported cases of DCS in astronauts or cosmonauts working in suits pressurized to 3.7-5.8 psia during EVAs, while research subjects testing prebreathe protocols in altitude chambers report about 20% DCS; mild symptoms may be under-reported in an operational setting, and NASA policy requires immediate reporting of the onset of any DCS symptoms; Type II symptoms (central nervous system, cardiopulmonary "chokes", circulatory collapse, shock) require immediate termination of an EVA; on the ISS, treatment keeps the crewmember in the suit (more than 95% oxygen) with stacked habitat and suit pressure, adding the Bends Treatment Apparatus if symptoms do not resolve; ending an EVA can take up to 30 minutes. The stacked habitat (14.7 psia) and suit (4.3 psid) pressure totals 19.0 psia; at an 8.2 psia exploration habitat the modeled probability of symptom resolution is only 48-67%, so it may not be enough to resolve symptoms at once. A diver's DCS happens on return to the surface, an astronaut's during their tasks. Many astronauts take aspirin before an EVA, so mild aches and pains are managed in advance; suit aches are comparable to pain-only DCS, many potentially mild cases are not reported, and it is possible that the first report of DCS during an EVA will be a serious case of DCS.
3. Mitchell SJ, Bennett MH, Bryson P, et al. Pre-hospital management of decompression illness: expert review of key principles and controversies. Diving Hyperb Med. 2018;48(1):45-55. PMID 29557102. doi:10.28920/dhm48.1.45-55 Supports: Diving-medicine consensus (on Earth): all divers who become unwell after diving should be discussed with a diving medicine physician as soon as possible; normobaric oxygen should be given as soon as possible after symptoms start; because new symptoms can develop later, a "mild" designation must be reviewed repeatedly over at least 24 hours after the most recent decompression, and decisions using it should be made by a physician with training and experience in decompression illness; a horizontal position is generally encouraged and head-down is no longer recommended; a recompression chamber is the gold standard, and in-water recompression is an option only for trained groups of divers. Applied to spaceflight by extrapolation: early expert contact, early oxygen and a watch of at least 24 hours transfer; positioning, in-water recompression and chamber tables do not.
4. Naval Sea Systems Command. U.S. Navy Diving Manual, Revision 7 Change A (SS521-AG-PRO-010, April 30, 2018). www.navsea.navy.mil/Portals/103/Documents/SUPSALV/Diving/US%… Supports: Context only: the source of U.S. Navy Treatment Table 6, which NASA-STD-3001 Vol 2 [V2 6009] names as the terrestrial standard for treating most forms of DCS. The document and address were confirmed; Treatment Table 6 itself was not opened, so this claim rests on the [V2 6009] rationale.
5. Institute for Safe Medication Practices. Guidelines for the safe use of automated dispensing cabinets (2019). www.ismp.org/system/files/resources/2019-11/ISMP170-ADC%20Gu… Supports: Override is limited to medicines needed in emergent circumstances where waiting could harm the patient (3.3b); limit what is available on override (3.4b); require documentation of the override rationale (3.4d); routinely analyze override reports (3.6). Used for the emergency-fetch pattern by analogy (a robot fetching a sealed kit is not a dispensing cabinet).
6. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
7. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
8. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: NASA-STD-3001 Vol 2 Rev F: V2 6009 requires DCS treatment capability; its rationale names U.S. Navy Treatment Table 6 as the terrestrial standard and says it may not be achievable, or required, for altitude DCS, that sub-terrestrial standard therapy is likely to be adequate for altitude-induced symptoms, and that quick treatment gives a higher probability of success. Section 10.6 covers automated and robotic systems.
9. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
10. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
11. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.