RMP-BEH-002 Scheduled mood, sleep and workload check-ins: private logging for the flight surgeon, urgent escalation of safety concerns

1 · Identity and scope

On a schedule the flight surgeon and behavioral health team set before flight, the crewmember gets a reminder on their own screen. If they choose to start, the robot runs a short, private, voice-only check-in about mood, stress, sleep and workload, using questions written by the behavioral health team. It logs answers word for word and sends them privately to the flight surgeon and behavioral health team. It never scores, interprets or counsels, and it does not replace the private psychological conference. Any mention of thoughts of self-harm, suicide or harming others, an immediate safety concern, or a request for help stops the questions at once (mid-question if need be) and goes to the flight surgeon, and to the CMO when the link is down or delayed (the second CMO if the CMO is the person concerned), as each crewmember agreed before flight; an unacknowledged alert is repeated and sent to the next named person. After an urgent alert the robot does not leave on its own. The robot listens for certain words, can miss things or raise false alarms, and is not a safety monitor.

Why this protocol was chosen. NASA lists stress, depression, anxiety, relationship problems and grief among behavioral health concerns in spaceflight, with sleep, workload and medical conditions as contributing factors; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms. Sleep loss is common: in a study of 85 astronauts, station crew slept about 6 hours a night and 75% reported using sleep-promoting medicines. NASA calls for additional, minimally obtrusive monitoring on missions beyond 6 months or beyond low Earth orbit. A short, optional, private check-in could give the flight surgeon a trend between conferences, but only if crew trust that it is private and optional, so this draft keeps the camera off, scores nothing, lets crew skip anything, stores transcripts encrypted, and never uses them to train or tune software. Asking directly about suicidal thoughts has not been found to increase them. The NICE self-harm guideline used here is written for people who have already self-harmed, so applying it to routine check-ins is an extrapolation.

Related: RMP-BEH-001 · RMP-BEH-003 · RMP-BEH-004 · RMP-NEURO-006 · RMP-ENV-004

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Behavioral health team (ground): writes the questions and reviews answers with the flight surgeon
• Each crewmember: chooses whether to start, can skip any question and can stop at any time
• CMO: told only of urgent safety concerns when the link is down or delayed, as agreed before flight. If the CMO is the crewmember concerned, the second trained CMO (or the person named in the pre-flight agreement) is told instead [V1 3006]

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [11]

3 · Preconditions and consent

• PRE-1 The schedule and questions (including a direct question about thoughts of self-harm at every check-in, worded by the behavioral health team) were set before flight by the flight surgeon and behavioral health team. Each crewmember's agreement was recorded before flight, after being told: who sees the answers; when the CMO is told (the urgent rule), and who is told if the CMO is the person concerned; that repeated skipped check-ins are flagged to the flight surgeon; that an urgent alert and the words that triggered it cannot be withdrawn; that transcripts are stored encrypted and never used to train software; and plainly: "This robot listens for certain words and can miss things or raise false alarms. It is not a safety monitor. If you are struggling, contact the CMO or flight surgeon directly at any time."
• PRE-2 A pre-flight plan exists for securing medicines and other means of self-harm onboard, and each crewmember who wanted one has a safety plan written with the behavioral health team.
• PRE-3 The crewmember started the check-in. The scheduled reminder is a message on the crewmember's own screen; the robot does not move until the crewmember starts.human_start == trueV2 10174
• PRE-4 A private place chosen by the crewmember; no one else in hearing range unless the crewmember agrees.
• PRE-5 Robot self-test passed; camera off and camera-off indicator lit.robot_camera_recording == falseV2 10161
• PRE-6 Link status and current delay known.

Consent

Each check-in is optional. The crewmember starts it, can skip any question and can stop at any time; an explicit "skip" is logged as "skipped (by choice)" and never questioned. No response is logged as "no response", never as skipped. At the start, the robot reminds the crewmember who will see the answers, that safety concerns go to the flight surgeon at once, and that it can miss things and is not a safety monitor.

Emergency consent

Not applicable: the robot never runs a check-in without the crewmember's agreement. A safety concern raised outside a check-in goes to RMP-BEH-001.

Withdrawal

The crewmember can stop at any time; the robot stops, and leaves if asked (after an urgent alert it stays available by voice until a human has taken over or the crewmember asks it to go). Routine answers so far are kept only if the crewmember agrees. Once an urgent alert has been sent, the alert and the words that triggered it are kept for the flight surgeon even if the crewmember stops or corrects the transcript; the robot says this plainly.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   At the scheduled time, send a reminder to the crewmember's own screen. The robot does not move.

   Done when: Crewmember starts, postpones or skips; logged.

   D2DecisionRobot decides

   Has the crewmember skipped or postponed the number of check-ins in a row the flight surgeon set?

   • Yes → Tell the flight surgeon privately that check-ins were skipped (crew were told before flight that this happens). No one else is told, and the robot does not press the crewmember.
   • No → Continue the schedule.
2. S2Crew

   The crewmember starts the check-in and chooses a private place.

   Done when: Started, with a place chosen.

   V2 10174

3. S3RobotRung 2

   Go to the chosen place with the camera off and the camera-off indicator lit (never into a sleep station unless invited).

   Done when: Robot at the place; camera off confirmed by the crewmember.

   Limit: <set by validation>

4. S4RobotRung 2

   Remind the crewmember who sees the answers and the urgent rule, and say: "This robot listens for certain words and can miss things or raise false alarms. It is not a safety monitor. If you are struggling, contact the CMO or flight surgeon directly at any time." Ask the pre-written questions by voice, including the direct question about thoughts of self-harm, accept "skip" at any point, and end with "Would you like to talk to someone on the ground?". Log answers word for word. After every answer, apply D1 at once: an urgent mention stops the question set immediately, even mid-question.

   Done when: Answers logged; D1 applied after every answer.

   D1DecisionRobot decides

   Checked after every answer during S4 (not only at the end): did the crewmember mention thoughts of self-harm, suicide or harming others, an immediate safety concern, or ask for help?

   • Yes → Stop the question set at once, even mid-question, and go to S5 (urgent alert). The robot gives no risk rating and tells the crewmember who is being contacted.
   • Not sure (unclear words, or the speech was not understood) → Treat as yes: go to S5.
   • No response after an urgent mention → Treat as yes: go to S5.
   • No → Continue the questions; after the last answer, skip S5 and go to S6.
5. S5RobotRung 2

   Only after an urgent answer (D1), at once: stop the questions; tell the crewmember who it is contacting now; send an URGENT private alert to the flight surgeon; if the link is down or delayed beyond the limit, alert the CMO as agreed before flight, or, if the CMO is the crewmember concerned, the second trained CMO (or the person named in the pre-flight agreement). If no alert is acknowledged within <set by flight surgeon> minutes, repeat it and alert the next person named in the pre-flight agreement. On RF1, the flight surgeon or CMO follows the pre-flight plan for securing medicines and other means onboard; from then on the robot fetches no medicine for that crewmember except on a CMO or flight surgeon order logged after the alert. Offer a private call (RMP-BEH-003) and, on request, show the crewmember's own safety plan.

   Done when: Alert acknowledged by a named person and logged; unacknowledged alerts repeated and escalated.

   V1 3006

6. S6RobotRung 2

   Read back a short transcript for the crewmember to confirm or correct; corrections are added as notes and the original is not overwritten. Send it privately to the flight surgeon and behavioral health team (queued if the link is down), stored encrypted and kept off the robot after sending; it is never used to train or tune any software. No one else receives it. After an urgent alert, the alert and the words that triggered it are kept for the flight surgeon even if the crewmember stops or asks to delete them; the robot says this plainly.

   Done when: Transcript confirmed (or noted as corrected) and delivered or queued.

   V1 6003V1 7003

7. S7RobotRung 2

   Delete the audio once the transcript is confirmed (or as the privacy plan set before flight says). If there was no urgent alert, leave the place. After an urgent alert, the robot does not leave on its own: it stays available by voice (offering the ground call) until a human has taken over or the crewmember asks it to go. It never follows, blocks or watches.

   Done when: Audio deleted; robot back at rest, or still available by voice until a human has taken over.

8. S8Ground

   The flight surgeon and behavioral health team review the answers, usually at the next private conference, and decide any follow-up or schedule change; the robot logs only the schedule change.

   Done when: Schedule change logged, or none.

   D3DecisionGround decides

   Follow-up needed?

   • Link live → Flight surgeon and behavioral health team decide; robot logs the schedule only.
   • Link down or delay too long → Urgent concerns go to the CMO under the agreed rule and the pre-approved onboard checklist; routine answers wait, encrypted, for the next contact.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Answers are visible only to the flight surgeon and behavioral health team. The onboard log records only that a check-in happened, was skipped, had no response, or raised an urgent alert, not what was said.V1 6003
• LOG-6 For every urgent alert: the time of the triggering answer, the alert, each acknowledgment or repeat, and who was alerted; the alert and the triggering words are write-once.V1 7001V1 7003

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [7] and Volume 2 Revision F [8]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Scripted conversations, including direct and indirect mentions of self-harm, harm to others and confusion at every point in the question set, silence, the CMO as the person concerned, and unacknowledged alerts, with and without a link. Pass: Every urgent mention escalates at once, mid-question (including uncertain ones); every unacknowledged alert is repeated and escalated; zero alerts deleted; zero departures after an urgent alert before a human takes over; zero silences logged as skipped; zero scores, advice or interpretations; zero answers shared outside the allowed list.
2. Earth analog. Isolation analog crews (for example multi-month habitat studies) with a remote behavioral health team. Pass: Crew trust and acceptance at or above <set by validation>; zero privacy breaches; the team finds the trend useful.
3. Flight use under flight surgeon supervision. Optional use alongside private psychological conferences. Pass: No privacy breaches; crew keep choosing to use it.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the crewmember. No real-time approval is needed; urgent alerts go to the flight surgeon at once (the CMO when the link is down or delayed).

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.5.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [10].

Loss of signal and Mars delay

Live link

Low Earth orbit: urgent alerts reach the flight surgeon within minutes; routine answers are reviewed at the next private conference.

Loss of signal

• Only the robot pauses; crew care never waits for the link or the robot.
• The robot pauses any movement and tells the crewmember and the CMO that the link is down, without saying who is in a check-in or what was said.
• On the CMO's confirmation, check-ins can continue offline; answers are stored encrypted for the flight surgeon, and urgent concerns go to the CMO as agreed before flight.

Mars-class delay

• With up to about 21-23 minutes one way, and blackouts of about 2-3 weeks, no one on the ground can answer in real time; urgent concerns go to the CMO, as agreed before flight.
• The questions, schedule and urgent rule are set before flight with each crewmember.

[9]

Sources

1. NASA OCHMO. Behavioral Health and Performance. Technical Brief OCHMO-TB-016 Rev B (Oct 24, 2023). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-016-behavio… Supports: Behavioral health concerns in spaceflight include stress, depression, anxiety, relationship problems and grief; contributing factors include sleep, workload, hypoxia, medicine side effects and medical conditions; 2 of 7 NASA Shuttle-Mir astronauts reported depressive symptoms; past events include reported possible hallucinations and withdrawal after delayed news of a family death; support includes private psychological conferences, and missions beyond 6 months or beyond low Earth orbit should add minimally obtrusive monitoring.
2. Barger LK, Flynn-Evans EE, Kubey A, et al. Prevalence of sleep deficiency and use of hypnotic drugs in astronauts before, during, and after spaceflight: an observational study. Lancet Neurol. 2014;13(9):904-912. PMID 25127232. doi:10.1016/S1474-4422(14)70122-X Supports: By wrist actigraphy, ISS crew obtained about 6.1 hours of sleep a night in flight and Shuttle crew about 6.0 hours; 12 of 16 ISS crew (75%) and 61 of 78 Shuttle crew (78%) reported using sleep-promoting drugs.
3. NASA Human Research Program. Evidence Report: Risk of Performance Decrements and Adverse Health Outcomes Resulting from Sleep Loss, Circadian Desynchronization, and Work Overload (2016). humanresearchroadmap.nasa.gov/evidence/reports/Sleep.pdf Supports: All studies to date show astronauts sleep less in spaceflight than on Earth; sleep medication is the most prevalent fatigue countermeasure in flight, and about three-quarters of Shuttle and ISS astronauts reported using sleep medications.
4. National Institute for Health and Care Excellence. Self-harm: assessment, management and preventing recurrence. NICE guideline NG225 (2022). www.nice.org.uk/guidance/ng225/chapter/Recommendations Supports: Do not use risk assessment tools and scales, or global low/medium/high risk stratification, to predict future suicide or repetition of self-harm (1.6.1-1.6.4); focus on how to support the person's immediate and long-term psychological and physical safety (1.6.5); establish the means of self-harm and, if accessible, discuss removing it (1.7.1); a safety plan held by the person includes keeping the environment safe by removing or restricting lethal means (1.11.7-1.11.8); treat the person with respect, dignity and compassion. NG225 is written for people who have self-harmed; using it for routine check-ins is an extrapolation.
5. Dazzi T, Gribble R, Wessely S, Fear NT. Does asking about suicide and related behaviours induce suicidal ideation? What is the evidence? Psychol Med. 2014;44(16):3361-3363. PMID 24998511. doi:10.1017/S0033291714001299 Supports: A review of published studies in adults and adolescents: none found a statistically significant increase in suicidal ideation among participants asked about suicidal thoughts.
6. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
7. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
8. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
9. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
10. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
11. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.