RMP-ENV-004 High cabin carbon dioxide: read cabin data, check crew symptoms and log for the flight surgeon

1 · Identity and scope

When cabin CO2 rises above a caution level, the robot prompts the crew ("CO2 above caution level; start check-ins?"). Only on a crewmember's command, or when a crewmember starts it because of symptoms the crew link to CO2, the robot reads the cabin sensors, carries a portable sensor to where people work and sleep, runs short symptom check-ins with each crewmember, and logs and reports everything to the crew, the environmental team and the flight surgeon until levels settle.

Why this protocol was chosen. On the station, the odds of a crewmember reporting a headache doubled for each 1 mmHg rise in CO2. NASA limits the 1-hour average to 3 mmHg, and notes that CO2 can collect in local pockets. Headaches in flight also have other causes, so symptoms go to the CMO rather than being blamed on CO2.

Priority: Moved up from Tier 2: CO2-linked headaches are common, the task is low risk, and the data it collects helps the flight surgeon and engineers.

Related: RMP-ENV-001 · RMP-ENV-002 · RMP-NEURO-007

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Environmental and life-support team (ground) and crew: decide on ventilation, scrubbers and moving people
• Each crewmember: answers check-in questions

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [9]

3 · Preconditions and consent

• PRE-1 A crewmember started the run by command. A CO2 caution only makes the robot prompt the crew; it never starts the run. Passive logging of vehicle CO2 data that already exists needs no robot run.human_start == trueV2 10174
• PRE-2 Robot and portable sensor self-tests passed; sensor calibration in date.V2 10161
• PRE-3 Not a fire, smoke, toxic-leak or pressure emergency. If it is, the vehicle emergency procedure takes over and the robot only helps if crew ask.
• PRE-4 Link status and delay known.

Consent

Each crewmember can decline a check-in explicitly; declining is logged, not questioned. Not answering is never logged as declining (see RF5).

Emergency consent

Not applicable; no patient contact.

Withdrawal

Any crewmember can stop the check-ins.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   On a crewmember's command, notify the crew, the environmental team and the flight surgeon.

   Done when: Crew acknowledge.

   V2 10174

2. S2RobotRung 2

   Read and log the cabin CO2 1-hour average and trend.

   Done when: Values logged.

   V2 6004

3. S3RobotRung 2

   Carry the portable sensor to each occupied area and log readings. For sleep stations, only when the occupant invites the robot or places the portable sensor themselves; otherwise mark "not measured".

   Done when: Each area measured, or marked not measured.

   D1DecisionRobot decides

   Do the vehicle and portable sensors disagree by more than the set amount?

   • Yes → Flag a possible sensor fault to crew and ground; humans decide which to trust.
   • No → Continue.
4. S4RobotRung 2

   Run a short symptom check-in with each crewmember and log the answers.

   Done when: Each crewmember answered, declined explicitly, or was escalated for no response.

   D3DecisionRobot decides

   Did every crewmember respond to the check-in within <set by validation>?

   • Yes (answered or declined) → Continue.
   • No response → URGENT: the robot alerts the CMO and a crewmember checks on them in person (possible incapacitation, RF5).
   D4DecisionCrew decides

   Does any crewmember report symptoms?

   • Yes → CMO assesses; any treatment is decided by the CMO and flight surgeon. Symptoms while CO2 is below the caution level are not assumed to be caused by CO2.
   • No → Continue monitoring.
5. S5RobotRung 2

   Send a summary: values against the caution level and a symptom table. No diagnosis and no advice.

   Done when: Summary delivered or queued.

   D2DecisionGround decides

   What environmental response is needed?

   • Link live → Ground and crew decide; robot logs.
   • Link down → Crew follow onboard procedures; robot logs for the ground.
6. S6Crew

   Crew and ground decide the environmental response; the CMO sees any crewmember with symptoms.

   Done when: Decisions logged.

7. S7RobotRung 2

   Repeat readings and check-ins every <set by clinical lead> minutes until CO2 is below the caution level for <set by clinical lead> minutes and symptoms have eased, then close the event.

   Done when: Event closed by a crewmember.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [5] and Volume 2 Revision F [6]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Replayed cabin CO2 data with simulated crew responses. Pass: Correct crew prompts (never a self-start), no-response escalation and summaries in every scripted case; zero advice or cause statements.
2. Training model. Mock-up habitat with a controlled CO2 source and portable sensors. Pass: Portable and fixed sensor readings within <set by validation>; zero keep-out violations.
3. Earth analog. Analog habitat crews over weeks. Pass: Crew acceptance of check-ins and data completeness at or above <set by validation>.
4. Flight use under flight surgeon supervision. Logging-only mode first, alongside existing procedures. Pass: No interference with crew operations; flight surgeon finds the data useful.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

A crewmember command only (a CO2 caution prompts the crew but never starts the run). The flight surgeon and environmental lead review summaries; no real-time approval needed for logging.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.6.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [8].

Loss of signal and Mars delay

Live link

Low Earth orbit: summaries reach the ground within minutes; engineers and the flight surgeon respond in real time.

Loss of signal

• Only the robot pauses; crew care never waits for the link or the robot.
• The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps measuring, running check-ins and logging offline; crew follow onboard procedures.
• All data sent as one package at the next contact.

Mars-class delay

• Ground advice arrives tens of minutes later at best, and not at all during blackouts.
• Caution levels and check-in intervals are set before flight; the crew decide in real time.

[7]

Sources

1. Law J, Van Baalen M, Foy M, et al. Relationship between carbon dioxide levels and reported headaches on the International Space Station. J Occup Environ Med. 2014;56(5):477-483. PMID 24806559. doi:10.1097/JOM.0000000000000158 Supports: For each 1 mmHg rise in CO2, the odds of a crewmember reporting a headache doubled; keeping headache risk below 1% would need a 7-day average below 2.5 mmHg (ISS range at the time 1-9 mmHg).
2. NASA OCHMO. Spaceflight Experience and Medical Care. Technical Brief OCHMO-TB-033 (2023). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-033-spacefl… Supports: Headaches are more common in spaceflight, with elevated CO2, fluid shifts and pressure changes among contributing factors; pre-mission exams include ECG, eye exams and photo documentation of skin.
3. National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150. www.nice.org.uk/guidance/cg150/chapter/Recommendations Supports: Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness.
4. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
5. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
6. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
7. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
8. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
9. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.