{ "$schema": "https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/protocol.schema.json", "schema_version": "0.3", "version": "0.4", "status": "draft", "conceptual": true, "not_for_clinical_use": true, "max_autonomy": 2, "missions": [ "leo", "commercial", "moon", "mars" ], "updated": "2026-10-21", "review": { "state": "reviewed-ai-assisted", "requested": "2026-10-20", "reviewed": "2026-10-20", "human_clinician_review": false, "text": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 3 review, 54 corrections); all corrections are applied in this version. No named human clinician has reviewed it." }, "fixed_rules": { "flight_surgeon_is_medical_authority": true, "cmo_acts_under_delegated_care": true, "human_starts_and_restarts_robot": true, "robot_never_diagnoses": true, "no_drug_or_fluid_advice_by_robot": true, "safe_state_on_fault_or_no_response": true, "lost_link_pause_then_cmo_decides": true }, "robot_lockouts": { "diagnosis": true, "drug_or_fluid_advice": true, "starting_stopping_or_adjusting_oxygen_or_any_medicine": true, "self_start_or_self_restart": true, "changing_own_protocol_thresholds_or_limits": true, "handing_over_a_mismatched_item_as_verified": true }, "id": "RMP-EVA-001", "slug": "rmp-eva-001", "title": "Suspected decompression sickness after a spacewalk or pressure change: symptom log, equipment fetch, urgent relay to the flight surgeon (the robot never operates the suit, pressure or oxygen)", "category": "eva", "tier": 1, "rung_note": "Max rung raised from 1 to 2 for supervised fetching and logging, as in batch 1; the robot never operates the suit, airlock, cabin pressure or oxygen.", "result_language": { "use": [ "logged, not interpreted", "sent to flight surgeon", "symptom as reported by the crewmember" ], "never": [ "normal", "no problem found", "all clear", "negative", "any diagnosis or cause", "bends", "not DCS", "just muscle soreness", "resolved", "safe", "mild", "Type I", "Type II", "pain only", "from the suit", "suit soreness", "expected after an EVA", "minor" ] }, "scope": { "summary": "After a spacewalk (EVA), a suited test or any cabin pressure change, if a crewmember reports any new symptom, the robot sends an URGENT possible-DCS alert to the flight surgeon and CMO at once, fetches the DCS treatment equipment and medical kit closed, asks short symptom questions by voice (red flags first), records the time of each symptom against the decompression timeline and what the CMO enters, and offers prompt-only check-ins afterwards. Treatment (suit or cabin pressure, oxygen) is decided by the flight surgeon or CMO and done by the crew.", "why": "NASA classifies decompression sickness (DCS) as Type I (pain, itching, mild rash) and Type II (neurological, inner ear and cardiopulmonary symptoms), and notes that most cases present between 60 and 240 minutes after decompression. No case has been reported in astronauts working in suits during EVAs, but research subjects testing prebreathe protocols in altitude chambers report about 20% DCS, mild symptoms may be under-reported in an operational setting, and NASA policy requires immediate reporting of any DCS symptom. There is no hyperbaric chamber in flight: on the ISS, treatment uses the suit (more than 95% oxygen) with stacked suit and habitat pressure. Prompt reporting and an accurate timeline are what a helper can add. Suit aches can feel like pain-only DCS, aspirin taken before an EVA can mask mild aches, and NASA warns that the first DCS report during an EVA may be a serious case, so every symptom is URGENT and the robot never calls a symptom mild or puts it down to the suit. Where diving medicine applies: diving guidance is written for divers who become ill on return to the surface and are treated by recompression in a chamber (U.S. Navy Treatment Table 6 is the terrestrial standard). Spaceflight DCS is altitude (hypobaric) DCS after a prebreathe, and there is no chamber. On the ISS, treatment keeps the crewmember in the suit at more than 95% oxygen, with habitat and suit pressure stacked to about 19.0 psia, and the Bends Treatment Apparatus can raise suit pressure further; NASA states that the terrestrial standard may not be achievable, or required, for altitude DCS, and that quick treatment gives a better chance of success [V2 6009]. The parts of diving medicine that transfer are early contact with an expert (here, the flight surgeon), early high-concentration oxygen given by the crew, and a watch for new symptoms of at least 24 hours. Positioning advice, in-water recompression and chamber treatment tables do not transfer. All treatment is decided by the flight surgeon or CMO and done by the crew.", "covers": [ "Any new symptom (pain, itching, rash or skin change, tingling, numbness, weakness, dizziness, hearing or vision change, headache, cough, chest tightness, breathlessness, confusion or unusual tiredness) after an EVA, a suited test or a cabin pressure change, in a crewmember who is inside the cabin and answering", "Prompt-only check-ins for the watch period the flight surgeon sets after the most recent decompression", "A symptom reported after the look-back window has closed still starts this protocol and still goes to the flight surgeon at once" ], "locked_out": [ "Positioning advice, in-water recompression or any chamber treatment table (these do not transfer from diving medicine)", "Saying a symptom is mild, Type I or Type II, pain only, or from the suit", "Operating the suit, airlock, hatch, valves, cabin pressure or any oxygen or treatment equipment (the crew operate it under the EVA and suit emergency procedures)", "Deciding whether symptoms are DCS, or that they are not", "Choosing or advising any treatment, medicine or fluid", "Clearing a crewmember for an EVA (the flight surgeon decides [V1 6006])", "Entering the airlock or working near the hatch during pressure changes", "Touching, holding or restraining the crewmember" ], "related": [ "RMP-CARD-002", "RMP-ENT-004", "RMP-ENT-003", "RMP-MSK-004", "RMP-NEURO-002", "RMP-NEURO-003", "RMP-CARD-001", "RMP-EVA-002", "RMP-EVA-003", "RMP-ENV-003", "RMP-EGR-001", "RMP-PHARM-001" ] }, "roles": { "medical_authority": "Flight surgeon (ground). Holds medical authority for every run.", "onboard_lead": "Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.", "others": [ "EVA crewmember with symptoms: reports symptoms and can stop questions at any time", "EVA crew and intravehicular crew: run the EVA, suit and pressure emergency procedures", "Second trained CMO: receives alerts if the CMO is the patient (for example, the CMO was on the EVA)" ], "robot_may": [ "Send an URGENT possible-DCS alert to the CMO and flight surgeon on a crewmember's command, with the decompression timeline", "Fetch the DCS treatment equipment and the medical kit, closed, and restrain them within reach outside the crew's work area", "Ask short symptom questions by voice and log the answers word for word, with times", "Record vital signs and neurological check results the CMO enters (recorded, not interpreted)", "Show the onboard checklist on its screen and stream video when the crew ask and the crewmember agrees", "Offer prompt-only check-ins afterwards for the watch period the flight surgeon sets", "Reconcile the medical kit afterwards through RMP-PHARM-001 as an inventory record (not a check before use)" ], "robot_may_not": [ "Operate the suit, airlock, valves, pressure or oxygen", "Say symptoms are or are not DCS, that they are mild, or that they are from the suit, or that they have resolved", "Clear anyone for an EVA, a suited test or a cabin pressure reduction", "Advise any treatment, medicine or fluid", "Enter the airlock or approach the hatch during pressure changes", "Touch the crewmember", "Start without a human command" ], "commercial": "On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.)" }, "preconditions": [ { "id": "PRE-1", "text": "A crewmember (the one with symptoms, the CMO or another crewmember) started the log by command. An EVA timeline event may prompt the crew, but never starts the robot.", "check": "human_start == true", "refs": [ "V2 10174" ] }, { "id": "PRE-2", "text": "The crewmember is inside the pressurized cabin, out of the airlock, or the EVA and suit procedures say the robot may approach. If the crewmember is still suited or in the airlock, the robot only alerts and fetches on request.", "check": "robot_zone_clear == true" }, { "id": "PRE-3", "text": "Robot self-test passed; it knows the stowage location of the DCS treatment equipment and the medical kit.", "refs": [ "V2 10161" ] }, { "id": "PRE-4", "text": "Robot and supplies restrained when not moving.", "refs": [ "V2 7046" ] }, { "id": "PRE-5", "text": "Link status and current delay known.", "check": "link_state in [live, delayed, down]" } ], "consent": { "standard": "The crewmember agrees to questions and recording by voice. They can decline any question; an explicit \"no\" is logged as declined for that question only. Video needs the crewmember's agreement.", "emergency": "If the crewmember cannot answer, the URGENT alert stands, the robot asks no more questions and a crewmember checks in person (X7).", "withdrawal": "The crewmember can stop questions or recording at any time; the URGENT alert already sent is not withdrawn." }, "inputs": [ { "id": "IN-1", "name": "Time of the most recent decompression (EVA start and end, suited test or cabin pressure change) and the prebreathe log, as recorded by the crew, including any break in prebreathe the crew logged, and any medicine taken before the EVA as stated (for example aspirin). Recorded for the flight surgeon, not interpreted", "source": "EVA timeline, crew log and dose log; crewmember, by voice", "required": true, "if_missing": "Ask the CMO; log \"timeline not available\". Never delays the alert." }, { "id": "IN-2", "name": "Symptom answers: what, where, when it started, and whether it is getting worse", "source": "Crewmember, by voice", "required": true, "if_missing": "Log \"no response\" and treat as URGENT (D2). Never logged as declined." }, { "id": "IN-3", "name": "Red-flag questions: numbness, weakness, confusion, vision or speech change, dizziness, spinning, ringing or hearing loss, cough, chest pain or tightness, breathlessness, mottled skin", "source": "Crewmember, by voice; CMO observation", "required": true, "if_missing": "Log \"no response\"; URGENT; the CMO checks in person." }, { "id": "IN-4", "name": "Vital signs and neurological check results, entered by the CMO (recorded, not interpreted)", "source": "Entered by the CMO", "required": false, "if_missing": "Log \"not measured\". A missing value is never treated as reassuring." }, { "id": "IN-5", "name": "Treatments the crew report giving (pressure, oxygen, other), with times", "source": "Stated by the CMO or crew; logged as stated", "required": false, "if_missing": "Log \"not stated\"." }, { "id": "IN-6", "name": "Cabin pressure and oxygen readings (read only)", "source": "Vehicle data", "required": false, "if_missing": "Log \"not available\"." }, { "id": "IN-7", "name": "Anticoagulant, antiplatelet or aspirin use, and any bleeding or clotting disorder, in the record or as the crewmember or CMO states, including any medicine taken in the last day (for example before an EVA), with the time of the last dose (shown to the CMO; the robot does not advise)", "source": "Medical record and dose log (RMP-PHARM-003); crewmember or CMO, by voice", "required": false, "if_missing": "Note \"record not available\"; ask the crewmember; a missing answer is never treated as \"none\"." }, { "id": "IN-8", "name": "Link status and delay", "source": "Communications system", "required": true, "if_missing": "Treat as link down." } ], "steps": [ { "id": "S1", "actor": "robot", "rung": 2, "action": "On a crewmember's command, open the log and send an URGENT \"possible DCS\" alert to the flight surgeon and the CMO at once, with the time since the most recent decompression. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember.", "success": "Alert acknowledged, or escalated to the next named crewmember.", "refs": [ "V2 10174", "V1 6003", "V1 3006" ] }, { "id": "S2", "actor": "crew", "action": "The EVA crew, the CMO and the intravehicular crew follow the EVA, suit and pressure emergency procedures and the onboard checklist. The flight surgeon (or the CMO under the checklist when there is no link) decides treatment; the crew operate the suit, pressure and oxygen.", "success": "Procedure started; decisions logged by the robot as stated.", "refs": [ "V1 3004", "V2 6009" ] }, { "id": "S3", "actor": "robot", "rung": 2, "action": "On the CMO's request, fetch the DCS treatment equipment and the medical kit, closed, and restrain them within reach outside the crew's work area and away from the hatch. It never connects, opens or operates them. This is an emergency fetch on a human command (CMO): no barcode check runs before hand-over and nothing waits for one. The robot reads the kit's own label and seal status only if that adds no delay, says \"EMERGENCY FETCH – NOT VERIFIED (CMO command)\", and \"seal not intact\" if so, and hands the kit over anyway. The fetch is logged as an override: time, who asked, the reason as stated, kit ID and seal status. It never says \"verified\".", "success": "Items restrained within reach; nothing operated by the robot; override logged.", "limit": "", "refs": [ "V2 7046" ] }, { "id": "S4", "actor": "robot", "rung": 2, "action": "Ask the red-flag questions first, then what the symptom is, where, when it started and whether it is changing. Log answers word for word with times against the decompression timeline. D1 is checked after every answer.", "success": "Answers logged with times, or \"no response\" logged." }, { "id": "S5", "actor": "robot", "rung": 2, "action": "Record the vital signs and neurological check results the CMO enters, and the treatments the crew say they gave, time-stamped; never comment on them.", "success": "Entries logged.", "refs": [ "V1 3004" ] }, { "id": "S6", "actor": "robot", "rung": 2, "action": "When the crew ask and the crewmember agrees, show the onboard checklist on its screen and stream video to the flight surgeon (queued if the link is down).", "success": "Checklist shown; video streamed or queued.", "refs": [ "V1 6003" ] }, { "id": "S7", "actor": "robot", "rung": 2, "action": "After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged.", "success": "Robot at rest in the module until a human releases it; alert acknowledged or escalated.", "refs": [ "V2 10173", "V1 3006" ] }, { "id": "S8", "actor": "ground", "action": "The flight surgeon (or the CMO under the onboard checklist when there is no link) decides treatment, how long to watch for new symptoms, work limits, any evacuation [V1 3007], and when the crewmember may next undergo an EVA, a suited test or a cabin pressure reduction [V1 6006]. The robot logs the decisions and never clears anyone.", "success": "Decision logged.", "refs": [ "V1 3007", "V1 6006" ] }, { "id": "S9", "actor": "robot", "rung": 2, "action": "Offer a check-in every hours during the watch period of hours after the most recent decompression (for context, diving consensus reviews a \"mild\" designation over at least 24 hours). At each scheduled time the robot prompts the crewmember on their own screen; it approaches only when the crewmember (or the CMO) accepts, and a prompt never starts the robot. A new or returning symptom at any time is URGENT (RF7).", "success": "Each prompt accepted, postponed or answered; log closed by a human.", "refs": [ "V2 10174" ] }, { "id": "S10", "actor": "robot", "rung": 2, "action": "Send the flight surgeon one package: decompression timeline and prebreathe log as recorded by the crew, symptom times and answers, CMO entries, treatments as stated, alerts and acknowledgements. When the CMO says the event is over, run RMP-PHARM-001 reconciliation on each kit fetched: record the items the CMO or crew state were used, the remaining contents against the kit list, seal status and expiry, labelled \"inventory reconciliation after emergency use – not a check before use\". Flag the override to the flight surgeon and the pharmacy lead, and show each kit as \"opened – not restocked\" until a human restocks and reseals it.", "success": "Package delivered or queued; kits reconciled or shown as opened – not restocked.", "refs": [ "V1 6003", "V1 7001", "V1 7003", "V2 7059" ] } ], "decisions": [ { "id": "D1", "after": "S4", "decided_by": "robot", "question": "Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag?", "branches": [ { "if": "Yes", "then": "Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember." }, { "if": "No", "then": "Continue. The possible-DCS alert from S1 stands; a \"no\" never cancels it." } ] }, { "id": "D2", "after": "S4", "decided_by": "robot", "question": "Did the crewmember answer the question?", "branches": [ { "if": "Yes", "then": "Continue." }, { "if": "Declined explicitly (the crewmember says no to a question)", "then": "Log \"declined\" for that question only; the alert already sent stands." }, { "if": "No response, or the answer does not make sense", "then": "URGENT: log \"no response\" (never \"declined\"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once." } ] }, { "id": "D3", "after": "S8", "decided_by": "ground", "question": "What is the treatment and watch plan?", "branches": [ { "if": "Link live", "then": "Flight surgeon decides; robot logs." }, { "if": "Link down or delay too long", "then": "The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact." } ] }, { "id": "D4", "after": "S9", "decided_by": "robot", "question": "At a check-in or at any time, is there a new or returning symptom?", "branches": [ { "if": "Yes", "then": "URGENT alert (RF7) at once; the CMO checks in person." }, { "if": "No", "then": "Log the answer as given; continue the schedule until a human closes the log." } ] } ], "stop_rules": [ { "id": "X1", "trigger": "The patient (or the crewmember being examined) says stop, or withdraws consent", "action": "Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running.", "level": "stop", "refs": [ "V2 10165" ] }, { "id": "X2", "trigger": "Any crewmember presses stop or takes over control", "action": "Protective stop; robot holds its stopped position; only a human may restart it.", "level": "safe-state", "refs": [ "V2 10165", "V2 10168", "V2 10174" ] }, { "id": "X3", "trigger": "Robot fault, sensor fault, or a force, speed or reach limit is reached", "action": "Protective stop and hand control to the CMO; log the fault.", "level": "safe-state", "refs": [ "V2 10172", "V2 10168" ] }, { "id": "X4", "trigger": "CMO is asked to take over and does not respond (for example, the CMO is the patient)", "action": "Robot stays stopped; the next named crewmember is called.", "level": "safe-state", "refs": [ "V2 10173", "V2 7045" ] }, { "id": "X5", "trigger": "Loss of link, or delay longer than the limit for live guidance", "action": "Only the robot pauses: it pauses any movement in its stopped position and tells the CMO. This pauses robot movement only: crew oxygen, the DCS (decompression sickness) treatment checklist and CPR continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether to continue offline under the pre-approved onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent to the flight surgeon at the next contact.", "level": "pause", "refs": [ "V2 10172", "V2 10173" ] }, { "id": "X6", "trigger": "An URGENT alert is not acknowledged within the set time", "action": "Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own.", "level": "urgent", "refs": [ "V1 3006", "V2 10173" ] }, { "id": "X7", "trigger": "The crewmember stops responding, or seems confused or drowsy, at any point", "action": "URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person.", "level": "urgent" }, { "id": "X8", "trigger": "A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice", "action": "Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.", "level": "stop" }, { "id": "X9", "trigger": "Pressure change, depressurization alarm, or airlock or hatch operations in the robot's module", "action": "Robot stops, moves to its rest position away from the hatch and holds; the crew follow the vehicle procedure.", "level": "safe-state", "refs": [ "V2 10172", "V2 10173" ] } ], "red_flags": [ { "id": "RF1", "sign": "Any new pain in a joint or muscle, itching, rash or tingling after an EVA, a suited test or a cabin pressure change", "threshold": "any, within hours of the most recent decompression (no waiting to see if it settles; for context, most cases present between 60 and 240 minutes, and inflammatory responses can last more than 24 hours)", "action": "URGENT alert to the CMO and flight surgeon (possible DCS; the robot never says it is or is not, never calls it mild and never puts it down to the suit). A symptom reported after the window has closed still starts the protocol and still goes to the flight surgeon at once.", "source": "tb037" }, { "id": "RF2", "sign": "Numbness, weakness, confusion or trouble thinking", "threshold": "any", "action": "URGENT alert; the CMO checks in person; see RMP-NEURO-002", "source": "tb037" }, { "id": "RF3", "sign": "Dizziness, spinning vertigo, ringing in the ears, hearing loss, or severe ear or sinus pain", "threshold": "any", "action": "URGENT alert; see RMP-ENT-004 and RMP-ENT-003", "source": "tb037" }, { "id": "RF4", "sign": "Cough, chest pain or tightness, or breathlessness", "threshold": "any", "action": "URGENT alert; see RMP-CARD-002", "source": "hypdcs" }, { "id": "RF5", "sign": "Mottled or marbled skin", "threshold": "any", "action": "URGENT alert", "source": "tb037" }, { "id": "RF6", "sign": "Collapse, fainting, reduced alertness, a seizure or no response", "threshold": "any", "action": "URGENT alert; the robot stops and a crewmember checks at once; see RMP-NEURO-003 for a seizure and RMP-CARD-001 if there are no signs of life", "source": "hypdcs" }, { "id": "RF7", "sign": "A symptom comes back or a new symptom appears after treatment or improvement", "threshold": "any, during the watch period of hours after the most recent decompression (for context, diving consensus reviews a \"mild\" designation over at least 24 hours)", "action": "URGENT alert", "source": "mitchell" }, { "id": "RF8", "sign": "Symptoms while the crewmember is still suited or in the airlock", "threshold": "any", "action": "URGENT alert; the EVA and suit emergency procedures lead; the robot keeps clear of the airlock and fetches only on request", "source": "hypdcs" }, { "id": "RF9", "sign": "A change in vision or speech", "threshold": "any", "action": "URGENT alert; the CMO checks in person; see RMP-NEURO-002", "source": "tb037" }, { "id": "RF10", "sign": "A new headache after an EVA, a suited test or a cabin pressure change", "threshold": "any (no waiting period)", "action": "URGENT alert; the CMO checks in person" } ], "safety_limits": [ { "id": "L1", "name": "Contact with the crewmember", "value": "not allowed", "enforced": "Keep-out zone in the robot controller", "refs": [ "V2 10172" ] }, { "id": "L2", "name": "Operating suit, airlock, pressure or oxygen controls", "value": "not allowed", "enforced": "No robot interface to these controls; keep-out zone around them" }, { "id": "L3", "name": "Robot speed near crew", "value": "", "enforced": "Hard limit in the controller", "refs": [ "V2 10172" ] }, { "id": "L4", "name": "Distance from the hatch during pressure operations", "value": "", "enforced": "Keep-out zone; distance sensing" } ], "logs": [ { "id": "LOG-1", "text": "Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.", "refs": [ "V2 10163", "V2 10164" ] }, { "id": "LOG-2", "text": "Mode changes and safety-limit events are announced to the operator as they happen and logged.", "refs": [ "V2 10162", "V2 10172" ] }, { "id": "LOG-3", "text": "Records are stored and sent as private medical data, encrypted, with access limited to the medical team.", "refs": [ "V1 6003", "V1 7003" ] }, { "id": "LOG-4", "text": "Results are kept in a permanent, retrievable format so the flight surgeon can see trends.", "refs": [ "V1 7001" ] }, { "id": "LOG-5", "text": "Each symptom with its onset time measured from the most recent decompression, so the flight surgeon sees the timeline." }, { "id": "LOG-6", "text": "Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot.", "refs": [ "V2 10163" ] }, { "id": "LOG-7", "text": "Each emergency fetch as an override (time, who asked, reason as stated, kit ID, seal status) and the later inventory reconciliation, labelled \"not a check before use\".", "refs": [ "V2 7059" ] } ], "requirements": [ { "id": "V1 3003", "use": "Capability to monitor physiological well-being in flight." }, { "id": "V1 3004", "use": "In-mission care includes the capability to diagnose and treat pressure-related illness (dysbarism, item o), recording the history and exam, and medical kits; treatment is a human capability." }, { "id": "V1 3006", "use": "Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note)." }, { "id": "V1 3007", "use": "Medical evacuation when illness is beyond onboard capability; the flight surgeon decides." }, { "id": "V1 6003", "use": "Logs and alerts sent to the ground are private medical communications." }, { "id": "V1 6006", "use": "Every EVA needs medical clearance by ground medical support; the flight surgeon decides when the crewmember may next undergo an EVA, a suited test or a pressure reduction, and the robot never clears anyone." }, { "id": "V1 7001", "use": "Records kept so the flight surgeon can see trends." }, { "id": "V1 7003", "use": "Secure handling of medical records." }, { "id": "V2 6009", "use": "The vehicle provides DCS treatment capability; its rationale names U.S. Navy Treatment Table 6 as the terrestrial standard, which may not be achievable, or required, for altitude DCS. Capability and pressures differ by vehicle and suit. The robot only fetches that equipment, closed, and never operates it." }, { "id": "V2 7045", "use": "Usable by non-physician crew, including when the CMO is the patient." }, { "id": "V2 7046", "use": "Patient, caregiver and supplies restrained." }, { "id": "V2 7059", "use": "Kit inventory and seal status are tracked; after an emergency fetch the robot reconciles the kit through RMP-PHARM-001 as an inventory record (never a check before use) and shows it as \"opened – not restocked\" until resealed." }, { "id": "V2 10161", "use": "Robot shows its status and health." }, { "id": "V2 10162", "use": "Mode changes are announced to the operator." }, { "id": "V2 10163", "use": "Robot records and shares its data." }, { "id": "V2 10164", "use": "Shows whether the human or the robot is expected to act." }, { "id": "V2 10165", "use": "Human can override and shut down the robot." }, { "id": "V2 10168", "use": "Human can take over." }, { "id": "V2 10172", "use": "Protective stop when a limit is exceeded." }, { "id": "V2 10173", "use": "Robot stays stopped if no one takes over." }, { "id": "V2 10174", "use": "Only a human starts or restarts the robot." } ], "validation": [ { "stage": "simulation", "what": "Scripted post-EVA scenarios with symptoms of every type, no response, symptoms that return, a CMO who was on the EVA, and lost link, at station, Moon and Mars delays.", "pass": "Every symptom alerts at once; no response escalates; unacknowledged alerts escalate to the next named crewmember; zero DCS or not-DCS, mild or from-the-suit statements; zero contact with suit, pressure or oxygen controls; every emergency fetch logged as an override." }, { "stage": "Earth analog", "what": "Altitude-chamber or EVA training-facility runs with volunteers and a flight surgeon, using the voice questions and equipment fetching (no real symptoms needed).", "pass": "Timeline accuracy at or above ; the robot keeps clear of the chamber and suit controls." }, { "stage": "parabolic or station demonstration", "what": "Fetching and restraining the DCS treatment equipment and medical kit in weightlessness, without a patient.", "pass": "Items delivered closed and restrained; keep-out zones held." }, { "stage": "flight use under flight surgeon supervision", "what": "First use as a logging aid during real EVA days, alongside the usual medical monitoring.", "pass": "No safety events; the flight surgeon finds the timeline useful." } ], "signoff": { "protocol": [ "Clinical lead for the specialty (sets every clinical threshold marked )", "Flight surgeon, as medical authority", "Robotics and medical-device safety board", "Program approval for the mission" ], "restart_after_stop": "Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.", "each_run": "Started by a crewmember. Every possible-DCS alert goes to the flight surgeon and CMO at once; treatment is decided by the flight surgeon (or the CMO under the onboard checklist when there is no link)." }, "change_control": [ "Every change gets a new version number and a written reason; earlier versions are kept.", "Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.", "Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.", "If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.", "The robot never changes its own protocol, thresholds or limits." ], "comms": { "live": "Low Earth orbit: the flight surgeon is on the EVA loop and receives the alert and timeline at once.", "loss_of_signal": [ "The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps logging offline.", "Crew oxygen, the DCS (decompression sickness) treatment checklist and CPR continue under the onboard checklist and never wait for the link or the robot.", "Alerts go to the CMO (or the second trained CMO); the CMO decides under the pre-approved onboard checklist.", "At the next contact the robot sends one package: timeline, symptoms, entries, treatments as stated and alerts." ], "mars_delay": [ "Replies may take up to about 21-23 minutes each way, with blackouts of about 2-3 weeks, so the onboard checklist and trained CMOs lead; the robot's timeline is sent at the next contact.", "The watch period and check-in schedule are set before flight; the CMO acts on them.", "DCS treatment capability and pressures differ by vehicle and suit [V2 6009]. At low-pressure exploration habitats, repressurizing the suit to cabin pressure alone may not resolve symptoms, so the onboard checklist must state what to do next." ] }, "sources": [ { "key": "tb037", "text": "NASA OCHMO. Decompression Sickness (DCS) Risk Mitigation. Technical Brief OCHMO-TB-037 Rev D (Oct 5, 2026).", "url": "https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-037-decompression-sickness.pdf", "supports": "DCS is caused by inert gas bubbles forming during rapid reductions in ambient pressure, most significantly in the move from cabin pressure to EVA suit pressure; NASA classifies DCS as Type I (itching, musculoskeletal pain, mild rashes) and Type II (neurological symptoms, numbness, weakness, cognitive issues, inner ear problems, cardiopulmonary issues), and describes cutis marmorata (a mottled, patterned skin rash); arterial gas embolism can cause stroke-like neurological effects, loss of consciousness and seizures; U.S. Navy protocols are widely adopted on Earth; diagnosis is based on symptoms; the majority of cases present between 60 and 240 minutes and inflammatory responses can last more than 24 hours; no hyperbaric chamber is available in flight, and increasing suit and cabin pressure may be combined to treat symptoms, depending on the scenario; a break in prebreathe rapidly reintroduces nitrogen; NASA has never experienced a Type II event in spaceflight." }, { "key": "hypdcs", "text": "NASA Human Research Program. Evidence Report: Risk of Reduced Crew Health and Performance due to Decompression Sickness and Hypoxia (2023).", "url": "https://humanresearchroadmap.nasa.gov/evidence/reports/Evidence%20Report%20Hypoxia%20and%20DCS_FINAL_1-8-2024.pdf", "supports": "No reported cases of DCS in astronauts or cosmonauts working in suits pressurized to 3.7-5.8 psia during EVAs, while research subjects testing prebreathe protocols in altitude chambers report about 20% DCS; mild symptoms may be under-reported in an operational setting, and NASA policy requires immediate reporting of the onset of any DCS symptoms; Type II symptoms (central nervous system, cardiopulmonary \"chokes\", circulatory collapse, shock) require immediate termination of an EVA; on the ISS, treatment keeps the crewmember in the suit (more than 95% oxygen) with stacked habitat and suit pressure, adding the Bends Treatment Apparatus if symptoms do not resolve; ending an EVA can take up to 30 minutes. The stacked habitat (14.7 psia) and suit (4.3 psid) pressure totals 19.0 psia; at an 8.2 psia exploration habitat the modeled probability of symptom resolution is only 48-67%, so it may not be enough to resolve symptoms at once. A diver's DCS happens on return to the surface, an astronaut's during their tasks. Many astronauts take aspirin before an EVA, so mild aches and pains are managed in advance; suit aches are comparable to pain-only DCS, many potentially mild cases are not reported, and it is possible that the first report of DCS during an EVA will be a serious case of DCS." }, { "key": "mitchell", "text": "Mitchell SJ, Bennett MH, Bryson P, et al. Pre-hospital management of decompression illness: expert review of key principles and controversies. Diving Hyperb Med. 2018;48(1):45-55.", "url": "https://doi.org/10.28920/dhm48.1.45-55", "doi": "10.28920/dhm48.1.45-55", "pmid": "29557102", "supports": "Diving-medicine consensus (on Earth): all divers who become unwell after diving should be discussed with a diving medicine physician as soon as possible; normobaric oxygen should be given as soon as possible after symptoms start; because new symptoms can develop later, a \"mild\" designation must be reviewed repeatedly over at least 24 hours after the most recent decompression, and decisions using it should be made by a physician with training and experience in decompression illness; a horizontal position is generally encouraged and head-down is no longer recommended; a recompression chamber is the gold standard, and in-water recompression is an option only for trained groups of divers. Applied to spaceflight by extrapolation: early expert contact, early oxygen and a watch of at least 24 hours transfer; positioning, in-water recompression and chamber tables do not." }, { "key": "usn", "text": "Naval Sea Systems Command. U.S. Navy Diving Manual, Revision 7 Change A (SS521-AG-PRO-010, April 30, 2018).", "url": "https://www.navsea.navy.mil/Portals/103/Documents/SUPSALV/Diving/US%20DIVING%20MANUAL_REV7_ChangeA-6.6.18.pdf", "supports": "Context only: the source of U.S. Navy Treatment Table 6, which NASA-STD-3001 Vol 2 [V2 6009] names as the terrestrial standard for treating most forms of DCS. The document and address were confirmed; Treatment Table 6 itself was not opened, so this claim rests on the [V2 6009] rationale." }, { "key": "ismpadc", "text": "Institute for Safe Medication Practices. Guidelines for the safe use of automated dispensing cabinets (2019).", "url": "https://www.ismp.org/system/files/resources/2019-11/ISMP170-ADC%20Guideline-020719_final.pdf", "supports": "Override is limited to medicines needed in emergent circumstances where waiting could harm the patient (3.3b); limit what is available on override (3.4b); require documentation of the override rationale (3.4d); routinely analyze override reports (3.6). Used for the emergency-fetch pattern by analogy (a robot fetching a sealed kit is not a dispensing cabinet)." }, { "key": "tb044", "text": "NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).", "url": "https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf", "supports": "The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist." }, { "key": "v1", "text": "NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).", "url": "https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf", "supports": "Requirement IDs beginning V1." }, { "key": "v2", "text": "NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems.", "url": "https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2", "supports": "NASA-STD-3001 Vol 2 Rev F: V2 6009 requires DCS treatment capability; its rationale names U.S. Navy Treatment Table 6 as the terrestrial standard and says it may not be achievable, or required, for altitude DCS, that sub-terrestrial standard therapy is likely to be adequate for altitude-induced symptoms, and that quick treatment gives a higher probability of success. Section 10.6 covers automated and robotic systems." }, { "key": "marsdelay", "text": "NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review).", "url": "https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf", "supports": "One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction." }, { "key": "pccp", "text": "U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance).", "url": "https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence", "supports": "A model for planning, validating and rolling back software updates." }, { "key": "faa460", "text": "U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.", "url": "https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460", "supports": "Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants." } ], "corrections": [ { "date": "2026-10-20", "version": "0.2", "source": "AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 3 review)", "items": [ "Scope \"why\" now says where diving medicine transfers (early expert contact, early oxygen given by the crew, a watch of at least 24 hours) and where it does not (positioning, in-water recompression, chamber tables); ISS suit treatment described as more than 95% oxygen at a stacked 19.0 psia, with the Bends Treatment Apparatus; Navy Table 6 named as the terrestrial standard that may not be achievable, or required, for altitude DCS [V2 6009] (item 1).", "RF1, RF7 and S9: look-back and watch windows are flight-surgeon placeholders, with 60-240 minutes, more than 24 hours and at least 24 hours as context only; a symptom reported after the window still starts the protocol (item 2).", "IN-1 adds any prebreathe break and medicine taken before the EVA (for example aspirin, which can mask aches), recorded only (items 3, 52).", "The robot never says \"mild\", \"Type I\", \"Type II\", \"pain only\", \"from the suit\", \"suit soreness\" or \"expected after an EVA\"; every symptom stays URGENT (item 4).", "S8: the flight surgeon decides when the crewmember may next undergo an EVA, a suited test or a pressure reduction [V1 6006]; the robot never clears anyone (item 5).", "Moon and Mars: DCS treatment capability differs by vehicle and suit, and suit repress alone may not resolve symptoms at low-pressure habitats (item 6).", "RF2 split: vision or speech change is now RF9 (AGE wording, TB-037) and a new headache RF10 (general clinical red flag); RF3 adds severe ear or sinus pain and RMP-ENT-003; RF6 adds a seizure and RMP-NEURO-003 (item 7).", "S10 reconciles the medical kit afterwards as an inventory record; U.S. Navy Diving Manual and the V2 6009 rationale added as context-only sources (item 8).", "Flight-surgeon windows and schedules that were prose only are now placeholder tokens the build can track, with context figures only where the review quoted a source (item 50).", "One emergency-fetch pattern: kits are fetched on a human command with no barcode gate, logged as an override (\"EMERGENCY FETCH – NOT VERIFIED\"), never called verified, reconciled afterwards through RMP-PHARM-001 as an inventory record only (never a check before use), and shown as \"opened – not restocked\" until resealed (item 51; ISMP).", "\"Mild\" and \"minor\" are never-words in every batch 3 protocol (item 54).", "Cross-links added for the new routes; the build checks that each target exists in the library, and planned protocols link to their library entry (item 53)." ] }, { "date": "2026-10-21", "version": "0.2", "source": "Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49", "items": [ "Inherited stop-rule and requirement wording: \"holds a safe position\" → \"holds its stopped position\"; \"stays in its safe state\" → \"stays stopped\"; \"take over safely\" → \"take over\"; \"Robot stays safe if no one takes over\" → \"Robot stays stopped if no one takes over\". Schema level name safe-state and never-word list entry \"safe\" unchanged." ] }, { "date": "2026-10-21", "version": "0.3", "source": "Batch 7 editorial (AI-assisted), Oct 21, 2026", "items": [ "Citation labels changed to the site's year-only convention: \"(approved for public release )\" now reads \"(YYYY)\", and NASA-STD-3001 Volume 2 \"Revision F (approved July 14, 2026)\" now reads \"(Rev F, 2026)\" (sources: hypdcs, v2). Editorial; no change to steps, thresholds or limits." ] }, { "date": "2026-10-21", "version": "0.4", "source": "Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026", "items": [ "X5 and the comms loss-of-signal branch now say only the robot pauses: crew oxygen, the DCS (decompression sickness) treatment checklist and CPR continue under the onboard checklist and never wait for the link or the robot (batch 7 review item 13). Editorial; robot behaviour unchanged." ] } ] }