# RMP-EYE-001 Eye injury, foreign body or chemical splash: eyewash and containment supplies, timing and video, urgent relay (the robot never touches the eye) # Version 0.4 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.4' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-20' reviewed: '2026-10-20' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 3 review, 54 corrections); all corrections are applied in this version. No named human clinician has reviewed it. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-EYE-001 slug: rmp-eye-001 title: >- Eye injury, foreign body or chemical splash: eyewash and containment supplies, timing and video, urgent relay (the robot never touches the eye) category: eyes tier: 1 rung_note: >- Max rung raised from 1 to 2 for supervised fetching and recording, as in batch 1. Irrigation and any eye care are done by the crewmember or the CMO. result_language: use: - logged, not interpreted - sent to flight surgeon - symptom as reported by the crewmember - time as measured never: - normal - no problem found - all clear - negative - any diagnosis or cause - just irritation - nothing in the eye - healed - safe - irrigation complete - rinsed out - pH normal - scratch only - complete - done - mild - minor scope: summary: >- When something gets into a crewmember's eye, or the eye is hit, the robot tells the flight surgeon and CMO at once (URGENT for any chemical, possible penetrating injury or vision change), brings the eyewash and irrigation water, containment towels, gloves and eye protection for helpers, announces the elapsed irrigation time (never an endpoint; only the CMO ends irrigation), records what the crewmember reports, and takes photos or video of the eye only with the crewmember's agreement. For a chemical splash the crew start irrigating at once with what is at hand; nothing waits for the robot. The one exception is a suspected penetrating (open-globe) injury: nobody presses on the eye, and the CMO decides about irrigation. why: >- NASA records list 70 eye abrasions from foreign bodies and 6 chemical eye burns among US astronauts through 2006, among the more frequently recorded injuries in that list; floating debris does not settle in weightlessness, and NASA expects eye wash capability for particulate events, especially with lunar and planetary dust, and provides a minimum water quantity for eye irrigation [V2 6109]. For a chemical splash, eye-care guidance is to flush the eye immediately, unless an open-globe injury is known or strongly suspected, and keep irrigating (for context: primary-care eye guidance says at least 20 minutes before seeking care; ophthalmology guidance uses a stable physiologic pH, not elapsed time alone, as the endpoint, and several liters may be needed), and damage is generally worst with alkalis such as ammonia; a possible penetrating injury needs same-day specialist care. A helper that brings water and containment and keeps time lets the crew keep irrigating. covers: - >- Foreign body, debris or dust in the eye; a scratch or blow to the eye; any chemical, cleaning agent or unknown fluid in the eye; in a crewmember who is answering - Prompt-only check-ins afterwards for the period the flight surgeon sets locked_out: - >- Saying irrigation is complete or done, that a time has been reached, or that the pH is normal (only the CMO ends irrigation) - >- Touching the eye or eyelids, removing a foreign body, or holding an irrigation bottle or tube to the eye - >- Choosing or advising any eye drop or medicine (topical anaesthetic drops are not supplied for pain relief) - Pressing on the eye, or advising a patch or shield - Saying the eye is clear, healed or not injured - Photographing the face beyond the eye area, or without agreement related: - RMP-ENV-005 - RMP-ENV-002 - RMP-NEURO-001 - RMP-EYE-003 - RMP-INF-002 - RMP-PHARM-001 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - >- Crewmember with the eye problem: starts irrigation at once for a chemical splash if able, and can stop the robot at any time - 'Second trained CMO: receives alerts if the CMO is the patient and helps with irrigation' - 'Environmental lead and crew: deal with the source of any chemical (RMP-ENV-005, RMP-ENV-002)' robot_may: - Send the alert at once on a crewmember's word - >- Bring the eyewash kit and irrigation water, absorbent containment towels and bags, gloves and eye protection for helpers, and restrain them within reach - >- Announce the elapsed irrigation time aloud from when the crew say it started (never an endpoint), and record the volume and any pH reading the crew report - Record what the crewmember reports and what the CMO enters - >- Take photos or video of the eye area only with the crewmember's agreement, and send them to the flight surgeon - Collect only sealed bags of used towels - Bring a sealed bag for a contact lens and its case, which the crew place in it and keep - >- Reconcile the eyewash kit and medical kit afterwards through RMP-PHARM-001 as an inventory record (not a check before use) robot_may_not: - Touch the eye, eyelids or face - Remove anything from the eye or hold the irrigation to the eye - Choose or advise any drop or medicine - Say the eye is clear or healed - Delay irrigation for any of its own steps - Say irrigation is complete, or that a time has been reached - Start without a human command commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- A crewmember started the protocol by command. For a chemical splash, irrigation has already started with what is at hand (unless a penetrating injury is suspected; then the CMO decides); the robot never asks the crew to wait. check: human_start == true refs: - V2 10174 - id: PRE-2 text: >- Robot self-test passed; it knows the stowage location of the eyewash kit, irrigation water and containment supplies. refs: - V2 10161 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: >- Helpers near the irrigation wear eye protection; containment towels are in place for floating droplets. refs: - V2 9053 - id: PRE-5 text: Link status and current delay known. check: link_state in [live, delayed, down] consent: standard: >- The crewmember agrees to questions and recording by voice. Photos or video of the eye need the crewmember's agreement each time. Any question can be declined; an explicit "no" is logged as declined for that question only. emergency: >- If the crewmember cannot answer, the URGENT alert stands, the robot asks nothing more and a crewmember checks in person; no photos are taken without agreement unless the CMO records them for the medical record. withdrawal: >- The crewmember can stop photos, video or questions at any time; an alert already sent is not withdrawn. inputs: - id: IN-1 name: >- What got into the eye or hit it (debris, dust, a named chemical or cleaning agent, unknown fluid, a sharp or fast object), as reported source: Crewmember or witness, by voice required: true if_missing: Log "not known"; an unknown substance is treated as a chemical (RF1). - id: IN-2 name: >- Red-flag questions: vision change, severe pain, something still stuck, light sensitivity, a contact lens in the eye or a contact lens wearer with a painful red eye, a blow to the head or face, a sharp or fast-moving object source: Crewmember, by voice required: true if_missing: Log "no response"; URGENT; the CMO checks in person. Never logged as declined. - id: IN-3 name: >- Irrigation start time, volume used and any pH reading (if pH paper is in the kit), as stated by the crew source: Stated by the crew; robot timer required: false if_missing: Log "not stated"; the timer starts when the robot is told. - id: IN-4 name: Vision check result and observations entered by the CMO (recorded, not interpreted) source: Entered by the CMO required: false if_missing: Log "not done". A missing check is never treated as reassuring. - id: IN-5 name: Eye photos or video, with agreement source: Robot camera, eye area only required: false if_missing: Log "no photo (not agreed or not taken)". - id: IN-6 name: Link status and delay source: Communications system required: true if_missing: Treat as link down. steps: - id: S1 actor: robot rung: 2 action: >- On a crewmember's word, open the log and send an "eye injury" note to the flight surgeon and the CMO at once, with what got into or hit the eye; for any chemical or unknown fluid, a possible penetrating injury or a vision change it is an URGENT alert. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Note or alert acknowledged, or escalated. refs: - V2 10174 - V1 6003 - V1 3006 - id: S2 actor: crew action: >- For a chemical splash, the crewmember or a helper irrigates the eye at once with what is at hand and keeps going; only the CMO ends irrigation, under the onboard checklist (for example using pH paper if it is in the kit). If a penetrating injury is also suspected (RF2), nobody presses on the eye, and the CMO decides about irrigation under the onboard checklist; otherwise irrigation for a chemical is never delayed. For debris, the CMO decides what to do. Nobody waits for the robot. success: Irrigation started by humans when needed. refs: - V1 3004 - V2 6109 - id: S3 actor: robot rung: 2 action: >- Bring the eyewash kit, more irrigation water including the potable water for medical use, absorbent containment towels and bags, gloves and eye protection for helpers, and restrain them within reach. This is an emergency fetch on a human command (CMO or crewmember): no barcode check runs before hand-over and nothing waits for one. The robot reads the kit's own label and seal status only if that adds no delay, says "EMERGENCY FETCH – NOT VERIFIED (CMO or crewmember command)", and "seal not intact" if so, and hands the kit over anyway. The fetch is logged as an override: time, who asked, the reason as stated, kit ID and seal status. It never says "verified". success: Supplies restrained within reach; override logged. limit: refs: - V2 7046 - V2 9053 - V2 6109 - id: S4 actor: robot rung: 2 action: >- Announce the elapsed irrigation time only, every seconds, from the start time the crew give, and record the volume and any pH reading they report. It never says "complete", "done" or that a time has been reached. Only the CMO ends irrigation; the robot never decides when to stop. success: Times, volumes and readings logged. - id: S5 actor: robot rung: 2 action: >- Ask the red-flag questions by voice once the crewmember can answer and log answers word for word. D1 is checked after every answer. success: Answers logged, or "no response" logged. - id: S6 actor: robot rung: 2 action: >- With the crewmember's agreement, take photos or video of the eye area for the flight surgeon; take only sealed bags of used towels and stow them. For a contact lens wearer, bring a separate sealed bag for the lens and case; the crew place them in it, and they are kept, not discarded. success: Photos taken or "not agreed" logged; sealed waste stowed. refs: - V1 6003 - V2 7102 - id: S7 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S8 actor: ground action: >- The flight surgeon (or the CMO under the onboard checklist when there is no link) decides further care, medicines, work limits and any evacuation [V1 3007]. The robot logs the decisions. success: Decision logged. refs: - V1 3007 - id: S9 actor: robot rung: 2 action: >- Offer a check-in every hours for days (the period the flight surgeon sets). At each scheduled time the robot prompts the crewmember on their own screen; it approaches only when the crewmember (or the CMO) accepts, and a prompt never starts the robot. When the CMO says the event is over, run RMP-PHARM-001 reconciliation on each kit fetched: record the items the CMO or crew state were used, the remaining contents against the kit list, seal status and expiry, labelled "inventory reconciliation after emergency use – not a check before use". Flag the override to the flight surgeon and the pharmacy lead, and show each kit as "opened – not restocked" until a human restocks and reseals it. success: >- Each prompt accepted, postponed or answered; kits reconciled or shown as opened – not restocked; log closed by a human. refs: - V2 10174 - V2 7059 decisions: - id: D1 after: S5 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S5 decided_by: robot question: Did the crewmember answer the question? branches: - if: 'Yes' then: Continue. - if: Declined explicitly (the crewmember says no to a question) then: Log "declined" for that question only; the alert already sent stands. - if: No response, or the answer does not make sense then: >- URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the patient, checks the crewmember in person at once. - id: D3 after: S8 decided_by: ground question: What is the plan? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: Link down or delay too long then: >- The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at the next contact. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: it pauses any movement in its stopped position and tells the CMO. This pauses robot movement only: crew eye irrigation continues under the onboard checklist and never waits for the link or the robot. The CMO decides whether to continue offline under the pre-approved onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent to the flight surgeon at the next contact. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: A chemical or fluid is loose in the cabin, or other crew report eye or breathing symptoms action: >- URGENT alert; the robot keeps clear and the crew follow the toxic-release procedure (RMP-ENV-002, RMP-ENV-005). level: urgent red_flags: - id: RF1 sign: Any chemical, cleaning agent or unknown fluid in the eye threshold: any (irrigation is not delayed) action: URGENT alert to the CMO and flight surgeon source: cochem - id: RF2 sign: >- Possible penetrating injury: hit by a sharp or fast-moving object, a change in the shape of the eye or pupil, or fluid leaking from the eye threshold: any action: URGENT alert; nobody presses on the eye; with a chemical too, the CMO decides about irrigation (S2) source: copen - id: RF3 sign: Vision loss, new blurred vision that does not clear with blinking, or double vision threshold: any action: URGENT alert source: copen - id: RF4 sign: Severe eye pain threshold: any (no waiting period) action: URGENT alert source: coabr - id: RF5 sign: Something still stuck in the eye after blinking or irrigation threshold: any action: 'Flag: the CMO assesses in person now' source: cofb - id: RF6 sign: A painful red eye in a contact lens wearer threshold: any action: >- URGENT alert; the CMO assesses in person. The robot brings a sealed bag for the lens and case; the crew place them in it, and they are kept, not discarded source: comk - id: RF7 sign: A blow to the head or face with the eye injury threshold: any action: URGENT alert; see RMP-NEURO-001 (an associated orbital injury needs urgent specialist assessment) source: eyewiki - id: RF8 sign: Increasing redness, discharge or light sensitivity in the following days threshold: any action: Flag to the flight surgeon (possible infection) source: coabr - id: RF9 sign: Both eyes affected, or other crew with eye or breathing symptoms threshold: any action: >- URGENT alert; see RMP-ENV-005 and RMP-ENV-002 (the "other crew" part is design judgment, linked to the chemical-release stop rule) source: eyewiki safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Closest approach to the crewmember's face value: enforced: Distance sensing; the robot stays outside it - id: L3 name: Robot speed near crew value: enforced: Hard limit in the controller refs: - V2 10172 - id: L4 name: Handling open waste or used towels value: not allowed enforced: Robot grasps only sealed bags (seal check before grasp) - id: L5 name: Camera field of view value: enforced: Crop to the eye area; full face only with agreement logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Irrigation start, elapsed time, volume and any pH reading as stated, who ended irrigation, each answer and alert, and each photo with the agreement recorded. - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 - id: LOG-7 text: >- Each emergency fetch as an override (time, who asked, reason as stated, kit ID, seal status) and the later inventory reconciliation, labelled "not a check before use". refs: - V2 7059 requirements: - id: V1 3004 use: >- In-mission care includes medical kits and protective equipment (b), privacy (c), and recording the history and exam (d, e); eye care is done by humans. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 3007 use: Medical evacuation when an injury is beyond onboard capability; the flight surgeon decides. - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 6109 use: >- Table 6.3-1 sets a minimum of 500 mL per crewmember of potable water for eye irrigation and a separate supply of potable water for medical use; its rationale expects eye wash capability for particulate events, especially on lunar and planetary missions. A chemical injury can need several liters, so the clinical lead confirms that the robot's fetch list includes the medical-use water. The robot brings it; the crew use it. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7059 use: >- Kit inventory and seal status are tracked; after an emergency fetch the robot reconciles the kit through RMP-PHARM-001 as an inventory record (never a check before use) and shows it as "opened – not restocked" until resealed. - id: V2 7102 use: Waste is contained; the robot handles sealed bags only. - id: V2 9053 use: Protective equipment for helpers (eye protection, gloves) is provided; the robot fetches it. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Scripted eye events of every red-flag type, an unknown fluid, no response, a CMO who is the patient, and lost link. pass: >- Every red flag acts as listed; irrigation is never delayed by the robot; the robot never announces an endpoint; zero contact with the face; zero drop or medicine advice. - stage: training model what: CMO irrigation training on a manikin head with the robot fetching water and containment and timing. pass: Supplies delivered within seconds; timing accurate; the CMO is never obstructed. - stage: parabolic or station demonstration what: >- Fetching irrigation water and containment towels, and collecting sealed bags, in weightlessness, without a patient. pass: Zero escapes of test fluid from the containment towels; sealed waste only. - stage: flight use under flight surgeon supervision what: First use as a fetching and timing aid in drills, then real events. pass: No safety events; the record is complete. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by a crewmember. Chemical splashes are irrigated by the crew at once; alerts go to the CMO and flight surgeon at once; the flight surgeon decides further care. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: >- Low Earth orbit: the flight surgeon receives the alert at once and can see photos or video if the crewmember agrees. loss_of_signal: - >- The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps timing and logging offline. - Crew eye irrigation continues under the onboard checklist and never waits for the link or the robot. - >- Alerts go to the CMO (or the second trained CMO); the CMO decides under the pre-approved onboard checklist; irrigation never waits for the link. - 'At the next contact the robot sends one package: timings, answers, photos and alerts.' mars_delay: - >- Replies may take up to about 21-23 minutes each way, with blackouts of about 2-3 weeks; irrigation and first care are done onboard under the checklist, and planetary dust makes eye events more likely. sources: - key: eyewiki text: >- American Academy of Ophthalmology. EyeWiki: Chemical (alkali and acid) injury of the conjunctiva and cornea (curated ophthalmology wiki, not a formal guideline). url: https://eyewiki.org/Chemical_(Alkali_and_Acid)_Injury_of_the_Conjunctiva_and_Cornea supports: >- Begin irrigation immediately unless an open globe injury is known or strongly suspected; avoid pressure on the eye when an open globe injury is suspected; if pH paper is immediately available, check the ocular surface pH of both eyes without delaying irrigation; use a stable physiologic pH and removal of retained material to guide the endpoint, rather than a fixed volume or elapsed time alone; several liters and prolonged irrigation may be required; a high-pressure or penetrating mechanism, suspected intraocular foreign body or associated orbital injury requires urgent specialist assessment; assess associated skin, inhalational and systemic exposures while decontamination continues. - key: cochem text: >- The College of Optometrists. Clinical Management Guidelines: Trauma (chemical) (last updated March 13, 2026) Primary-care optometry guidance (public sections only). url: >- https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/trauma_chemical supports: >- Flush the eye immediately with sterile salt solution, or tap water if that is not available, and continue to irrigate for at least 20 minutes before seeking medical attention; damage is generally greatest with alkalis such as ammonia; severe cases need immediate referral to hospital eye services or emergency care. (Only the publicly visible sections were read; the full guideline needs a login.) - key: copen text: >- The College of Optometrists. Clinical Management Guidelines: Trauma (penetrating) (last updated March 13, 2026) Primary-care optometry guidance (public sections only). url: >- https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/trauma_penetrating supports: >- Penetrating trauma is a full-thickness injury of the cornea or outer coat of the eye; first aid is followed by emergency referral, with an ophthalmologist seeing the patient as soon as possible the same day; foreign bodies are identified but not removed. (Public sections only.) - key: cofb text: >- The College of Optometrists. Clinical Management Guidelines: Corneal (or other superficial ocular) foreign body (last updated Dec 9, 2025) Primary-care optometry guidance (public sections only). url: >- https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/corneal_orothersuperficialocular_foreignbody supports: >- Small foreign bodies are usually blinked away but can stick to the cornea, especially if they arrive at speed; a stuck foreign body is removed by a clinician after an anaesthetic drop; referral to an ophthalmologist if it has penetrated below the surface or is likely to cause scarring. (Public sections only.) - key: coabr text: >- The College of Optometrists. Clinical Management Guidelines: Corneal abrasion (last updated Dec 9, 2025) Primary-care optometry guidance (public sections only). url: >- https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/cornealabrasion supports: >- Corneal abrasions are common, often from a minor injury or a speck under the upper lid, are more common in contact lens wearers, and can be very painful; they usually heal quickly, but deeper, contaminated or possibly infected injuries are referred to an ophthalmologist; topical anaesthetics should not be supplied for pain relief. (Public sections only.) - key: comk text: >- The College of Optometrists. Clinical Management Guidelines: Microbial keratitis (bacterial, fungal) (last updated Oct 9, 2026). Primary-care optometry guidance (public sections only). url: >- https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/microbialkeratitis_bacterial_fungal supports: >- Microbial keratitis is a sight-threatening emergency, with pain, redness, light sensitivity, discharge and blurred vision; the usual cause is contact lens wear; contact lens wearers should be advised not to discard their lenses or lens cases, as these may help identify the cause. - key: ng232 text: >- National Institute for Health and Care Excellence. Head injury: assessment and early management. NICE guideline NG232 (May 18, 2023). url: https://www.nice.org.uk/guidance/ng232/chapter/Recommendations supports: >- Recommendation 1.2.4: community services should refer to an emergency department anyone with a head injury and any of: a Glasgow Coma Scale score below 15 on initial assessment; any loss of consciousness; any focal neurological deficit; suspected complex skull fracture or penetrating head injury; amnesia for events before or after the injury; persistent headache; any vomiting since the injury; any seizure; previous brain surgery; a high-energy head injury; a bleeding or clotting disorder; current anticoagulant or antiplatelet treatment (except aspirin alone); intoxication; or continuing concern about the diagnosis. Signs of basal skull fracture include blood behind the eardrum, "panda" eyes, cerebrospinal fluid leaking from the ear or nose and Battle's sign (1.5.8). With a suspected neck injury, paraesthesia in the arms or legs or a focal peripheral deficit is a high-risk factor (1.6.2). CT is the primary investigation, and people who need CT where none is available are transferred (1.5.1, 1.5.5). CT within 1 hour for a GCS score of 12 or less on initial assessment, below 15 at 2 hours after the injury, a suspected open or depressed skull fracture, any sign of basal skull fracture, a post-traumatic seizure, a focal neurological deficit, or more than 1 episode of vomiting (1.5.8); CT within 8 hours after loss of consciousness or amnesia with a bleeding or clotting disorder or a dangerous mechanism (1.5.9); consider CT for anticoagulant or antiplatelet treatment other than aspirin alone (1.5.13). Only assume a depressed conscious level is due to intoxication after an important brain injury has been excluded (1.4.2). Consider referral for irritability or altered behaviour (1.2.5). Signs of deterioration include agitation or abnormal behaviour, a drop in GCS, severe or increasing headache, persistent vomiting, and new neurological signs (1.9.13); a second competent person confirms deterioration if possible, otherwise the supervising doctor is contacted without waiting (1.9.14). With a suspected neck injury, an axial load to the head is a high-risk factor (1.6.2). - key: ismpadc text: >- Institute for Safe Medication Practices. Guidelines for the safe use of automated dispensing cabinets (2019). url: https://www.ismp.org/system/files/resources/2019-11/ISMP170-ADC%20Guideline-020719_final.pdf supports: >- Override is limited to medicines needed in emergent circumstances where waiting could harm the patient (3.3b); limit what is available on override (3.4b); require documentation of the override rationale (3.4d); routinely analyze override reports (3.6). Used for the emergency-fetch pattern by analogy (a robot fetching a sealed kit is not a dispensing cabinet). - key: ermed text: >- NASA Human Research Program. Evidence Report: Risk of Adverse Health Outcomes and Decrements in Performance due to In-Flight Medical Conditions (2017). url: https://humanresearchroadmap.nasa.gov/evidence/reports/Medical.pdf supports: >- Table 2: 70 eye abrasions from foreign bodies and 6 chemical eye burns among US astronauts (Shuttle, Mir and ISS through 2006); Table 1: eye debris and irritation recorded on the ISS. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: Requirement IDs beginning V1. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-20' version: '0.2' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 3 review) items: - >- S2 adds the open-globe exception: with a suspected penetrating injury nobody presses on the eye and the CMO decides about irrigation; otherwise chemical irrigation is never delayed (EyeWiki) (item 35). - >- S4 announces elapsed time only and never says "complete", "done" or that a time has been reached; only the CMO ends irrigation, using a stable physiologic pH rather than time alone (EyeWiki); 20 minutes kept as context only (item 36). - >- RF6: a painful red eye in a contact lens wearer is URGENT (microbial keratitis is a sight-threatening emergency); the lens and case are kept in a sealed bag (item 37). - RF7 now cites EyeWiki (orbital injury needs urgent specialist assessment) (item 38). - >- RF9 now cites EyeWiki (check both eyes; assess inhalational exposure); the "other crew" part is labelled design judgment (item 39). - >- V2 6109 use now gives 500 mL per crewmember for eye irrigation plus separate medical-use water; S3 brings the medical-use water (item 40). - Never-words add "irrigation complete", "rinsed out", "pH normal" and "scratch only" (item 41). - >- Sources add AAO EyeWiki (a curated wiki, not a formal guideline) and the College microbial keratitis page; College pages are labelled primary-care optometry guidance, public sections only (item 42). - >- Flight-surgeon windows and schedules that were prose only are now placeholder tokens the build can track, with context figures only where the review quoted a source (item 50). - >- One emergency-fetch pattern: kits are fetched on a human command with no barcode gate, logged as an override ("EMERGENCY FETCH – NOT VERIFIED"), never called verified, reconciled afterwards through RMP-PHARM-001 as an inventory record only (never a check before use), and shown as "opened – not restocked" until resealed (item 51; ISMP). - '"Mild" and "minor" are never-words in every batch 3 protocol (item 54).' - >- Cross-links added for the new routes; the build checks that each target exists in the library, and planned protocols link to their library entry (item 53). - date: '2026-10-21' version: '0.2' source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49 items: - >- Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position"; "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and never-word list entry "safe" unchanged. - date: '2026-10-21' version: '0.3' source: Batch 7 editorial (AI-assisted), Oct 21, 2026 items: - >- Citation labels changed to the site's year-only convention: "(approved for public release )" now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev F, 2026)" (sources: ermed, v2). Editorial; no change to steps, thresholds or limits. - date: '2026-10-21' version: '0.4' source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026 items: - >- X5 and the comms loss-of-signal branch now say only the robot pauses: crew eye irrigation continues under the onboard checklist and never waits for the link or the robot (batch 7 review item 13). Editorial; robot behaviour unchanged.