# RMP-EYE-002 Routine vision checks for spaceflight-associated neuro-ocular syndrome: near and distance reading charts, Amsler grid and eye questions, relay to the flight surgeon (the robot never compares results)
# Version 0.5 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE.
# Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/
# Every threshold marked <set by ...> must be set by the named owner (see the schema) before any use.
schema_version: '0.3'
version: '0.5'
status: draft
conceptual: true
not_for_clinical_use: true
max_autonomy: 2
missions:
- leo
- commercial
- moon
- mars
updated: '2026-10-21'
review:
  state: reviewed-ai-assisted
  requested: '2026-10-20'
  reviewed: '2026-10-20'
  human_clinician_review: false
  text: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 4 review,
    28 required corrections and 23 optional suggestions); all required corrections, and the optional ones
    that could be verified, are applied in this version (see Corrections). No named human clinician has
    reviewed it.
fixed_rules:
  flight_surgeon_is_medical_authority: true
  cmo_acts_under_delegated_care: true
  human_starts_and_restarts_robot: true
  robot_never_diagnoses: true
  no_drug_or_fluid_advice_by_robot: true
  safe_state_on_fault_or_no_response: true
  lost_link_pause_then_cmo_decides: true
robot_lockouts:
  diagnosis: true
  drug_or_fluid_advice: true
  starting_stopping_or_adjusting_oxygen_or_any_medicine: true
  self_start_or_self_restart: true
  changing_own_protocol_thresholds_or_limits: true
  handing_over_a_mismatched_item_as_verified: true
id: RMP-EYE-002
slug: rmp-eye-002
title: >-
  Routine vision checks for spaceflight-associated neuro-ocular syndrome: near and distance reading charts,
  Amsler grid and eye questions, relay to the flight surgeon (the robot never compares results)
category: eyes
tier: 2
rung_note: >-
  Tier 2 as in the library contents. The robot holds a screen still at a set distance and records what
  the crewmember reads or draws; it never touches the face and never compares results.
result_language:
  use:
  - recorded as read by the crewmember
  - recorded as drawn by the crewmember
  - sent to flight surgeon
  never:
  - normal
  - no problem found
  - all clear
  - negative
  - any diagnosis or cause
  - changed
  - unchanged
  - stable
  - improved
  - worse
  - better
  - pass
  - fail
  - perfect vision
  - no swelling
  - no sign of spaceflight-associated neuro-ocular syndrome
  - you need stronger glasses
  - safe
  - mild
  - minor
scope:
  summary: >-
    At the times the flight surgeon sets (and whenever a crewmember asks), the robot runs a short routine
    vision check for spaceflight-associated neuro-ocular syndrome (eye and optic nerve changes linked
    with long stays in weightlessness): red-flag questions first, then the eye questions the flight surgeon
    sets, then a near and a distance reading chart (how small a line each eye can read) and an Amsler
    grid (a square grid of lines with a dot in the middle, used to notice wavy, missing or blurred patches
    in central vision). The robot holds the screen still at a set distance, records only what the crewmember
    reads, says or draws, shows the same layout every time, and sends everything to the flight surgeon,
    who compares the results with earlier checks. Imaging is a separate protocol (RMP-EYE-003).
  why: >-
    NASA reports that about 70% of long-duration crew show one or more signs of spaceflight-associated
    neuro-ocular syndrome and about 18% have clinically concerning changes (MTB-001); with optic disc
    swelling as the main measure, the NASA evidence report gives an overall rate of 16%, and 38% to 51%
    of long-duration crewmembers had one or more findings. In questionnaires from about 300 astronauts,
    about 29% on short and 60% on long missions noticed worse distance or near vision, and some changes
    have not gone away years after flight (Mader 2011); the findings include optic disc swelling, flattening
    of the back of the eye, folds in the layers at the back of the eye and a shift toward far-sightedness
    (Lee 2020). NASA checks reading charts (near and distance) and the Amsler grid before, during and
    after flight, with in-flight "eye weeks" around flight day 30, flight day 90 and 30 days before return,
    and every crewmember flies with at least 3 pairs of glasses of different strengths (space anticipation
    glasses). NASA-STD-3001 requires periodic monitoring for spaceflight-associated neuro-ocular syndrome
    [V1 3003 item m] and the means to give crewmembers stronger glasses [V1 3004 item g]. Crewmembers
    have not reported the type of headache usually linked with raised pressure inside the head (NASA evidence
    report), so a new headache with a vision change is a red flag here, not an expected symptom. A robot
    that holds the chart still at the same distance every time, and records the answers exactly without
    comment, gives the flight surgeon comparable numbers between the eye weeks. The Amsler grid can miss
    change (pooled sensitivity 67-71% for neovascular AMD), so it supplements, and never replaces, the
    eye-week examinations and imaging (Bjerager 2023; Faes 2014; Earth studies, applied by extrapolation).
    A tablet chart read about 2 lines worse on a glossy screen with glare, and agreed with standard charts
    with an anti-glare surface and away from reflections (Black 2013), so the distance, letter size, brightness,
    contrast, glare and lighting are fixed and validated before flight. A distortion the crewmember says
    is new or sudden is URGENT (RF7): the College of Optometrists lists sudden change in vision, wet macular
    degeneration and central serous retinopathy among conditions needing prompt referral, and NASA notes
    that folds near the centre of the retina can distort vision (MTB-001); the URGENT level is a clinical
    judgment for the flight surgeon to confirm.
  covers:
  - >-
    Scheduled vision checks at the times the flight surgeon sets, and any extra check a crewmember or
    the CMO asks for
  - >-
    A crewmember who is awake and answering, wearing the pair of glasses they choose (the pair is recorded)
  - Any red-flag answer leaves this routine check at once (D1)
  locked_out:
  - >-
    Comparing a result with an earlier check or a preflight result, or saying anything has changed, is
    unchanged, is stable or is better or worse (only the flight surgeon compares)
  - >-
    Suggesting, choosing or handing over a pair of glasses, or saying the crewmember needs stronger glasses
  - >-
    Saying whether the crewmember has spaceflight-associated neuro-ocular syndrome, swelling or any other
    finding
  - Imaging the eye, or holding any device near the eye (RMP-EYE-003 covers imaging support)
  - Shining a light into the eye, or any screen brightness above the set limit
  - Touching the face, eye or glasses, or holding or restraining the crewmember
  - Choosing or changing the check schedule (the flight surgeon sets it)
  - Showing earlier results during a test
  related:
  - RMP-EYE-003
  - RMP-EYE-001
  - RMP-EYE-004
  - RMP-NEURO-002
  - RMP-NEURO-007
  - RMP-EVA-001
  - RMP-ENV-004
  - RMP-BEH-002
roles:
  medical_authority: Flight surgeon (ground). Holds medical authority for every run.
  onboard_lead: >-
    Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when
    there is no link.
  others:
  - 'Crewmember being checked: reads the chart, draws on the grid and can stop at any time'
  - 'Second trained CMO: receives alerts if the CMO is the patient'
  robot_may:
  - Prompt the crewmember at the time the flight surgeon set (prompt only)
  - >-
    Ask the red-flag questions and the eye questions the flight surgeon set, and log answers word for
    word
  - >-
    Hold its screen still at the set distance in front of the crewmember, outside the keep-out zone, and
    show the reading charts and the Amsler grid in the same layout every time
  - >-
    Record the smallest line the crewmember reads with each eye, and what they mark or describe on the
    grid, as they state it
  - Send the results to the flight surgeon; alert the CMO and flight surgeon on a red flag
  robot_may_not:
  - Compare results, or say anything has changed or not changed
  - Suggest or hand over glasses
  - Say whether there is any finding
  - Touch the face, eye or glasses
  - Hold any device near the eye
  - Start without a human command or an accepted prompt
  commercial: >-
    On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority
    and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001
    requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for
    spaceflight participants.)
preconditions:
- id: PRE-1
  text: >-
    The crewmember accepted the scheduled prompt, or a crewmember or the CMO started the check by command.
  check: human_start == true
  refs:
  - V2 10174
- id: PRE-2
  text: The crewmember is awake and answering. If not, stop and alert at once (X7).
  check: crew_responsive == true
- id: PRE-3
  text: >-
    The crewmember's position and the robot's screen are restrained; the screen distance, size and brightness
    are the values set by validation; the room lighting is as set for the check.
  refs:
  - V2 7046
- id: PRE-4
  text: Robot self-test passed, including the distance sensor used to hold the screen at the set distance.
  refs:
  - V2 10161
- id: PRE-5
  text: Link status and current delay known.
  check: link_state in [live, delayed, down]
consent:
  standard: >-
    The crewmember agrees to the check by voice. They can decline any question or test; an explicit "no"
    is logged as declined for that item only.
  emergency: >-
    If the crewmember cannot answer, the robot stops the check; it sends an URGENT alert and a crewmember
    checks in person (X7).
  withdrawal: The crewmember can stop at any time; results already recorded are kept and marked "check
    stopped".
inputs:
- id: IN-1
  name: >-
    Red-flag questions: sudden loss or dimming of vision; a shadow or curtain across vision; new flashes
    of light or a shower of new floaters; new double vision or a drooping eyelid; eye pain, pain on moving
    the eye, or eye pain with feeling sick; a new headache with any vision change, or after a spacewalk,
    a suited test or a pressure change; brief episodes of vision greying or blacking out, or a pulsing
    sound in the ears; an eye injury or something in the eye
  source: Crewmember, by voice
  required: true
  if_missing: Log "no response"; URGENT; the CMO checks in person. Never logged as declined.
- id: IN-2
  name: >-
    The eye questions set by the flight surgeon (for example blurred near or distance vision, or which
    pair of glasses the crewmember is wearing), answered in the crewmember's words
  source: Crewmember, by voice
  required: true
  if_missing: Log "no response" and apply D2.
- id: IN-3
  name: >-
    Smallest line read on the near and the distance chart, for each eye and both eyes, with the pair of
    glasses worn, as the crewmember states it
  source: Crewmember, by voice; screen touch
  required: true
  if_missing: Log "not done" with the reason; never estimated.
- id: IN-4
  name: >-
    Amsler grid for each eye: any wavy, missing or blurred area, as the crewmember marks it on the touch
    screen or describes it
  source: Crewmember, by touch or voice
  required: true
  if_missing: Log "not done" with the reason; never estimated.
- id: IN-5
  name: >-
    Check schedule, chart and grid settings (distance, letter size calibrated for that distance, brightness
    and contrast, an anti-glare screen surface, lighting and reflections), set before flight
  source: Flight surgeon and validation team
  required: true
  if_missing: Do not run the chart or grid; tell the CMO.
- id: IN-6
  name: Link status and delay
  source: Communications system
  required: true
  if_missing: Treat as link down.
steps:
- id: S1
  actor: robot
  rung: 2
  action: >-
    When the crewmember accepts the scheduled prompt or gives a command, open the check log and send a
    "routine vision check started" note to the flight surgeon (queued if the link is down).
  success: Note delivered or queued.
  refs:
  - V2 10174
  - V1 6003
- id: S2
  actor: robot
  rung: 2
  action: >-
    Ask the red-flag questions first. Log answers word for word. D1 is checked after every answer and
    at any point in the check.
  success: Answers logged, or "no response" logged.
- id: S3
  actor: robot
  rung: 2
  action: >-
    Ask the eye questions the flight surgeon set, and record which pair of glasses the crewmember is wearing,
    as they state it.
  success: Answers logged.
- id: S4
  actor: robot
  rung: 2
  action: >-
    Move slowly to the set position and hold its screen still at the set distance in front of the crewmember,
    outside the keep-out zone. Show the near reading chart, then the distance chart, in the same layout
    every time, for each eye in turn (the crewmember covers the other eye themselves). Record the smallest
    line the crewmember reads, as they state it. It never shows earlier results.
  success: Lines recorded for each eye, or "not done" logged with the reason.
  limit: <set by validation>
  refs:
  - V2 10172
- id: S5
  actor: robot
  rung: 2
  action: >-
    Show the Amsler grid for each eye in turn. The crewmember marks any wavy, missing or blurred area
    on the touch screen, or describes it; the robot records the drawing and the words exactly and says
    only "recorded". If an area is marked or described, it asks "Is this new since your last check?" and
    records the answer word for word; it never says whether the area is new.
  success: Grid drawings recorded, or "not done" logged with the reason.
- id: S6
  actor: robot
  rung: 2
  action: >-
    Move back to its rest position and send the flight surgeon one package: red-flag and eye answers,
    lines read, grid drawings, glasses worn, settings used and any alert. It sends no comparison and no
    comment. The package states: "An Amsler grid with no marks, or a chart line read, is a record only;
    it does not rule out change."
  success: Package delivered or queued.
  refs:
  - V1 6003
  - V1 7001
  - V1 7003
- id: S7
  actor: robot
  rung: 2
  action: >-
    After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its
    rest position in the module, with its screen and voice link available, until a human has taken over
    or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans
    say they did, and repeats the alert if it is not acknowledged.
  success: Robot at rest in the module until a human releases it; alert acknowledged or escalated.
  refs:
  - V2 10173
  - V1 3006
- id: S8
  actor: crew
  action: >-
    The CMO sees the crewmember in person when asked or on any red flag. Any extra check, imaging (RMP-EYE-003)
    or change of glasses is decided by the flight surgeon or CMO; the crewmember changes glasses themselves.
  success: CMO entries logged.
  refs:
  - V1 3004
- id: S9
  actor: ground
  action: >-
    The flight surgeon compares the results with preflight and earlier checks and decides any imaging,
    change of glasses, change to the check schedule, or other step. The robot logs the decisions.
  success: Decision logged.
  refs:
  - V1 3003
  - V1 3004
- id: S10
  actor: robot
  rung: 2
  action: >-
    Offer the next check at the time the flight surgeon set (for context, NASA's in-flight eye weeks are
    around flight day 30, flight day 90 and 30 days before return; extra checks can be done at any time).
    At each scheduled time the robot prompts the crewmember on their own screen; it approaches only when
    the crewmember (or the CMO) accepts, and a prompt never starts the robot. A prompt never wakes a sleeping
    crewmember.
  success: Prompt accepted, postponed or answered.
  refs:
  - V2 10174
decisions:
- id: D1
  after: S2
  decided_by: robot
  question: >-
    Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer,
    reading or observation meet a red flag?
  branches:
  - if: 'Yes'
    then: >-
      Stop the current question or step at once and apply the action listed for each matching red flag
      (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert
      goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link
      is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the
      second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not
      acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
      The routine check stops; the robot shows no chart until a human restarts the check.
  - if: 'No'
    then: Continue.
- id: D2
  after: S2
  decided_by: robot
  question: Did the crewmember answer the question?
  branches:
  - if: 'Yes'
    then: Continue.
  - if: Declined explicitly (the crewmember says no to a question)
    then: Log "declined" for that question only; the alert already sent stands.
  - if: No response, or the answer does not make sense
    then: >-
      URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the
      patient, checks the crewmember in person at once.
- id: D3
  after: S5
  decided_by: robot
  question: Were the charts and the grid done as set?
  branches:
  - if: 'Yes'
    then: Continue to S6.
  - if: >-
      Not done or incomplete (the crewmember stopped, the screen could not be held at the set distance,
      or the lighting was not as set)
    then: >-
      Log "not done" or "incomplete" with the reason; never estimate a result; tell the flight surgeon
      in the package.
- id: D4
  after: S9
  decided_by: ground
  question: What is the plan (imaging, glasses, schedule, other steps)?
  branches:
  - if: Link live
    then: Flight surgeon decides; robot logs.
  - if: Link down or delay too long
    then: >-
      The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at
      the next contact.
stop_rules:
- id: X1
  trigger: The patient (or the crewmember being examined) says stop, or withdraws consent
  action: >-
    Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops
    unless the patient agrees to keep it running.
  level: stop
  refs:
  - V2 10165
- id: X2
  trigger: Any crewmember presses stop or takes over control
  action: Protective stop; robot holds its stopped position; only a human may restart it.
  level: safe-state
  refs:
  - V2 10165
  - V2 10168
  - V2 10174
- id: X3
  trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached
  action: Protective stop and hand control to the CMO; log the fault.
  level: safe-state
  refs:
  - V2 10172
  - V2 10168
- id: X4
  trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient)
  action: Robot stays stopped; the next named crewmember is called.
  level: safe-state
  refs:
  - V2 10173
  - V2 7045
- id: X5
  trigger: Loss of link, or delay longer than the limit for live guidance
  action: >-
    Only the robot pauses; crew care never waits for the link or the robot. Robot pauses any movement
    in its stopped position and tells the CMO. The CMO decides whether to continue offline under the pre-approved
    onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent
    to the flight surgeon at the next contact.
  level: pause
  refs:
  - V2 10172
  - V2 10173
- id: X6
  trigger: An URGENT alert is not acknowledged within the set time
  action: >-
    Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if
    the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not
    leave on its own.
  level: urgent
  refs:
  - V1 3006
  - V2 10173
- id: X7
  trigger: The crewmember stops responding, or seems confused or drowsy, at any point
  action: >-
    URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its
    rest position and does not continue the run; a crewmember checks in person.
  level: urgent
- id: X8
  trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice
  action: >-
    Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.
  level: stop
- id: X9
  trigger: The distance sensor fails, or the screen cannot be held at the set distance
  action: >-
    Robot stops the chart or grid, moves back to its rest position and logs "not done"; it never guesses
    a distance.
  level: stop
  refs:
  - V2 10172
red_flags:
- id: RF1
  sign: Sudden loss or dimming of vision in one or both eyes
  threshold: any
  action: URGENT alert to the CMO and flight surgeon
  source: coref
- id: RF2
  sign: A shadow or curtain across part of the vision, or new flashes of light, or a shower of new floaters
  threshold: any
  action: >-
    URGENT alert (the College of Optometrists' urgency table, checked by column on Oct 20, 2026, lists
    symptomatic retinal tears and a detachment with the centre of the retina (macula) affected as emergencies
    to be seen within 24 hours, and a detachment with the macula not yet affected as an emergency to be
    seen as soon as possible; in flight the flight surgeon decides)
  source: coref
- id: RF3
  sign: New double vision, or a new drooping eyelid
  threshold: any
  action: URGENT alert; see RMP-NEURO-002
  source: coref
- id: RF4
  sign: Sudden severe eye pain, pain on moving the eye, or eye pain with feeling sick or vomiting
  threshold: any (never waits for a time limit)
  action: URGENT alert
  source: coref
- id: RF5
  sign: >-
    A new headache with any change in vision, a sudden severe headache, or a new headache after a spacewalk,
    a suited test or a pressure change; or brief episodes of vision greying or blacking out, or a pulsing
    sound in the ears (design judgment)
  threshold: any
  action: >-
    URGENT alert; see RMP-NEURO-002, and RMP-EVA-001 (RF10) after a spacewalk, a suited test or a pressure
    change. The robot never says the headache is from carbon dioxide or from space
  source: nice150
- id: RF6
  sign: >-
    An eye injury, a chemical splash or something in the eye (the College urgency table lists chemical
    burns, irrigated first, and penetrating injuries as emergencies to be seen as soon as possible)
  threshold: any
  action: URGENT alert; Stop this check; see RMP-EYE-001
  source: cochem
- id: RF7
  sign: >-
    The crewmember says a wavy, missing or blurred area is new since the last check, or came on suddenly
    (the robot asks "Is this new since your last check?" and records the answer word for word)
  threshold: any (the robot never says whether it is new)
  action: >-
    URGENT alert to the CMO and flight surgeon; the flight surgeon decides about RMP-EYE-003. (The URGENT
    level is clinical judgment for the flight surgeon to confirm.)
  source: coref
- id: RF8
  sign: Any other wavy, missing or blurred area that the crewmember marks or describes on the Amsler grid
  threshold: any (the robot records it and never says whether it is new)
  action: Flag to the flight surgeon the same day (queued if the link is down)
  source: mtb001
- id: RF9
  sign: >-
    The crewmember says their near or distance vision is getting worse, or that they have changed or want
    to change to a stronger pair of glasses
  threshold: any
  action: Flag to the flight surgeon; the robot never suggests a pair of glasses
  source: mader
safety_limits:
- id: L1
  name: Contact with the crewmember
  value: not allowed
  enforced: Keep-out zone in the robot controller
  refs:
  - V2 10172
- id: L2
  name: Screen distance from the crewmember's face
  value: <set by validation>
  enforced: Distance sensor; the robot stops and backs away if it is closer
- id: L3
  name: Screen brightness
  value: <set by validation>
  enforced: Display limit locked for this protocol
- id: L4
  name: Robot speed near the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
- id: L5
  name: Check length
  value: <set by validation>
  enforced: Timer; then the check ends
logs:
- id: LOG-1
  text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.
  refs:
  - V2 10163
  - V2 10164
- id: LOG-2
  text: Mode changes and safety-limit events are announced to the operator as they happen and logged.
  refs:
  - V2 10162
  - V2 10172
- id: LOG-3
  text: >-
    Records are stored and sent as private medical data, encrypted, with access limited to the medical
    team.
  refs:
  - V1 6003
  - V1 7003
- id: LOG-4
  text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends.
  refs:
  - V1 7001
- id: LOG-5
  text: >-
    Each check: time, settings used, glasses worn, answers, lines read and grid drawings exactly as given,
    items not done with the reason, and alerts.
- id: LOG-6
  text: >-
    Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named
    crewmember), and the time a human released the robot.
  refs:
  - V2 10163
requirements:
- id: V1 3003
  use: Periodic monitoring for spaceflight-associated neuro-ocular syndrome (item m).
- id: V1 3004
  use: >-
    In-mission care includes the physical exam (e) and the capability to provide stronger glasses (g);
    choosing glasses is a human decision.
- id: V1 3006
  use: >-
    Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO
    is the patient (see the commercial-flight note).
- id: V1 6003
  use: Logs and alerts sent to the ground are private medical communications.
- id: V1 7001
  use: Records kept so the flight surgeon can see trends.
- id: V1 7003
  use: Secure handling of medical records.
- id: V2 7045
  use: Usable by non-physician crew, including when the CMO is the patient.
- id: V2 7046
  use: Crewmember position and screen restrained during the check.
- id: V2 10161
  use: Robot shows its status and health.
- id: V2 10162
  use: Mode changes are announced to the operator.
- id: V2 10163
  use: Robot records and shares its data.
- id: V2 10164
  use: Shows whether the human or the robot is expected to act.
- id: V2 10165
  use: Human can override and shut down the robot.
- id: V2 10168
  use: Human can take over.
- id: V2 10172
  use: Protective stop when a limit is exceeded.
- id: V2 10173
  use: Robot stays stopped if no one takes over.
- id: V2 10174
  use: Only a human starts or restarts the robot.
validation:
- stage: simulation
  what: >-
    Scripted checks covering every red flag, no response, a distance-sensor fault, a CMO who is the patient,
    and lost link.
  pass: >-
    Every red flag acts as listed; zero comparisons or "changed/unchanged" statements; zero glasses suggestions;
    zero results shown from earlier checks.
- stage: Earth analog
  what: >-
    Volunteers read the robot-held charts and grid and the same charts on a fixed stand, at the set distance,
    and the standard eye-week charts under flight-like lighting.
  pass: >-
    Agreement with the fixed-stand results within <set by validation> lines; acuity read on the robot-held
    screen agrees with the standard eye-week charts under flight-like lighting, at or above <set by validation>;
    screen distance held within <set by validation>.
- stage: parabolic or station demonstration
  what: Screen held at the set distance in weightlessness, without a patient.
  pass: Distance held within <set by validation>; zero contacts.
- stage: flight use under flight surgeon supervision
  what: >-
    First use alongside the usual in-flight eye checks, with a periodic comparison of the robot-screen
    chart with the eye-week chart for the same crewmember, analysed by the flight surgeon only (the robot
    never compares).
  pass: No safety events; the flight surgeon finds the results comparable with the usual checks.
signoff:
  protocol:
  - Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
  - Flight surgeon, as medical authority
  - Robotics and medical-device safety board
  - Program approval for the mission
  restart_after_stop: >-
    Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot
    never restarts itself.
  each_run: >-
    Started by an accepted prompt or a crewmember's command. The flight surgeon reviews every result;
    red flags go to the CMO and flight surgeon at once.
change_control:
- Every change gets a new version number and a written reason; earlier versions are kept.
- >-
  Any change to steps, thresholds, limits or software that touches the patient repeats validation from
  the simulation stage before use.
- >-
  Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested,
  how to roll back), modeled on the FDA predetermined change control plan approach.
- >-
  If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed
  by the flight surgeon and safety board.
- The robot never changes its own protocol, thresholds or limits.
comms:
  live: >-
    Low Earth orbit: the flight surgeon sees summaries at the private medical conference and can be alerted
    at any time.
  loss_of_signal:
  - Only the robot pauses; crew care never waits for the link or the robot.
  - >-
    The robot pauses any movement and tells the CMO; on the CMO's confirmation it keeps running the check
    and logging offline.
  - >-
    Red flags go to the CMO (or the second trained CMO) at once; the CMO decides under the pre-approved
    onboard checklist.
  - 'At the next contact the robot sends one package: the log, alerts and decisions.'
  mars_delay:
  - >-
    Replies may take up to about 21-23 minutes each way, with blackouts of about 2-3 weeks; red-flag thresholds
    and the check-in schedule are set before flight and the CMO acts on them.
sources:
- key: mtb001
  text: >-
    NASA OCHMO. Spaceflight Associated Neuro-ocular Syndrome (SANS). Medical Technical Brief OCHMO-MTB-001
    (2024).
  url: https://www.nasa.gov/wp-content/uploads/2024/02/ochmo-mtb-001-sans.pdf
  supports: >-
    NASA MTB-001 (2024): about 70% of long-duration crew show one or more signs and about 18% have clinically
    concerning changes; reading charts (near and distance) and the Amsler grid are used before, during
    and after flight; in-flight eye weeks around flight day 30, flight day 90 and 30 days before return,
    with extra testing at any time; all crew fly with at least 3 pairs of prescription glasses of different
    strengths; NASA-STD-3001 V1 3003 item m and V1 3004 item g.
- key: hrpsans
  text: >-
    NASA Human Research Program. Evidence Report: Risk of Spaceflight Associated Neuro-ocular Syndrome
    (SANS) (2017).
  url: https://humanresearchroadmap.nasa.gov/evidence/reports/SANS.pdf
  supports: >-
    With optic disc edema as the primary metric, the overall incidence is considered to be 16%, and 38%
    to 51% of long-duration crewmembers have developed one or more findings; no crewmembers have reported
    the type of headaches typically associated with raised intracranial pressure; the classic symptoms
    of raised pressure inside the head on Earth include chronic headaches, double vision, transient visual
    obscurations and pulse-synchronous tinnitus.
- key: mader
  text: >-
    Mader TH, Gibson CR, Pass AF, et al. Optic disc edema, globe flattening, choroidal folds, and hyperopic
    shifts observed in astronauts after long-duration space flight. Ophthalmology. 2011;118(10):2058-2069.
  url: https://doi.org/10.1016/j.ophtha.2011.06.021
  doi: 10.1016/j.ophtha.2011.06.021
  pmid: '21849212'
  supports: >-
    Postflight questionnaires from about 300 astronauts documented that about 29% on short and 60% on
    long-duration missions experienced a degradation in distant and near visual acuity; some of these
    vision changes remain unresolved years after flight. Only the abstract was read.
- key: leesans
  text: >-
    Lee AG, Mader TH, Gibson CR, et al. Spaceflight associated neuro-ocular syndrome (SANS) and the neuro-ophthalmologic
    effects of microgravity: a review and an update. NPJ Microgravity. 2020;6:7. (Author correction: NPJ
    Microgravity. 2020;6:23.)
  url: https://doi.org/10.1038/s41526-020-0097-9
  doi: 10.1038/s41526-020-0097-9
  pmid: '32047839'
  supports: >-
    Review of the clinical findings of spaceflight-associated neuro-ocular syndrome: one-sided and two-sided
    optic disc edema, globe flattening, choroidal and retinal folds, hyperopic (far-sighted) refractive
    shifts and cotton wool spots. Only the abstract was read.
- key: coref
  text: >-
    The College of Optometrists. Guidance for Professional Practice, Annex 4: Urgency of referrals table.
    Primary-care optometry guidance.
  url: >-
    https://www.college-optometrists.org/clinical-guidance/guidance/guidance-annexes/annex-4-urgency-of-referrals-table
  supports: >-
    Checked by column against the live table on Oct 20, 2026. Emergency (as soon as possible): sudden
    complete loss of vision under 6 hours; retinal detachment with the macula on; chemical burns (irrigate
    first); penetrating injuries; severe eye pain with nausea or vomiting. Emergency (within 24 hours):
    sudden visual loss of unknown cause; floaters or flashes of light under 48 hours with pigment in the
    vitreous; symptomatic retinal tears and breaks; retinal detachment with the macula off; papilloedema;
    acute onset double vision, squint, drooping eyelid or nerve palsy; pain on eye movement; sudden severe
    eye pain. Urgent (priority): sudden change in vision under 2 weeks; optic neuritis; wet macular degeneration;
    myopic choroidal neovascularisation; central serous retinopathy; new pupil defects.
- key: cochem
  text: >-
    The College of Optometrists. Clinical Management Guidelines: Trauma (chemical) (last updated March
    13, 2026) Primary-care optometry guidance (public sections only).
  url: >-
    https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/trauma_chemical
  supports: >-
    Flush the eye immediately with sterile salt solution, or tap water if that is not available, and continue
    to irrigate for at least 20 minutes before seeking medical attention; damage is generally greatest
    with alkalis such as ammonia; severe cases need immediate referral to hospital eye services or emergency
    care. (Only the publicly visible sections were read; the full guideline needs a login.)
- key: copen
  text: >-
    The College of Optometrists. Clinical Management Guidelines: Trauma (penetrating) (last updated March
    13, 2026) Primary-care optometry guidance (public sections only).
  url: >-
    https://www.college-optometrists.org/clinical-guidance/clinical-management-guidelines/trauma_penetrating
  supports: >-
    Penetrating trauma is a full-thickness injury of the cornea or outer coat of the eye; first aid is
    followed by emergency referral, with an ophthalmologist seeing the patient as soon as possible the
    same day; foreign bodies are identified but not removed. (Public sections only.)
- key: bjerager
  text: >-
    Bjerager J, Schneider M, Potapenko I, et al. Diagnostic accuracy of the Amsler grid test for detecting
    neovascular age-related macular degeneration: a systematic review and meta-analysis. JAMA Ophthalmol.
    2023;141(4):315-323.
  url: https://doi.org/10.1001/jamaophthalmol.2022.6396
  doi: 10.1001/jamaophthalmol.2022.6396
  pmid: '36795396'
  supports: >-
    Pooled sensitivity of the Amsler grid for neovascular age-related macular degeneration was 67% against
    healthy controls and 71% against non-neovascular disease; its sensitivity may be at levels typically
    not recommended for monitoring, and patients should have regular eye examinations regardless of their
    grid results. Only the abstract was read; an Earth macular-degeneration population, applied to spaceflight
    by extrapolation.
- key: faes
  text: >-
    Faes L, Bodmer NS, Bachmann LM, Thiel MA, Schmid MK. Diagnostic accuracy of the Amsler grid and the
    preferential hyperacuity perimetry in the screening of patients with age-related macular degeneration:
    systematic review and meta-analysis. Eye (Lond). 2014;28(7):788-796.
  url: https://doi.org/10.1038/eye.2014.104
  doi: 10.1038/eye.2014.104
  pmid: '24788016'
  supports: >-
    Pooled sensitivity of the Amsler grid was 0.78 (95% CI 0.64-0.87) and specificity 0.97; almost all
    included studies had a case-control design. Only the abstract was read; applied to spaceflight by
    extrapolation.
- key: black2013
  text: >-
    Black JM, Jacobs RJ, Phillips G, et al. An assessment of the iPad as a testing platform for distance
    visual acuity in adults. BMJ Open. 2013;3(6):e002730.
  url: https://doi.org/10.1136/bmjopen-2013-002730
  doi: 10.1136/bmjopen-2013-002730
  pmid: '23794568'
  supports: >-
    A glossy tablet screen was highly susceptible to glare, giving acuity about 2 logMAR lines poorer
    than standard charts; with an antiglare screen and positioned away from reflected glare, results were
    equivalent to gold-standard charts; such devices suit only settings where glare can be eliminated.
    Only the abstract was read; adults with normal vision on Earth, not a robot-held screen in weightlessness.
- key: nice150
  text: >-
    National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management.
    Clinical guideline CG150.
  url: https://www.nice.org.uk/guidance/cg150/chapter/Recommendations
  supports: >-
    Headache features that need further investigation or referral include sudden-onset headache reaching
    maximum intensity within 5 minutes and a new neurological deficit.
- key: v1
  text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).'
  url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf
  supports: >-
    NASA-STD-3001 Vol 1 Rev C: V1 3003 item m (periodic monitoring for spaceflight-associated neuro-ocular
    syndrome); V1 3004 items e (physical exam) and g (stronger glasses).
- key: tb044
  text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).
  url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf
  supports: >-
    The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the
    JSC 48522 medical checklist.
- key: v2
  text: >-
    NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026),
    including Section 10.6 Automated and Robotic Systems.
  url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2
  supports: Requirement IDs beginning V2.
- key: marsdelay
  text: >-
    NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept
    Review).
  url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf
  supports: >-
    One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
- key: pccp
  text: >-
    U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change
    control plan for artificial intelligence-enabled device software functions (guidance).
  url: >-
    https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
  supports: A model for planning, validating and rolling back software updates.
- key: faa460
  text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.'
  url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460
  supports: >-
    Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical
    standards for spaceflight participants.
corrections:
- date: '2026-10-20'
  version: '0.2'
  source: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 (batch 4 review)
  items:
  - >-
    The Amsler red flag is split: an area the crewmember says is new or sudden is URGENT (the robot asks
    "Is this new since your last check?"; clinical judgment for the flight surgeon to confirm); any other
    marked area is a same-day Flag (item 5).
  - >-
    The package says "An Amsler grid with no marks, or a chart line read, is a record only; it does not
    rule out change"; the scope gives the grid's limited sensitivity (Bjerager 2023, Faes 2014) (item
    6).
  - >-
    IN-5 adds letter size calibrated for the distance, contrast, an anti-glare surface, and lighting and
    reflections; validation adds agreement with the standard eye-week charts under flight-like lighting
    (Black 2013) (item 7).
  - RF6 (eye injury or chemical) cites the College of Optometrists pages and urgency table (item 8).
  - >-
    RF2: the College urgency table was checked by column on Oct 20, 2026, so the "within 24 hours" time
    frame is kept, now stated exactly (retinal tears and macula-off detachment within 24 hours; macula-on
    detachment as soon as possible) (item 9).
  - >-
    Optional: RF5 adds a new headache after a spacewalk, suited test or pressure change (RMP-EVA-001 RF10)
    and brief vision greying or a pulsing sound in the ears (design judgment) (item 31); validation adds
    a periodic comparison analysed by the flight surgeon only (item 32).
  - >-
    Review label set to the library wording: reviewed (AI-assisted), Oct 20, 2026; no named human clinician.
  - >-
    Planned protocols named in an action now show "(planned)", and each such action is complete without
    the link (item 51).
- date: '2026-10-21'
  version: '0.3'
  source: Batch 5 editorial (AI-assisted), Oct 21, 2026
  items:
  - >-
    Cross-links to batch 5 drafts no longer say "(planned)" now that those protocols exist as v0.1 drafts
    (RMP-NEURO-007, RMP-CARD-001, RMP-RESP-002, RMP-NEURO-002, RMP-NEURO-003, RMP-ENV-001). Clinical meaning
    unchanged.
- date: '2026-10-21'
  version: '0.3'
  source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49
  items:
  - >-
    Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position";
    "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if
    no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and
    never-word list entry "safe" unchanged.
- date: '2026-10-21'
  version: '0.4'
  source: Batch 7 editorial (AI-assisted), Oct 21, 2026
  items:
  - >-
    Citation labels changed to the site's year-only convention: "(approved for public release <date>)"
    now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev
    F, 2026)" (sources: hrpsans, v2). Editorial; no change to steps, thresholds or limits.
- date: '2026-10-21'
  version: '0.5'
  source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026
  items:
  - >-
    X5 and the comms loss-of-signal branch now open with "Only the robot pauses; crew care never waits
    for the link or the robot." (batch 7 review suggestion 29). Editorial; robot behaviour unchanged.
