# RMP-EYE-003 Retinal photo and OCT imaging: camera positioning support for SANS monitoring # Version 0.5 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' id: RMP-EYE-003 slug: rmp-eye-003 title: 'Retinal photo and OCT imaging: camera positioning support for SANS monitoring' version: '0.5' status: draft conceptual: true not_for_clinical_use: true category: eyes tier: 1 tier_note: >- Moved up from Tier 2: about 70% of long-duration crew show at least one sign of SANS and about 18% are diagnosed with clinically concerning SANS; imaging is scheduled and routine, and crews may go months between training and use. max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-20' reviewed: '2026-10-20' human_clinician_review: false text: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026; no named human clinician. All corrections from that review are applied in this version (see Corrections). Written with AI assistance; sources self-verified. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true result_language: use: - acquired, for specialist review - 'image quality: gradeable / not gradeable' - non-diagnostic (quality too low) never: - normal - no problem found - all clear - negative - any diagnosis or cause - no swelling - no folds - stable scope: summary: >- For scheduled or flight-surgeon-requested eye imaging, the robot holds and positions the retinal camera or OCT device, guides the crewmember's alignment, checks image quality, and labels, stores and sends the images to the flight surgeon and an eye specialist. It never grades or compares images. why: >- NASA reports that 70% of long-duration crew show at least one sign of SANS and 18% are diagnosed with clinically concerning SANS. Optic disc swelling and retinal folds are tracked with fundus photos and OCT before, during and after flight. Crews train on the devices before flight, but it may be months before they use them; a robot that steadies the device and checks quality could make in-flight images more consistent. covers: - Fundus (retinal) photographs of the optic disc and macula, both eyes - OCT scans of the optic nerve head and macula, both eyes - A short vision-symptom questionnaire logged with the images locked_out: - Touching the eye or eyelids - >- Eye drops of any kind (for example dilating drops are medicines decided by the CMO and flight surgeon) - Ocular ultrasound (see RMP-EYE-004) - Grading optic disc swelling or folds, measuring change, or comparing with earlier images - Recommending glasses or any treatment related: - RMP-EYE-002 - RMP-EYE-004 - RMP-INF-002 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Ground eye specialist: reviews images for the flight surgeon' - 'Operator: the CMO or another trained crewmember' - 'Subject: the crewmember being imaged, who can stop at any time' robot_may: - Unstow and hold the imaging device at the working position within set limits - Give alignment prompts and adjust device position - Run the device's image-quality checks and repeat captures up to a set number - >- Label, store and send images; show the operator earlier images side by side for human comparison only robot_may_not: - Touch the face except through the device's head and chin rest - Interpret, grade or measure images - Suggest drops, glasses or treatment - Continue if the subject reports pain or sudden vision change commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- Imaging is on the flight surgeon's schedule or was requested by the flight surgeon; a crewmember started the run. refs: - V2 10174 - id: PRE-2 text: Subject and operator restrained; head and chin rest in place. refs: - V2 7046 - id: PRE-3 text: Device and robot self-tests passed; lens clean; cabin lighting set per device instructions. refs: - V2 10161 - id: PRE-4 text: No acute eye symptoms. Eye pain, sudden vision loss or injury go to the CMO and RMP-EYE-001 instead. - id: PRE-5 text: Link status and delay known. consent: standard: The subject agrees by voice or touch before each session; logged. emergency: >- Not applicable: this is a scheduled, non-emergency exam. Without consent, the session is rescheduled. withdrawal: The subject can stop at any time; the robot withdraws the device. inputs: - id: IN-1 name: OCT scan with the device quality index source: OCT device required: true if_missing: Do not report the scan as acquired; hand to the operator or a ground-guided session. - id: IN-2 name: Fundus image with focus and illumination quality score source: Retinal camera required: true if_missing: Retake up to times, then hand to the operator. - id: IN-3 name: Subject fixation and head position source: Robot camera and head-rest contact sensor required: true if_missing: Pause capture until restored. - id: IN-4 name: Baseline images from the medical record source: Medical record required: false if_missing: Note "no baseline available"; images are still sent. - id: IN-5 name: Vision-symptom answers (blurred near or far vision, distortion, new blind spots) source: Voice or touch questionnaire required: true if_missing: Log "not answered". - id: IN-6 name: Link status and delay source: Communications system required: true if_missing: Treat as link down. steps: - id: S1 actor: robot rung: 2 action: >- Confirm the subject's identity and the requested image set; retrieve baseline images for the operator. success: Subject and image set confirmed by the operator. - id: S2 actor: robot rung: 2 action: >- Before the device comes near the face, ask the vision-symptom and red-flag questions and log the answers word for word. success: Answers logged. - id: S3 actor: crew action: Unstow the device; the operator restrains the subject and fits the head and chin rest. success: Subject restrained; head and chin rest in place. refs: - V2 7046 - id: S4 actor: robot rung: 2 action: Hold and restrain the device at the working position. success: Device steady at working position. limit: refs: - V2 7046 - id: S5 actor: robot rung: 2 action: Guide alignment with voice prompts and small device moves within the distance limit. success: Fixation and alignment confirmed by the device. limit: - id: S6 actor: robot rung: 2 action: Capture OCT scans of the optic nerve head and macula, each eye; run the quality check. success: Each scan meets the device quality threshold. - id: S7 actor: robot rung: 2 action: Capture fundus photos of the optic disc and macula, each eye; run the quality check. success: Each photo meets the quality threshold. - id: S8 actor: robot rung: 2 action: >- Label each image (eye, scan type, time, quality), store it in the medical record and send it to the flight surgeon and eye specialist, or queue it. success: Delivery confirmed or queued. refs: - V1 6003 - V1 7001 - V1 7003 - id: S9 actor: crew action: Stow the device. success: Device stowed. - id: S10 actor: robot rung: 2 action: Clean the head and chin rest per the cleaning protocol. success: Cleaning logged. decisions: - id: D1 after: S2 decided_by: robot question: Does any answer match a red flag (RF1, RF2, RF3 or RF5)? branches: - if: 'Yes' then: >- Stop before the device approaches the face; URGENT call to the CMO and flight surgeon (eye pain or injury: RMP-EYE-001). - if: 'No' then: Continue. - id: D2 after: S5 decided_by: crew question: Is the subject comfortable and able to continue? branches: - if: 'Yes' then: Continue. - if: 'No' then: Pause; reschedule; log the reason. - id: D3 after: S6 decided_by: robot question: Did the OCT scans pass the quality check within the allowed attempts? branches: - if: 'Yes' then: Continue. - if: 'No' then: Label "not gradeable (quality)"; hand to the operator, or ask the ground for a guided session. - id: D4 after: S7 decided_by: robot question: Did the fundus photos pass the quality check within the allowed attempts? branches: - if: 'Yes' then: Continue. - if: 'No' then: Label "not gradeable (quality)"; hand to the operator, or ask the ground for a guided session. - id: D5 after: S8 decided_by: ground question: Do the images need follow-up? branches: - if: Specialist and flight surgeon request more imaging or tests then: New schedule is set by the flight surgeon; robot logs it. - if: No change to the plan then: Next scheduled session stands. stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses; crew care never waits for the link or the robot. Robot pauses any movement in its stopped position and tells the CMO. The CMO decides whether to continue offline under the pre-approved onboard checklist; the robot resumes only on the CMO's confirmation. Everything is logged and sent to the flight surgeon at the next contact. level: pause refs: - V2 10172 - V2 10173 red_flags: - id: RF1 sign: Sudden loss of vision, or a new blind spot or curtain threshold: any action: Stop; URGENT call to CMO and flight surgeon - id: RF2 sign: Eye pain, injury or chemical exposure threshold: any action: Stop; switch to RMP-EYE-001 - id: RF3 sign: New double vision, or severe headache with vision change threshold: any action: Stop; URGENT call - id: RF4 sign: Subject-reported change in vision since the last session threshold: action: Flag to the flight surgeon with the images - id: RF5 sign: Sudden-onset severe headache; new weakness, numbness or speech change; or reduced alertness threshold: any action: Stop; URGENT call to CMO and flight surgeon source: nice150 safety_limits: - id: L1 name: Closest device approach to the face (outside the head and chin rest) value: enforced: Distance sensing; hard stop refs: - V2 10172 - id: L2 name: Force on head and chin rest value: enforced: Force sensing - id: L3 name: Light exposure per session value: enforced: Within the device manufacturer's labeled limits; capture count capped - id: L4 name: Session length value: enforced: Timer; then rest and reschedule logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 requirements: - id: V1 3004 use: In-mission care includes ancillary tests such as ocular imaging. - id: V1 3006 use: Two crew medical officers per vehicle for NASA programs (see the commercial-flight note). - id: V1 6003 use: Images sent to the ground are private medical communications. - id: V1 7001 use: Images kept so the flight surgeon can see trends across the mission. - id: V1 7003 use: Secure handling of medical records. - id: V2 7045 use: Usable by non-physician crew. - id: V2 7046 use: Subject, operator and device restrained. - id: V2 10161 use: Robot shows status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows who is expected to act. - id: V2 10165 use: Human override and shut-down. - id: V2 10166 use: Operator can adjust settings only within safety limits. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: Robot positioning against a model head and eye, at station and Mars delays. pass: Zero approach-limit violations; quality check behaves as specified. - stage: training model what: Model eyes with known features; operators of different experience levels. pass: Share of image sets judged gradeable by an eye specialist at or above . - stage: Earth analog what: Analog crews with remote eye specialists, compared with crew-only imaging. pass: Robot-assisted image quality at least as good as crew-only, as judged blind by specialists. - stage: flight use under flight surgeon supervision what: Side by side with the standard crew-operated exam. pass: No safety events; specialists judge images usable. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Scheduled by the flight surgeon; started by the operator. No flight surgeon real-time presence needed; images reviewed at the next opportunity. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: an eye specialist can guide the session live or review images within hours.' loss_of_signal: - Only the robot pauses; crew care never waits for the link or the robot. - >- The robot pauses and tells the operator. On the CMO's confirmation, the session continues with the device quality checks only; images are queued. - If images stay not gradeable, the session is rescheduled rather than repeated many times. mars_delay: - No real-time guidance is possible; review happens hours to weeks later. - >- Before flight, the flight surgeon sets which symptoms trigger extra imaging and how often to image; the CMO applies them. - Images and symptom logs are sent as packages; the robot tracks which have been reviewed. sources: - key: mtb001 text: >- NASA OCHMO. Spaceflight Associated Neuro-ocular Syndrome (SANS). Medical Technical Brief OCHMO-MTB-001 (2024). url: https://www.nasa.gov/wp-content/uploads/2024/02/ochmo-mtb-001-sans.pdf supports: >- 70% of crew show one or more signs of SANS and 18% are diagnosed with clinically concerning SANS on long missions; optic disc edema and chorioretinal folds are monitored with fundoscopy, photography and OCT before, during and after flight; crew train on OCT, fundoscope and ocular ultrasound, but it may be months before that training is used. - key: nice150 text: >- National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150. url: https://www.nice.org.uk/guidance/cg150/chapter/Recommendations supports: >- Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: Requirement IDs beginning V1. - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: Requirement IDs beginning V2. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-20' version: '0.2' source: AI-assisted clinical and source review by the Medical Research Assistant, Oct 20, 2026 items: - Vision-symptom and red-flag questions moved to S2, before the device approaches the face. - The image-quality decision now follows both the OCT step and the fundus step. - >- Prevalence now reads about 70% with at least one sign and about 18% clinically concerning SANS (NASA MTB-001). - >- New red flag RF5: sudden-onset severe headache, new neurological signs or reduced alertness (NICE CG150). - Light-exposure limit owner changed to the clinical lead, within the device's labeled limits. - Robot actions inside crew steps are now separate robot steps, so the build checks their rung. - >- Loss of link (X5) now means: pause motion, tell the CMO, and continue offline only on the CMO's confirmation (fixes the contradiction with the comms branch). - >- Added a commercial-flight note on who the flight surgeon and CMO are, and a fixed list of robot lockouts checked by the build. - date: '2026-10-21' version: '0.2' source: Batch 5 editorial (AI-assisted), Oct 21, 2026; batch 4 review item 49 items: - >- Inherited stop-rule and requirement wording: "holds a safe position" → "holds its stopped position"; "stays in its safe state" → "stays stopped"; "take over safely" → "take over"; "Robot stays safe if no one takes over" → "Robot stays stopped if no one takes over". Schema level name safe-state and never-word list entry "safe" unchanged. - date: '2026-10-21' version: '0.3' source: Batch 6 editorial (AI-assisted), Oct 21, 2026 items: - >- Requirement use for [V2 10173] changed from "Safe default." to "Robot stays stopped if no one takes over." (batch 5 review item 25; editorial, behaviour unchanged). - date: '2026-10-21' version: '0.4' source: Batch 7 editorial (AI-assisted), Oct 21, 2026 items: - >- Citation labels changed to the site's year-only convention: "(approved for public release )" now reads "(YYYY)", and NASA-STD-3001 Volume 2 "Revision F (approved July 14, 2026)" now reads "(Rev F, 2026)" (sources: v2). Editorial; no change to steps, thresholds or limits. - date: '2026-10-21' version: '0.5' source: Batch 7 review and batch 8 editorial (AI-assisted), Oct 21, 2026 items: - >- X5 and the comms loss-of-signal branch now open with "Only the robot pauses; crew care never waits for the link or the robot." (batch 7 review suggestion 29). Editorial; robot behaviour unchanged.