RMP-EYE-003 Retinal photo and OCT imaging: camera positioning support for SANS monitoring

1 · Identity and scope

For scheduled or flight-surgeon-requested eye imaging, the robot holds and positions the retinal camera or OCT device, guides the crewmember's alignment, checks image quality, and labels, stores and sends the images to the flight surgeon and an eye specialist. It never grades or compares images.

Why this protocol was chosen. NASA reports that 70% of long-duration crew show at least one sign of SANS and 18% are diagnosed with clinically concerning SANS. Optic disc swelling and retinal folds are tracked with fundus photos and OCT before, during and after flight. Crews train on the devices before flight, but it may be months before they use them; a robot that steadies the device and checks quality could make in-flight images more consistent.

Priority: Moved up from Tier 2: about 70% of long-duration crew show at least one sign of SANS and about 18% are diagnosed with clinically concerning SANS; imaging is scheduled and routine, and crews may go months between training and use.

Related: RMP-EYE-002 · RMP-EYE-004 · RMP-INF-002

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Ground eye specialist: reviews images for the flight surgeon
• Operator: the CMO or another trained crewmember
• Subject: the crewmember being imaged, who can stop at any time

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [8]

3 · Preconditions and consent

• PRE-1 Imaging is on the flight surgeon's schedule or was requested by the flight surgeon; a crewmember started the run.V2 10174
• PRE-2 Subject and operator restrained; head and chin rest in place.V2 7046
• PRE-3 Device and robot self-tests passed; lens clean; cabin lighting set per device instructions.V2 10161
• PRE-4 No acute eye symptoms. Eye pain, sudden vision loss or injury go to the CMO and RMP-EYE-001 instead.
• PRE-5 Link status and delay known.

Consent

The subject agrees by voice or touch before each session; logged.

Emergency consent

Not applicable: this is a scheduled, non-emergency exam. Without consent, the session is rescheduled.

Withdrawal

The subject can stop at any time; the robot withdraws the device.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1RobotRung 2

   Confirm the subject's identity and the requested image set; retrieve baseline images for the operator.

   Done when: Subject and image set confirmed by the operator.

2. S2RobotRung 2

   Before the device comes near the face, ask the vision-symptom and red-flag questions and log the answers word for word.

   Done when: Answers logged.

   D1DecisionRobot decides

   Does any answer match a red flag (RF1, RF2, RF3 or RF5)?

   • Yes → Stop before the device approaches the face; URGENT call to the CMO and flight surgeon (eye pain or injury: RMP-EYE-001).
   • No → Continue.
3. S3Crew

   Unstow the device; the operator restrains the subject and fits the head and chin rest.

   Done when: Subject restrained; head and chin rest in place.

   V2 7046

4. S4RobotRung 2

   Hold and restrain the device at the working position.

   Done when: Device steady at working position.

   Limit: <set by validation>

   V2 7046

5. S5RobotRung 2

   Guide alignment with voice prompts and small device moves within the distance limit.

   Done when: Fixation and alignment confirmed by the device.

   Limit: <set by validation>

   D2DecisionCrew decides

   Is the subject comfortable and able to continue?

   • Yes → Continue.
   • No → Pause; reschedule; log the reason.
6. S6RobotRung 2

   Capture OCT scans of the optic nerve head and macula, each eye; run the quality check.

   Done when: Each scan meets the device quality threshold.

   D3DecisionRobot decides

   Did the OCT scans pass the quality check within the allowed attempts?

   • Yes → Continue.
   • No → Label "not gradeable (quality)"; hand to the operator, or ask the ground for a guided session.
7. S7RobotRung 2

   Capture fundus photos of the optic disc and macula, each eye; run the quality check.

   Done when: Each photo meets the quality threshold.

   D4DecisionRobot decides

   Did the fundus photos pass the quality check within the allowed attempts?

   • Yes → Continue.
   • No → Label "not gradeable (quality)"; hand to the operator, or ask the ground for a guided session.
8. S8RobotRung 2

   Label each image (eye, scan type, time, quality), store it in the medical record and send it to the flight surgeon and eye specialist, or queue it.

   Done when: Delivery confirmed or queued.

   V1 6003V1 7001V1 7003

   D5DecisionGround decides

   Do the images need follow-up?

   • Specialist and flight surgeon request more imaging or tests → New schedule is set by the flight surgeon; robot logs it.
   • No change to the plan → Next scheduled session stands.
9. S9Crew

   Stow the device.

   Done when: Device stowed.

10. S10RobotRung 2

    Clean the head and chin rest per the cleaning protocol.

    Done when: Cleaning logged.

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [4] and Volume 2 Revision F [5]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Robot positioning against a model head and eye, at station and Mars delays. Pass: Zero approach-limit violations; quality check behaves as specified.
2. Training model. Model eyes with known features; operators of different experience levels. Pass: Share of image sets judged gradeable by an eye specialist at or above <set by clinical lead>.
3. Earth analog. Analog crews with remote eye specialists, compared with crew-only imaging. Pass: Robot-assisted image quality at least as good as crew-only, as judged blind by specialists.
4. Flight use under flight surgeon supervision. Side by side with the standard crew-operated exam. Pass: No safety events; specialists judge images usable.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Scheduled by the flight surgeon; started by the operator. No flight surgeon real-time presence needed; images reviewed at the next opportunity.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.5.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [7].

Loss of signal and Mars delay

Live link

Low Earth orbit: an eye specialist can guide the session live or review images within hours.

Loss of signal

• Only the robot pauses; crew care never waits for the link or the robot.
• The robot pauses and tells the operator. On the CMO's confirmation, the session continues with the device quality checks only; images are queued.
• If images stay not gradeable, the session is rescheduled rather than repeated many times.

Mars-class delay

• No real-time guidance is possible; review happens hours to weeks later.
• Before flight, the flight surgeon sets which symptoms trigger extra imaging and how often to image; the CMO applies them.
• Images and symptom logs are sent as packages; the robot tracks which have been reviewed.

[6]

Sources

1. NASA OCHMO. Spaceflight Associated Neuro-ocular Syndrome (SANS). Medical Technical Brief OCHMO-MTB-001 (2024). www.nasa.gov/wp-content/uploads/2024/02/ochmo-mtb-001-sans.p… Supports: 70% of crew show one or more signs of SANS and 18% are diagnosed with clinically concerning SANS on long missions; optic disc edema and chorioretinal folds are monitored with fundoscopy, photography and OCT before, during and after flight; crew train on OCT, fundoscope and ocular ultrasound, but it may be months before that training is used.
2. National Institute for Health and Care Excellence. Headaches in over 12s: diagnosis and management. Clinical guideline CG150. www.nice.org.uk/guidance/cg150/chapter/Recommendations Supports: Headache features that need further investigation or referral include worsening headache with fever, sudden-onset headache reaching maximum intensity within 5 minutes, new-onset neurological deficit, and impaired level of consciousness.
3. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
4. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
5. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
6. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
7. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
8. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.