RMP-PHARM-001 Fetch a medicine a human has prescribed and match it to the order by barcode (robot checks and logs; no drug advice)

1 · Identity and scope

After the CMO or flight surgeon has decided on a medicine, the robot fetches it from stowage and checks it against every field of the human order: the crewmember, medicine, strength, dose form, quantity and ordered time window, plus expiry, storage record and human-entered record flags. At hand-over it confirms the recipient is the ordered crewmember. Only a full MATCH TO ORDER is handed to the CMO. Any mismatch or failed check is a hard stop: the item is quarantined, not handed over. The robot never chooses, recommends, doses or gives a medicine, and a match is not a clinical safety check.

Why this protocol was chosen. In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41% and related potential adverse drug events by 51%, but did not eliminate errors. Barcode checks aim to confirm the right patient, drug, dose, route and time, and workarounds such as proxy scanning undermine them. On long missions, medicines may outlast their expiry dates, so expiry and storage checks matter, and NASA requires inventory tracking of item locations and quantities.

Reworked in v0.7. After the AI-assisted review (v0.3 adds a logged, two-step CMO override): full order match (recipient identity, medicine, strength, dose form, quantity, ordered time window, expiry, storage, record flags), a hard stop with no hand-over after any mismatch, and result wording that cannot read as "safe to take".

Related: RMP-PHARM-002 · RMP-PHARM-003 · RMP-PHARM-004

2 · Roles

Medical authority

Flight surgeon (ground). Holds medical authority for every run.

Onboard lead

Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link.

Others

• Prescriber: the flight surgeon, or the CMO under the onboard checklist
• Recipient: the crewmember named on the order

Commercial flights

On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) [10]

3 · Preconditions and consent

• PRE-1 A complete human order exists: prescriber, crewmember, medicine, strength, dose form, quantity and ordered time window.order.complete == true
• PRE-2 The CMO started the run.human_start == trueV2 10174
• PRE-3 Inventory database synced (or the local copy is in use, with the CMO's confirmation); barcode scanner and crew ID scanner self-tests passed.V2 10161
• PRE-4 Not an emergency where seconds matter: in an emergency the crew take items directly and the robot logs afterward.

Consent

The CMO confirms the order on read-back. The recipient's consent to the medicine is a CMO responsibility, outside the robot's role.

Emergency consent

In an emergency the crew bypass the robot; it reconciles inventory afterward.

Withdrawal

The CMO can cancel the fetch at any time; the item is returned to stowage.

4 · Required sensor inputs

5–6 · Steps and decision points

Each step names who acts. Decision points sit after the step they follow and say who decides: Robot Crew Ground. Any stop rule in section 7 can interrupt any step.

1. S1Crew

   The CMO enters the order, or confirms one uplinked by the flight surgeon.

   Done when: Order complete.

2. S2RobotRung 2

   Read the order back aloud and on screen: crewmember, medicine, strength, dose form, quantity and time window; the CMO confirms.

   Done when: CMO confirms the read-back.

3. S3RobotRung 2

   Find the item's stowage location and retrieve it without opening the packaging.

   Done when: Item in gripper; location logged.

   V2 7052

   D1DecisionRobot decides

   Was the item found where inventory says, in the expected quantity?

   • Yes → Continue.
   • No → Flag an inventory discrepancy to crew and ground; ask the CMO.
4. S4RobotRung 2

   Scan the item's own barcode and compare every field: crewmember on the order, medicine, strength, dose form, quantity and ordered time window; check expiry date, storage record and human-entered record flags. Expiry or storage problems are shown as MISMATCH here, before any hand-over.

   Done when: Every field checked and shown on screen.

   V2 10170V2 10171

   D2DecisionRobot decides

   Did every order field, expiry, storage and record-flag check match?

   • Yes → Continue to the recipient check (S5).
   • No, or a check could not be done → HARD STOP. Show MISMATCH or CANNOT VERIFY with the fields named. Seal the item in a labeled NOT VERIFIED bag and place it in the quarantine bin. No hand-over. The CMO and flight surgeon decide what happens next (for example whether an expired item may be used).No hand-over
   • The CMO makes an explicit two-step override request (states the override and its reason, then confirms) → Go to S7: after logging and flagging, hand the item to the CMO only, stating "NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged."CMO override only · two-step · logged · flight surgeon flagged
5. S5RobotRung 2

   Confirm the recipient's identity (crew ID scan, or the CMO confirms by voice) against the crewmember on the order.

   Done when: Recipient identity checked.

   D3DecisionRobot decides

   Is the recipient the crewmember on the order?

   • Yes → Continue to S6.
   • No, or identity not confirmed → HARD STOP: MISMATCH: recipient. Quarantine the item. No hand-over. Alert the CMO.No hand-over
   • The CMO makes an explicit two-step override request → Go to S7: after logging and flagging, hand the item to the CMO only, stating "NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged."CMO override only · two-step · logged · flight surgeon flagged
6. S6RobotRung 2

   Only after a full match: show "MATCH TO ORDER. Not a dose, interaction or allergy review." and hand the item to the CMO.

   Done when: CMO acknowledges the screen and takes the item.

   V2 10170

7. S7RobotRung 2

   Only after a mismatch or failed check, and only on the CMO's two-step override (the CMO states the override and its reason, then confirms): confirm the CMO's identity; log the timestamp, CMO identity, reason, mismatched fields, order and item barcode; flag the override to the flight surgeon (queued if the link is down); state and show "NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged." and hand the item to the CMO only.

   Done when: Override logged and flagged; item in the CMO's hands; or no override requested and the item stays in quarantine.

   V2 10165V2 10163V2 10170

8. S8Crew

   CMO checks the item by eye and decides whether and how to give it (outside the robot's role).

   Done when: CMO accepts or rejects; logged.

9. S9RobotRung 2

   Log the fetch and every check; update the inventory count; flag low stock to the ground.

   Done when: Inventory updated.

   V2 7059

10. S10RobotRung 2

    Return any unused or rejected item to its stowage location (quarantined items stay in the quarantine bin).

    Done when: Item stowed; inventory updated.

    V2 7052

7 · Stop and escalate rules, red flags

Red flags

The robot reports the sign or value only, never what it means. Numeric thresholds are placeholders for the clinical lead.

8 · Safety limits

9 · Logs and audit

• LOG-1 Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.V2 10163V2 10164
• LOG-2 Mode changes and safety-limit events are announced to the operator as they happen and logged.V2 10162V2 10172
• LOG-3 Records are stored and sent as private medical data, encrypted, with access limited to the medical team.V1 6003V1 7003
• LOG-4 Results are kept in a permanent, retrievable format so the flight surgeon can see trends.V1 7001
• LOG-5 Every fetch, field-by-field result, mismatch, quarantine, CMO decision and inventory change, linked to the order. Every override records the timestamp, CMO identity, reason, mismatched fields, order and item barcode, and when the flight surgeon flag was sent.

10 · Links to NASA-STD-3001

IDs as published in Volume 1 Revision C [6] and Volume 2 Revision F [7]. NASA-STD-3001 binds NASA programs; it is not a regulation for commercial flights. Its robot rules are general automation requirements, not medical-device rules.

11 · Validation

1. Simulation. Simulated inventory with seeded errors (wrong recipient, wrong strength or form, outside the time window, expired, out-of-storage, unreadable code, proxy label). Pass: Every seeded error caught; zero false MATCH TO ORDER results; zero hand-overs after a mismatch.
2. Training model. Mock-up stowage with real packaging and labels. Pass: Retrieval success and scan accuracy at or above <set by validation>.
3. Earth analog. Analog crews using the robot for routine medicines. Pass: Zero unverified hand-overs; overrides reviewed; crew workload not increased.
4. Flight use under flight surgeon supervision. Inventory checks first, then non-urgent fetches. Pass: Inventory accuracy at or above <set by validation>; no safety events.

No stage has been run. Pass and fail criteria must be fixed in advance by the clinical lead and safety board.

12 · Human sign-off

Before any use

• Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
• Flight surgeon, as medical authority
• Robotics and medical-device safety board
• Program approval for the mission

Each run

Started by the CMO after a human order. No flight surgeon real-time presence needed; overrides reviewed by the flight surgeon at the next contact.

Restart after a stop

Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself.

None of these sign-offs has happened. This is a Draft v0.7.

13 · Change control for learning

• Every change gets a new version number and a written reason; earlier versions are kept.
• Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use.
• Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach.
• If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board.
• The robot never changes its own protocol, thresholds or limits.

Change-plan model: FDA guidance [9].

Loss of signal and Mars delay

Live link

Low Earth orbit: the flight surgeon can uplink orders; inventory syncs with the ground.

Loss of signal

• Only the robot pauses; crew care never waits for the link or the robot.
• The robot tells the CMO; on the CMO's confirmation it works from the local inventory copy, and the CMO enters orders onboard.
• Inventory, logs and overrides sync at the next contact.

Mars-class delay

• All orders are entered onboard; the robot never waits for the ground to match an item to the order.
• Inventory, expiry, override and resupply data go to the ground as packages.

[8]

Sources

1. Poon EG, Keohane CA, Yoon CS, et al. Effect of bar-code technology on the safety of medication administration. N Engl J Med. 2010;362(18):1698-1707. PMID 20445181. doi:10.1056/NEJMsa0907115 Supports: In one hospital before-and-after study, bar-code verification cut non-timing administration errors by 41.4% and related potential adverse drug events (other than those from timing errors) by 50.8%, but did not eliminate errors; timing errors fell, but timing-related potential adverse drug events did not change.
2. Koppel R, Wetterneck T, Telles JL, Karsh BT. Workarounds to barcode medication administration systems: their occurrences, causes, and threats to patient safety. J Am Med Inform Assoc. 2008;15(4):408-423. PMID 18436903. doi:10.1197/jamia.M2616 Supports: Barcode medication administration aims to help confirm the five 'rights': right patient, drug, dose, route and time; workarounds (for example unreadable barcodes, or patient ID barcodes stuck to carts or doorframes) undermine it.
3. Institute for Safe Medication Practices. Lack of proper escalation process for BCMA scanning failures. ISMP Medication Safety Alert! Acute Care, March 21, 2024. www.ismp.org/sites/default/files/newsletter-issues/20240321.… Supports: Procedures must include an escalation process for barcode scanning failures; unsafe practices include giving a medicine when the barcode will not scan and scanning barcodes from sources other than the medicine itself (proxy scanning).
4. NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmac… Supports: Exploration missions of 1-5 years will outlast typical medication expiration dates of 1-2 years; medication storage and inventory tracking are linked to NASA-STD-3001 [V2 7059].
5. NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical… Supports: The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist.
6. NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023). www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-… Supports: Requirement IDs beginning V1.
7. NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 Supports: Requirement IDs beginning V2.
8. NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). www.nasa.gov/wp-content/uploads/2024/01/mars-communications-… Supports: One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
9. U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). www.fda.gov/regulatory-information/search-fda-guidance-docum… Supports: A model for planning, validating and rolling back software updates.
10. U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements. www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-… Supports: Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants.

Checked on 2026-10-20: links opened (HTTP 200 or publisher redirect), DOIs and PubMed IDs matched, NASA documents read in full text. The framework comes from Part 1.