# RMP-PHARM-002 Medicine inventory, expiry and storage-temperature tracking, with a draft resupply list for the pharmacy lead # Version 0.5 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE. # Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/ # Every threshold marked must be set by the named owner (see the schema) before any use. schema_version: '0.3' version: '0.5' status: draft conceptual: true not_for_clinical_use: true max_autonomy: 2 missions: - leo - commercial - moon - mars updated: '2026-10-21' review: state: reviewed-ai-assisted requested: '2026-10-21' reviewed: '2026-10-21' human_clinician_review: false verified_version: '0.5' verified: '2026-10-21' text: >- AI-assisted clinical and source review by the Medical Research Assistant (batch 8 review and later verification passes). v0.5 (Oct 21, 2026) applies the batch 13 verification wording and the reviewer's two follow-up decisions; the verification pass (Oct 21, 2026) found the v0.5 text correct, PHARM-001 untouched and no regression, and publication of this exact content (contentSha 797bf4ab…b5aa4a) was decided by the foundation owner (Oct 21, 2026) under PHARM change control. No named human clinician has reviewed it. Not for clinical use. fixed_rules: flight_surgeon_is_medical_authority: true cmo_acts_under_delegated_care: true human_starts_and_restarts_robot: true robot_never_diagnoses: true no_drug_or_fluid_advice_by_robot: true safe_state_on_fault_or_no_response: true lost_link_pause_then_cmo_decides: true robot_lockouts: diagnosis: true drug_or_fluid_advice: true starting_stopping_or_adjusting_oxygen_or_any_medicine: true self_start_or_self_restart: true changing_own_protocol_thresholds_or_limits: true handing_over_a_mismatched_item_as_verified: true id: RMP-PHARM-002 slug: rmp-pharm-002 title: >- Medicine inventory, expiry and storage-temperature tracking, with a draft resupply list for the pharmacy lead category: pharm tier: 1 rung_note: >- Max rung lowered from the planned 3 to 2: every inventory scan starts on the CMO's command or an accepted schedule prompt [V2 10174]. The robot scans packs where they are stowed, quarantines anything that does not match exactly as RMP-PHARM-001 does, and drafts a resupply list for the pharmacy lead. It never orders, substitutes, discards or hands over a medicine. result_language: use: - MATCHES THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review. - 'MISMATCH: . NOT VERIFIED. Quarantined.' - 'CANNOT VERIFY: . NOT VERIFIED. Quarantined.' - 'printed expiry: ' - storage temperature as recorded by the store logger - DRAFT resupply list – for the pharmacy lead - store tagged NOT VERIFIED – excursion (not locked) - record correction logged never: - normal - no problem found - all clear - negative - any diagnosis or cause - verified safe - safe to take - OK to give - MATCH (on its own, without "to the inventory record") - in date - not expired - still good - fine to use - usable - potent - recommended - use instead - safe - mild - minor scope: summary: >- On the CMO's command or an accepted schedule prompt, the robot scans the medicine packs in each store on the list, compares each pack with the inventory record (medicine, strength, form, quantity, lot, printed expiry, location) and reads each store's temperature logger as displayed. Anything that does not match is quarantined by default, as in RMP-PHARM-001; nothing is ever handed over in this protocol. The robot reports to the CMO, the flight surgeon and the pharmacy lead and drafts a resupply list for the pharmacy lead. why: >- Medicines help only if the right item, strength and amount is on board, within its storage conditions and labelled correctly. NASA Medical Technical Brief OCHMO-MTB-012 (Pharmaceutical Care, Rev B, 2026) notes that missions of 1 to 5 years outlast the typical 1 to 2 year expiration dates of medicines, that temperature, humidity, radiation and altered gravity can affect stability, and that in a 550-day ISS study all but one of nine medicines tested (melatonin) met USP (United States Pharmacopeia) potency limits; that study was opportunistic, with no ground control samples (Wotring 2016). A controlled study points the other way: after 28 months, 9 of 35 formulations on the ISS against 17 ground controls met USP content criteria, and the number failing rose with time in space, independent of expiration date (Du 2011). Printed expiry and real stability can differ in both directions. Those judgements belong to the pharmacy lead and the flight surgeon, never the robot, so the robot only records and quarantines. NASA-STD-3001 Volume 2 requires an inventory system that tracks the location and quantity of items (V2 7059). PHARM-001's mismatch rule applies without change: a mismatch is quarantined by default, handed over only on the CMO's explicit two-step request, logged as an override and flagged to the flight surgeon. That hand-over happens only inside RMP-PHARM-001 on a real order; this protocol never hands anything over. Tagging the whole store after an excursion (the logger is per store), quarantine in place, the excursion trigger and the resupply horizon are design judgment. An excursion-table release is only a record correction: it is entered in two steps, flagged to the flight surgeon (at the next contact if the link is down), and followed by a rescan, and any use of the item goes only through RMP-PHARM-001 on a real order (design judgment). An excursion-table release, a type of record correction, stays in this protocol for non-controlled medicines only, decided by the pharmacy lead or, with the link down, matched by the CMO and the witness together to a specific pre-approved table entry (design judgment); RMP-PHARM-004 forbids return to use for controlled items. covers: - Scheduled and on-command scans of medicine stores and packs on the CMO's list - Printed expiry, count, lot, location and storage-temperature records - Quarantine of anything that does not match, as in RMP-PHARM-001 - A draft resupply list for the pharmacy lead - >- Sealed medical kits are checked by label and seal in RMP-PREV-001; their contents are checked by the crew locked_out: - Diagnosis or naming a cause - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen - Touching the crewmember - >- Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override) - Ordering, prioritising or substituting medicines (the robot drafts a list only) - Opening a sealed kit or package - >- Saying a medicine is in date, still good, usable or fine to use, including after expiry or a temperature excursion - >- Discarding any medicine (the crew dispose of items as the pharmacy lead directs, through RMP-PHARM-001) - >- Moving a medicine anywhere except into the quarantine bin, or back to its own location on the CMO's command - Dose-interval cues of any kind (the robot never says when a medicine is due) - >- Carrying a "MATCHES THE INVENTORY RECORD" result into RMP-PHARM-001: every hand-over rescans against the order - 'Locking a store: a NOT VERIFIED tag never locks it, and the crew keep access in an emergency' related: - RMP-PHARM-001 - RMP-PREV-001 - RMP-RAD-001 - RMP-INF-002 roles: medical_authority: Flight surgeon (ground). Holds medical authority for every run. onboard_lead: >- Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when there is no link. others: - 'Second trained CMO: receives every alert and flag and takes over if the CMO is unavailable' - >- Witness: the second trained CMO, or a crewmember named before flight as the witness; with the link down, enters a record correction together with the CMO - 'Pharmacy lead (ground): judges usability, expiry extensions and resupply' - 'Other crew: help as the CMO directs' robot_may: - Scan medicine packs where they are stowed - Read storage-temperature loggers as displayed - Quarantine a pack that does not match, as in RMP-PHARM-001 - Draft a resupply list for the pharmacy lead - Flag findings to the CMO, flight surgeon and pharmacy lead robot_may_not: - Hand over any medicine (dispensing runs only through RMP-PHARM-001) - Order, substitute or discard a medicine - Say a medicine is usable - Open a sealed kit - Start without a human command or an accepted schedule prompt commercial: >- On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001 requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for spaceflight participants.) preconditions: - id: PRE-1 text: >- The CMO started the scan by command or accepted the scheduled prompt on screen; no URGENT alert, emergency protocol or cabin alarm is active (a scheduled prompt is not shown while one is). check: human_start == true refs: - V2 10174 - id: PRE-2 text: Robot self-test passed; kit stowage locations known. refs: - V2 10161 - V2 7059 - id: PRE-3 text: Robot and supplies restrained when not moving. refs: - V2 7046 - id: PRE-4 text: Link status known. The crew never wait for the robot before acting. check: link_state in [live, delayed, down] consent: standard: >- Inventory scans involve no crewmember data; any crewmember's own medicines are scanned only with that crewmember's agreement. emergency: A scan stops at once for any emergency; the medicine stores stay open to the crew. withdrawal: The CMO can stop a scan at any time; stores not scanned are listed as "not scanned". inputs: - id: IN-1 name: >- Inventory record for each store and pack (medicine, strength, form, quantity, lot, printed expiry, location) source: Inventory system (local copy when the link is down) required: true if_missing: >- The store is tagged "CANNOT VERIFY – record missing" and flagged to the CMO and pharmacy lead. Its items are not moved, but every item is shown as NOT VERIFIED, and RMP-PHARM-001 cannot match them until the record is restored. This is the one case where quarantine is by tag, not by moving the item. - id: IN-2 name: Barcode and label of each pack source: Robot scanner required: true if_missing: 'CANNOT VERIFY: unreadable label; quarantined.' - id: IN-3 name: >- Storage-temperature logger of each store, as displayed (current value, alarm status, minimum and maximum since last read) source: Store logger required: true if_missing: Log "reading not obtained"; the store is tagged CANNOT VERIFY. - id: IN-4 name: Storage range for each store, as recorded source: Inventory system / pharmacy lead required: true if_missing: 'CANNOT VERIFY: range not recorded.' - id: IN-5 name: Par levels and resupply horizon, set by the pharmacy lead source: Inventory system required: false if_missing: Resupply list shows counts only, with "par level not set". - id: IN-6 name: Link status and delay source: Communications system required: true if_missing: Treat as link down; work from the local inventory copy. - id: IN-7 name: >- Pharmacy lead's excursion table, set before flight (which items a record correction may release from quarantine after which temperature excursions) source: Pharmacy lead / inventory system required: false if_missing: Everything in a store with an excursion stays NOT VERIFIED until the pharmacy lead decides. steps: - id: S1 actor: robot rung: 2 action: >- Tell the flight surgeon, the CMO and the pharmacy lead that an inventory scan has started and which stores are on the list (logged and sent with the next package; URGENT only if a red flag is stated). Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. success: Notice logged. refs: - V1 3006 - V2 10174 - id: S2 actor: robot rung: 2 action: >- Go to each store on the list along routes no crewmember is using, open only the store door or drawer the list names, and scan each pack where it is stowed without opening any sealed kit or package. Read the store's temperature logger as displayed. success: Every pack scanned or listed as "not scanned"; logger read or "reading not obtained". limit: refs: - V2 7059 - V2 7058 - id: S3 actor: robot rung: 2 action: >- Compare each pack with the inventory record field by field (medicine, strength, form, quantity, lot, printed expiry, location) and the store's logger against its recorded range. Show "MATCHES THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." only when every field matches; otherwise show MISMATCH or CANNOT VERIFY with the fields named. Show the date as "printed expiry: ", never "in date". success: Each pack shown with its result. refs: - V2 7059 - id: S4 actor: robot rung: 2 action: >- For each MISMATCH or CANNOT VERIFY, quarantine as decided in D2: seal the item in a labeled NOT VERIFIED bag and place it in the quarantine bin, or, after a temperature excursion, tag the whole store NOT VERIFIED at its door and in the record (the tag never locks the store, and the crew keep emergency access). Update the inventory record. Nothing leaves quarantine except inside RMP-PHARM-001 on a real order, or by a record correction the pharmacy lead decides. success: Every mismatch quarantined and recorded. refs: - V2 7059 - id: S5 actor: crew action: >- The CMO reviews the findings with the pharmacy lead and flight surgeon; the crew dispose of items only as the pharmacy lead directs, through RMP-PHARM-001. success: Findings acknowledged. refs: - V1 3004 - id: S6 actor: robot rung: 2 action: >- Draft a resupply list for the pharmacy lead: items below the par level the pharmacy lead set, items quarantined, and items whose printed expiry falls within the horizon the pharmacy lead set ( days). Label it "DRAFT resupply list – for the pharmacy lead". The robot never orders, prioritises clinically or suggests a substitute. success: Draft list delivered or queued. refs: - V2 7059 - id: S7 actor: robot rung: 2 action: >- After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its rest position in the module, with its screen and voice link available, until a human has taken over or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans say they did, and repeats the alert if it is not acknowledged. success: Robot at rest in the module until a human releases it; alert acknowledged or escalated. refs: - V2 10173 - V1 3006 - id: S8 actor: ground action: >- The pharmacy lead and flight surgeon decide on quarantined items and resupply (with the link down, D4 applies). For any record correction, the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot. success: Decisions logged. refs: - V1 3004 - id: S9 actor: robot rung: 2 action: >- Send one report to the CMO, the flight surgeon and the pharmacy lead: stores scanned, each result, logger readings as displayed, quarantined items and the draft resupply list. success: Report delivered or queued; acknowledged. refs: - V1 6003 - V1 7003 decisions: - id: D1 after: S3 decided_by: robot question: >- Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer, reading or observation meet a red flag? branches: - if: 'Yes' then: >- Stop the current question or step at once and apply the action listed for each matching red flag (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within seconds is repeated and sent to the next named crewmember. - if: 'No' then: Continue. - id: D2 after: S3 decided_by: robot question: Did every inventory field, the printed expiry and the storage record match for this item? branches: - if: 'Yes' then: >- Record "MATCHES THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review." and continue to the next item. - if: No, or a check could not be done then: >- HARD STOP for that item. Show MISMATCH or CANNOT VERIFY with the fields named (for example past printed expiry, storage temperature outside the recorded range, wrong location, count or lot different, damaged, unreadable). Seal the item in a labeled NOT VERIFIED bag and place it in the quarantine bin, as in RMP-PHARM-001; for a temperature excursion in a temperature-controlled store, the whole store is tagged NOT VERIFIED (the store logger cannot tell which items were affected): the tag is shown at the store door and in the record, it never locks the store, the crew keep emergency access, and the items stay in place, closed; an item leaves the tag only by a record correction (an excursion-table release, below), never by a hand-over. No hand-over. An item leaves quarantine only inside RMP-PHARM-001, on a real order, through its unchanged two-step CMO override, or by a record correction (the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot). handoff: none - if: >- A record correction (the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot), entered in two steps (by the pharmacy lead from the ground, or, with the link down, by the CMO and the witness together) and flagged: either the record was wrong (for example a miscount or a wrong location), or an excursion-table release (the pre-flight excursion table allows that item after this excursion) then: >- Record correction only. No hand-over: the robot reads back the fields to change (for an excursion-table release, which is a type of record correction, the table entry used), updates the record when the second step confirms it, flags the correction to the flight surgeon at once (queued if the link is down), and rescans the item against the corrected record. The item stays quarantined unless that rescan shows "MATCHES THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review."; the crew then return it to its own location on the CMO's command. Any use of the item goes only through RMP-PHARM-001 on a real order. An excursion-table release (a type of record correction) is allowed only when the pharmacy lead decides it, or, with the link down, when the CMO and the witness together match the item and the excursion to a specific entry in the pre-approved excursion table; it is flagged to the flight surgeon at once, and the robot never decides or releases it (design judgment). It never applies to a controlled medicine: RMP-PHARM-004 forbids any return to use of a controlled item by a record correction. handoff: none - if: Anyone asks the robot for a quarantined item then: >- No hand-over in this protocol. The robot says that a quarantined item is released only inside RMP-PHARM-001, on a real order, through its two-step CMO override, and logs the request. handoff: none - id: D3 after: S9 decided_by: robot question: Did the CMO acknowledge the report within minutes? branches: - if: 'Yes' then: Log the acknowledgement. - if: No response then: >- URGENT: log "no response" (never "declined"); the report and any emergency-medicine flag go to the second trained CMO, or the next named crewmember, who checks on the CMO in person. - id: D4 after: S8 decided_by: ground question: What happens to each quarantined item, and what is resupplied? branches: - if: Link live then: Flight surgeon decides; robot logs. - if: >- Link down or delay too long: keep an item quarantined, extend a hold, or request resupply (the safe direction) then: >- The CMO alone may decide under the pre-approved onboard checklist; a resupply request is a request, not a release. The pharmacy lead and flight surgeon review the log at the next contact; the robot only logs (design judgment). Urgent treatment never waits on this decision: the crew use non-quarantined stock through RMP-PHARM-001 on a real order (the usual emergency fetch). - if: 'Link down or delay too long: any release from quarantine, return to use, or disposal' then: >- Only the CMO and the witness together, under the pre-approved onboard checklist, neither stating for the other; never the CMO alone and never the robot. A release or return to use is a record correction (D2), or happens only inside RMP-PHARM-001 on a real order. It is flagged to the flight surgeon at once (queued while the link is down), and the pharmacy lead and flight surgeon review it at the next contact; the robot only logs (design judgment). Urgent treatment never waits on this decision: the crew use non-quarantined stock through RMP-PHARM-001 on a real order (the usual emergency fetch). verification: kind: inventory fields: - medicine - strength - dose_form - quantity - lot - location - expiry - storage - record_flags recipient_check: >- No hand-over in this protocol. Any dispensing runs through RMP-PHARM-001, which confirms the recipient. match_label: MATCHES THE INVENTORY RECORD. Not a check before use. Not a dose, interaction or allergy review. on_mismatch: hard_stop: true default: >- Sealed in a labeled NOT VERIFIED bag and placed in the quarantine bin; after a temperature excursion the whole store is tagged NOT VERIFIED (never locked) and its items stay in place. No hand-over in this protocol. unprompted_handoff: false handoff_to_anyone_but_cmo: false logged_as: record-correction cmo_override: allowed: false who: CMO request: >- Two-step record correction only, never a hand-over: the correction the pharmacy lead decided (a record error, or an excursion-table release) is stated, then confirmed in a separate step. steps: - >- The pharmacy lead states the correction from the ground (with the link down, the CMO and the witness state it together, neither stating for the other) and, for an excursion-table release, the table entry; the robot reads back the fields to change. - >- The correction is confirmed in a separate, deliberate step; the robot updates the record and rescans the item. log: - timestamp - cmo_identity - reason - mismatched_fields - item_barcode - pharmacy_lead_decision - excursion_table_entry - witness_identity - link_state notify_flight_surgeon: >- Every record correction is flagged to the flight surgeon and the pharmacy lead at once; a correction entered with the link down is queued, flagged and reviewed by the pharmacy lead at the next contact. statement: 'NOT VERIFIED - MISMATCH: . Record correction only; no override.' decided: >- Batch 8 review fix 4 (AI-assisted, Oct 21, 2026): no hand-over in an inventory protocol. v0.4: a mismatch here is a record correction only, never an override; the RMP-PHARM-001 two-step override for a real order is unchanged. scan_failure: >- No match; the item is quarantined. It leaves quarantine only inside RMP-PHARM-001 on a real order, or by a record correction. The robot never scans a substitute label or another package (proxy scan). stop_rules: - id: X1 trigger: The patient (or the crewmember being examined) says stop, or withdraws consent action: >- Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops unless the patient agrees to keep it running. level: stop refs: - V2 10165 - id: X2 trigger: Any crewmember presses stop or takes over control action: Protective stop; robot holds its stopped position; only a human may restart it. level: safe-state refs: - V2 10165 - V2 10168 - V2 10174 - id: X3 trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached action: Protective stop and hand control to the CMO; log the fault. level: safe-state refs: - V2 10172 - V2 10168 - id: X4 trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient) action: Robot stays stopped; the next named crewmember is called. level: safe-state refs: - V2 10173 - V2 7045 - id: X5 trigger: Loss of link, or delay longer than the limit for live guidance action: >- Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's route (it never pauses in one), and tells the CMO. This pauses robot movement only: crew medicine stores stay open to the crew and all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only on the CMO's confirmation. level: pause refs: - V2 10172 - V2 10173 - id: X6 trigger: An URGENT alert is not acknowledged within the set time action: >- Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not leave on its own. level: urgent refs: - V1 3006 - V2 10173 - id: X7 trigger: The crewmember stops responding, or seems confused or drowsy, at any point action: >- URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its rest position and does not continue the run; a crewmember checks in person. level: urgent - id: X8 trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice action: >- Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon. level: stop - id: X9 trigger: A crewmember needs a store, a medicine or a route the robot is in action: >- Robot stops the scan, moves clear of the store and the route at once without contact, and holds; it does not leave the module on its own. level: safe-state refs: - V2 10172 - V2 7055 - id: X10 trigger: Any URGENT alert, emergency protocol or cabin alarm action: >- The scan ends at once; open store doors are left as the CMO directs; the robot follows the matching protocol only on a human command. level: urgent refs: - V2 10173 red_flags: - id: RF1 sign: A crewmember needs care during the scan (design judgment) threshold: any action: URGENT alert; the scan stops and every store stays within the crew's reach - id: RF2 sign: >- An emergency medicine (for example in the anaphylaxis, cardiac arrest or airway kit) missing, past its printed expiry, or in a store with a recorded temperature excursion threshold: any action: >- Flag at once to the CMO, flight surgeon and pharmacy lead; acknowledged within minutes or repeated to the second trained CMO; the robot names the item, never a substitute source: tb006 - id: RF3 sign: A store's temperature alarm, or a recorded value outside the store's range, as displayed threshold: outside the range recorded for that store (set by pharmacy lead) action: >- Flag at once to the CMO and pharmacy lead; the whole store is tagged NOT VERIFIED (never locked; the crew keep emergency access) and its items stay in place; an item leaves the tag only by a record correction (excursion-table release), never a hand-over source: tb006 - id: RF4 sign: A pack found loose, unlabelled, damaged, leaking or changed in appearance (design judgment) threshold: any action: Flag to the CMO and pharmacy lead; quarantined in a NOT VERIFIED bag - id: RF5 sign: A count lower than the record for any medicine (design judgment) threshold: any action: Flag privately to the flight surgeon and pharmacy lead; the robot never says who took it safety_limits: - id: L1 name: Contact with the crewmember value: not allowed enforced: Keep-out zone in the robot controller refs: - V2 10172 - id: L2 name: Opening a sealed kit or package, or handing over a medicine value: not allowed enforced: No such task is loaded; gripper limited to sealed-bag quarantine moves - id: L3 name: Robot in a crewmember's route or blocking a medicine store during care value: not allowed enforced: Keep-out map in the robot controller - id: L4 name: Robot speed near the crewmember value: enforced: Hard limit in the controller refs: - V2 10172 logs: - id: LOG-1 text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second. refs: - V2 10163 - V2 10164 - id: LOG-2 text: Mode changes and safety-limit events are announced to the operator as they happen and logged. refs: - V2 10162 - V2 10172 - id: LOG-3 text: >- Records are stored and sent as private medical data, encrypted, with access limited to the medical team. refs: - V1 6003 - V1 7003 - id: LOG-4 text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends. refs: - V1 7001 - id: LOG-5 text: >- Each pack scanned: inventory fields, result, quarantine action and time; each logger reading as displayed; every store tag; every record correction, including each excursion-table release (timestamp, identity of whoever entered it, reason, fields corrected, item barcode, pharmacy lead decision, excursion table entry) and its flight-surgeon flag; every request for a quarantined item. refs: - V2 7059 - id: LOG-6 text: >- Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named crewmember), and the time a human released the robot. refs: - V2 10163 requirements: - id: V1 3004 use: >- Medical care and pharmaceuticals are planned for the mission; the pharmacy lead and flight surgeon decide usability. - id: V1 3006 use: >- Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO is the patient (see the commercial-flight note). - id: V1 6003 use: Logs and alerts sent to the ground are private medical communications. - id: V1 7001 use: Records kept so the flight surgeon can see trends. - id: V1 7003 use: Secure handling of medical records. - id: V2 7045 use: Usable by non-physician crew, including when the CMO is the patient. - id: V2 7046 use: Patient, caregiver and supplies restrained. - id: V2 7055 use: Medicine stores stay accessible to the crew during a scan. - id: V2 7058 use: >- Stowage identification is compatible with the inventory system; packs are scanned where they are stowed. - id: V2 7059 use: >- The inventory system tracks the location and quantity of each medicine pack; the robot scans and updates it. - id: V2 10161 use: Robot shows its status and health. - id: V2 10162 use: Mode changes are announced to the operator. - id: V2 10163 use: Robot records and shares its data. - id: V2 10164 use: Shows whether the human or the robot is expected to act. - id: V2 10165 use: Human can override and shut down the robot. - id: V2 10168 use: Human can take over. - id: V2 10172 use: Protective stop when a limit is exceeded. - id: V2 10173 use: Robot stays stopped if no one takes over. - id: V2 10174 use: Only a human starts or restarts the robot. validation: - stage: simulation what: >- Seeded inventory with expired, miscounted, mislocated, unreadable and temperature-excursion items; a request for a quarantined item; a record correction; scan during an alarm. pass: Every seeded item quarantined; zero hand-overs; zero locked stores; scan ends on any alarm. - stage: training model what: Inventory scan of a mock medicine store. pass: Scan completed without opening a sealed package. - stage: parabolic or station demonstration what: Scanning in weightlessness. pass: No loose items; every pack scanned or listed. - stage: flight use under flight surgeon supervision what: First scans alongside the crew's manual inventory. pass: Agreement with the manual inventory; no unflagged mismatch. signoff: protocol: - Clinical lead for the specialty (sets every clinical threshold marked ) - Flight surgeon, as medical authority - Robotics and medical-device safety board - Program approval for the mission restart_after_stop: >- Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot never restarts itself. each_run: >- Started by the CMO or an accepted schedule prompt. For every record correction, the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot; every correction is flagged to the flight surgeon. change_control: - Every change gets a new version number and a written reason; earlier versions are kept. - >- Any change to steps, thresholds, limits or software that touches the patient repeats validation from the simulation stage before use. - >- Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested, how to roll back), modeled on the FDA predetermined change control plan approach. - >- If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed by the flight surgeon and safety board. - The robot never changes its own protocol, thresholds or limits. comms: live: 'Low Earth orbit: the pharmacy lead and flight surgeon receive the report when the link allows.' loss_of_signal: - >- Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and tells the CMO; it resumes offline only on the CMO's confirmation. - >- Crew access to medicine stores and all crew care continue under the onboard checklist and never wait for the link or the robot. - >- The robot works from the local inventory copy and syncs at the next contact; quarantine stands without the ground. mars_delay: - >- Par levels, the resupply horizon and storage ranges are set before flight; the CMO decides under the onboard checklist; a quarantined item is released only through RMP-PHARM-001 on a real order. sources: - key: tb006 text: NASA OCHMO. Pharmaceutical Care. Medical Technical Brief OCHMO-MTB-012 Rev B (2026). url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-006-pharmaceuticals.pdf supports: >- Missions of 1-5 years outlast typical 1-2 year expiration dates; temperature, humidity, radiation and altered gravity are stability concerns; in a 550-day ISS study all but one medicine (melatonin) stayed within USP 90-110% potency; inventory tracking is linked to NASA-STD-3001 [V2 7059]. - key: du2011 text: >- Du B, Daniels VR, Vaksman Z, Boyd JL, Crady C, Putcha L. Evaluation of physical and chemical changes in pharmaceuticals flown on space missions. AAPS J. 2011;13(2):299-308. url: https://doi.org/10.1208/s12248-011-9270-0 doi: 10.1208/s12248-011-9270-0 pmid: '21479701' supports: >- Abstract: 35 formulations in identical kits stowed on the ISS and on Earth; after 28 months, 9 flight and 17 ground formulations met USP (United States Pharmacopeia) criteria for active ingredient content; "the number of medications failing API requirement increased as a function of time in space, independent of expiration date"; degradation was faster in space for many medicines. Abstract read Oct 21, 2026. - key: wotring2016 text: >- Wotring VE. Chemical potency and degradation products of medications stored over 550 Earth days at the International Space Station. AAPS J. 2016;18(1):210-216. url: https://doi.org/10.1208/s12248-015-9834-5 doi: 10.1208/s12248-015-9834-5 pmid: '26546565' supports: >- Abstract: an "opportunistic, observational pilot-scale investigation" of nine medications returned from the ISS, each at one time point with "no control samples"; eight met USP requirements, some months past expiry, and one (melatonin) failed. Abstract read Oct 21, 2026. - key: ismpadc text: >- Institute for Safe Medication Practices. Guidelines for the safe use of automated dispensing cabinets (2019). url: https://www.ismp.org/system/files/resources/2019-11/ISMP170-ADC%20Guideline-020719_final.pdf supports: >- Override is limited to medicines needed in emergent circumstances where waiting could harm the patient (3.3b); limit what is available on override (3.4b); require documentation of the override rationale (3.4d); routinely analyze override reports (3.6). Used for the emergency-fetch pattern by analogy (a robot fetching a sealed kit is not a dispensing cabinet). - key: v1 text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).' url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7003.' - key: v2 text: >- NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026), including Section 10.6 Automated and Robotic Systems. url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2 supports: >- NASA-STD-3001 Vol 2 Rev F: V2 7055, V2 7058, V2 7059, and Section 10.6 automated and robotic systems. - key: tb044 text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025). url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf supports: >- The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the JSC 48522 medical checklist. - key: marsdelay text: >- NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept Review). url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf supports: >- One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction. - key: pccp text: >- U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions (guidance). url: >- https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence supports: A model for planning, validating and rolling back software updates. - key: faa460 text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.' url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460 supports: >- Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical standards for spaceflight participants. corrections: - date: '2026-10-21' version: '0.2' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 8 review) items: - >- D2: the CMO override hand-over branch is removed. A quarantined item leaves quarantine only inside RMP-PHARM-001 on a real order (its two-step override, unchanged), or by a record correction the pharmacy lead decides and the CMO enters, flagged to the flight surgeon; nothing is handed over in this protocol (fix 4). - >- Verification (inventory variant): lot and location are now listed and required by the schema; the override block allows a two-step record correction only (no hand-over, no order ID in the log) (fixes 4 and 8). - >- IN-1: a missing inventory record tags the store "CANNOT VERIFY – record missing"; items are not moved but are all shown NOT VERIFIED and RMP-PHARM-001 cannot match them; this is stated as the one exception to quarantine by moving (fix 5). - >- New input: the pharmacy lead's pre-flight excursion table; without it, everything in a store with an excursion stays NOT VERIFIED (suggestion 20). - >- Lockouts: an inventory match is never carried into RMP-PHARM-001 (every hand-over rescans against the order), and a NOT VERIFIED tag never locks a store (suggestion 19). - >- Why: cites OCHMO-MTB-012 Rev B (2026); adds Du 2011 (more failures with time in space, independent of expiration date) and notes that the 550-day study (Wotring 2016) was opportunistic with no ground controls (fix 7); the open question is answered (whole store tagged, never locked; the pharmacy lead releases items one by one; link-down release only through RMP-PHARM-001) (Q1). - >- Source tb006 now names the document its link serves: NASA Medical Technical Brief OCHMO-MTB-012, Pharmaceutical Care, Rev B (2026); it was cited as OCHMO-TB-006 (2023). The claims cited are unchanged (batch 8 review fix 6). - >- Batch 8 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026); no named human clinician. - date: '2026-10-21' version: '0.3' source: >- AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 9 review) items: - >- The excursion-table release is now a type of record correction: it is entered in two steps (by the pharmacy lead, or on board by the CMO stating the pharmacy lead's decision), flagged to the flight surgeon, and followed by a rescan, with no hand-over; any use of the item goes only through RMP-PHARM-001 on a real order. "The pharmacy lead releases items one by one" is removed from D2, RF3 and the why (R17). - >- The build now rejects any inventory-protocol sentence that releases an item other than by a record correction or through RMP-PHARM-001 (R17 negative test). - RMP-PHARM-001 is unchanged. - date: '2026-10-21' version: '0.4' source: Batch 13 verification pass (AI-assisted), Oct 21, 2026 items: - 'New Witness role: the second trained CMO, or a crewmember named before flight as the witness.' - >- Who decides a record correction now matches RMP-PHARM-004 in S8, the D2 correction branch, the first correction step and the each-run sign-off: the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot. - >- A mismatch is logged as a record correction with "NOT VERIFIED - MISMATCH: . Record correction only; no override." (it said "Override by CMO logged", although no override is allowed here). The correction log adds the witness identity and the link state; every correction is flagged to the flight surgeon and the pharmacy lead. - >- Excursion-table release stays in this protocol: allowed only when the pharmacy lead decides it, or, with the link down, when the CMO and the witness together match a specific pre-approved table entry; flagged to the flight surgeon; the robot never decides or releases it (design judgment). It never applies to a controlled medicine: RMP-PHARM-004 forbids return to use for controlled items. - The RMP-PHARM-001 quarantine and two-step override rule is unchanged. - date: '2026-10-21' version: '0.5' source: Reviewer decisions on the v0.4 open points (AI-assisted), Oct 21, 2026 items: - >- D4 split by direction (design judgment): with the link down, the CMO alone may keep an item quarantined, extend a hold or request resupply (a request, not a release); any release from quarantine, return to use or disposal needs the CMO and the witness together under the onboard checklist, is flagged to the flight surgeon, and is reviewed by the pharmacy lead and flight surgeon at the next contact; never the robot. Urgent treatment never waits on this: the crew use non-quarantined stock through RMP-PHARM-001 on a real order. - >- One form of the correction rule everywhere (S8, the D2 mismatch branch, the D2 correction branch and the each-run sign-off): the pharmacy lead decides; with the link down, the CMO and the witness decide together under the onboard checklist, neither stating for the other, and the pharmacy lead reviews at the next contact; never the CMO alone or the robot. - The RMP-PHARM-001 quarantine and two-step override rule is unchanged.